@agent-native/core 0.47.1 → 0.48.1

package/dist/cli/code-agent-connector.d.ts

@@ -1,17 +0,0 @@
-export interface RemoteCodeAgentDeviceConfig {
-    token: string;
-    relayUrl?: string;
-    deviceId?: string;
-    deviceName?: string;
-    pollIntervalMs?: number;
-}
-export interface RunCodeAgentConnectorOptions {
-    relayUrl?: string;
-    output?: NodeJS.WritableStream;
-    signal?: AbortSignal;
-    once?: boolean;
-}
-export declare function remoteDeviceConfigPath(): string;
-export declare function loadRemoteCodeAgentDeviceConfig(configPath?: string): RemoteCodeAgentDeviceConfig | null;
-export declare function runCodeAgentConnector(options?: RunCodeAgentConnectorOptions): Promise<number>;
-//# sourceMappingURL=code-agent-connector.d.ts.map

package/dist/cli/code-agent-connector.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"code-agent-connector.d.ts","sourceRoot":"","sources":["../../src/cli/code-agent-connector.ts"],"names":[],"mappings":"AAqBA,MAAM,WAAW,2BAA2B;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IAC/B,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AA6BD,wBAAgB,sBAAsB,IAAI,MAAM,CAK/C;AAED,wBAAgB,+BAA+B,CAC7C,UAAU,SAA2B,GACpC,2BAA2B,GAAG,IAAI,CA0BpC;AAED,wBAAsB,qBAAqB,CACzC,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,MAAM,CAAC,CAmCjB"}

package/dist/cli/code.d.ts

@@ -1,66 +0,0 @@
-import { type CodeAgentFollowUpMode, type CodeAgentPermissionMode } from "./code-agent-runs.js";
-export type CodeAgentGoalId = "task" | "migrate" | "audit";
-export interface CodeAgentCliGoal {
-    id: CodeAgentGoalId;
-    slashCommand: string;
-    aliases: string[];
-    summary: string;
-    backingCommand: "task" | "migrate" | "audit-agent-web";
-}
-export type CodeCliCommand = {
-    kind: "shell";
-} | {
-    kind: "help";
-} | {
-    kind: "list-goals";
-} | {
-    kind: "serve";
-    relayUrl?: string;
-} | {
-    kind: "execute-existing-run";
-    runId: string;
-} | {
-    kind: "control";
-    subcommand: CodeAgentControlSubcommand;
-    args: string[];
-} | {
-    kind: "record-follow-up";
-    prompt: string;
-    runId?: string;
-    permissionMode?: CodeAgentPermissionMode;
-    followUpMode?: CodeAgentFollowUpMode;
-} | {
-    kind: "run-project-command";
-    commandName: string;
-    forwardedArgs: string[];
-} | {
-    kind: "run-goal";
-    goalId: CodeAgentGoalId;
-    forwardedArgs: string[];
-};
-export declare const CODE_AGENT_CLI_GOALS: CodeAgentCliGoal[];
-type CodeAgentControlSubcommand = "approve" | "attach" | "list" | "logs" | "ps" | "resume" | "status" | "stop" | "ui";
-export interface CodeShellOptions {
-    input?: NodeJS.ReadableStream;
-    output?: NodeJS.WritableStream;
-    runGoal?: CodeGoalRunner;
-}
-type CodeGoalRunner = (goalId: CodeAgentGoalId, forwardedArgs: string[], output?: NodeJS.WritableStream) => Promise<void>;
-type CodeShellLineResult = "continue" | "exit";
-export declare function resolveCodeCommand(argv: string[]): CodeCliCommand;
-export declare function runCode(argv: string[], options?: CodeShellOptions): Promise<void>;
-export declare function runCodeShell(options?: CodeShellOptions): Promise<void>;
-export declare function handleCodeShellLine(line: string, options: Required<Pick<CodeShellOptions, "output" | "runGoal">>): Promise<CodeShellLineResult>;
-export declare function codeUsage(): string;
-export declare function codeShellIntro(): string;
-export declare function codeShellHelp(): string;
-export declare function codeShellFreeTextMessage(): string;
-export declare function parseCodeShellArgs(line: string): {
-    ok: true;
-    args: string[];
-} | {
-    ok: false;
-    error: string;
-};
-export {};
-//# sourceMappingURL=code.d.ts.map

package/dist/cli/code.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"code.d.ts","sourceRoot":"","sources":["../../src/cli/code.ts"],"names":[],"mappings":"AAKA,OAAO,EAYL,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,EAG7B,MAAM,sBAAsB,CAAC;AAc9B,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC;AAE3D,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,eAAe,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,GAAG,SAAS,GAAG,iBAAiB,CAAC;CACxD;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GACjB;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,IAAI,EAAE,YAAY,CAAA;CAAE,GACtB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,sBAAsB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,UAAU,EAAE,0BAA0B,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,GAC3E;IACE,IAAI,EAAE,kBAAkB,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,uBAAuB,CAAC;IACzC,YAAY,CAAC,EAAE,qBAAqB,CAAC;CACtC,GACD;IACE,IAAI,EAAE,qBAAqB,CAAC;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB,GACD;IACE,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,eAAe,CAAC;IACxB,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB,CAAC;AAEN,eAAO,MAAM,oBAAoB,EAAE,gBAAgB,EAyBlD,CAAC;AAEF,KAAK,0BAA0B,GAC3B,SAAS,GACT,QAAQ,GACR,MAAM,GACN,MAAM,GACN,IAAI,GACJ,QAAQ,GACR,QAAQ,GACR,MAAM,GACN,IAAI,CAAC;AAgBT,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IAC/B,OAAO,CAAC,EAAE,cAAc,CAAC;CAC1B;AAED,KAAK,cAAc,GAAG,CACpB,MAAM,EAAE,eAAe,EACvB,aAAa,EAAE,MAAM,EAAE,EACvB,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,KAC3B,OAAO,CAAC,IAAI,CAAC,CAAC;AAEnB,KAAK,mBAAmB,GAAG,UAAU,GAAG,MAAM,CAAC;AAkB/C,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,cAAc,CAiHjE;AAED,wBAAsB,OAAO,CAC3B,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,IAAI,CAAC,CA6Df;AAED,wBAAsB,YAAY,CAChC,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,IAAI,CAAC,CAwBf;AAED,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,GAAG,SAAS,CAAC,CAAC,GAC9D,OAAO,CAAC,mBAAmB,CAAC,CA+G9B;AAED,wBAAgB,SAAS,IAAI,MAAM,CA0DlC;AAED,wBAAgB,cAAc,IAAI,MAAM,CAQvC;AAED,wBAAgB,aAAa,IAAI,MAAM,CA4BtC;AAED,wBAAgB,wBAAwB,IAAI,MAAM,CAGjD;AAED,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,GACX;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAgE7D"}

