@4pm/cli 1.4.2 → 1.4.4

package/dist/index.js

@@ -28550,7 +28550,7 @@ ${INSECURE_URL_WARNING}
 
 // src/commands/start.ts
 import { spawn as spawn9 } from "child_process";
-import { join as join30 } from "path";
+import { join as join29 } from "path";
 
 // src/core/update.ts
 import { execSync as execSync2 } from "child_process";
@@ -28723,7 +28723,7 @@ async function checkAndUpdate(serverUrl, autoUpdate) {
 // src/core/ws-client.ts
 init_wrapper();
 import { randomUUID } from "crypto";
-import { basename as basename4, join as join25 } from "path";
+import { basename as basename4, join as join24 } from "path";
 
 // vendor/@4pm/utils/helpers.ts
 function backoffJitterMs(attempt, baseMs = 500, maxMs = 1e4) {
@@ -33087,6 +33087,19 @@ var createProjectRequestSchema = external_exports.object({
 var copyProjectRequestSchema = external_exports.object({
   name: external_exports.string().min(1).max(100)
 });
+var PROJECT_ALERT_KINDS = ["budgetPercent", "absolute"];
+var projectAlertRuleSchema = external_exports.object({
+  id: external_exports.string().min(1).max(64),
+  kind: external_exports.enum(PROJECT_ALERT_KINDS),
+  metric: external_exports.enum([UsageMetric.AI_TOKENS, UsageMetric.COMMANDS]),
+  threshold: external_exports.number().int().min(1),
+  email: external_exports.union([external_exports.string().email(), external_exports.literal("")]).optional(),
+  notifyUserId: external_exports.union([external_exports.string().uuid(), external_exports.literal("")]).optional(),
+  enabled: external_exports.boolean().default(true)
+});
+var projectAlertsSchema = external_exports.object({
+  rules: external_exports.array(projectAlertRuleSchema).max(20).default([])
+});
 var DEFAULT_OUTBOUND_RULES = {
   secret: [
     String.raw`/\b(api[_-]?key|secret|password|passwd|access[_-]?token|bearer)\b\s*[:=]\s*\S+/i`,
@@ -33650,6 +33663,10 @@ var WsChannels = {
   USAGE_REPORT: "usage.report",
   // cli → server: Claude subscription usage snapshot (5h / weekly — ADR-0072)
   MACHINE_USAGE: "machine.usage",
+  // cli → server: last-run result of an external tool (claude/codex/gh/glab/git — ADR-0223).
+  // One-way, sent immediately after each direct tool invocation (last-wins per tool); the
+  // server merges it into `MachineLink.usageSnapshot.toolHealth` for the admin pool lists.
+  TOOL_HEALTH: "tool.health",
   // cli → server: durable per-command history record on finish (ADR-0072)
   COMMAND_HISTORY: "command.history",
   // cli → server: periodic upload of the cli's own JSONL log file (ADR-0122) — stored
@@ -33729,7 +33746,7 @@ function decryptPayload(key, payloadBase64, nonceBase64) {
 }
 
 // src/core/ws-client.ts
-import { existsSync as existsSync11, mkdirSync as mkdirSync5, rmSync as rmSync5 } from "fs";
+import { existsSync as existsSync12, mkdirSync as mkdirSync5, rmSync as rmSync4 } from "fs";
 import { randomUUID as randomCommandId } from "crypto";
 
 // src/core/update-scheduler.ts
@@ -33998,6 +34015,24 @@ async function runCommand(dispatch, emit) {
   });
 }
 
+// src/core/tool-health.ts
+var sink = null;
+function setToolHealthSink(fn) {
+  sink = fn;
+}
+function reportToolResult(tool, ok, message) {
+  try {
+    const reason = (message ?? "").trim().slice(0, 200);
+    sink?.({
+      tool,
+      ok,
+      message: ok ? null : reason || "failed",
+      at: (/* @__PURE__ */ new Date()).toISOString()
+    });
+  } catch {
+  }
+}
+
 // src/core/ai-stream.ts
 function assistantText(ev) {
   const parts = ev.message?.content ?? [];
@@ -34104,8 +34139,11 @@ function runAttempt(commandId, cmd, args, cwd2, env3, onChunk) {
 async function runAiFailover(plan, commandId, cwd2, handlers) {
   const total = plan.attempts.length;
   let finalExit = -1;
+  let lastCmd = plan.attempts[0]?.cmd ?? "claude";
+  let lastCaptured = "";
   for (let i = 0; i < total; i++) {
     const attempt = plan.attempts[i];
+    lastCmd = attempt.cmd;
     if (total > 1) handlers.onAttemptStart(attempt.label, i, total, attempt.cmd);
     const parser = createAiStreamParser(attempt.cmd);
     let captured = "";
@@ -34122,17 +34160,26 @@ async function runAiFailover(plan, commandId, cwd2, handlers) {
       captured += tail;
       handlers.onChunk(tail);
     }
+    lastCaptured = captured;
     if (finalExit === 0) {
       const usage = parser.usage();
       if (usage.tokens === 0) usage.tokens = estimateTokens(captured);
+      reportToolResult(attempt.cmd, true);
       return { exitCode: 0, workedDir: attempt.dir, workedKey: attempt.key, workedCmd: attempt.cmd, usage };
     }
     const reason = isAuthFailure(captured) ? "auth" : isSessionLimit(captured) ? "limit" : null;
     if (!reason || i === total - 1) break;
     handlers.onAttemptFail(attempt.label, reason);
   }
+  reportToolResult(lastCmd, false, summarizeAiFailure(lastCaptured, finalExit));
   return { exitCode: finalExit, workedDir: null, workedKey: null, workedCmd: null, usage: { tokens: 0, input: 0, output: 0, cacheRead: 0, cacheCreation: 0 } };
 }
+function summarizeAiFailure(captured, exitCode) {
+  if (isAuthFailure(captured)) return "Not logged in";
+  if (isSessionLimit(captured)) return "Usage limit reached";
+  const firstLine = captured.split("\n").map((l) => l.trim()).find((l) => l.length > 0);
+  return firstLine || `exited ${exitCode}`;
+}
 
