@4pm/cli 1.4.1 → 1.4.3

package/dist/index.js

@@ -28550,7 +28550,7 @@ ${INSECURE_URL_WARNING}
 
 // src/commands/start.ts
 import { spawn as spawn9 } from "child_process";
-import { join as join30 } from "path";
+import { join as join29 } from "path";
 
 // src/core/update.ts
 import { execSync as execSync2 } from "child_process";
@@ -28723,7 +28723,7 @@ async function checkAndUpdate(serverUrl, autoUpdate) {
 // src/core/ws-client.ts
 init_wrapper();
 import { randomUUID } from "crypto";
-import { basename as basename4, join as join25 } from "path";
+import { basename as basename4, join as join24 } from "path";
 
 // vendor/@4pm/utils/helpers.ts
 function backoffJitterMs(attempt, baseMs = 500, maxMs = 1e4) {
@@ -33087,6 +33087,19 @@ var createProjectRequestSchema = external_exports.object({
 var copyProjectRequestSchema = external_exports.object({
   name: external_exports.string().min(1).max(100)
 });
+var PROJECT_ALERT_KINDS = ["budgetPercent", "absolute"];
+var projectAlertRuleSchema = external_exports.object({
+  id: external_exports.string().min(1).max(64),
+  kind: external_exports.enum(PROJECT_ALERT_KINDS),
+  metric: external_exports.enum([UsageMetric.AI_TOKENS, UsageMetric.COMMANDS]),
+  threshold: external_exports.number().int().min(1),
+  email: external_exports.union([external_exports.string().email(), external_exports.literal("")]).optional(),
+  notifyUserId: external_exports.union([external_exports.string().uuid(), external_exports.literal("")]).optional(),
+  enabled: external_exports.boolean().default(true)
+});
+var projectAlertsSchema = external_exports.object({
+  rules: external_exports.array(projectAlertRuleSchema).max(20).default([])
+});
 var DEFAULT_OUTBOUND_RULES = {
   secret: [
     String.raw`/\b(api[_-]?key|secret|password|passwd|access[_-]?token|bearer)\b\s*[:=]\s*\S+/i`,
@@ -33309,9 +33322,47 @@ async function readCgroup(file) {
     return null;
   }
 }
+function parseKv(text) {
+  const map = /* @__PURE__ */ new Map();
+  if (!text) return map;
+  for (const line of text.split("\n")) {
+    const [k, v] = line.trim().split(/\s+/);
+    if (k && v !== void 0) {
+      const n = Number(v);
+      if (Number.isFinite(n)) map.set(k, n);
+    }
+  }
+  return map;
+}
+function parsePressureSome(text) {
+  if (!text) return void 0;
+  const some = text.split("\n").find((l) => l.startsWith("some "));
+  const m = some?.match(/avg10=([\d.]+)/);
+  const n = m ? Number(m[1]) : NaN;
+  return Number.isFinite(n) ? clampPct(n) : void 0;
+}
+function parseIoStat(text) {
+  if (!text) return null;
+  let rBytes = 0;
+  let wBytes = 0;
+  for (const line of text.split("\n")) {
+    const r = line.match(/\brbytes=(\d+)/);
+    const w = line.match(/\bwbytes=(\d+)/);
+    if (r) rBytes += Number(r[1]);
+    if (w) wBytes += Number(w[1]);
+  }
+  return { rBytes, wBytes };
+}
+function parseMaybeMax(text) {
+  if (text === null) return null;
+  if (text === "max") return null;
+  const n = Number(text);
+  return Number.isFinite(n) ? n : null;
+}
 function createWorkerMetricsSampler(diskPath) {
   const cgroupV2 = existsSync4(`${CGROUP}/cpu.stat`) && existsSync4(`${CGROUP}/memory.current`);
-  let prev = null;
+  let cgPrev = null;
+  let osPrev = null;
   async function cgroupCpuCount() {
     const raw = await readCgroup("cpu.max");
     if (raw) {
@@ -33323,22 +33374,6 @@ function createWorkerMetricsSampler(diskPath) {
     }
     return cpus().length;
   }
-  async function cgroupCpuPct(cpuCount) {
-    const stat2 = await readCgroup("cpu.stat");
-    const m = stat2?.match(/usage_usec\s+(\d+)/);
-    const usageUsec = m ? Number(m[1]) : NaN;
-    const now = Date.now();
-    if (!Number.isFinite(usageUsec)) return 0;
-    if (!prev) {
-      prev = { busy: usageUsec, ref: now };
-      return 0;
-    }
-    const dUsage = usageUsec - prev.busy;
-    const dWall = (now - prev.ref) * 1e3;
-    prev = { busy: usageUsec, ref: now };
-    if (dWall <= 0) return 0;
-    return clampPct(dUsage / (dWall * cpuCount) * 100);
-  }
   function osCpuPct() {
     let busy = 0;
     let total = 0;
@@ -33347,13 +33382,13 @@ function createWorkerMetricsSampler(diskPath) {
       busy += t.user + t.nice + t.sys + t.irq;
       total += t.user + t.nice + t.sys + t.irq + t.idle;
     }
-    if (!prev) {
-      prev = { busy, ref: total };
+    if (!osPrev) {
+      osPrev = { busy, total };
       return 0;
     }
-    const dBusy = busy - prev.busy;
-    const dTotal = total - prev.ref;
-    prev = { busy, ref: total };
+    const dBusy = busy - osPrev.busy;
+    const dTotal = total - osPrev.total;