package/dist/cli/connect.d.ts

@@ -1,140 +0,0 @@
-/**
- * `agent-native connect <url>` — wire your local Claude Code / Codex / Cowork
- * to a DEPLOYED agent-native app. OAuth-capable clients receive a standard
- * remote MCP URL entry and authenticate in the host. Fallback clients use the
- * browser device-code flow: open the verification URL, approve in the browser,
- * and the minted HTTP MCP server entry is written idempotently.
- *
- *   agent-native connect <url> [--client all|claude-code|claude-code-cli|
- *                               codex|cowork] [--scope user|project]
- *                               [--name <serverName>]
- *   agent-native reconnect [<url>] [--client ...] [--name <serverName>]
- *   agent-native connect <url> --token <token>   (no-browser fallback)
- *   agent-native connect        [--client ...]   (pick first-party apps)
- *   agent-native connect --all  [--client ...]   (separate first-party app MCP resources)
- *
- * Server contract (implemented by another agent on `<url>`):
- *   POST <url>/_agent-native/mcp/connect/device/start  (no auth)
- *     body { client?, app? }
- *     → { device_code, user_code, verification_uri,
- *         verification_uri_complete, interval, expires_in }
- *   POST <url>/_agent-native/mcp/connect/device/poll   (no auth)
- *     body { device_code }
- *     → { status: "pending" }
- *     | { status: "approved", token, mcpUrl, serverName, mcpServerEntry }
- *     | { status: "expired" }
- *     | { status: "consumed" }
- *     | { status: "error" | "not_found", message? }
- *
- * Node-only CLI module. Uses Node built-ins, @clack/prompts, and global fetch.
- */
-import { ClientId } from "./mcp-config-writers.js";
-export interface ParsedConnectArgs {
-    /** Developer profile switch: local dev gateway or saved production config. */
-    mode?: "dev" | "prod" | "reauth" | "reconnect";
-    /** Positional URL (the deployed app origin). Undefined for `--all`. */
-    url?: string;
-    /** all | claude-code | claude-code-cli | codex | cowork (default "all"). */
-    client: string;
-    /** True when the user passed --client explicitly, so we skip the picker. */
-    clientExplicit: boolean;
-    /** user | project (default "user"). */
-    scope: string;
-    /** Override the minted MCP server name. */
-    name?: string;
-    /** No-browser fallback: skip device flow, use this token directly. */
-    token?: string;
-    /** Connect every first-party hosted app. */
-    all: boolean;
-    /** Comma-separated app names for profile switching. */
-    apps?: string;
-    /** Local dev-lazy gateway URL for `connect dev`. */
-    gateway?: string;
-    /** Shorthand for a local dev-lazy gateway port. */
-    port?: number;
-    /** Local owner email override for dev entries. */
-    ownerEmail?: string;
-}
-export declare function parseConnectArgs(argv: string[]): ParsedConnectArgs;
-/**
- * Normalize a user-supplied app URL: trim, require http/https, strip the
- * trailing slash. Throws a friendly Error otherwise.
- */
-export declare function normalizeUrl(raw: string): string;
-/** Resolve the requested clients list. "all" → every supported client. */
-export declare function resolveClients(client: string): ClientId[];
-export declare function connectPreferencesPath(): string;
-export declare function readConnectClientPreferences(file?: string): ClientId[] | null;
-export declare function writeConnectClientPreferences(clients: ClientId[], file?: string): void;
-export interface ConnectClientPromptContext {
-    initialClients: ClientId[];
-    options: {
-        value: ClientId;
-        label: string;
-        hint: string;
-    }[];
-    preferencesFile: string;
-}
-export interface HostedApp {
-    name: string;
-    label: string;
-    url: string;
-}
-export interface ConnectHostedAppsPromptContext {
-    apps: HostedApp[];
-    initialApps: string[];
-}
-export declare function supportsRemoteMcpOAuth(client: ClientId): boolean;
-/** Injectable hooks so the poll state machine is unit-testable. */
-export interface ConnectDeps {
-    /** Defaults to global fetch. */
-    fetchImpl?: typeof fetch;
-    /** Sleep between polls (ms). Defaults to real setTimeout. */
-    sleep?: (ms: number) => Promise<void>;
-    /** Open the verification URL. Defaults to the platform browser opener. */
-    openBrowser?: (url: string) => void;
-    /** Override "now" for the expiry cap (ms epoch). Defaults to Date.now. */
-    now?: () => number;
-    /** Tests/embedders can force or suppress the interactive client picker. */
-    isInteractive?: () => boolean;
-    /** Injectable client picker. Defaults to @clack/prompts multiselect. */
-    promptClients?: (context: ConnectClientPromptContext) => Promise<ClientId[] | null>;
-    /** Injectable hosted app picker. Defaults to @clack/prompts multiselect. */
-    promptHostedApps?: (context: ConnectHostedAppsPromptContext) => Promise<string[] | null>;
-    /** Override the persisted connect preferences file. */
-    preferencesFile?: string;
-    /** Override the saved dev/prod profile file. */
-    profilesFile?: string;
-}
-/**
- * Run the device-code flow against `baseUrl` and return the approved grant.
- * Resolves with `null` (and prints a clear message) on expired/consumed or
- * other terminal failure — the caller maps that to a non-zero exit.
- */
-export declare function runDeviceFlow(baseUrl: string, appSlug: string, clientArg: string, deps?: ConnectDeps): Promise<{
-    token?: string;
-    mcpUrl: string;
-    serverName: string;
-    headers?: Record<string, string>;
-} | null>;
-/**
- * Write the HTTP MCP entry into every requested client config idempotently.
- * Returns the list of files written so the caller can print them.
- */
-export declare function writeConfigs(clients: ClientId[], serverName: string, mcpUrl: string, token: string | undefined, scope: string, baseDir?: string, headers?: Record<string, string>): {
-    client: ClientId;
-    file: string;
-}[];
-export declare function connectProfilesPath(): string;
-/** Hosted first-party apps: visible (non-hidden) templates with a prodUrl. */
-export declare function hostedApps(): HostedApp[];
-/**
- * `agent-native connect` entry point. `deps` is injectable for tests; the
- * dispatcher in index.ts calls it with just `args`.
- *
- * Sets `process.exitCode = 1` on failure (so the process exits non-zero
- * once the event loop drains) rather than calling `process.exit`, keeping
- * the function testable — same pattern as `audit-agent-web`.
- */
-export declare function runConnect(args: string[], deps?: ConnectDeps): Promise<void>;
-//# sourceMappingURL=connect.d.ts.map

package/dist/cli/connect.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"connect.d.ts","sourceRoot":"","sources":["../../src/cli/connect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAQH,OAAO,EAEL,QAAQ,EAKT,MAAM,yBAAyB,CAAC;AA8CjC,MAAM,WAAW,iBAAiB;IAChC,8EAA8E;IAC9E,IAAI,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,QAAQ,GAAG,WAAW,CAAC;IAC/C,uEAAuE;IACvE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,cAAc,EAAE,OAAO,CAAC;IACxB,uCAAuC;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,2CAA2C;IAC3C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,sEAAsE;IACtE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4CAA4C;IAC5C,GAAG,EAAE,OAAO,CAAC;IACb,uDAAuD;IACvD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mDAAmD;IACnD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kDAAkD;IAClD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,iBAAiB,CAqClE;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAmChD;AAED,0EAA0E;AAC1E,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,QAAQ,EAAE,CAWzD;AAED,wBAAgB,sBAAsB,IAAI,MAAM,CAE/C;AAkBD,wBAAgB,4BAA4B,CAC1C,IAAI,GAAE,MAAiC,GACtC,QAAQ,EAAE,GAAG,IAAI,CAUnB;AAED,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,QAAQ,EAAE,EACnB,IAAI,GAAE,MAAiC,GACtC,IAAI,CAiBN;AAED,MAAM,WAAW,0BAA0B;IACzC,cAAc,EAAE,QAAQ,EAAE,CAAC;IAC3B,OAAO,EAAE;QAAE,KAAK,EAAE,QAAQ,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC5D,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,8BAA8B;IAC7C,IAAI,EAAE,SAAS,EAAE,CAAC;IAClB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AA0ID,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,QAAQ,GAAG,OAAO,CAEhE;AAiFD,mEAAmE;AACnE,MAAM,WAAW,WAAW;IAC1B,gCAAgC;IAChC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,6DAA6D;IAC7D,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,0EAA0E;IAC1E,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,0EAA0E;IAC1E,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,2EAA2E;IAC3E,aAAa,CAAC,EAAE,MAAM,OAAO,CAAC;IAC9B,wEAAwE;IACxE,aAAa,CAAC,EAAE,CACd,OAAO,EAAE,0BAA0B,KAChC,OAAO,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,CAAC;IAChC,4EAA4E;IAC5E,gBAAgB,CAAC,EAAE,CACjB,OAAO,EAAE,8BAA8B,KACpC,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC;IAC9B,uDAAuD;IACvD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gDAAgD;IAChD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAgHD;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE,WAAgB,GACrB,OAAO,CAAC;IACT,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC,GAAG,IAAI,CAAC,CAqHR;AAWD;;;GAGG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,QAAQ,EAAE,EACnB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,MAAyB,EAClC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,CAetC;AAiCD,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C;AA49BD,8EAA8E;AAC9E,wBAAgB,UAAU,IAAI,SAAS,EAAE,CAQxC;AAmGD;;;;;;;GAOG;AACH,wBAAsB,UAAU,CAC9B,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,GAAE,WAAgB,GACrB,OAAO,CAAC,IAAI,CAAC,CAwDf"}