 // src/core/ai-profile-state.ts
 import { existsSync as existsSync5, readFileSync as readFileSync7, writeFileSync as writeFileSync4 } from "fs";
@@ -35055,7 +35102,10 @@ async function runKnowledgeCompose(req, ai, physicRoot) {
   for (let i = 0; i < attempts.length; i++) {
     try {
       const { code, out, err } = await runOnce(ai.cmd, attempts[i], prompt, physicRoot, ai.env);
-      if (code === 0 && out.trim()) return { bodyMarkdown: out.trim() };
+      if (code === 0 && out.trim()) {
+        reportToolResult(ai.cmd, true);
+        return { bodyMarkdown: out.trim() };
+      }
       const combined = err || out;
       lastReason = `exited ${code}: ${combined.slice(0, 500)}`;
       if (!isAuthFailure(combined) && !isSessionLimit(combined) || i === attempts.length - 1) break;
@@ -35064,6 +35114,7 @@ async function runKnowledgeCompose(req, ai, physicRoot) {
       break;
     }
   }
+  reportToolResult(ai.cmd, false, lastReason);
   return { bodyMarkdown: "", error: lastReason };
 }
 
@@ -35492,28 +35543,87 @@ async function removePackage(root, slug) {
   }
 }
 
-// src/core/sandbox.ts
-import { rmSync as rmSync4, writeFileSync as writeFileSync6 } from "fs";
-import { join as join16 } from "path";
-var EGRESS_ALLOWLIST_FILE = "sandbox-egress.txt";
-function writeEgressAllowlist(profileDir2, policy) {
-  const path = join16(profileDir2, EGRESS_ALLOWLIST_FILE);
+// src/core/network-probe.ts
+import { existsSync as existsSync9, readFileSync as readFileSync14 } from "fs";
+import { connect } from "net";
+var CANARY_TARGETS = [
+  { host: "1.1.1.1", port: 443 },
+  { host: "8.8.8.8", port: 443 }
+];
+var PROBE_TIMEOUT_MS = 2500;
+function detectContainerized() {
   try {
-    if (policy && policy.network === "allowlist") {
-      const body = ["# 4PM egress allowlist (ADR-0192) \u2014 generated from the project sandbox policy"].concat(policy.allowedDomains).join("\n");
-      writeFileSync6(path, `${body}
-`, "utf8");
-    } else {
-      rmSync4(path, { force: true });
+    if (existsSync9("/.dockerenv")) return true;
+    const cgroup = readFileSync14("/proc/1/cgroup", "utf8");
+    return /docker|containerd|kubepods|libpod/.test(cgroup);
+  } catch {
+    return false;
+  }
+}
+function canReach(host, port) {
+  return new Promise((resolve8) => {
+    const socket = connect({ host, port });
+    let done = false;
+    const finish = (ok) => {
+      if (done) return;
+      done = true;
+      socket.destroy();
+      resolve8(ok);
+    };
+    socket.setTimeout(PROBE_TIMEOUT_MS);
+    socket.once("connect", () => finish(true));
+    socket.once("timeout", () => finish(false));
+    socket.once("error", () => finish(false));
+  });
+}
+async function probeOutbound() {
+  try {
+    const results = await Promise.all(CANARY_TARGETS.map((t) => canReach(t.host, t.port)));
+    return results.some(Boolean) ? "open" : "restricted";
+  } catch {
+    return "restricted";
+  }
+}
+function probeInbound() {
+  const isExposed = (path, loopbackHexPrefixes) => {
+    let body;
+    try {
+      body = readFileSync14(path, "utf8");
+    } catch {
+      return false;
+    }
+    for (const line of body.split("\n").slice(1)) {
+      const cols = line.trim().split(/\s+/);
+      const local = cols[1];
+      const st = cols[3];
+      if (!local || st !== "0A") continue;
+      const addrHex = local.split(":")[0]?.toUpperCase() ?? "";
+      if (loopbackHexPrefixes.some((p) => addrHex === p)) continue;
+      return true;
     }
+    return false;
+  };
+  try {
+    const v4 = isExposed("/proc/net/tcp", ["0100007F"]);
+    const v6 = isExposed("/proc/net/tcp6", ["00000000000000000000000001000000"]);
+    return v4 || v6 ? "exposed" : "isolated";
   } catch {
+    return "isolated";
   }
 }
+async function probeNetwork() {
+  return {
+    outbound: await probeOutbound(),
+    inbound: probeInbound(),
+    containerized: detectContainerized(),
+    checkedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
 