+    osPrev = { busy, total };
     if (dTotal <= 0) return 0;
     return clampPct(dBusy / dTotal * 100);
   }
@@ -33367,9 +33402,74 @@ function createWorkerMetricsSampler(diskPath) {
       return { usedGb: 0, totalGb: 0 };
     }
   }
+  async function cgroupExtended(cpuCount, now) {
+    const [cpuStatRaw, memStatRaw, ioStatRaw, cpuPsi, memPsi, ioPsi, swapCurRaw, swapMaxRaw, memEventsRaw, pidsCurRaw, pidsMaxRaw] = await Promise.all([
+      readCgroup("cpu.stat"),
+      readCgroup("memory.stat"),
+      readCgroup("io.stat"),
+      readCgroup("cpu.pressure"),
+      readCgroup("memory.pressure"),
+      readCgroup("io.pressure"),
+      readCgroup("memory.swap.current"),
+      readCgroup("memory.swap.max"),
+      readCgroup("memory.events"),
+      readCgroup("pids.current"),
+      readCgroup("pids.max")
+    ]);
+    const cpuStat = parseKv(cpuStatRaw);
+    const usageUsec = cpuStat.get("usage_usec") ?? NaN;
+    const nrThrottled = cpuStat.get("nr_throttled") ?? 0;
+    const nrPeriods = cpuStat.get("nr_periods") ?? 0;
+    const io = parseIoStat(ioStatRaw);
+    const extra = {};
+    extra.cpuPressurePct = parsePressureSome(cpuPsi);
+    extra.memPressurePct = parsePressureSome(memPsi);
+    extra.ioPressurePct = parsePressureSome(ioPsi);
+    const memStat = parseKv(memStatRaw);
+    if (memStat.has("anon")) extra.memAnonMb = Math.round(memStat.get("anon") / MB);
+    if (memStat.has("file")) extra.memCacheMb = Math.round(memStat.get("file") / MB);
+    if (swapCurRaw !== null) extra.swapUsedMb = Math.round(Number(swapCurRaw) / MB);
+    if (swapMaxRaw !== null) {
+      const max = parseMaybeMax(swapMaxRaw);
+      extra.swapTotalMb = max === null ? null : Math.round(max / MB);
+    }
+    const memEvents = parseKv(memEventsRaw);
+    if (memEvents.has("oom_kill")) extra.oomKills = memEvents.get("oom_kill");
+    if (pidsCurRaw !== null) {
+      const n = Number(pidsCurRaw);
+      if (Number.isFinite(n)) extra.pidsCurrent = n;
+    }
+    if (pidsMaxRaw !== null) extra.pidsMax = parseMaybeMax(pidsMaxRaw);
+    let cpuPct = 0;
+    if (Number.isFinite(usageUsec)) {
+      if (cgPrev) {
+        const dWallUsec = (now - cgPrev.wallMs) * 1e3;
+        if (dWallUsec > 0) cpuPct = clampPct((usageUsec - cgPrev.usageUsec) / (dWallUsec * cpuCount) * 100);
+        const dPeriods = nrPeriods - cgPrev.nrPeriods;
+        if (dPeriods > 0) extra.cpuThrottledPct = clampPct((nrThrottled - cgPrev.nrThrottled) / dPeriods * 100);
+        if (io) {
+          const dSec = (now - cgPrev.wallMs) / 1e3;
+          if (dSec > 0) {
+            extra.diskReadMbps = round1((io.rBytes - cgPrev.ioR) / MB / dSec);
+            extra.diskWriteMbps = round1((io.wBytes - cgPrev.ioW) / MB / dSec);
+          }
+        }
+      }
+      cgPrev = {
+        usageUsec,
+        nrThrottled,
+        nrPeriods,
+        ioR: io?.rBytes ?? 0,
+        ioW: io?.wBytes ?? 0,
+        wallMs: now
+      };
+    }
+    return { cpuPct, extra };
+  }
   return {
     async sample() {
-      const at = (/* @__PURE__ */ new Date()).toISOString();
+      const now = Date.now();
+      const at = new Date(now).toISOString();
       const { usedGb: diskUsedGb, totalGb: diskTotalGb } = await disk();
       const base = { platform: platform(), arch: arch(), diskUsedGb, diskTotalGb, at };
       if (cgroupV2) {
@@ -33378,14 +33478,15 @@ function createWorkerMetricsSampler(diskPath) {
         const memTotalBytes = memMaxRaw && memMaxRaw !== "max" ? Number(memMaxRaw) : totalmem();
         const memUsedBytes = memCurRaw ? Number(memCurRaw) : totalmem() - freemem();
         const cpuCount = await cgroupCpuCount();
-        const cpuPct = await cgroupCpuPct(cpuCount);
+        const { cpuPct, extra } = await cgroupExtended(cpuCount, now);
         return {
           ...base,
           source: "cgroup",
           cpuCount,
           cpuPct,
           memUsedMb: Math.round(memUsedBytes / MB),
-          memTotalMb: Math.round(memTotalBytes / MB)
+          memTotalMb: Math.round(memTotalBytes / MB),
+          ...extra
         };
       }
       const total = totalmem();
@@ -33641,7 +33742,7 @@ function decryptPayload(key, payloadBase64, nonceBase64) {
 }
 
 // src/core/ws-client.ts
-import { existsSync as existsSync11, mkdirSync as mkdirSync5, rmSync as rmSync5 } from "fs";
+import { existsSync as existsSync12, mkdirSync as mkdirSync5, rmSync as rmSync4 } from "fs";
 import { randomUUID as randomCommandId } from "crypto";
 
 // src/core/update-scheduler.ts
@@ -35404,28 +35505,87 @@ async function removePackage(root, slug) {
   }
 }
 