package/dist/cli/context-xray-local.d.ts

@@ -1,16 +0,0 @@
-import type { ClientId } from "./mcp-config-writers.js";
-export interface InstallLocalContextXrayOptions {
-    baseDir?: string;
-    clients: ClientId[];
-    scope: string;
-    dryRun?: boolean;
-}
-export interface InstallLocalContextXrayResult {
-    commands: string[];
-    scriptPath: string;
-    written: string[];
-}
-export declare const CONTEXT_XRAY_SKILL_MD = "---\nname: context-xray\ndescription: >-\n  Visualize local Codex and Claude Code context usage, open an inline/browser\n  report, flag warnings, and suggest prompt/tooling optimizations. Use when the\n  user types /context-xray, asks where context is going, wants recent local\n  coding-agent trends, or wants to improve context efficiency.\nmetadata:\n  visibility: exported\n---\n\n# Context X-Ray\n\nUse the locally installed Context X-Ray command to visualize recent Codex and\nClaude Code context usage. It reads local transcript files only and does not\nupload transcript content.\n\nProject-scoped installs write only project `.agents` skill and command\nartifacts; user-scoped installs write global Codex/Claude instructions.\n\n## Run\n\nCurrent or most recent local thread:\n\n```sh\n~/.agent-native/context-xray/context-xray --open\n```\n\nThread picker / recent sessions:\n\n```sh\n~/.agent-native/context-xray/context-xray threads --open\n```\n\nWeekly trends:\n\n```sh\n~/.agent-native/context-xray/context-xray trends --since 7d --open\n```\n\nExact session when the host exposes one:\n\n```sh\n~/.agent-native/context-xray/context-xray --session-id \"$CLAUDE_CODE_SESSION_ID\" --open\n```\n\nAfter running, report the link, the number of sessions analyzed, the largest\ncontext buckets, and 3-5 specific optimizations.\n`--open` opens the generated local HTML file directly and does not keep a\nbackground report server running.\n\n## Interpret\n\n- Treat the Overview score as a triage signal, then open Findings for evidence.\n- Repeated file reads: ask the agent to keep a short file-role note and reopen\n  only when exact line numbers are needed.\n- Retry loops or failed tool loops: ask the agent to stop after two identical\n  failures, summarize the error, and change strategy before rerunning.\n- Exploration heavy: give an inspection budget, then ask for a short\n  implementation plan before more reading.\n- Cache churn or context growth: move stable instructions into skills or repo\n  docs and continue large work from a compact handoff summary.\n- Tool output heavy: ask the agent to cap command output, summarize failures,\n  and only expand logs when exact lines matter.\n- Metadata heavy: use Metadata/Sources drilldowns for protocol overhead, but\n  prioritize prompt changes around user/tool/output buckets first.\n";
-export declare const CONTEXT_XRAY_COMMAND_MD = "---\ndescription: Visualize local Codex/Claude context usage and get optimization tips.\nargument-hint: [current|threads|trends|--since 7d]\n---\n\nRun Context X-Ray locally and show the user the generated report link plus the\ntop warnings.\n\nChoose the command from the user's arguments:\n\n- No arguments or `current`:\n  `~/.agent-native/context-xray/context-xray --open`\n- `threads`:\n  `~/.agent-native/context-xray/context-xray threads --open`\n- `trends`:\n  `~/.agent-native/context-xray/context-xray trends --since 7d --open`\n\nIf `$ARGUMENTS` includes flags such as `--since 24h`, `--last 20`, or\n`--all-projects`, pass them through to the command. If the host exposes\n`CLAUDE_CODE_SESSION_ID`, prefer:\n\n```sh\n~/.agent-native/context-xray/context-xray --session-id \"$CLAUDE_CODE_SESSION_ID\" --open\n```\n\n`--open` opens a local HTML report file directly; there should not be a\nlong-running server process to monitor.\n\nAfter the command finishes, summarize:\n\n- the report link\n- sessions analyzed\n- the health score and most important finding\n- one concrete evidence point\n- two or three promptable ways to improve this thread\n";
-export declare function installLocalContextXray(options: InstallLocalContextXrayOptions): InstallLocalContextXrayResult;
-//# sourceMappingURL=context-xray-local.d.ts.map

package/dist/cli/context-xray-local.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"context-xray-local.d.ts","sourceRoot":"","sources":["../../src/cli/context-xray-local.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAExD,MAAM,WAAW,8BAA8B;IAC7C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,QAAQ,EAAE,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAk7DD,eAAO,MAAM,qBAAqB,qzEAkEjC,CAAC;AAEF,eAAO,MAAM,uBAAuB,2oCAmCnC,CAAC;AA+BF,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,8BAA8B,GACtC,6BAA6B,CAqE/B"}

package/dist/cli/create-workspace.d.ts

@@ -1,8 +0,0 @@
-export interface CreateWorkspaceOptions {
-    name?: string;
-    /** Pre-select these templates in the picker. */
-    template?: string;
-    noInstall?: boolean;
-}
-export declare function createWorkspace(opts?: CreateWorkspaceOptions): Promise<void>;
-//# sourceMappingURL=create-workspace.d.ts.map

package/dist/cli/create-workspace.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"create-workspace.d.ts","sourceRoot":"","sources":["../../src/cli/create-workspace.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,sBAAsB;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gDAAgD;IAChD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,wBAAsB,eAAe,CACnC,IAAI,GAAE,sBAA2B,GAChC,OAAO,CAAC,IAAI,CAAC,CAMf"}

package/dist/cli/index.d.ts

@@ -1,3 +0,0 @@
-#!/usr/bin/env node
-export {};
-//# sourceMappingURL=index.d.ts.map

package/dist/cli/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":""}

package/dist/cli/info.d.ts

@@ -1,2 +0,0 @@
-export declare function runInfo(pkgName?: string): void;
-//# sourceMappingURL=info.d.ts.map

package/dist/cli/info.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"info.d.ts","sourceRoot":"","sources":["../../src/cli/info.ts"],"names":[],"mappings":"AAUA,wBAAgB,OAAO,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAmE9C"}