 // src/core/git-auth.ts
-import { writeFileSync as writeFileSync7 } from "fs";
+import { writeFileSync as writeFileSync6 } from "fs";
 import { homedir as homedir4 } from "os";
-import { join as join17 } from "path";
+import { join as join16 } from "path";
 function tokenTarget(method) {
   if (method === "gitlab-group-token") {
     return { host: process.env.FOURPM_GIT_HOST || "gitlab.com", user: "oauth2" };
@@ -35531,7 +35641,7 @@ function applyGitAuth(method) {
   try {
     const line = `https://${target.user}:${token}@${target.host}
 `;
-    writeFileSync7(join17(homedir4(), ".git-credentials"), line, { encoding: "utf8", mode: 384 });
+    writeFileSync6(join16(homedir4(), ".git-credentials"), line, { encoding: "utf8", mode: 384 });
     return true;
   } catch {
     return false;
@@ -35540,7 +35650,7 @@ function applyGitAuth(method) {
 
 // src/core/secrets.ts
 import { readFile as readFile6, writeFile as writeFile5 } from "fs/promises";
-import { join as join18 } from "path";
+import { join as join17 } from "path";
 var SECURITY_REL = "AI_SECURITY.md";
 var PLACEHOLDER_REL = "AI_PLACEHOLDER.md";
 var SECRETS_REL = "project.secrets.json";
@@ -35553,7 +35663,7 @@ async function readText3(path, fallback = "") {
 }
 async function readSecretsObject(root) {
   try {
-    const v = JSON.parse(await readFile6(join18(root, SECRETS_REL), "utf8"));
+    const v = JSON.parse(await readFile6(join17(root, SECRETS_REL), "utf8"));
     return v && typeof v === "object" ? v : {};
   } catch {
     return {};
@@ -35572,8 +35682,8 @@ function placeholderKeys(text) {
 }
 async function readSecrets(root) {
   const [security, placeholder, secrets] = await Promise.all([
-    readText3(join18(root, SECURITY_REL)),
-    readText3(join18(root, PLACEHOLDER_REL)),
+    readText3(join17(root, SECURITY_REL)),
+    readText3(join17(root, PLACEHOLDER_REL)),
     readSecretsObject(root)
   ]);
   const names = /* @__PURE__ */ new Set([...placeholderKeys(placeholder), ...Object.keys(secrets)]);
@@ -35586,14 +35696,14 @@ async function readSecrets(root) {
 async function writeSecrets(root, req) {
   try {
     if (req.kind === "security") {
-      await writeFile5(join18(root, SECURITY_REL), req.content, "utf8");
+      await writeFile5(join17(root, SECURITY_REL), req.content, "utf8");
     } else if (req.kind === "placeholder") {
-      await writeFile5(join18(root, PLACEHOLDER_REL), req.content, "utf8");
+      await writeFile5(join17(root, PLACEHOLDER_REL), req.content, "utf8");
     } else {
       const secrets = await readSecretsObject(root);
       if (req.kind === "secret") secrets[req.key] = req.value;
       else delete secrets[req.key];
-      await writeFile5(join18(root, SECRETS_REL), JSON.stringify(secrets, null, 2) + "\n", "utf8");
+      await writeFile5(join17(root, SECRETS_REL), JSON.stringify(secrets, null, 2) + "\n", "utf8");
     }
     return { ok: true };
   } catch (err) {
@@ -35603,13 +35713,13 @@ async function writeSecrets(root, req) {
 
 // src/core/agent-tools.ts
 import { readFile as readFile7, writeFile as writeFile6, mkdir as mkdir5 } from "fs/promises";
-import { dirname as dirname5, join as join19 } from "path";
+import { dirname as dirname5, join as join18 } from "path";
 var SHARED_REL = ".claude/settings.json";
 var LOCAL_REL = ".claude/settings.local.json";
 var SECRETS_DENY = "Read(./project.secrets.json)";
 var MODES = ["default", "acceptEdits", "plan", "bypassPermissions"];
 function fileFor(root, scope) {
-  return join19(root, scope === "shared" ? SHARED_REL : LOCAL_REL);
+  return join18(root, scope === "shared" ? SHARED_REL : LOCAL_REL);
 }
 async function readSettingsObject(path) {
   try {
@@ -35646,7 +35756,7 @@ async function writeAgentTools(root, scope, permissions) {
 
 // src/core/graph.ts
 import { readFile as readFile8, readdir as readdir5 } from "fs/promises";
-import { join as join20, relative as relative2, dirname as dirname6, resolve as resolve4, extname, basename as basename2 } from "path";
+import { join as join19, relative as relative2, dirname as dirname6, resolve as resolve4, extname, basename as basename2 } from "path";
 var MAX_FILES = 2e3;
 var MAX_NODES = 3e3;
 var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", "build", ".next", "out", "coverage", ".turbo"]);
@@ -35666,7 +35776,7 @@ async function walk(root, accept) {
       if (e.name.startsWith(".") && e.name !== ".claude") {
         if (e.isDirectory()) continue;
       }
-      const full = join20(dir2, e.name);
+      const full = join19(dir2, e.name);
       if (e.isDirectory()) {
         if (!SKIP_DIRS.has(e.name)) stack.push(full);
       } else if (accept(full)) {
@@ -35786,10 +35896,10 @@ async function buildGraph(root, mode) {
 