-// src/core/sandbox.ts
-import { rmSync as rmSync4, writeFileSync as writeFileSync6 } from "fs";
-import { join as join16 } from "path";
-var EGRESS_ALLOWLIST_FILE = "sandbox-egress.txt";
-function writeEgressAllowlist(profileDir2, policy) {
-  const path = join16(profileDir2, EGRESS_ALLOWLIST_FILE);
+// src/core/network-probe.ts
+import { existsSync as existsSync9, readFileSync as readFileSync14 } from "fs";
+import { connect } from "net";
+var CANARY_TARGETS = [
+  { host: "1.1.1.1", port: 443 },
+  { host: "8.8.8.8", port: 443 }
+];
+var PROBE_TIMEOUT_MS = 2500;
+function detectContainerized() {
   try {
-    if (policy && policy.network === "allowlist") {
-      const body = ["# 4PM egress allowlist (ADR-0192) \u2014 generated from the project sandbox policy"].concat(policy.allowedDomains).join("\n");
-      writeFileSync6(path, `${body}
-`, "utf8");
-    } else {
-      rmSync4(path, { force: true });
+    if (existsSync9("/.dockerenv")) return true;
+    const cgroup = readFileSync14("/proc/1/cgroup", "utf8");
+    return /docker|containerd|kubepods|libpod/.test(cgroup);
+  } catch {
+    return false;
+  }
+}
+function canReach(host, port) {
+  return new Promise((resolve8) => {
+    const socket = connect({ host, port });
+    let done = false;
+    const finish = (ok) => {
+      if (done) return;
+      done = true;
+      socket.destroy();
+      resolve8(ok);
+    };
+    socket.setTimeout(PROBE_TIMEOUT_MS);
+    socket.once("connect", () => finish(true));
+    socket.once("timeout", () => finish(false));
+    socket.once("error", () => finish(false));
+  });
+}
+async function probeOutbound() {
+  try {
+    const results = await Promise.all(CANARY_TARGETS.map((t) => canReach(t.host, t.port)));
+    return results.some(Boolean) ? "open" : "restricted";
+  } catch {
+    return "restricted";
+  }
+}
+function probeInbound() {
+  const isExposed = (path, loopbackHexPrefixes) => {
+    let body;
+    try {
+      body = readFileSync14(path, "utf8");
+    } catch {
+      return false;
     }
+    for (const line of body.split("\n").slice(1)) {
+      const cols = line.trim().split(/\s+/);
+      const local = cols[1];
+      const st = cols[3];
+      if (!local || st !== "0A") continue;
+      const addrHex = local.split(":")[0]?.toUpperCase() ?? "";
+      if (loopbackHexPrefixes.some((p) => addrHex === p)) continue;
+      return true;
+    }
+    return false;
+  };
+  try {
+    const v4 = isExposed("/proc/net/tcp", ["0100007F"]);
+    const v6 = isExposed("/proc/net/tcp6", ["00000000000000000000000001000000"]);
+    return v4 || v6 ? "exposed" : "isolated";
   } catch {
+    return "isolated";
   }
 }
+async function probeNetwork() {
+  return {
+    outbound: await probeOutbound(),
+    inbound: probeInbound(),
+    containerized: detectContainerized(),
+    checkedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
 
 // src/core/git-auth.ts
-import { writeFileSync as writeFileSync7 } from "fs";
+import { writeFileSync as writeFileSync6 } from "fs";
 import { homedir as homedir4 } from "os";
-import { join as join17 } from "path";
+import { join as join16 } from "path";
 function tokenTarget(method) {
   if (method === "gitlab-group-token") {
     return { host: process.env.FOURPM_GIT_HOST || "gitlab.com", user: "oauth2" };
@@ -35443,7 +35603,7 @@ function applyGitAuth(method) {
   try {
     const line = `https://${target.user}:${token}@${target.host}
 `;
-    writeFileSync7(join17(homedir4(), ".git-credentials"), line, { encoding: "utf8", mode: 384 });
+    writeFileSync6(join16(homedir4(), ".git-credentials"), line, { encoding: "utf8", mode: 384 });
     return true;
   } catch {
     return false;
@@ -35452,7 +35612,7 @@ function applyGitAuth(method) {
 
 // src/core/secrets.ts
 import { readFile as readFile6, writeFile as writeFile5 } from "fs/promises";
-import { join as join18 } from "path";
+import { join as join17 } from "path";
 var SECURITY_REL = "AI_SECURITY.md";
 var PLACEHOLDER_REL = "AI_PLACEHOLDER.md";
 var SECRETS_REL = "project.secrets.json";
@@ -35465,7 +35625,7 @@ async function readText3(path, fallback = "") {
 }
 async function readSecretsObject(root) {
   try {
-    const v = JSON.parse(await readFile6(join18(root, SECRETS_REL), "utf8"));
+    const v = JSON.parse(await readFile6(join17(root, SECRETS_REL), "utf8"));
     return v && typeof v === "object" ? v : {};
   } catch {
     return {};
@@ -35484,8 +35644,8 @@ function placeholderKeys(text) {
 }
 async function readSecrets(root) {
   const [security, placeholder, secrets] = await Promise.all([
-    readText3(join18(root, SECURITY_REL)),
-    readText3(join18(root, PLACEHOLDER_REL)),
+    readText3(join17(root, SECURITY_REL)),
+    readText3(join17(root, PLACEHOLDER_REL)),
     readSecretsObject(root)
   ]);
   const names = /* @__PURE__ */ new Set([...placeholderKeys(placeholder), ...Object.keys(secrets)]);
@@ -35498,14 +35658,14 @@ async function readSecrets(root) {
 async function writeSecrets(root, req) {
   try {
     if (req.kind === "security") {
-      await writeFile5(join18(root, SECURITY_REL), req.content, "utf8");
+      await writeFile5(join17(root, SECURITY_REL), req.content, "utf8");
     } else if (req.kind === "placeholder") {
-      await writeFile5(join18(root, PLACEHOLDER_REL), req.content, "utf8");
+      await writeFile5(join17(root, PLACEHOLDER_REL), req.content, "utf8");
     } else {
       const secrets = await readSecretsObject(root);
       if (req.kind === "secret") secrets[req.key] = req.value;
       else delete secrets[req.key];
-      await writeFile5(join18(root, SECRETS_REL), JSON.stringify(secrets, null, 2) + "\n", "utf8");
+      await writeFile5(join17(root, SECRETS_REL), JSON.stringify(secrets, null, 2) + "\n", "utf8");
     }
     return { ok: true };
   } catch (err) {
@@ -35515,13 +35675,13 @@ async function writeSecrets(root, req) {
 
