@agentdeck/bridge 1.1.0 → 1.2.1

package/dist/native-dependency-diagnostics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-dependency-diagnostics.js","sourceRoot":"","sources":["../src/native-dependency-diagnostics.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AAEvC,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAE/C,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAU,CAAC;AAC3D,MAAM,CAAC,MAAM,qBAAqB,GAAG,sBAAsB,CAAC;AAoC5D,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,OAAQ,qBAA2C,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,OAAqC,EAAE;IAEvC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC;IACnD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAC9E,MAAM,OAAO,GAA4B;QACvC,UAAU,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,IAAI,OAAO,CAAC,QAAQ;QACxD,IAAI;QACJ,UAAU,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO;QAChE,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,IAAI,OAAO,CAAC,QAAQ;QACpD,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,IAAI,OAAO,CAAC,IAAI;QACxC,SAAS,EAAE,oBAAoB,CAAC,KAAK,CAAC;KACvC,CAAC;IACF,MAAM,QAAQ,GACZ,+DAA+D;QAC/D,kGAAkG,CAAC;IAErG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACvB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO;YACP,aAAa,EAAE;gBACb,MAAM,EAAE,aAAa;gBACrB,KAAK,EAAE,+BAA+B,OAAO,CAAC,IAAI,uCAAuC;gBACzF,QAAQ;aACT;SACF,CAAC;IACJ,CAAC;IAED,IAAI,EAAE,GAAwB,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAoE,CAAC;QACzG,MAAM,IAAI,GAAG,OAAO,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;QACpE,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QAClE,EAAE,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1B,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,GAAG,EAAE,CAAC;QACnC,IAAI,OAA2B,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,6BAA6B,CAA0B,CAAC;YACzE,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;gBAAE,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;QAC3E,CAAC;QACD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,OAAO;YACP,aAAa,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE;SACtD,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO;YACP,aAAa,EAAE;gBACb,MAAM,EAAE,aAAa;gBACrB,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC;gBAClB,QAAQ;aACT;SACF,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,EAAE,EAAE,KAAK,EAAE,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,6BAA6B;QAC/B,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sCAAsC,CAAC,MAAwC;IAC7F,MAAM,KAAK,GAAG;QACZ,wCAAwC;QACxC,YAAY,MAAM,CAAC,OAAO,CAAC,IAAI,SAAS,MAAM,CAAC,OAAO,CAAC,UAAU,GAAG;QACpE,eAAe,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE;QAC1C,aAAa,MAAM,CAAC,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE;QAC7D,sBAAsB,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,qBAAqB,GAAG,EAAE;KAC3F,CAAC;IACF,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QAC5C,KAAK,CAAC,IAAI,CAAC,wBAAwB,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,aAAa,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjH,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAC;QACtF,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK;YAAE,KAAK,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC,CAAC;QACpF,KAAK,CAAC,IAAI,CAAC,aAAa,MAAM,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/observed-steering.d.ts

@@ -23,9 +23,8 @@
  * Keyed by the Claude session UUID (same key as awaiting-overlay.ts). Lives
  * outside the state machine for the same reason: per-session attribution.
  */
-/** Bash signature = first two command tokens (the granularity of Claude's own
- *  "always allow `git push`"-style session approvals); other tools = tool name. */
-export declare function gateSignature(tool: string, toolInput: Record<string, unknown> | undefined): string;
+import { gateSignature } from '@agentdeck/shared';
+export { gateSignature };
 /** Human-readable question for the gate's awaiting overlay — device-native
  *  semantics ("Allow Bash: git push …?"), never a fabricated mirror of the
  *  TUI prompt's option labels. Overlay caps length at 120 chars. */
@@ -124,6 +123,7 @@ export declare function gateReleased(sid: string, requestId: string, opts: {
     undecided: boolean;
     tool: string;
     toolInput?: Record<string, unknown>;
+    toolUseId?: string;
 }): void;
 /** A permission_prompt Notification arrived — every recent undecided release
  *  was a GENUINE prompt, so nothing should be learned as auto-approved. */
@@ -134,7 +134,7 @@ export declare function notePermissionPromptShown(sid: string): void;
  * (session-scoped "always allow" we cannot read) — suppress the signature so
  * it is never held again this session.