 // src/core/rag.ts
 import { readFile as readFile9, writeFile as writeFile7, statfs as statfs2, mkdir as mkdir6 } from "fs/promises";
-import { existsSync as existsSync9 } from "fs";
+import { existsSync as existsSync10 } from "fs";
 import { execFile as execFile4, spawn as spawn7 } from "child_process";
 import { totalmem as totalmem2, cpus as cpus2 } from "os";
-import { join as join21 } from "path";
+import { join as join20 } from "path";
 import { promisify as promisify4 } from "util";
 var run3 = promisify4(execFile4);
 var RAG_REL = ".claude/rag";
@@ -35810,7 +35920,7 @@ async function detectPython() {
 }
 async function installLog(root) {
   try {
-    const text = await readFile9(join21(root, RAG_REL, "install.log"), "utf8");
+    const text = await readFile9(join20(root, RAG_REL, "install.log"), "utf8");
     return text.split("\n").filter((l) => l.length > 0).slice(-200);
   } catch {
     return [];
@@ -35872,14 +35982,14 @@ async function ragStatus(root) {
   };
   let modelName = "";
   try {
-    modelName = (await readFile9(join21(root, RAG_REL, ".installed"), "utf8")).trim();
+    modelName = (await readFile9(join20(root, RAG_REL, ".installed"), "utf8")).trim();
   } catch {
     modelName = "";
   }
   const modelPresent = modelName.length > 0;
   return {
     installed: fastembed && sqliteVec && modelPresent,
-    installing: existsSync9(join21(root, RAG_REL, ".installing")),
+    installing: existsSync10(join20(root, RAG_REL, ".installing")),
     python: { found: py.found, version: py.version },
     deps: { pip, fastembed, sqliteVec },
     model: { present: modelPresent, name: modelName },
@@ -35890,9 +36000,9 @@ async function ragStatus(root) {
   };
 }
 async function readIndexMeta(root) {
-  const indexing = existsSync9(join21(root, RAG_REL, ".indexing"));
+  const indexing = existsSync10(join20(root, RAG_REL, ".indexing"));
   try {
-    const m = JSON.parse(await readFile9(join21(root, RAG_REL, ".index.json"), "utf8"));
+    const m = JSON.parse(await readFile9(join20(root, RAG_REL, ".index.json"), "utf8"));
     return {
       present: true,
       indexing,
@@ -35959,14 +36069,14 @@ if __name__ == "__main__":
     elif cmd == "query": query(sys.argv[2], int(sys.argv[3]) if len(sys.argv) > 3 else 8)
 `;
 async function ensureEngine(root) {
-  await mkdir6(join21(root, RAG_REL), { recursive: true }).catch(() => void 0);
-  await writeFile7(join21(root, RAG_REL, "rag_engine.py"), RAG_ENGINE_PY, "utf8");
+  await mkdir6(join20(root, RAG_REL), { recursive: true }).catch(() => void 0);
+  await writeFile7(join20(root, RAG_REL, "rag_engine.py"), RAG_ENGINE_PY, "utf8");
 }
 async function ragReindex(root) {
   const py = await detectPython();
   if (!py.found) return { ok: false, started: false, error: "python3 not found" };
-  if (!existsSync9(join21(root, RAG_REL, ".installed"))) return { ok: false, started: false, error: "RAG is not installed" };
-  if (existsSync9(join21(root, RAG_REL, ".indexing"))) return { ok: true, started: true };
+  if (!existsSync10(join20(root, RAG_REL, ".installed"))) return { ok: false, started: false, error: "RAG is not installed" };
+  if (existsSync10(join20(root, RAG_REL, ".indexing"))) return { ok: true, started: true };
   await ensureEngine(root);
   const script = `
 set +e
@@ -35986,12 +36096,12 @@ rm -f "${RAG_REL}/.indexing"
 async function ragQuery(root, queryText, k = 8) {
   const py = await detectPython();
   if (!py.found) return { results: [], error: "python3 not found" };
-  if (!existsSync9(join21(root, RAG_REL, "index.db"))) return { results: [], error: "no index \u2014 reindex first" };
+  if (!existsSync10(join20(root, RAG_REL, "index.db"))) return { results: [], error: "no index \u2014 reindex first" };
   await ensureEngine(root);
   try {
     const { stdout } = await run3(
       py.bin,
-      [join21(RAG_REL, "rag_engine.py"), "query", queryText, String(Math.min(Math.max(k, 1), 20))],
+      [join20(RAG_REL, "rag_engine.py"), "query", queryText, String(Math.min(Math.max(k, 1), 20))],
       { cwd: root, timeout: 3e4, maxBuffer: 4 * 1024 * 1024 }
     );
     const parsed = JSON.parse(stdout.trim() || '{"results":[]}');
@@ -36003,9 +36113,9 @@ async function ragQuery(root, queryText, k = 8) {
 async function ragInstall(root, model) {
   const py = await detectPython();
   if (!py.found) return { ok: false, started: false, error: "python3 not found on the worker" };
-  if (existsSync9(join21(root, RAG_REL, ".installing"))) return { ok: true, started: true };
+  if (existsSync10(join20(root, RAG_REL, ".installing"))) return { ok: true, started: true };
   try {
-    await mkdir6(join21(root, RAG_REL), { recursive: true });
+    await mkdir6(join20(root, RAG_REL), { recursive: true });
   } catch {
   }
   const script = `
@@ -36093,12 +36203,12 @@ ${stderr}`;
 // src/core/git-ssh-key.ts
 import { execFile as execFile7 } from "child_process";
 import { readFile as readFile11, rm as rm3, mkdir as mkdir7 } from "fs/promises";
-import { join as join22 } from "path";
+import { join as join21 } from "path";
 import { promisify as promisify7 } from "util";
 var run6 = promisify7(execFile7);
 function keyPaths(profileDir2) {
-  const dir2 = join22(profileDir2, ".ssh");
-  const key = join22(dir2, "id_4pm");
+  const dir2 = join21(profileDir2, ".ssh");
+  const key = join21(dir2, "id_4pm");
   return { dir: dir2, key, pub: `${key}.pub` };
 }
 async function readPublicKey(pub) {
@@ -36290,7 +36400,7 @@ async function setCommitAuthor(cwd2, machineUsername) {
 // src/core/scaffold.ts
 import { cp, mkdir as mkdir8, writeFile as writeFile8 } from "fs/promises";
 import { execFile as execFile10 } from "child_process";
-import { dirname as dirname8, join as join23, resolve as resolve7 } from "path";
+import { dirname as dirname8, join as join22, resolve as resolve7 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 import { promisify as promisify10 } from "util";
 var run9 = promisify10(execFile10);
@@ -36319,7 +36429,7 @@ async function provisionRepos(target, repos, emit, opts = {}) {
       }
       continue;
     }
-    const dir2 = join23(target, subDirName(repo));
+    const dir2 = join22(target, subDirName(repo));
     if (repo.url) {
       emit("git", `Cloning sub-repo ${repo.url}\u2026`);
       await run9("git", ["clone", repo.url, dir2], { timeout: 12e4 });
@@ -36339,14 +36449,14 @@ async function scaffoldProject(payload, profileDir2, onProgress) {
   const emit = (step, message) => onProgress?.({ projectId: payload.projectId, step, message });
   try {
     const root = process.env.SCAFFOLD_ROOT ? resolve7(process.env.SCAFFOLD_ROOT) : resolve7(profileDir2);
-    const target = join23(root, payload.projectName);
+    const target = join22(root, payload.projectName);
     await mkdir8(target, { recursive: true });
     emit("copy", "Copying the sample template\u2026");
     await cp(sampleDir(), target, { recursive: true, force: false, errorOnExist: false });
     if (payload.spec) {
       emit("spec", "Writing project.spec.json\u2026");
       await writeFile8(
-        join23(target, "project.spec.json"),
+        join22(target, "project.spec.json"),
         JSON.stringify(payload.spec, null, 2),
         "utf8"
       );
@@ -36364,7 +36474,7 @@ async function aiInit(target, spec, emit) {
   emit("ai-init", "AI init: subagents, README, CLAUDE.md\u2026");
   const subagents = Array.isArray(spec.subagents) ? spec.subagents : [];
   if (subagents.length > 0) {
-    await mkdir8(join23(target, ".claude", "agents"), { recursive: true });
+    await mkdir8(join22(target, ".claude", "agents"), { recursive: true });
     for (const sa of subagents) {
       const name = (sa.name || "").trim().replace(/[^\w.-]+/g, "-").replace(/^-+|-+$/g, "");
       if (!name) continue;
@@ -36374,17 +36484,17 @@ name: ${name}
 