 // src/core/agent-tools.ts
 import { readFile as readFile7, writeFile as writeFile6, mkdir as mkdir5 } from "fs/promises";
-import { dirname as dirname5, join as join19 } from "path";
+import { dirname as dirname5, join as join18 } from "path";
 var SHARED_REL = ".claude/settings.json";
 var LOCAL_REL = ".claude/settings.local.json";
 var SECRETS_DENY = "Read(./project.secrets.json)";
 var MODES = ["default", "acceptEdits", "plan", "bypassPermissions"];
 function fileFor(root, scope) {
-  return join19(root, scope === "shared" ? SHARED_REL : LOCAL_REL);
+  return join18(root, scope === "shared" ? SHARED_REL : LOCAL_REL);
 }
 async function readSettingsObject(path) {
   try {
@@ -35558,7 +35718,7 @@ async function writeAgentTools(root, scope, permissions) {
 
 // src/core/graph.ts
 import { readFile as readFile8, readdir as readdir5 } from "fs/promises";
-import { join as join20, relative as relative2, dirname as dirname6, resolve as resolve4, extname, basename as basename2 } from "path";
+import { join as join19, relative as relative2, dirname as dirname6, resolve as resolve4, extname, basename as basename2 } from "path";
 var MAX_FILES = 2e3;
 var MAX_NODES = 3e3;
 var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", "build", ".next", "out", "coverage", ".turbo"]);
@@ -35578,7 +35738,7 @@ async function walk(root, accept) {
       if (e.name.startsWith(".") && e.name !== ".claude") {
         if (e.isDirectory()) continue;
       }
-      const full = join20(dir2, e.name);
+      const full = join19(dir2, e.name);
       if (e.isDirectory()) {
         if (!SKIP_DIRS.has(e.name)) stack.push(full);
       } else if (accept(full)) {
@@ -35698,10 +35858,10 @@ async function buildGraph(root, mode) {
 