  */
-export declare function noteToolEnd(sid: string, tool: string | undefined): void;
+export declare function noteToolEnd(sid: string, tool: string | undefined, toolUseId?: string): void;
 /** Enrichment snapshot for sessions_list (devices render STOPPING / queue badges). */
 export declare function steeringSnapshot(sid: string): {
     stopRequested: boolean;

package/dist/observed-steering.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"observed-steering.d.ts","sourceRoot":"","sources":["../src/observed-steering.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AA4CH;mFACmF;AACnF,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,MAAM,CAMlG;AAED;;oEAEoE;AACpE,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAK3F;AAID,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAG7C;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAK9C;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAQpD;AAED,oDAAoD;AACpD,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAKhD;AAED,eAAO,MAAM,gBAAgB,QAGuC,CAAC;AAErE;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,KAAK,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,GAClD,MAAM,CAWR;AAID,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAUjE;AAED;uEACuE;AACvE,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAU7D;AAED;;;;;;;;;;;;+EAY+E;AAC/E,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAC3C,MAAM,GAAG,SAAS,CAGpB;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAMxD;AAED;+CAC+C;AAC/C,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAOtD;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAE9C;AAID,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,OAAO,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;IAC/C,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;IACxB,0EAA0E;IAC1E,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,WAAW,GAAG,YAAY,CAqBnE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;CAClB,GAAG,YAAY,CAQf;AAED;0EAC0E;AAC1E,wBAAgB,YAAY,CAC1B,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE;IAAE,SAAS,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GAC9E,IAAI,CAYN;AAED;2EAC2E;AAC3E,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAG3D;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAevE;AAED,sFAAsF;AACtF,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,aAAa,EAAE,OAAO,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE,CAKlG;AAED,mBAAmB;AACnB,wBAAgB,cAAc,IAAI,IAAI,CAErC"}
+{"version":3,"file":"observed-steering.d.ts","sourceRoot":"","sources":["../src/observed-steering.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAGH,OAAO,EAEL,aAAa,EAEd,MAAM,mBAAmB,CAAC;AAI3B,OAAO,EAAE,aAAa,EAAE,CAAC;AAqCzB;;oEAEoE;AACpE,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAK3F;AAID,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAG7C;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAK9C;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAQpD;AAED,oDAAoD;AACpD,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAKhD;AAED,eAAO,MAAM,gBAAgB,QAGuC,CAAC;AAErE;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,KAAK,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,GAClD,MAAM,CAWR;AAID,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAUjE;AAED;uEACuE;AACvE,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAU7D;AAED;;;;;;;;;;;;+EAY+E;AAC/E,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAC3C,MAAM,GAAG,SAAS,CAGpB;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAMxD;AAED;+CAC+C;AAC/C,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAOtD;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAE9C;AAID,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,OAAO,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;IAC/C,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;IACxB,0EAA0E;IAC1E,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,WAAW,GAAG,YAAY,CAqBnE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;CAClB,GAAG,YAAY,CAQf;AAED;0EAC0E;AAC1E,wBAAgB,YAAY,CAC1B,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE;IAAE,SAAS,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAClG,IAAI,CAaN;AAED;2EAC2E;AAC3E,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAG3D;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAqB3F;AAED,sFAAsF;AACtF,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,aAAa,EAAE,OAAO,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE,CAKlG;AAED,mBAAmB;AACnB,wBAAgB,cAAc,IAAI,IAAI,CAErC"}

package/dist/observed-steering.js

@@ -24,17 +24,20 @@
  * outside the state machine for the same reason: per-session attribution.