package/dist/cli/mcp-config-writers.d.ts

@@ -1,82 +0,0 @@
-/**
- * Shared MCP client-config writers.
- *
- * Extracted so both `agent-native mcp install` (see `mcp.ts`) and
- * `agent-native connect` (see `connect.ts`) write the EXACT same on-disk
- * config file targets and formats for every supported client. `mcp.ts`
- * intentionally keeps its own hand-rolled copies of these writers (its
- * external behavior is unchanged); new code should import from here so the
- * formats never diverge.
- *
- * Supported clients and their config files:
- *   - claude-code / claude-code-cli → `.mcp.json` (project) or
- *     `~/.claude.json` (user). JSON `mcpServers[name] = entry`.
- *   - cowork                        → `~/.cowork/mcp.json`. Same JSON shape.
- *   - codex                         → `$CODEX_HOME/config.toml` when set,
- *     otherwise `~/.codex/config.toml`.
- *     `[mcp_servers.<name>]` block.
- *
- * Node-only. No new npm deps — hand-rolled JSON merge + minimal TOML block
- * merge, mirroring `mcp.ts`.
- */
-export type ClientId = "claude-code" | "claude-code-cli" | "codex" | "cowork";
-export declare const CLIENTS: ClientId[];
-/** The HTTP MCP server entry written into a JSON client config. */
-export interface HttpMcpEntry {
-    type: "http";
-    url: string;
-    headers?: Record<string, string>;
-}
-/** Build the HTTP MCP server entry for a deployed agent-native app. */
-export declare function buildHttpMcpEntry(mcpUrl: string, token?: string, headers?: Record<string, string>): HttpMcpEntry;
-/**
- * Cowork consumes MCP exactly like Claude Code (same JSON server-entry
- * shape). Resolved lazily so `os.homedir()` reflects the current `$HOME`.
- */
-export declare function coworkConfigPath(): string;
-export declare function claudeCodeProjectConfig(baseDir: string): string;
-export declare function claudeCodeUserConfig(): string;
-export declare function codexConfigPath(): string;
-/**
- * Resolve the on-disk config path for a client.
- *
- * `scope` only affects Claude Code / Claude Code CLI: `"user"` → the global
- * `~/.claude.json`, anything else → the project-local `.mcp.json` rooted at
- * `baseDir`.
- */
-export declare function configPathFor(client: ClientId, baseDir: string, scope: string | undefined): string;
-/**
- * Write `data` to `file` atomically: write a sibling temp file, then rename it
- * over the target. `rename(2)` is atomic on the same filesystem, so a crash or
- * `kill` mid-write can never leave a half-written/truncated file. This matters
- * most for `~/.claude.json`, which is Claude Code's entire user state (projects,
- * history, auth) — a torn write there would corrupt the user's whole config,
- * not just our MCP entry. The temp file lives in the target's directory so the
- * rename stays within one filesystem.
- */
-export declare function writeFileAtomic(file: string, data: string): void;
-/**
- * Idempotently write `mcpServers[name] = entry` into a JSON config file.
- * Pass `entry === null` to delete the named entry. Re-running with the same
- * name replaces the existing entry in place — never duplicates.
- */
-export declare function writeJsonMcpEntry(file: string, name: string, entry: Record<string, unknown> | null): void;
-export declare function hasJsonMcpEntry(file: string, name: string): boolean;
-/** Build a `[mcp_servers.<name>]` block for an HTTP-type MCP server. */
-export declare function buildCodexHttpBlock(name: string, mcpUrl: string, token?: string, headers?: Record<string, string>): string;
-/**
- * Replace (or append) the `[mcp_servers.<name>]` block in a TOML file
- * without disturbing other content. A block is the header line plus every
- * following line until the next top-level `[` table header or EOF. Pass
- * `block === null` to remove the block. Identical algorithm to `mcp.ts`'s
- * `writeCodexBlock` so the two never diverge.
- */
-export declare function writeCodexBlock(file: string, name: string, block: string | null): void;
-export declare function codexHasBlock(file: string, name: string): boolean;
-/**
- * Idempotently write the HTTP MCP server entry for `serverName` into the
- * given client's config file and return the file path that was written.
- * Re-running replaces the same named entry — never duplicates.
- */
-export declare function writeHttpEntryForClient(client: ClientId, serverName: string, mcpUrl: string, token: string | undefined, baseDir: string, scope: string | undefined, headers?: Record<string, string>): string;
-//# sourceMappingURL=mcp-config-writers.d.ts.map

package/dist/cli/mcp-config-writers.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"mcp-config-writers.d.ts","sourceRoot":"","sources":["../../src/cli/mcp-config-writers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAMH,MAAM,MAAM,QAAQ,GAAG,aAAa,GAAG,iBAAiB,GAAG,OAAO,GAAG,QAAQ,CAAC;AAE9E,eAAO,MAAM,OAAO,EAAE,QAAQ,EAK7B,CAAC;AAEF,mEAAmE;AACnE,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED,uEAAuE;AACvE,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,EACd,KAAK,CAAC,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,YAAY,CAUd;AAMD;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED,wBAAgB,eAAe,IAAI,MAAM,CAIxC;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,QAAQ,EAChB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,MAAM,CAYR;AAmCD;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAuBhE;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GACpC,IAAI,CAWN;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAGnE;AAkBD,wEAAwE;AACxE,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,KAAK,CAAC,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,MAAM,CAgBR;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GAAG,IAAI,GACnB,IAAI,CA0CN;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAYjE;AAMD;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,QAAQ,EAChB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,MAAM,CAmBR"}

package/dist/cli/mcp.d.ts

@@ -1,16 +0,0 @@
-/**
- * `agent-native mcp <subcommand>` — connect external coding agents (Claude
- * Code desktop & CLI, Claude Cowork, Codex) to this agent-native app/workspace
- * over MCP.
- *
- *   serve      Run the MCP stdio transport (this is what client configs spawn).
- *   install    Provision a token + write the client's MCP config idempotently.
- *   uninstall  Remove the named entry from a client's MCP config.
- *   status     Print resolved MCP URL/port, token state, and per-client entries.
- *   token      Print or rotate the local ACCESS_TOKEN in the workspace .env.
- *
- * Node-only CLI module. Hand-rolled `.env` upsert + minimal TOML block merge
- * keep this dependency-free (no new npm deps).
- */
-export declare function runMcp(args: string[]): Promise<void>;
-//# sourceMappingURL=mcp.d.ts.map

package/dist/cli/mcp.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../../src/cli/mcp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAypBH,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA+B1D"}

package/dist/cli/migrate.d.ts

@@ -1,38 +0,0 @@
-type MigrateSubcommand = "resume" | "status" | "stop" | "ui";
-type SourceKind = "path" | "url" | "description";
-export interface MigrateCliOptions {
-    subcommand?: MigrateSubcommand;
-    source?: string;
-    sourcePath?: string;
-    sourceUrl?: string;
-    sourceDescription?: string;
-    workbench?: string;
-    output?: string;
-    appName?: string;
-    target?: string;
-    planOnly?: boolean;
-    planFile?: string;
-    emit?: boolean;
-    emitDir?: string;
-    appSurface?: boolean;
-    last?: boolean;
-    help?: boolean;
-}
-export interface SourceSpec {
-    kind: SourceKind;
-    value: string;
-    sourceRoot?: string;
-    description?: string;
-}
-export interface EmitDossierResult {
-    dossierRoot: string;
-    files: string[];
-    source: SourceSpec;
-    usedMigrateHelpers: boolean;
-}
-export declare function parseMigrateArgs(argv: string[]): MigrateCliOptions;
-export declare function runMigrate(argv: string[]): Promise<void>;
-export declare function emitOwnAgentDossier(opts: MigrateCliOptions, cwd?: string): Promise<EmitDossierResult>;
-export declare function isExpectedMigrationCliError(error: unknown): boolean;
-export {};
-//# sourceMappingURL=migrate.d.ts.map