 // src/core/rag.ts
 import { readFile as readFile9, writeFile as writeFile7, statfs as statfs2, mkdir as mkdir6 } from "fs/promises";
-import { existsSync as existsSync9 } from "fs";
+import { existsSync as existsSync10 } from "fs";
 import { execFile as execFile4, spawn as spawn7 } from "child_process";
 import { totalmem as totalmem2, cpus as cpus2 } from "os";
-import { join as join21 } from "path";
+import { join as join20 } from "path";
 import { promisify as promisify4 } from "util";
 var run3 = promisify4(execFile4);
 var RAG_REL = ".claude/rag";
@@ -35722,7 +35882,7 @@ async function detectPython() {
 }
 async function installLog(root) {
   try {
-    const text = await readFile9(join21(root, RAG_REL, "install.log"), "utf8");
+    const text = await readFile9(join20(root, RAG_REL, "install.log"), "utf8");
     return text.split("\n").filter((l) => l.length > 0).slice(-200);
   } catch {
     return [];
@@ -35784,14 +35944,14 @@ async function ragStatus(root) {
   };
   let modelName = "";
   try {
-    modelName = (await readFile9(join21(root, RAG_REL, ".installed"), "utf8")).trim();
+    modelName = (await readFile9(join20(root, RAG_REL, ".installed"), "utf8")).trim();
   } catch {
     modelName = "";
   }
   const modelPresent = modelName.length > 0;
   return {
     installed: fastembed && sqliteVec && modelPresent,
-    installing: existsSync9(join21(root, RAG_REL, ".installing")),
+    installing: existsSync10(join20(root, RAG_REL, ".installing")),
     python: { found: py.found, version: py.version },
     deps: { pip, fastembed, sqliteVec },
     model: { present: modelPresent, name: modelName },
@@ -35802,9 +35962,9 @@ async function ragStatus(root) {
   };
 }
 async function readIndexMeta(root) {
-  const indexing = existsSync9(join21(root, RAG_REL, ".indexing"));
+  const indexing = existsSync10(join20(root, RAG_REL, ".indexing"));
   try {
-    const m = JSON.parse(await readFile9(join21(root, RAG_REL, ".index.json"), "utf8"));
+    const m = JSON.parse(await readFile9(join20(root, RAG_REL, ".index.json"), "utf8"));
     return {
       present: true,
       indexing,
@@ -35871,14 +36031,14 @@ if __name__ == "__main__":
     elif cmd == "query": query(sys.argv[2], int(sys.argv[3]) if len(sys.argv) > 3 else 8)
 `;
 async function ensureEngine(root) {
-  await mkdir6(join21(root, RAG_REL), { recursive: true }).catch(() => void 0);
-  await writeFile7(join21(root, RAG_REL, "rag_engine.py"), RAG_ENGINE_PY, "utf8");
+  await mkdir6(join20(root, RAG_REL), { recursive: true }).catch(() => void 0);
+  await writeFile7(join20(root, RAG_REL, "rag_engine.py"), RAG_ENGINE_PY, "utf8");
 }
 async function ragReindex(root) {
   const py = await detectPython();
   if (!py.found) return { ok: false, started: false, error: "python3 not found" };
-  if (!existsSync9(join21(root, RAG_REL, ".installed"))) return { ok: false, started: false, error: "RAG is not installed" };
-  if (existsSync9(join21(root, RAG_REL, ".indexing"))) return { ok: true, started: true };
+  if (!existsSync10(join20(root, RAG_REL, ".installed"))) return { ok: false, started: false, error: "RAG is not installed" };
+  if (existsSync10(join20(root, RAG_REL, ".indexing"))) return { ok: true, started: true };
   await ensureEngine(root);
   const script = `
 set +e
@@ -35898,12 +36058,12 @@ rm -f "${RAG_REL}/.indexing"
 async function ragQuery(root, queryText, k = 8) {
   const py = await detectPython();
   if (!py.found) return { results: [], error: "python3 not found" };
-  if (!existsSync9(join21(root, RAG_REL, "index.db"))) return { results: [], error: "no index \u2014 reindex first" };
+  if (!existsSync10(join20(root, RAG_REL, "index.db"))) return { results: [], error: "no index \u2014 reindex first" };
   await ensureEngine(root);
   try {
     const { stdout } = await run3(
       py.bin,
-      [join21(RAG_REL, "rag_engine.py"), "query", queryText, String(Math.min(Math.max(k, 1), 20))],
+      [join20(RAG_REL, "rag_engine.py"), "query", queryText, String(Math.min(Math.max(k, 1), 20))],
       { cwd: root, timeout: 3e4, maxBuffer: 4 * 1024 * 1024 }
     );
     const parsed = JSON.parse(stdout.trim() || '{"results":[]}');
@@ -35915,9 +36075,9 @@ async function ragQuery(root, queryText, k = 8) {
 async function ragInstall(root, model) {
   const py = await detectPython();
   if (!py.found) return { ok: false, started: false, error: "python3 not found on the worker" };
-  if (existsSync9(join21(root, RAG_REL, ".installing"))) return { ok: true, started: true };
+  if (existsSync10(join20(root, RAG_REL, ".installing"))) return { ok: true, started: true };
   try {
-    await mkdir6(join21(root, RAG_REL), { recursive: true });
+    await mkdir6(join20(root, RAG_REL), { recursive: true });
   } catch {
   }
   const script = `
@@ -36005,12 +36165,12 @@ ${stderr}`;
 // src/core/git-ssh-key.ts
 import { execFile as execFile7 } from "child_process";
 import { readFile as readFile11, rm as rm3, mkdir as mkdir7 } from "fs/promises";
-import { join as join22 } from "path";
+import { join as join21 } from "path";
 import { promisify as promisify7 } from "util";
 var run6 = promisify7(execFile7);
 function keyPaths(profileDir2) {
-  const dir2 = join22(profileDir2, ".ssh");
-  const key = join22(dir2, "id_4pm");
+  const dir2 = join21(profileDir2, ".ssh");
+  const key = join21(dir2, "id_4pm");
   return { dir: dir2, key, pub: `${key}.pub` };
 }
 async function readPublicKey(pub) {
@@ -36202,7 +36362,7 @@ async function setCommitAuthor(cwd2, machineUsername) {
 // src/core/scaffold.ts
 import { cp, mkdir as mkdir8, writeFile as writeFile8 } from "fs/promises";
 import { execFile as execFile10 } from "child_process";
-import { dirname as dirname8, join as join23, resolve as resolve7 } from "path";
+import { dirname as dirname8, join as join22, resolve as resolve7 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 import { promisify as promisify10 } from "util";
 var run9 = promisify10(execFile10);
@@ -36231,7 +36391,7 @@ async function provisionRepos(target, repos, emit, opts = {}) {
       }
       continue;
     }
-    const dir2 = join23(target, subDirName(repo));
+    const dir2 = join22(target, subDirName(repo));
     if (repo.url) {
       emit("git", `Cloning sub-repo ${repo.url}\u2026`);
       await run9("git", ["clone", repo.url, dir2], { timeout: 12e4 });
@@ -36251,14 +36411,14 @@ async function scaffoldProject(payload, profileDir2, onProgress) {
   const emit = (step, message) => onProgress?.({ projectId: payload.projectId, step, message });
   try {
     const root = process.env.SCAFFOLD_ROOT ? resolve7(process.env.SCAFFOLD_ROOT) : resolve7(profileDir2);
-    const target = join23(root, payload.projectName);
+    const target = join22(root, payload.projectName);
     await mkdir8(target, { recursive: true });
     emit("copy", "Copying the sample template\u2026");
     await cp(sampleDir(), target, { recursive: true, force: false, errorOnExist: false });
     if (payload.spec) {
       emit("spec", "Writing project.spec.json\u2026");
       await writeFile8(
-        join23(target, "project.spec.json"),
+        join22(target, "project.spec.json"),
         JSON.stringify(payload.spec, null, 2),
         "utf8"
       );
@@ -36276,7 +36436,7 @@ async function aiInit(target, spec, emit) {
   emit("ai-init", "AI init: subagents, README, CLAUDE.md\u2026");
   const subagents = Array.isArray(spec.subagents) ? spec.subagents : [];
   if (subagents.length > 0) {
-    await mkdir8(join23(target, ".claude", "agents"), { recursive: true });
+    await mkdir8(join22(target, ".claude", "agents"), { recursive: true });
     for (const sa of subagents) {
       const name = (sa.name || "").trim().replace(/[^\w.-]+/g, "-").replace(/^-+|-+$/g, "");
       if (!name) continue;
@@ -36286,17 +36446,17 @@ name: ${name}
 