 ${(sa.description || "").trim()}
 `;
-      await writeFile8(join23(target, ".claude", "agents", `${name}.md`), body, "utf8");
+      await writeFile8(join22(target, ".claude", "agents", `${name}.md`), body, "utf8");
     }
   }
   const specJson = JSON.stringify(spec);
   await generateFile(
-    join23(target, "README.md"),
+    join22(target, "README.md"),
     `Write a concise README.md (Markdown only, no preamble) for this project from its spec JSON:
 ${specJson}`
   );
   await generateFile(
-    join23(target, "CLAUDE.md"),
+    join22(target, "CLAUDE.md"),
     `Write a CLAUDE.md (Markdown only, no preamble) with guidance/conventions for AI agents working in this project, derived from its spec JSON:
 ${specJson}`
   );
@@ -36400,7 +36510,7 @@ async function addProject(payload, profileDir2, onProgress) {
   const emit = (step, message) => onProgress?.({ projectId: payload.projectId, step, message });
   try {
     const root = process.env.SCAFFOLD_ROOT ? resolve7(process.env.SCAFFOLD_ROOT) : resolve7(profileDir2);
-    const target = join23(root, payload.projectName);
+    const target = join22(root, payload.projectName);
     await mkdir8(target, { recursive: true });
     const repos = payload.repos ?? [];
     if (repos.length > 0) await provisionRepos(target, repos, emit, { clonePrimary: true });
@@ -36412,14 +36522,14 @@ async function addProject(payload, profileDir2, onProgress) {
 }
 