package/dist/cli/migrate.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"migrate.d.ts","sourceRoot":"","sources":["../../src/cli/migrate.ts"],"names":[],"mappings":"AAkCA,KAAK,iBAAiB,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,IAAI,CAAC;AAC7D,KAAK,UAAU,GAAG,MAAM,GAAG,KAAK,GAAG,aAAa,CAAC;AAEjD,MAAM,WAAW,iBAAiB;IAChC,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,UAAU,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,UAAU,CAAC;IACnB,kBAAkB,EAAE,OAAO,CAAC;CAC7B;AA2DD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,iBAAiB,CAoFlE;AAED,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAmD9D;AAED,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,iBAAiB,EACvB,GAAG,SAAgB,GAClB,OAAO,CAAC,iBAAiB,CAAC,CAsF5B;AAED,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAQnE"}

package/dist/cli/plan-local.d.ts

@@ -1,43 +0,0 @@
-/**
- * DB-free local plan helpers.
- *
- * These commands are intentionally separate from the Plan app actions. They do
- * not call MCP, HTTP, SQLite, or the Plan template runtime; they only read and
- * write local files so privacy-focused users have an auditable no-DB path.
- */
-type LocalPlanKind = "plan" | "recap";
-type LocalPlanFiles = {
-    dir: string;
-    planMdx: string;
-    canvasMdx?: string;
-    prototypeMdx?: string;
-    stateJson?: string;
-};
-type LocalPlanPreviewInput = {
-    dir: string;
-    kind?: LocalPlanKind;
-    title?: string;
-    brief?: string;
-};
-type LocalPlanPreviewResult = {
-    ok: true;
-    dir: string;
-    out: string;
-    url: string;
-    title: string;
-    kind: LocalPlanKind;
-    files: string[];
-};
-export declare function localPlanFolderName(title: string): string;
-export declare function readLocalPlanFiles(dir: string): LocalPlanFiles;
-export declare function buildLocalPlanPreviewHtml(input: LocalPlanPreviewInput): string;
-export declare function writeLocalPlanPreview(input: {
-    dir: string;
-    out?: string;
-    kind?: LocalPlanKind;
-    title?: string;
-    brief?: string;
-}): LocalPlanPreviewResult;
-export declare function runPlan(argv: string[]): Promise<void>;
-export {};
-//# sourceMappingURL=plan-local.d.ts.map

package/dist/cli/plan-local.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"plan-local.d.ts","sourceRoot":"","sources":["../../src/cli/plan-local.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,KAAK,aAAa,GAAG,MAAM,GAAG,OAAO,CAAC;AAEtC,KAAK,cAAc,GAAG;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,KAAK,qBAAqB,GAAG;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,KAAK,sBAAsB,GAAG;IAC5B,EAAE,EAAE,IAAI,CAAC;IACT,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,aAAa,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB,CAAC;AAyCF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAUzD;AA8KD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,CAiB9D;AAED,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,qBAAqB,GAC3B,MAAM,CA2GR;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,sBAAsB,CA2BzB;AAkID,wBAAsB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA0C3D"}

package/dist/cli/plan-publish-store.d.ts

@@ -1,62 +0,0 @@
-/**
- * Canonical publish-token store for the local Plans server.
- *
- * `agent-native connect <hosted-url>` mints a bearer token and writes it into
- * each coding agent's per-client MCP config (`.mcp.json` / Codex `config.toml`
- * via `mcp-config-writers`). Those files are client-specific, so the local Plans
- * server cannot read them for a server-to-server publish.
- *
- * To close that seam, the connect flow ALSO writes a single canonical record to
- * `~/.agent-native/plan-publish.json` whenever it authenticates a first-party
- * Plans app. The local server's `publish-visual-plan` action reads the exact
- * same file (see `templates/plan/server/lib/plan-publish.ts`):
- *
- *   { "url": "https://plan.agent-native.com", "token": "<bearer>" }
- *
- * This mirrors the existing device-token precedent in
- * `code-agent-connector.ts` (`~/.agent-native/remote-device.json`): home-dir
- * JSON, env-overridable path, atomic 0600 write. The write is additive — it
- * merges into any existing file rather than clobbering sibling keys — and
- * best-effort, since persisting MCP config is the primary contract and a failed
- * canonical write must never fail the connect.
- */
-/**
- * Absolute path to the canonical publish-token file. Honors
- * `PLAN_PUBLISH_CONFIG_PATH` so connect and the local server agree on the
- * location in tests and custom setups; defaults to
- * `~/.agent-native/plan-publish.json`.
- */
-export declare function planPublishConfigPath(): string;
-/**
- * Whether `url`'s host is the first-party Agent-Native Plans app whose token
- * we should mirror to the canonical publish file. Only the hosted Plans app
- * (`plan.agent-native.com`) qualifies — mirroring tokens for other
- * agent-native subdomains (assets, mail, …) would silently overwrite the
- * canonical Plans endpoint with the wrong URL+token each time `connect --all`
- * runs last-write-wins. A custom self-hosted origin (ngrok, localhost, a
- * private deployment) is intentionally excluded: the user can still point the
- * server at it via `PLAN_PUBLISH_URL` / `PLAN_PUBLISH_TOKEN` env vars.
- */
-export declare function isFirstPartyPlanHost(url: string): boolean;
-/**
- * Merge `{ url, token }` into the canonical publish file without clobbering any
- * other keys the file already holds. Best-effort: returns the written path on
- * success, or `null` if the write failed or the inputs were unusable.
- *
- * `filePath` is injectable for tests; production callers omit it and get the
- * env-overridable home-dir path.
- */
-export declare function writePlanPublishAuth(params: {
-    url: string;
-    token: string;
-}, filePath?: string): string | null;
-/**
- * Read the canonical Plans publish auth written by `agent-native connect`.
- * Returns `null` for missing/corrupt/incomplete files so callers can treat the
- * publish token as optional and guide the user to reconnect.
- */
-export declare function readPlanPublishAuth(filePath?: string): {
-    url: string;
-    token: string;
-} | null;
-//# sourceMappingURL=plan-publish-store.d.ts.map

package/dist/cli/plan-publish-store.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"plan-publish-store.d.ts","sourceRoot":"","sources":["../../src/cli/plan-publish-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AASH;;;;;GAKG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,CAK9C;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAOzD;AAMD;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EACtC,QAAQ,GAAE,MAAgC,GACzC,MAAM,GAAG,IAAI,CAmCf;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,GAAE,MAAgC,GACzC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAgBvC"}