 ${(sa.description || "").trim()}
 `;
-      await writeFile8(join23(target, ".claude", "agents", `${name}.md`), body, "utf8");
+      await writeFile8(join22(target, ".claude", "agents", `${name}.md`), body, "utf8");
     }
   }
   const specJson = JSON.stringify(spec);
   await generateFile(
-    join23(target, "README.md"),
+    join22(target, "README.md"),
     `Write a concise README.md (Markdown only, no preamble) for this project from its spec JSON:
 ${specJson}`
   );
   await generateFile(
-    join23(target, "CLAUDE.md"),
+    join22(target, "CLAUDE.md"),
     `Write a CLAUDE.md (Markdown only, no preamble) with guidance/conventions for AI agents working in this project, derived from its spec JSON:
 ${specJson}`
   );
@@ -36312,7 +36472,7 @@ async function addProject(payload, profileDir2, onProgress) {
   const emit = (step, message) => onProgress?.({ projectId: payload.projectId, step, message });
   try {
     const root = process.env.SCAFFOLD_ROOT ? resolve7(process.env.SCAFFOLD_ROOT) : resolve7(profileDir2);
-    const target = join23(root, payload.projectName);
+    const target = join22(root, payload.projectName);
     await mkdir8(target, { recursive: true });
     const repos = payload.repos ?? [];
     if (repos.length > 0) await provisionRepos(target, repos, emit, { clonePrimary: true });
@@ -36324,14 +36484,14 @@ async function addProject(payload, profileDir2, onProgress) {
 }
 
 // src/core/config-sync.ts
-import { existsSync as existsSync10, readFileSync as readFileSync14 } from "fs";
-import { join as join24 } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync15 } from "fs";
+import { join as join23 } from "path";
 var SERVER_MANAGED_KEYS = ["physicPath", "sessionSwitchPct", "perPromptTokenLimit"];
 function readConfigText(profileDir2) {
-  const path = join24(profileDir2, "config.json");
-  if (existsSync10(path)) {
+  const path = join23(profileDir2, "config.json");
+  if (existsSync11(path)) {
     try {
-      return readFileSync14(path, "utf8");
+      return readFileSync15(path, "utf8");
     } catch {
     }
   }
@@ -36756,7 +36916,6 @@ var WsClient = class {
         });
         this.outboundReviewEnabled = token.outboundReview?.enabled === true;
         this.restrictToFolder = token.aiRestrictToFolder === true;
-        writeEgressAllowlist(this.context.profileDir, token.aiSandbox ?? null);
         applyGitAuth(token.gitAuth ?? null);
         this.machineUsername = token.machineUsername ?? "";
         if (token.scope && token.scope !== this.credential.scope) {
@@ -36904,8 +37063,8 @@ var WsClient = class {
           const oldRoot = this.physicFolderPath(sync.oldName);
           if (oldRoot) void uninstallCron(oldRoot).catch(() => void 0);
         }
-        if (sync.oldName) rmSync5(join25(this.context.profileDir, sync.oldName), { recursive: true, force: true });
-        mkdirSync5(join25(this.context.profileDir, sync.newName), { recursive: true });
+        if (sync.oldName) rmSync4(join24(this.context.profileDir, sync.oldName), { recursive: true, force: true });
+        mkdirSync5(join24(this.context.profileDir, sync.newName), { recursive: true });
         this.physicRoot = this.physicFolderPath(sync.newName);
         this.bus.setProject(sync.newName);
         this.bus.log(`Physic project folder synced \u2192 ${sync.newName}`);
@@ -36916,7 +37075,7 @@ var WsClient = class {
         if (del.name) {
           const delRoot = this.physicFolderPath(del.name);
           if (delRoot) void uninstallCron(delRoot).catch(() => void 0);
-          rmSync5(join25(this.context.profileDir, del.name), { recursive: true, force: true });
+          rmSync4(join24(this.context.profileDir, del.name), { recursive: true, force: true });
           this.bus.log(`Physic project folder deleted (project removed) \u2192 ${del.name}`);
         }
         void manageSshKey("delete", this.context.profileDir).catch(() => void 0);
@@ -37288,7 +37447,7 @@ var WsClient = class {
       }
       case WsChannels.LOG_READ: {
         const limit = Math.min(Math.max(payload.limit ?? 200, 1), 2e3);
-        const lines = readRecentLogLines(join25(this.context.profileDir, "logs"), limit);
+        const lines = readRecentLogLines(join24(this.context.profileDir, "logs"), limit);
         this.send(WsChannels.LOG_READ, { lines }, message.id);
         break;
       }
@@ -37874,7 +38033,7 @@ var WsClient = class {
   /** Create the physic folder at an absolute path if missing (best-effort). */
   ensurePhysicFolderPath(folder) {
     try {
-      if (!existsSync11(folder)) {
+      if (!existsSync12(folder)) {
         mkdirSync5(folder, { recursive: true });
         this.bus.log(`Created physic project folder: ${folder}`);
       }
@@ -37889,7 +38048,7 @@ var WsClient = class {
    */
   physicFolderPath(projectName) {
     const safe = projectName.replace(/[/\\]/g, "_").replace(/\.\./g, "_").trim();
-    return safe ? join25(this.context.profileDir, safe) : null;
+    return safe ? join24(this.context.profileDir, safe) : null;
   }
   /**
    * Report machine.status: version + the state of the physic project being served
@@ -37903,7 +38062,7 @@ var WsClient = class {
       projects: [],
       version: CLI_VERSION,
       physicPath,
-      physicPathExists: physicPath ? existsSync11(physicPath) : void 0,
+      physicPathExists: physicPath ? existsSync12(physicPath) : void 0,
       // Real coarse state (ADR-0152): !paused and a recent tick (was hard-coded false).
       autonomousRunning: physicPath ? isAutonomousRunning(physicPath) : false
     });
@@ -37951,6 +38110,7 @@ var WsClient = class {
       };
       snapshot.aiCli = aiCli2;
       snapshot.profile = profile;
+      snapshot.network = await probeNetwork();
       this.usageSnapshot = snapshot;
       this.bus.setUsage?.(snapshot);
       this.send(WsChannels.MACHINE_USAGE, snapshot);
@@ -37992,7 +38152,7 @@ var WsClient = class {
    */
   uploadLog() {
     try {
-      const upload = readLogUpload(join25(this.context.profileDir, "logs"));
+      const upload = readLogUpload(join24(this.context.profileDir, "logs"));
       if (!upload) return;
       const sig = `${upload.fileName}:${upload.totalBytes}`;
       if (sig === this.lastLogSig) return;
@@ -38020,10 +38180,10 @@ var WsClient = class {
 };
 