  */
 import { randomUUID } from 'crypto';
-import { evaluatePermissionRules, isNeverPromptTool, isPromptProneTool, } from './claude-permission-rules.js';
-import { shouldGatePreToolUse } from './awaiting-overlay.js';
+import { GATE_LEARN_WINDOW_MS, gateSignature, predictPreToolUseHold, } from '@agentdeck/shared';
+import { loadMergedPermissionRules } from './claude-permission-rules.js';
 import { debug } from './logger.js';
+export { gateSignature };
 const STOP_FLAG_TTL_MS = 10 * 60_000; // stale STOP must not deny a tool an hour later
 const DIRECTIVE_TTL_MS = 60 * 60_000;
 const DIRECTIVE_QUEUE_CAP = 3;
 /** After a hold releases undecided, how long we correlate PostToolUse-without-
  *  Notification to learn "this signature was auto-approved" (session
  *  "always allow" answers live only in Claude's memory — this is the only way
- *  to see them). */
-const ASK_RELEASE_LEARN_WINDOW_MS = 8_000;
+ *  to see them). SSOT in @agentdeck/shared: a `permission_prompt`
+ *  Notification clears the pending release, so this bounds only how slow the
+ *  TOOL may be — and 8 s was shorter than a routine `curl`. */
+const ASK_RELEASE_LEARN_WINDOW_MS = GATE_LEARN_WINDOW_MS;
 const sessions = new Map();
 function ses(sid) {
     let s = sessions.get(sid);
@@ -44,15 +47,6 @@ function ses(sid) {
     }
     return s;
 }
-/** Bash signature = first two command tokens (the granularity of Claude's own
- *  "always allow `git push`"-style session approvals); other tools = tool name. */
-export function gateSignature(tool, toolInput) {
-    if (tool === 'Bash' && typeof toolInput?.command === 'string') {
-        const head = toolInput.command.trim().split(/\s+/).slice(0, 2).join(' ');
-        return `Bash|${head}`;
-    }
-    return tool;
-}
 /** Human-readable question for the gate's awaiting overlay — device-native
  *  semantics ("Allow Bash: git push …?"), never a fabricated mirror of the
  *  TUI prompt's option labels. Overlay caps length at 120 chars. */
@@ -199,31 +193,26 @@ export function shouldHoldPreToolUse(ctx) {
         return { hold: false, reason: 'no clients' };
     if (!ctx.tool)
         return { hold: false, reason: 'no tool name' };
-    if (ctx.tool.startsWith('mcp__'))
-        return { hold: false, reason: 'mcp tool (trust state unknown)' };
-    if (isNeverPromptTool(ctx.tool))
-        return { hold: false, reason: 'never-prompt tool' };
-    if (!isPromptProneTool(ctx.tool))
-        return { hold: false, reason: 'not prompt-prone' };
-    if (!shouldGatePreToolUse(ctx.permissionMode, ctx.tool)) {
-        return { hold: false, reason: `permission_mode=${ctx.permissionMode ?? 'default'} auto-approves` };
-    }
     const s = ses(ctx.sessionId);
     const signature = gateSignature(ctx.tool, ctx.toolInput);
     if (s.suppressed.has(signature))
         return { hold: false, reason: 'signature learned auto-approved' };
     if (s.heldRequestId)
         return { hold: false, reason: 'another gate already held' };
-    const verdict = evaluatePermissionRules(ctx.tool, ctx.toolInput, ctx.cwd);
-    if (verdict === 'unknown')
-        return { hold: false, reason: 'settings unreadable' };
-    if (verdict === 'deny')
-        return { hold: false, reason: 'deny rule may match' };
-    if (verdict === 'allow')
-        return { hold: false, reason: 'allow rule may match' };
+    // The stateless prediction (tool sets, mode gate, allow/deny/ask rules,
+    // built-in read-only and acceptEdits auto-approvals) is the shared SSOT the
+    // Swift daemon runs as generated code — one decision, two daemons.
+    const prediction = predictPreToolUseHold({
+        tool: ctx.tool,
+        toolInput: ctx.toolInput,
+        permissionMode: ctx.permissionMode,
+        rules: loadMergedPermissionRules(ctx.cwd),
+    });
+    if (!prediction.hold)
+        return { hold: false, reason: prediction.reason };
     const requestId = randomUUID();
     s.heldRequestId = requestId;
-    return { hold: true, requestId, reason: verdict === 'ask' ? 'ask rule matches' : 'prompt-prone, no rule match' };
+    return { hold: true, requestId, reason: prediction.reason };
 }
 /**
  * Register a hold for an AskUserQuestion PreToolUse so a device can answer it.