package/dist/cli/pr-visual-recap-workflow.d.ts

@@ -1,11 +0,0 @@
-/**
- * Bundled copy of .github/workflows/pr-visual-recap.yml so the CLI can write the
- * PR Visual Recap workflow into a user repo via
- * `agent-native skills add visual-plan --with-github-action`.
- *
- * AUTO-GENERATED — keep byte-identical with the source workflow. A sync test in
- * recap.spec.ts fails if these drift. Regenerate from the YAML with the snippet
- * in recap.spec.ts.
- */
-export declare const PR_VISUAL_RECAP_WORKFLOW_YML = "name: PR Visual Recap\n\n# Visual code review: a coding agent runs the repo's visual-recap skill over the\n# PR diff, publishes a plan, and upserts one sticky comment with a screenshot.\n# Plain `pull_request` (NOT `pull_request_target`) so fork code never sees secrets.\n\non:\n  pull_request:\n    types: [opened, synchronize, reopened, ready_for_review]\n\npermissions:\n  contents: read\n\nconcurrency:\n  group: pr-visual-recap-${{ github.event.pull_request.number }}\n  cancel-in-progress: true\n\nenv:\n  VISUAL_RECAP_AGENT: ${{ vars.VISUAL_RECAP_AGENT || 'claude' }}\n  VISUAL_RECAP_SKILL_SOURCE: ${{ vars.VISUAL_RECAP_SKILL_SOURCE || 'auto' }}\n\njobs:\n  gate:\n    name: Gate\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    permissions:\n      contents: read\n      pull-requests: read\n    outputs:\n      run: ${{ steps.decide.outputs.run }}\n      agent: ${{ steps.decide.outputs.agent }}\n    steps:\n      - id: decide\n        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n        env:\n          # Presence-only signals \u2014 never expose secret VALUES to the gate.\n          HAS_PLAN: ${{ secrets.PLAN_RECAP_TOKEN != '' }}\n          HAS_ANTHROPIC: ${{ secrets.ANTHROPIC_API_KEY != '' }}\n          HAS_OPENAI: ${{ secrets.OPENAI_API_KEY != '' }}\n          AGENT: ${{ env.VISUAL_RECAP_AGENT }}\n          VISUAL_RECAP_MODEL: ${{ vars.VISUAL_RECAP_MODEL }}\n        with:\n          script: |\n            const pr = context.payload.pull_request;\n            const reasons = [];\n\n            if (!pr) reasons.push('no pull_request payload');\n            if (pr && pr.draft) reasons.push('draft PR');\n\n            // Fork PRs run with no secrets, so publishing would fail anyway \u2014 skip.\n            const headRepo = pr && pr.head && pr.head.repo && pr.head.repo.full_name;\n            if (pr && headRepo && headRepo !== process.env.GITHUB_REPOSITORY) {\n              reasons.push(`fork PR (${headRepo})`);\n            }\n\n            const login = (pr && pr.user && pr.user.login || '').toLowerCase();\n            const botAuthors = ['dependabot[bot]', 'dependabot', 'renovate[bot]', 'renovate'];\n            if (botAuthors.includes(login)) reasons.push(`bot author (${login})`);\n            if (pr && pr.user && pr.user.type === 'Bot') reasons.push('bot author (type=Bot)');\n\n            if (process.env.HAS_PLAN !== 'true') reasons.push('PLAN_RECAP_TOKEN not configured');\n\n            // Normalize + validate the agent so a mis-cased value can't pass the\n            // gate and then match neither agent step below.\n            const agent = (process.env.AGENT || 'claude').toLowerCase();\n            if (agent !== 'claude' && agent !== 'codex') {\n              reasons.push(`unsupported VISUAL_RECAP_AGENT \"${process.env.AGENT}\" (expected \"claude\" or \"codex\")`);\n            } else if (agent === 'codex') {\n              if (process.env.HAS_OPENAI !== 'true') reasons.push('OPENAI_API_KEY not configured (codex backend)');\n            } else {\n              if (process.env.HAS_ANTHROPIC !== 'true') reasons.push('ANTHROPIC_API_KEY not configured (claude backend)');\n            }\n\n            // Validate the model before it reaches the agent CLI.\n            const model = process.env.VISUAL_RECAP_MODEL || '';\n            if (model && !/^[a-zA-Z0-9._-]{1,80}$/.test(model)) {\n              reasons.push(`invalid VISUAL_RECAP_MODEL value (must match [a-zA-Z0-9._-]{1,80})`);\n            }\n\n            // Self-modifying guard, evaluated in the trusted gate (runs NO\n            // PR-checked-out code): skip the ENTIRE job if the PR touches the\n            // workflow, skill, local CLI, or any agent config the runner loads,\n            // so a PR can't rewrite what runs and exfiltrate secrets.\n            if (pr) {\n              try {\n                const files = await github.paginate(github.rest.pulls.listFiles, {\n                  owner: context.repo.owner,\n                  repo: context.repo.repo,\n                  pull_number: pr.number,\n                  per_page: 100,\n                });\n                const isAgentNativeMonorepo = context.repo.owner === 'BuilderIO' && context.repo.repo === 'agent-native';\n                const isSensitive = (p) =>\n                  p === '.github/workflows/pr-visual-recap.yml' ||\n                  /(^|\\/)skills\\/visual-(recap|plan|plans)\\//.test(p) ||\n                  /(^|\\/)\\.claude\\//.test(p) ||\n                  /(^|\\/)CLAUDE\\.md$/.test(p) ||\n                  /(^|\\/)AGENTS\\.md$/.test(p) ||\n                  /(^|\\/)\\.mcp\\.json$/.test(p) ||\n                  (isAgentNativeMonorepo && /(^|\\/)packages\\/core\\//.test(p));\n                const hits = files.map((f) => f.filename).filter(isSensitive);\n                if (hits.length) {\n                  reasons.push(`PR modifies recap-control files (${hits.slice(0, 3).join(', ')}${hits.length > 3 ? ', \u2026' : ''}) \u2014 skipping so untrusted PR code never runs with secrets`);\n                }\n              } catch (e) {\n                // Fail closed: if the file list can't be read, skip.\n                reasons.push(`could not list PR files for the self-modifying guard (${e.message}); skipping to be safe`);\n              }\n            }\n\n            const run = reasons.length === 0;\n            core.setOutput('run', run ? 'true' : 'false');\n            core.setOutput('agent', agent);\n            core.info(run ? `Visual recap will run (${agent}).` : `Visual recap skipped: ${reasons.join('; ')}`);\n\n  recap:\n    name: Generate visual recap\n    needs: gate\n    if: needs.gate.outputs.run == 'true'\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    permissions:\n      checks: write\n      contents: read\n      issues: write\n      pull-requests: write\n    env:\n      PLAN_RECAP_APP_URL: ${{ secrets.PLAN_RECAP_APP_URL || 'https://plan.agent-native.com' }}\n      PLAN_RECAP_TOKEN: ${{ secrets.PLAN_RECAP_TOKEN }}\n      GH_TOKEN: ${{ github.token }}\n      PR_NUMBER: ${{ github.event.pull_request.number }}\n      HEAD_SHA: ${{ github.event.pull_request.head.sha }}\n      VISUAL_RECAP_MODEL: ${{ vars.VISUAL_RECAP_MODEL }}\n      VISUAL_RECAP_REASONING: ${{ vars.VISUAL_RECAP_REASONING }}\n      VISUAL_RECAP_SKILL_SOURCE: ${{ vars.VISUAL_RECAP_SKILL_SOURCE || 'auto' }}\n    steps:\n      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3\n        with:\n          fetch-depth: 0\n          # This job runs an agent over untrusted PR diff; don't leave the token\n          # in .git/config (it uses GH_TOKEN for gh API calls, never git push).