 // src/core/instance-lock.ts
-import { readFileSync as readFileSync15, rmSync as rmSync6, writeFileSync as writeFileSync8 } from "fs";
-import { join as join26 } from "path";
+import { readFileSync as readFileSync16, rmSync as rmSync5, writeFileSync as writeFileSync7 } from "fs";
+import { join as join25 } from "path";
 function lockPath(profileDir2) {
-  return join26(profileDir2, "start.lock");
+  return join25(profileDir2, "start.lock");
 }
 function isAlive(pid) {
   try {
@@ -38035,7 +38195,7 @@ function isAlive(pid) {
 }
 function lockHolder(profileDir2) {
   try {
-    const pid = Number.parseInt(readFileSync15(lockPath(profileDir2), "utf8").trim(), 10);
+    const pid = Number.parseInt(readFileSync16(lockPath(profileDir2), "utf8").trim(), 10);
     if (Number.isInteger(pid) && pid > 0 && pid !== process.pid && isAlive(pid)) return pid;
   } catch {
   }
@@ -38043,13 +38203,13 @@ function lockHolder(profileDir2) {
 }
 function acquireInstanceLock(profileDir2) {
   if (lockHolder(profileDir2) !== null) return false;
-  writeFileSync8(lockPath(profileDir2), String(process.pid), "utf8");
+  writeFileSync7(lockPath(profileDir2), String(process.pid), "utf8");
   return true;
 }
 function releaseInstanceLock(profileDir2) {
   try {
-    const pid = Number.parseInt(readFileSync15(lockPath(profileDir2), "utf8").trim(), 10);
-    if (pid === process.pid) rmSync6(lockPath(profileDir2), { force: true });
+    const pid = Number.parseInt(readFileSync16(lockPath(profileDir2), "utf8").trim(), 10);
+    if (pid === process.pid) rmSync5(lockPath(profileDir2), { force: true });
   } catch {
   }
 }
@@ -38310,8 +38470,8 @@ var SessionBus = class {
 
 // src/core/control-server.ts
 import { createServer } from "net";
-import { rmSync as rmSync7 } from "fs";
-import { join as join27 } from "path";
+import { rmSync as rmSync6 } from "fs";
+import { join as join26 } from "path";
 
 // src/core/control-protocol.ts
 var CONTROL_SOCKET_FILE = "control.sock";
@@ -38340,9 +38500,9 @@ function createFrameParser() {
 
 // src/core/control-server.ts
 function startControlServer(bus, profileDir2, info) {
-  const socketPath = join27(profileDir2, CONTROL_SOCKET_FILE);
+  const socketPath = join26(profileDir2, CONTROL_SOCKET_FILE);
   try {
-    rmSync7(socketPath, { force: true });
+    rmSync6(socketPath, { force: true });
   } catch {
   }
   const clients = /* @__PURE__ */ new Set();
@@ -38408,7 +38568,7 @@ function startControlServer(bus, profileDir2, info) {
     clients.clear();
     server.close();
     try {
-      rmSync7(socketPath, { force: true });
+      rmSync6(socketPath, { force: true });
     } catch {
     }
   };
@@ -40388,7 +40548,7 @@ var src_default = Yoga;
 
 // ../../node_modules/.pnpm/ink@5.2.1_@types+react@18.3.31_react@18.3.1/node_modules/ink/build/reconciler.js
 var import_react_reconciler = __toESM(require_react_reconciler(), 1);
-var import_constants6 = __toESM(require_constants2(), 1);
+var import_constants7 = __toESM(require_constants2(), 1);
 import process3 from "process";
 
 // ../../node_modules/.pnpm/ansi-regex@6.2.2/node_modules/ansi-regex/index.js
@@ -41630,7 +41790,7 @@ var reconciler_default = (0, import_react_reconciler.default)({
   scheduleTimeout: setTimeout,
   cancelTimeout: clearTimeout,
   noTimeout: -1,
-  getCurrentEventPriority: () => import_constants6.DefaultEventPriority,
+  getCurrentEventPriority: () => import_constants7.DefaultEventPriority,
   beforeActiveInstanceBlur() {
   },
   afterActiveInstanceBlur() {
@@ -44072,17 +44232,17 @@ var import_react21 = __toESM(require_react(), 1);
 var import_react26 = __toESM(require_react(), 1);
 