 // src/core/config-sync.ts
-import { existsSync as existsSync10, readFileSync as readFileSync14 } from "fs";
-import { join as join24 } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync15 } from "fs";
+import { join as join23 } from "path";
 var SERVER_MANAGED_KEYS = ["physicPath", "sessionSwitchPct", "perPromptTokenLimit"];
 function readConfigText(profileDir2) {
-  const path = join24(profileDir2, "config.json");
-  if (existsSync10(path)) {
+  const path = join23(profileDir2, "config.json");
+  if (existsSync11(path)) {
     try {
-      return readFileSync14(path, "utf8");
+      return readFileSync15(path, "utf8");
     } catch {
     }
   }
@@ -36844,7 +36954,6 @@ var WsClient = class {
         });
         this.outboundReviewEnabled = token.outboundReview?.enabled === true;
         this.restrictToFolder = token.aiRestrictToFolder === true;
-        writeEgressAllowlist(this.context.profileDir, token.aiSandbox ?? null);
         applyGitAuth(token.gitAuth ?? null);
         this.machineUsername = token.machineUsername ?? "";
         if (token.scope && token.scope !== this.credential.scope) {
@@ -36890,6 +36999,7 @@ var WsClient = class {
         socket.on("close", (code) => {
           this.clearHeartbeat();
           this.sessionKey = null;
+          setToolHealthSink(null);
           logger.debug("ws.close", { code });
           if (code === CLOSE_DRAINING) {
             this.bus.log("Server draining \u2014 will reconnect (backoff + jitter).");
@@ -36931,6 +37041,7 @@ var WsClient = class {
         this.startUsagePolling();
         this.startLogUpload();
         this.startKbRefresh();
+        setToolHealthSink((report) => this.send(WsChannels.TOOL_HEALTH, report));
         this.connectWaiters.splice(0).forEach((fn) => fn());
         return;
       }
@@ -36992,8 +37103,8 @@ var WsClient = class {
           const oldRoot = this.physicFolderPath(sync.oldName);
           if (oldRoot) void uninstallCron(oldRoot).catch(() => void 0);
         }
-        if (sync.oldName) rmSync5(join25(this.context.profileDir, sync.oldName), { recursive: true, force: true });
-        mkdirSync5(join25(this.context.profileDir, sync.newName), { recursive: true });
+        if (sync.oldName) rmSync4(join24(this.context.profileDir, sync.oldName), { recursive: true, force: true });
+        mkdirSync5(join24(this.context.profileDir, sync.newName), { recursive: true });
         this.physicRoot = this.physicFolderPath(sync.newName);
         this.bus.setProject(sync.newName);
         this.bus.log(`Physic project folder synced \u2192 ${sync.newName}`);
@@ -37004,7 +37115,7 @@ var WsClient = class {
         if (del.name) {
           const delRoot = this.physicFolderPath(del.name);
           if (delRoot) void uninstallCron(delRoot).catch(() => void 0);
-          rmSync5(join25(this.context.profileDir, del.name), { recursive: true, force: true });
+          rmSync4(join24(this.context.profileDir, del.name), { recursive: true, force: true });
           this.bus.log(`Physic project folder deleted (project removed) \u2192 ${del.name}`);
         }
         void manageSshKey("delete", this.context.profileDir).catch(() => void 0);
@@ -37103,6 +37214,7 @@ var WsClient = class {
             this.bus.push({ source: "server", kind: "aires", text: `${supportCmd} \u203A` });
             this.bus.push({ source: "server", kind: "out", text: reply.body });
           }
+          reportToolResult(supportCmd, !reply.error, reply.error);
           this.send(WsChannels.SUPPORT_ANSWER, reply, message.id);
         }).finally(() => this.bus.endBusy("support-answer"));
         break;
@@ -37376,7 +37488,7 @@ var WsClient = class {
       }
       case WsChannels.LOG_READ: {
         const limit = Math.min(Math.max(payload.limit ?? 200, 1), 2e3);
-        const lines = readRecentLogLines(join25(this.context.profileDir, "logs"), limit);
+        const lines = readRecentLogLines(join24(this.context.profileDir, "logs"), limit);
         this.send(WsChannels.LOG_READ, { lines }, message.id);
         break;
       }
@@ -37962,7 +38074,7 @@ var WsClient = class {
   /** Create the physic folder at an absolute path if missing (best-effort). */
   ensurePhysicFolderPath(folder) {
     try {
-      if (!existsSync11(folder)) {
+      if (!existsSync12(folder)) {
         mkdirSync5(folder, { recursive: true });
         this.bus.log(`Created physic project folder: ${folder}`);
       }
@@ -37977,7 +38089,7 @@ var WsClient = class {
    */
   physicFolderPath(projectName) {
     const safe = projectName.replace(/[/\\]/g, "_").replace(/\.\./g, "_").trim();
-    return safe ? join25(this.context.profileDir, safe) : null;
+    return safe ? join24(this.context.profileDir, safe) : null;
   }
   /**
    * Report machine.status: version + the state of the physic project being served
@@ -37991,7 +38103,7 @@ var WsClient = class {
       projects: [],
       version: CLI_VERSION,
       physicPath,
-      physicPathExists: physicPath ? existsSync11(physicPath) : void 0,
+      physicPathExists: physicPath ? existsSync12(physicPath) : void 0,
       // Real coarse state (ADR-0152): !paused and a recent tick (was hard-coded false).
       autonomousRunning: physicPath ? isAutonomousRunning(physicPath) : false
     });
@@ -38039,6 +38151,7 @@ var WsClient = class {
       };
       snapshot.aiCli = aiCli2;
       snapshot.profile = profile;
+      snapshot.network = await probeNetwork();
       this.usageSnapshot = snapshot;
       this.bus.setUsage?.(snapshot);
       this.send(WsChannels.MACHINE_USAGE, snapshot);
@@ -38080,7 +38193,7 @@ var WsClient = class {
    */
   uploadLog() {
     try {
-      const upload = readLogUpload(join25(this.context.profileDir, "logs"));
+      const upload = readLogUpload(join24(this.context.profileDir, "logs"));
       if (!upload) return;
       const sig = `${upload.fileName}:${upload.totalBytes}`;
       if (sig === this.lastLogSig) return;
@@ -38108,10 +38221,10 @@ var WsClient = class {
 };
 