\n          persist-credentials: false\n\n      # Dogfood local source inside this monorepo, else the published package.\n      # The pnpm steps run ONLY on the local path so npm/yarn consumer repos\n      # (no pnpm-lock.yaml) fall back to `npx @agent-native/core`.\n      - name: Resolve recap CLI\n        id: cli\n        run: |\n          if [ -f packages/core/src/cli/index.ts ]; then\n            echo \"RECAP_CLI=pnpm exec tsx packages/core/src/cli/index.ts\" >> \"$GITHUB_ENV\"\n            echo \"local=true\" >> \"$GITHUB_OUTPUT\"\n          else\n            echo \"RECAP_CLI=npx -y @agent-native/core@latest\" >> \"$GITHUB_ENV\"\n            echo \"local=false\" >> \"$GITHUB_OUTPUT\"\n          fi\n\n      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8\n        if: steps.cli.outputs.local == 'true'\n\n      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0\n        with:\n          node-version: \"22\"\n          cache: ${{ steps.cli.outputs.local == 'true' && 'pnpm' || '' }}\n\n      - name: Install workspace (local source only)\n        if: steps.cli.outputs.local == 'true'\n        run: pnpm install --frozen-lockfile --ignore-scripts\n\n      - name: Start visual recap check\n        id: recap_check\n        continue-on-error: true\n        run: |\n          set -uo pipefail\n          $RECAP_CLI recap check start --sha \"$HEAD_SHA\" --workflow-url \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID\"\n\n      - name: Collect bounded diff\n        id: diff\n        env:\n          BASE_SHA: ${{ github.event.pull_request.base.sha }}\n        run: |\n          set -euo pipefail\n          $RECAP_CLI recap collect-diff --base \"$BASE_SHA\" --head \"$HEAD_SHA\" --out recap.diff --stat recap.stat\n\n      - name: Secret scan\n        id: scan\n        if: steps.diff.outputs.tiny != 'true'\n        run: |\n          set -uo pipefail\n          # Fail CLOSED: a scanner error or invalid JSON suppresses the diff so a\n          # credential-bearing diff is never handed to the agent / plan service.\n          if ! SCAN_JSON=\"$($RECAP_CLI recap scan --diff recap.diff)\"; then\n            SCAN_JSON='{\"suppressed\":true,\"reason\":\"secret scan failed to run; failing closed\"}'\n          fi\n          {\n            echo 'json<<__RECAP_SCAN_EOF__'\n            echo \"$SCAN_JSON\"\n            echo '__RECAP_SCAN_EOF__'\n          } >> \"$GITHUB_OUTPUT\"\n          SUPPRESSED=$(node -e 'try{process.stdout.write(JSON.parse(process.argv[1]).suppressed?\"true\":\"false\")}catch{process.stdout.write(\"true\")}' \"$SCAN_JSON\")\n          echo \"suppressed=$SUPPRESSED\" >> \"$GITHUB_OUTPUT\"\n\n      - name: Read previous plan id\n        id: prev\n        continue-on-error: true\n        run: |\n          set -euo pipefail\n          PLAN_ID=\"$($RECAP_CLI recap comment find-plan-id --repo \"$GITHUB_REPOSITORY\" --issue \"$PR_NUMBER\" --token \"$GH_TOKEN\")\"\n          echo \"plan_id=$PLAN_ID\" >> \"$GITHUB_OUTPUT\"\n\n      - name: Build recap prompt\n        id: prompt\n        if: steps.diff.outputs.tiny != 'true' && steps.scan.outputs.suppressed != 'true'\n        env:\n          # Pass step outputs via env, NOT ${{ }} interpolation into the run body:\n          # the prev plan id is parsed from a PR comment and could inject shell.\n          PREV_PLAN_ID: ${{ steps.prev.outputs.plan_id }}\n          DIFF_HUGE: ${{ steps.diff.outputs.huge }}\n        run: |\n          set -euo pipefail\n          ARGS=(--diff recap.diff --stat recap.stat --pr \"$PR_NUMBER\" --repo \"$GITHUB_REPOSITORY\" --head \"$HEAD_SHA\" --app-url \"$PLAN_RECAP_APP_URL\" --skill-source \"$VISUAL_RECAP_SKILL_SOURCE\" --out recap-prompt.md)\n          if [ \"${DIFF_HUGE:-}\" = \"true\" ]; then ARGS+=(--huge); fi\n          if [ -n \"${PREV_PLAN_ID:-}\" ]; then ARGS+=(--prev-plan-id \"$PREV_PLAN_ID\"); fi\n          $RECAP_CLI recap build-prompt \"${ARGS[@]}\"\n\n      - name: Run agent (Claude Code)\n        id: claude\n        if: needs.gate.outputs.agent == 'claude' && steps.diff.outputs.tiny != 'true' && steps.scan.outputs.suppressed != 'true'\n        continue-on-error: true\n        env:\n          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}\n        run: |\n          set -uo pipefail\n          MCP_CONFIG=\"$RUNNER_TEMP/plan-mcp.json\"\n          $RECAP_CLI recap mcp-config --agent claude --app-url \"$PLAN_RECAP_APP_URL\" --out \"$MCP_CONFIG\"\n          CLAUDE_ARGS=(-p \"$(cat recap-prompt.md)\" --mcp-config \"$MCP_CONFIG\" --allowedTools \"Read,Write,Bash(git diff:*),mcp__plan__get-plan-blocks,mcp__plan__create-visual-recap,mcp__plan__set-resource-visibility\" --permission-mode dontAsk --output-format json)\n          if [ -n \"${VISUAL_RECAP_MODEL:-}\" ]; then CLAUDE_ARGS+=(--model \"$VISUAL_RECAP_MODEL\"); fi\n          npx -y @anthropic-ai/claude-code@2 \"${CLAUDE_ARGS[@]}\" > claude-result.json || true\n          rm -f \"$MCP_CONFIG\" || true\n\n      - name: Run agent (Codex)\n        id: codex\n        if: needs.gate.outputs.agent == 'codex' && steps.diff.outputs.tiny != 'true' && steps.scan.outputs.suppressed != 'true'\n        continue-on-error: true\n        env:\n          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}\n        run: |\n          set -uo pipefail\n          $RECAP_CLI recap mcp-config --agent codex --app-url \"$PLAN_RECAP_APP_URL\"\n          # `codex login` writes ~/.codex/auth.json (the bare env var is dropped on\n          # the gpt-5.5 wss transport); stdin keeps the key out of process args.\n          printenv OPENAI_API_KEY | npx -y @openai/codex@0 login --with-api-key || true\n          # The runner is itself an ephemeral sandbox; bypass Codex's own sandbox\n          # (bubblewrap can't init here) and approval gate (cancels the MCP write).\n          CODEX_ARGS=(exec --dangerously-bypass-approvals-and-sandbox --skip-git-repo-check)\n          if [ -n \"${VISUAL_RECAP_MODEL:-}\" ]; then CODEX_ARGS+=(--model \"$VISUAL_RECAP_MODEL\"); fi\n          # Validate reasoning against the enum before embedding it in the TOML override.