 // src/core/input-history.ts
-import { existsSync as existsSync13, readFileSync as readFileSync17, writeFileSync as writeFileSync9 } from "fs";
-import { join as join28 } from "path";
+import { existsSync as existsSync14, readFileSync as readFileSync18, writeFileSync as writeFileSync8 } from "fs";
+import { join as join27 } from "path";
 var MAX_HISTORY = 200;
 function historyPath(profileDir2) {
-  return join28(profileDir2, "input-history.json");
+  return join27(profileDir2, "input-history.json");
 }
 function loadInputHistory(profileDir2) {
   const path = historyPath(profileDir2);
-  if (!existsSync13(path)) return [];
+  if (!existsSync14(path)) return [];
   try {
-    const data = JSON.parse(readFileSync17(path, "utf8"));
+    const data = JSON.parse(readFileSync18(path, "utf8"));
     return Array.isArray(data) ? data.filter((x) => typeof x === "string") : [];
   } catch {
     return [];
@@ -44093,7 +44253,7 @@ function appendInputHistory(profileDir2, line, current) {
   if (!trimmed || current[current.length - 1] === trimmed) return current;
   const next = [...current, trimmed].slice(-MAX_HISTORY);
   try {
-    writeFileSync9(historyPath(profileDir2), JSON.stringify(next), "utf8");
+    writeFileSync8(historyPath(profileDir2), JSON.stringify(next), "utf8");
   } catch {
   }
   return next;
@@ -44342,8 +44502,8 @@ function TranscriptLine({ line }) {
 var import_react24 = __toESM(require_react(), 1);
 
 // src/ui/slash-commands.ts
-import { existsSync as existsSync14 } from "fs";
-import { join as join29 } from "path";
+import { existsSync as existsSync15 } from "fs";
+import { join as join28 } from "path";
 var CONFIG_KEYS = [
   "aiCli",
   "claudeHome",
@@ -44355,7 +44515,7 @@ var CONFIG_KEYS = [
   "aiEnv"
 ];
 function configPath(profileDir2) {
-  return join29(profileDir2, "config.json");
+  return join28(profileDir2, "config.json");
 }
 function parseConfigAssignment(key, valueTokens) {
   const value = valueTokens.join(" ").trim();
@@ -44405,7 +44565,7 @@ function runConfig(ctx) {
       ctx.print(`\u2714 ${verb} default config: ${path}`);
       ctx.print("add claude profiles: /config set claudeHome .claude .claude-1 (tried in order)");
     };
-    if (existsSync14(path)) {
+    if (existsSync15(path)) {
       ctx.confirm(
         `config exists: ${path} \u2014 replace it with defaults? (y/N)`,
         () => writeDefaults("replaced with")
@@ -44490,7 +44650,7 @@ function runOutput(ctx) {
 }
 function runLogs(ctx) {
   const n = Math.max(1, Math.min(200, Number(ctx.args[0]) || 20));
-  const dir2 = join29(ctx.info.profileDir, "logs");
+  const dir2 = join28(ctx.info.profileDir, "logs");
   const lines = readRecentLogLines(dir2, n);
   if (lines.length === 0) {
     ctx.print("No log lines yet.");
@@ -45011,7 +45171,7 @@ async function runStart(profileDir2, profileName) {
     return;
   }
   logger.configure({
-    dir: join30(profileDir2, "logs"),
+    dir: join29(profileDir2, "logs"),
     level: resolveLogLevel(),
     base: { version: CLI_VERSION, profile: profileName, scope: credential.scope }
   });
@@ -45117,13 +45277,13 @@ async function runStart(profileDir2, profileName) {
 }
 
 // src/commands/attach.ts
-import { join as join31 } from "path";
+import { join as join30 } from "path";
 
 // src/core/control-client.ts
-import { connect } from "net";
+import { connect as connect2 } from "net";
 function connectControl(socketPath, bus) {
   return new Promise((resolve8, reject) => {
-    const socket = connect(socketPath);
+    const socket = connect2(socketPath);
     socket.setEncoding("utf8");
     let ready = false;
     const forwardSubmit = bus.onLocalSubmit((input) => {
@@ -45216,7 +45376,7 @@ async function runAttach(profileDir2, profileName) {
     process.exitCode = 1;
     return;
   }
-  const socketPath = join31(profileDir2, CONTROL_SOCKET_FILE);
+  const socketPath = join30(profileDir2, CONTROL_SOCKET_FILE);
   const bus = new SessionBus();
   let conn;
   try {
@@ -45301,7 +45461,7 @@ Tip: for the credentials to survive \`docker rm\`/recreate, keep each profile pa
 }
 
 // src/commands/unlink.ts
-import { rmSync as rmSync8 } from "fs";
+import { rmSync as rmSync7 } from "fs";
 async function runUnlink(profileDir2, profileName) {
   const cred = readCredential(profileDir2, profileName);
   if (!cred) {
@@ -45316,7 +45476,7 @@ async function runUnlink(profileDir2, profileName) {
       `\u26A0 Could not reach the server to revoke \u2014 revoke it at web /machines. (${err.message})`
     );
   }
-  rmSync8(profileDir2, { recursive: true, force: true });
+  rmSync7(profileDir2, { recursive: true, force: true });
   clearDefaultProfileIf(profileName);
   console.log("\u2714 Deleted the profile and its physic project folder.");
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@4pm/cli",
-  "version": "1.4.1",
+  "version": "1.4.3",
   "private": false,
   "description": "4PM CLI — drives Claude/Codex CLIs on AI worker machines (Node + TypeScript)",
   "license": "LicenseRef-4PM-Source-Available",