 // src/core/instance-lock.ts
-import { readFileSync as readFileSync15, rmSync as rmSync6, writeFileSync as writeFileSync8 } from "fs";
-import { join as join26 } from "path";
+import { readFileSync as readFileSync16, rmSync as rmSync5, writeFileSync as writeFileSync7 } from "fs";
+import { join as join25 } from "path";
 function lockPath(profileDir2) {
-  return join26(profileDir2, "start.lock");
+  return join25(profileDir2, "start.lock");
 }
 function isAlive(pid) {
   try {
@@ -38123,7 +38236,7 @@ function isAlive(pid) {
 }
 function lockHolder(profileDir2) {
   try {
-    const pid = Number.parseInt(readFileSync15(lockPath(profileDir2), "utf8").trim(), 10);
+    const pid = Number.parseInt(readFileSync16(lockPath(profileDir2), "utf8").trim(), 10);
     if (Number.isInteger(pid) && pid > 0 && pid !== process.pid && isAlive(pid)) return pid;
   } catch {
   }
@@ -38131,13 +38244,13 @@ function lockHolder(profileDir2) {
 }
 function acquireInstanceLock(profileDir2) {
   if (lockHolder(profileDir2) !== null) return false;
-  writeFileSync8(lockPath(profileDir2), String(process.pid), "utf8");
+  writeFileSync7(lockPath(profileDir2), String(process.pid), "utf8");
   return true;
 }
 function releaseInstanceLock(profileDir2) {
   try {
-    const pid = Number.parseInt(readFileSync15(lockPath(profileDir2), "utf8").trim(), 10);
-    if (pid === process.pid) rmSync6(lockPath(profileDir2), { force: true });
+    const pid = Number.parseInt(readFileSync16(lockPath(profileDir2), "utf8").trim(), 10);
+    if (pid === process.pid) rmSync5(lockPath(profileDir2), { force: true });
   } catch {
   }
 }
@@ -38398,8 +38511,8 @@ var SessionBus = class {
 
 // src/core/control-server.ts
 import { createServer } from "net";
-import { rmSync as rmSync7 } from "fs";
-import { join as join27 } from "path";
+import { rmSync as rmSync6 } from "fs";
+import { join as join26 } from "path";
 
 // src/core/control-protocol.ts
 var CONTROL_SOCKET_FILE = "control.sock";
@@ -38428,9 +38541,9 @@ function createFrameParser() {
 
 // src/core/control-server.ts
 function startControlServer(bus, profileDir2, info) {
-  const socketPath = join27(profileDir2, CONTROL_SOCKET_FILE);
+  const socketPath = join26(profileDir2, CONTROL_SOCKET_FILE);
   try {
-    rmSync7(socketPath, { force: true });
+    rmSync6(socketPath, { force: true });
   } catch {
   }
   const clients = /* @__PURE__ */ new Set();
@@ -38496,7 +38609,7 @@ function startControlServer(bus, profileDir2, info) {
     clients.clear();
     server.close();
     try {
-      rmSync7(socketPath, { force: true });
+      rmSync6(socketPath, { force: true });
     } catch {
     }
   };
@@ -40476,7 +40589,7 @@ var src_default = Yoga;
 
 // ../../node_modules/.pnpm/ink@5.2.1_@types+react@18.3.31_react@18.3.1/node_modules/ink/build/reconciler.js
 var import_react_reconciler = __toESM(require_react_reconciler(), 1);
-var import_constants6 = __toESM(require_constants2(), 1);
+var import_constants7 = __toESM(require_constants2(), 1);
 import process3 from "process";
 
 // ../../node_modules/.pnpm/ansi-regex@6.2.2/node_modules/ansi-regex/index.js
@@ -41718,7 +41831,7 @@ var reconciler_default = (0, import_react_reconciler.default)({
   scheduleTimeout: setTimeout,
   cancelTimeout: clearTimeout,
   noTimeout: -1,
-  getCurrentEventPriority: () => import_constants6.DefaultEventPriority,
+  getCurrentEventPriority: () => import_constants7.DefaultEventPriority,
   beforeActiveInstanceBlur() {
   },
   afterActiveInstanceBlur() {
@@ -44160,17 +44273,17 @@ var import_react21 = __toESM(require_react(), 1);
 var import_react26 = __toESM(require_react(), 1);
 