\n          case \"${VISUAL_RECAP_REASONING:-}\" in\n            none|minimal|low|medium|high|xhigh)\n              CODEX_ARGS+=(-c \"model_reasoning_effort=\\\"$VISUAL_RECAP_REASONING\\\"\") ;;\n            \"\") ;;\n            *) echo \"Ignoring invalid VISUAL_RECAP_REASONING: $VISUAL_RECAP_REASONING\" ;;\n          esac\n          npx -y @openai/codex@0 \"${CODEX_ARGS[@]}\" --json \"$(cat recap-prompt.md)\" | tee codex-events.jsonl || true\n\n      - name: Read plan URL\n        id: url\n        if: steps.diff.outputs.tiny != 'true' && steps.scan.outputs.suppressed != 'true'\n        run: |\n          set -uo pipefail\n          PLAN_URL=\"\"\n          if [ -f recap-url.txt ]; then PLAN_URL=\"$(tr -d '\\r\\n' < recap-url.txt | tr -d ' ')\"; fi\n          # recap-url.txt is agent-written -> untrusted. Rebuild a canonical\n          # recap URL from the trusted app base and a strictly validated plan id,\n          # preserving path-prefixed self-hosted mounts.\n          CANONICAL_URL=$(PLAN_URL=\"$PLAN_URL\" node <<'NODE'\n          try {\n            const raw = process.env.PLAN_URL || \"\";\n            const trusted = new URL(process.env.PLAN_RECAP_APP_URL || \"https://plan.agent-native.com\");\n            const parsed = /^https?:\\/\\//i.test(raw)\n              ? new URL(raw)\n              : new URL(raw, trusted);\n            if (parsed.origin !== trusted.origin) {\n              process.exit(0);\n            }\n\n            const base = trusted.pathname.replace(/\\/$/, \"\");\n            const paths = [parsed.pathname];\n            if (base && parsed.pathname.startsWith(`${base}/`)) {\n              paths.push(parsed.pathname.slice(base.length) || \"/\");\n            }\n\n            for (const path of paths) {\n              const match = path.match(/^\\/(?:plans|recaps)\\/([A-Za-z0-9_-]+)\\/?$/);\n              if (match) {\n                process.stdout.write(`${trusted.origin}${base}/recaps/${match[1]}`);\n                break;\n              }\n            }\n          } catch {\n            process.exit(0);\n          }\n          NODE\n          )\n          if [ -n \"$CANONICAL_URL\" ]; then\n            echo \"plan_url=$CANONICAL_URL\" >> \"$GITHUB_OUTPUT\"; echo \"ok=true\" >> \"$GITHUB_OUTPUT\"\n          else\n            echo \"plan_url=\" >> \"$GITHUB_OUTPUT\"; echo \"ok=false\" >> \"$GITHUB_OUTPUT\"\n          fi\n\n      - name: Attach usage\n        if: steps.url.outputs.ok == 'true'\n        continue-on-error: true\n        env:\n          PLAN_URL: ${{ steps.url.outputs.plan_url }}\n          # Use the gate-normalized agent so \"Codex\" still selects the right file.\n          RECAP_AGENT: ${{ needs.gate.outputs.agent }}\n        run: |\n          set -uo pipefail\n          RESULT=claude-result.json\n          if [ \"$RECAP_AGENT\" = \"codex\" ]; then RESULT=codex-events.jsonl; fi\n          if [ -f \"$RESULT\" ]; then $RECAP_CLI recap usage --plan-url \"$PLAN_URL\" --agent \"$RECAP_AGENT\" --result-file \"$RESULT\" --model \"${VISUAL_RECAP_MODEL:-}\" --app-url \"$PLAN_RECAP_APP_URL\" --token \"$PLAN_RECAP_TOKEN\" || true; fi\n\n      - name: Cache Playwright browsers\n        if: steps.url.outputs.ok == 'true'\n        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3\n        with:\n          path: ~/.cache/ms-playwright\n          key: playwright-1-${{ runner.os }}\n\n      - name: Screenshot + upload\n        id: shot\n        if: steps.url.outputs.ok == 'true'\n        continue-on-error: true\n        env:\n          # recap-url.txt is untrusted agent output; pass via env, never ${{ }}.\n          PLAN_URL: ${{ steps.url.outputs.plan_url }}\n        run: |\n          set -uo pipefail\n          pnpm exec playwright install --with-deps chromium 2>/dev/null || npx -y playwright@1 install --with-deps chromium || true\n          SHOT_JSON=\"$($RECAP_CLI recap shot --url \"$PLAN_URL\" --token \"$PLAN_RECAP_TOKEN\" --app-url \"$PLAN_RECAP_APP_URL\" --out recap.png || echo '{}')\"\n          IMAGE_URL=$(node -e 'try{process.stdout.write(JSON.parse(process.argv[1]).imageUrl||\"\")}catch{process.stdout.write(\"\")}' \"$SHOT_JSON\")\n          echo \"image_url=$IMAGE_URL\" >> \"$GITHUB_OUTPUT\"\n          if [ -f recap.png ]; then echo \"captured=true\" >> \"$GITHUB_OUTPUT\"; else echo \"captured=false\" >> \"$GITHUB_OUTPUT\"; fi\n\n      - name: Upload recap screenshot artifact\n        if: steps.shot.outputs.captured == 'true'\n        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1\n        with:\n          name: pr-visual-recap-${{ github.event.pull_request.number }}\n          path: recap.png\n          if-no-files-found: ignore\n          retention-days: 14\n\n      - name: Upsert sticky comment\n        if: always()\n        continue-on-error: true\n        env:\n          PLAN_URL: ${{ steps.url.outputs.plan_url }}\n          RECAP_IMAGE_URL: ${{ steps.shot.outputs.image_url }}\n          SUPPRESSED: ${{ steps.scan.outputs.suppressed }}\n          SUPPRESSED_JSON: ${{ steps.scan.outputs.json }}\n          DIFF_HUGE: ${{ steps.diff.outputs.huge }}\n          DIFF_TINY: ${{ steps.diff.outputs.tiny }}\n          PREV_PLAN_ID: ${{ steps.prev.outputs.plan_id }}\n        run: |\n          set -euo pipefail\n          ARGS=(recap comment upsert --repo \"$GITHUB_REPOSITORY\" --issue \"$PR_NUMBER\" --token \"$GH_TOKEN\")\n          # On a tiny diff, only REFRESH an existing comment, never create one.\n          if [ \"${DIFF_TINY:-}\" = \"true\" ]; then ARGS+=(--update-only); fi\n          $RECAP_CLI \"${ARGS[@]}\"\n\n      - name: Complete visual recap check\n        if: always() && steps.recap_check.outputs.check_run_id != ''\n        continue-on-error: true\n        env:\n          # Untrusted/step values via env (NOT ${{ }}-interpolated into the run\n          # body): the agent-written plan URL and the scan JSON could inject shell.\n          CHECK_RUN_ID: ${{ steps.recap_check.outputs.check_run_id }}\n          PLAN_OK: ${{ steps.url.outputs.ok }}\n          PLAN_URL: ${{ steps.url.outputs.plan_url }}\n          SUPPRESSED: ${{ steps.scan.outputs.suppressed }}\n          SUPPRESSED_JSON: ${{ steps.scan.outputs.json }}\n          DIFF_HUGE: ${{ steps.diff.outputs.huge }}\n          DIFF_TINY: ${{ steps.diff.outputs.tiny }}\n        run: |\n          set -uo pipefail\n          $RECAP_CLI recap check complete \\\n            --check-run-id \"$CHECK_RUN_ID\" \\\n            --plan-ok \"$PLAN_OK\" \\\n            --plan-url \"$PLAN_URL\" \\\n            --suppressed \"$SUPPRESSED\" \\\n            --suppressed-json \"$SUPPRESSED_JSON\" \\\n            --huge \"$DIFF_HUGE\" \\\n            --tiny \"$DIFF_TINY\" \\\n            --workflow-url \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID\"\n";
-//# sourceMappingURL=pr-visual-recap-workflow.d.ts.map