 // src/core/input-history.ts
-import { existsSync as existsSync13, readFileSync as readFileSync17, writeFileSync as writeFileSync9 } from "fs";
-import { join as join28 } from "path";
+import { existsSync as existsSync14, readFileSync as readFileSync18, writeFileSync as writeFileSync8 } from "fs";
+import { join as join27 } from "path";
 var MAX_HISTORY = 200;
 function historyPath(profileDir2) {
-  return join28(profileDir2, "input-history.json");
+  return join27(profileDir2, "input-history.json");
 }
 function loadInputHistory(profileDir2) {
   const path = historyPath(profileDir2);
-  if (!existsSync13(path)) return [];
+  if (!existsSync14(path)) return [];
   try {
-    const data = JSON.parse(readFileSync17(path, "utf8"));
+    const data = JSON.parse(readFileSync18(path, "utf8"));
     return Array.isArray(data) ? data.filter((x) => typeof x === "string") : [];
   } catch {
     return [];
@@ -44181,7 +44294,7 @@ function appendInputHistory(profileDir2, line, current) {
   if (!trimmed || current[current.length - 1] === trimmed) return current;
   const next = [...current, trimmed].slice(-MAX_HISTORY);
   try {
-    writeFileSync9(historyPath(profileDir2), JSON.stringify(next), "utf8");
+    writeFileSync8(historyPath(profileDir2), JSON.stringify(next), "utf8");
   } catch {
   }
   return next;
@@ -44430,8 +44543,8 @@ function TranscriptLine({ line }) {
 var import_react24 = __toESM(require_react(), 1);
 
 // src/ui/slash-commands.ts
-import { existsSync as existsSync14 } from "fs";
-import { join as join29 } from "path";
+import { existsSync as existsSync15 } from "fs";
+import { join as join28 } from "path";
 var CONFIG_KEYS = [
   "aiCli",
   "claudeHome",
@@ -44443,7 +44556,7 @@ var CONFIG_KEYS = [
   "aiEnv"
 ];
 function configPath(profileDir2) {
-  return join29(profileDir2, "config.json");
+  return join28(profileDir2, "config.json");
 }
 function parseConfigAssignment(key, valueTokens) {
   const value = valueTokens.join(" ").trim();
@@ -44493,7 +44606,7 @@ function runConfig(ctx) {
       ctx.print(`\u2714 ${verb} default config: ${path}`);
       ctx.print("add claude profiles: /config set claudeHome .claude .claude-1 (tried in order)");
     };
-    if (existsSync14(path)) {
+    if (existsSync15(path)) {
       ctx.confirm(
         `config exists: ${path} \u2014 replace it with defaults? (y/N)`,
         () => writeDefaults("replaced with")
@@ -44578,7 +44691,7 @@ function runOutput(ctx) {
 }
 function runLogs(ctx) {
   const n = Math.max(1, Math.min(200, Number(ctx.args[0]) || 20));
-  const dir2 = join29(ctx.info.profileDir, "logs");
+  const dir2 = join28(ctx.info.profileDir, "logs");
   const lines = readRecentLogLines(dir2, n);
   if (lines.length === 0) {
     ctx.print("No log lines yet.");
@@ -45099,7 +45212,7 @@ async function runStart(profileDir2, profileName) {
     return;
   }
   logger.configure({
-    dir: join30(profileDir2, "logs"),
+    dir: join29(profileDir2, "logs"),
     level: resolveLogLevel(),
     base: { version: CLI_VERSION, profile: profileName, scope: credential.scope }
   });
@@ -45205,13 +45318,13 @@ async function runStart(profileDir2, profileName) {
 }
 
 // src/commands/attach.ts
-import { join as join31 } from "path";
+import { join as join30 } from "path";
 
 // src/core/control-client.ts
-import { connect } from "net";
+import { connect as connect2 } from "net";
 function connectControl(socketPath, bus) {
   return new Promise((resolve8, reject) => {
-    const socket = connect(socketPath);
+    const socket = connect2(socketPath);
     socket.setEncoding("utf8");
     let ready = false;
     const forwardSubmit = bus.onLocalSubmit((input) => {
@@ -45304,7 +45417,7 @@ async function runAttach(profileDir2, profileName) {
     process.exitCode = 1;
     return;
   }
-  const socketPath = join31(profileDir2, CONTROL_SOCKET_FILE);
+  const socketPath = join30(profileDir2, CONTROL_SOCKET_FILE);
   const bus = new SessionBus();
   let conn;
   try {
@@ -45389,7 +45502,7 @@ Tip: for the credentials to survive \`docker rm\`/recreate, keep each profile pa
 }
 
 // src/commands/unlink.ts
-import { rmSync as rmSync8 } from "fs";
+import { rmSync as rmSync7 } from "fs";
 async function runUnlink(profileDir2, profileName) {
   const cred = readCredential(profileDir2, profileName);
   if (!cred) {
@@ -45404,7 +45517,7 @@ async function runUnlink(profileDir2, profileName) {
       `\u26A0 Could not reach the server to revoke \u2014 revoke it at web /machines. (${err.message})`
     );
   }
-  rmSync8(profileDir2, { recursive: true, force: true });
+  rmSync7(profileDir2, { recursive: true, force: true });
   clearDefaultProfileIf(profileName);
   console.log("\u2714 Deleted the profile and its physic project folder.");
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@4pm/cli",
-  "version": "1.4.2",
+  "version": "1.4.4",
   "private": false,
   "description": "4PM CLI — drives Claude/Codex CLIs on AI worker machines (Node + TypeScript)",
   "license": "LicenseRef-4PM-Source-Available",