@@ -267,6 +256,7 @@ export function gateReleased(sid, requestId, opts) {
             tool: opts.tool,
             signature: gateSignature(opts.tool, opts.toolInput),
             ts: Date.now(),
+            toolUseId: opts.toolUseId,
         });
         if (s.recentAskReleases.length > 8)
             s.recentAskReleases.shift();
@@ -285,7 +275,7 @@ export function notePermissionPromptShown(sid) {
  * (session-scoped "always allow" we cannot read) — suppress the signature so
  * it is never held again this session.
  */
-export function noteToolEnd(sid, tool) {
+export function noteToolEnd(sid, tool, toolUseId) {
     const s = sessions.get(sid);
     if (!s || !tool || s.recentAskReleases.length === 0)
         return;
@@ -294,7 +284,13 @@ export function noteToolEnd(sid, tool) {
     for (const r of s.recentAskReleases) {
         if (now - r.ts > ASK_RELEASE_LEARN_WINDOW_MS)
             continue; // expired
-        if (r.tool === tool) {
+        // The held call and its PostToolUse share a `tool_use_id`, so a release
+        // that recorded one learns ONLY from its own completion — a parallel
+        // allowlisted Bash finishing inside the window must not teach the held
+        // signature (the window is 15 min now, wide enough for that to happen).
+        // Releases without an id (older Claude) fall back to the tool name.
+        const matches = r.toolUseId ? r.toolUseId === toolUseId : r.tool === tool;
+        if (matches) {
             s.suppressed.add(r.signature);
             debug('steering', `learned auto-approved signature for ${sid}: ${r.signature}`);
         }

package/dist/observed-steering.js.map

@@ -1 +1 @@
-{"version":3,"file":"observed-steering.js","sourceRoot":"","sources":["../src/observed-steering.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EACL,uBAAuB,EACvB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEpC,MAAM,gBAAgB,GAAG,EAAE,GAAG,MAAM,CAAC,CAAM,gDAAgD;AAC3F,MAAM,gBAAgB,GAAG,EAAE,GAAG,MAAM,CAAC;AACrC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAC9B;;;oBAGoB;AACpB,MAAM,2BAA2B,GAAG,KAAK,CAAC;AAe1C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA2B,CAAC;AAEpD,SAAS,GAAG,CAAC,GAAW;IACtB,IAAI,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,GAAG,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE,CAAC;QACrE,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;mFACmF;AACnF,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,SAA8C;IACxF,IAAI,IAAI,KAAK,MAAM,IAAI,OAAO,SAAS,EAAE,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC9D,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzE,OAAO,QAAQ,IAAI,EAAE,CAAC;IACxB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;oEAEoE;AACpE,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,SAAmC;IACjF,MAAM,OAAO,GAAG,IAAI,KAAK,MAAM,IAAI,OAAO,SAAS,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO;QAC3F,CAAC,CAAC,OAAO,SAAS,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS;YAC9D,CAAC,CAAC,OAAO,SAAS,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,OAAO,OAAO,CAAC,CAAC,CAAC,SAAS,IAAI,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,GAAG,CAAC;AAClE,CAAC;AAED,oBAAoB;AAEpB,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,GAAG,CAAC,GAAG,CAAC,CAAC,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACtC,KAAK,CAAC,UAAU,EAAE,sBAAsB,GAAG,EAAE,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,eAAe,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACxD,CAAC,CAAC,eAAe,GAAG,SAAS,CAAC;IAC9B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,eAAe,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACxD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,eAAe,GAAG,gBAAgB,EAAE,CAAC;QACtD,CAAC,CAAC,eAAe,GAAG,SAAS,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,GAAG,CAAC,GAAG,CAAC,CAAC,eAAe,GAAG,SAAS,CAAC;IACrC,KAAK,CAAC,UAAU,EAAE,wCAAwC,GAAG,EAAE,CAAC,CAAC;IACjE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAC3B,kEAAkE;MAChE,4EAA4E;MAC5E,gEAAgE,CAAC;AAErE;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAmD;IAEnD,MAAM,KAAK,GAAG,OAAO;SAClB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;SACtB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,QAAQ,QAAQ,CAAC,CAAC,KAAK,EAAE,CAAC;SAC7C,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO,wEAAwE;UAC3E,6EAA6E;UAC7E,GAAG,KAAK,IAAI;UACZ,2EAA2E;UAC3E,2EAA2E;UAC3E,0DAA0D,CAAC;AACjE,CAAC;AAED,mCAAmC;AAEnC,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,IAAY;IACtD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IACnB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,GAAG,gBAAgB,CAAC,CAAC;IACzE,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,IAAI,mBAAmB;QAAE,OAAO,KAAK,CAAC;IAC7D,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAC9C,KAAK,CAAC,UAAU,EAAE,wBAAwB,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,MAAM,UAAU,CAAC,CAAC;IAC5G,OAAO,IAAI,CAAC;AACd,CAAC;AAED;uEACuE;AACvE,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,CAAC,CAAC,UAAU,GAAG,EAAE,CAAC;QAClB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,GAAG,gBAAgB,CAAC,CAAC;IACzE,OAAO,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC;AACpC,CAAC;AAED;;;;;;;;;;;;+EAY+E;AAC/E,MAAM,UAAU,oBAAoB,CAClC,GAAW,EACX,OAA4C;IAE5C,IAAI,OAAO,EAAE,cAAc,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACvD,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IACjB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,GAAG,gBAAgB,CAAC,CAAC;IACzE,OAAO,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;AAC7B,CAAC;AAED;+CAC+C;AAC/C,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrB,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,eAAe,KAAK,SAAS,CAAC;IACvE,CAAC,CAAC,UAAU,GAAG,EAAE,CAAC;IAClB,CAAC,CAAC,eAAe,GAAG,SAAS,CAAC;IAC9B,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AACvB,CAAC;AAqBD;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAgB;IACnD,IAAI,CAAC,GAAG,CAAC,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC7D,IAAI,GAAG,CAAC,WAAW,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IACtE,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAC9D,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;IACnG,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACrF,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACrF,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,cAAc,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACxD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,GAAG,CAAC,cAAc,IAAI,SAAS,gBAAgB,EAAE,CAAC;IACrG,CAAC;IACD,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC7B,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;IACzD,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC;IACnG,IAAI,CAAC,CAAC,aAAa;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;IACjF,MAAM,OAAO,GAAG,uBAAuB,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IAC1E,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IACjF,IAAI,OAAO,KAAK,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAC9E,IAAI,OAAO,KAAK,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IAChF,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;IAC/B,CAAC,CAAC,aAAa,GAAG,SAAS,CAAC;IAC5B,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,6BAA6B,EAAE,CAAC;AACnH,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,YAAY,CAAC,GAI5B;IACC,IAAI,CAAC,GAAG,CAAC,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC7D,IAAI,GAAG,CAAC,WAAW,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IACtE,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC7B,IAAI,CAAC,CAAC,aAAa;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;IACjF,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;IAC/B,CAAC,CAAC,aAAa,GAAG,SAAS,CAAC;IAC5B,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;AAC7E,CAAC;AAED;0EAC0E;AAC1E,MAAM,UAAU,YAAY,CAC1B,GAAW,EACX,SAAiB,EACjB,IAA+E;IAE/E,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,CAAC,CAAC;QAAE,OAAO;IACf,IAAI,CAAC,CAAC,aAAa,KAAK,SAAS;QAAE,CAAC,CAAC,aAAa,GAAG,SAAS,CAAC;IAC/D,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC;YACvB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnD,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;SACf,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC;YAAE,CAAC,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC;IAClE,CAAC;AACH,CAAC;AAED;2EAC2E;AAC3E,MAAM,UAAU,yBAAyB,CAAC,GAAW;IACnD,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,CAAC;QAAE,CAAC,CAAC,iBAAiB,GAAG,EAAE,CAAC;AAClC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,IAAwB;IAC/D,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,IAAI,GAAiB,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,iBAAiB,EAAE,CAAC;QACpC,IAAI,GAAG,GAAG,CAAC,CAAC,EAAE,GAAG,2BAA2B;YAAE,SAAS,CAAC,UAAU;QAClE,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACpB,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC9B,KAAK,CAAC,UAAU,EAAE,uCAAuC,GAAG,KAAK,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QAClF,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACf,CAAC;IACH,CAAC;IACD,CAAC,CAAC,iBAAiB,GAAG,IAAI,CAAC;AAC7B,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,OAAO;QACL,aAAa,EAAE,eAAe,CAAC,GAAG,CAAC;QACnC,gBAAgB,EAAE,oBAAoB,CAAC,GAAG,CAAC;KAC5C,CAAC;AACJ,CAAC;AAED,mBAAmB;AACnB,MAAM,UAAU,cAAc;IAC5B,QAAQ,CAAC,KAAK,EAAE,CAAC;AACnB,CAAC"}
+{"version":3,"file":"observed-steering.js","sourceRoot":"","sources":["../src/observed-steering.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EACL,oBAAoB,EACpB,aAAa,EACb,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEpC,OAAO,EAAE,aAAa,EAAE,CAAC;AAEzB,MAAM,gBAAgB,GAAG,EAAE,GAAG,MAAM,CAAC,CAAM,gDAAgD;AAC3F,MAAM,gBAAgB,GAAG,EAAE,GAAG,MAAM,CAAC;AACrC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAC9B;;;;;+DAK+D;AAC/D,MAAM,2BAA2B,GAAG,oBAAoB,CAAC;AAezD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA2B,CAAC;AAEpD,SAAS,GAAG,CAAC,GAAW;IACtB,IAAI,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,GAAG,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE,CAAC;QACrE,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;oEAEoE;AACpE,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,SAAmC;IACjF,MAAM,OAAO,GAAG,IAAI,KAAK,MAAM,IAAI,OAAO,SAAS,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO;QAC3F,CAAC,CAAC,OAAO,SAAS,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS;YAC9D,CAAC,CAAC,OAAO,SAAS,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,OAAO,OAAO,CAAC,CAAC,CAAC,SAAS,IAAI,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,GAAG,CAAC;AAClE,CAAC;AAED,oBAAoB;AAEpB,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,GAAG,CAAC,GAAG,CAAC,CAAC,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACtC,KAAK,CAAC,UAAU,EAAE,sBAAsB,GAAG,EAAE,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,eAAe,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACxD,CAAC,CAAC,eAAe,GAAG,SAAS,CAAC;IAC9B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,eAAe,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACxD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,eAAe,GAAG,gBAAgB,EAAE,CAAC;QACtD,CAAC,CAAC,eAAe,GAAG,SAAS,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,GAAG,CAAC,GAAG,CAAC,CAAC,eAAe,GAAG,SAAS,CAAC;IACrC,KAAK,CAAC,UAAU,EAAE,wCAAwC,GAAG,EAAE,CAAC,CAAC;IACjE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAC3B,kEAAkE;MAChE,4EAA4E;MAC5E,gEAAgE,CAAC;AAErE;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAmD;IAEnD,MAAM,KAAK,GAAG,OAAO;SAClB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;SACtB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,QAAQ,QAAQ,CAAC,CAAC,KAAK,EAAE,CAAC;SAC7C,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO,wEAAwE;UAC3E,6EAA6E;UAC7E,GAAG,KAAK,IAAI;UACZ,2EAA2E;UAC3E,2EAA2E;UAC3E,0DAA0D,CAAC;AACjE,CAAC;AAED,mCAAmC;AAEnC,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,IAAY;IACtD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IACnB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,GAAG,gBAAgB,CAAC,CAAC;IACzE,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,IAAI,mBAAmB;QAAE,OAAO,KAAK,CAAC;IAC7D,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAC9C,KAAK,CAAC,UAAU,EAAE,wBAAwB,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,MAAM,UAAU,CAAC,CAAC;IAC5G,OAAO,IAAI,CAAC;AACd,CAAC;AAED;uEACuE;AACvE,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,CAAC,CAAC,UAAU,GAAG,EAAE,CAAC;QAClB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,GAAG,gBAAgB,CAAC,CAAC;IACzE,OAAO,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC;AACpC,CAAC;AAED;;;;;;;;;;;;+EAY+E;AAC/E,MAAM,UAAU,oBAAoB,CAClC,GAAW,EACX,OAA4C;IAE5C,IAAI,OAAO,EAAE,cAAc,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACvD,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IACjB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,GAAG,gBAAgB,CAAC,CAAC;IACzE,OAAO,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;AAC7B,CAAC;AAED;+CAC+C;AAC/C,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrB,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,eAAe,KAAK,SAAS,CAAC;IACvE,CAAC,CAAC,UAAU,GAAG,EAAE,CAAC;IAClB,CAAC,CAAC,eAAe,GAAG,SAAS,CAAC;IAC9B,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AACvB,CAAC;AAqBD;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAgB;IACnD,IAAI,CAAC,GAAG,CAAC,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC7D,IAAI,GAAG,CAAC,WAAW,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IACtE,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAC9D,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC7B,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;IACzD,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC;IACnG,IAAI,CAAC,CAAC,aAAa;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;IACjF,wEAAwE;IACxE,4EAA4E;IAC5E,mEAAmE;IACnE,MAAM,UAAU,GAAG,qBAAqB,CAAC;QACvC,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,cAAc,EAAE,GAAG,CAAC,cAAc;QAClC,KAAK,EAAE,yBAAyB,CAAC,GAAG,CAAC,GAAG,CAAC;KAC1C,CAAC,CAAC;IACH,IAAI,CAAC,UAAU,CAAC,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;IACxE,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;IAC/B,CAAC,CAAC,aAAa,GAAG,SAAS,CAAC;IAC5B,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;AAC9D,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,YAAY,CAAC,GAI5B;IACC,IAAI,CAAC,GAAG,CAAC,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC7D,IAAI,GAAG,CAAC,WAAW,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IACtE,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC7B,IAAI,CAAC,CAAC,aAAa;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;IACjF,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;IAC/B,CAAC,CAAC,aAAa,GAAG,SAAS,CAAC;IAC5B,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;AAC7E,CAAC;AAED;0EAC0E;AAC1E,MAAM,UAAU,YAAY,CAC1B,GAAW,EACX,SAAiB,EACjB,IAAmG;IAEnG,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,CAAC,CAAC;QAAE,OAAO;IACf,IAAI,CAAC,CAAC,aAAa,KAAK,SAAS;QAAE,CAAC,CAAC,aAAa,GAAG,SAAS,CAAC;IAC/D,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC;YACvB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnD,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;YACd,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC;YAAE,CAAC,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC;IAClE,CAAC;AACH,CAAC;AAED;2EAC2E;AAC3E,MAAM,UAAU,yBAAyB,CAAC,GAAW;IACnD,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,CAAC;QAAE,CAAC,CAAC,iBAAiB,GAAG,EAAE,CAAC;AAClC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,IAAwB,EAAE,SAAkB;IACnF,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,IAAI,GAAiB,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,iBAAiB,EAAE,CAAC;QACpC,IAAI,GAAG,GAAG,CAAC,CAAC,EAAE,GAAG,2BAA2B;YAAE,SAAS,CAAC,UAAU;QAClE,wEAAwE;QACxE,qEAAqE;QACrE,uEAAuE;QACvE,wEAAwE;QACxE,oEAAoE;QACpE,MAAM,OAAO,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC;QAC1E,IAAI,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC9B,KAAK,CAAC,UAAU,EAAE,uCAAuC,GAAG,KAAK,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QAClF,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACf,CAAC;IACH,CAAC;IACD,CAAC,CAAC,iBAAiB,GAAG,IAAI,CAAC;AAC7B,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,OAAO;QACL,aAAa,EAAE,eAAe,CAAC,GAAG,CAAC;QACnC,gBAAgB,EAAE,oBAAoB,CAAC,GAAG,CAAC;KAC5C,CAAC;AACJ,CAAC;AAED,mBAAmB;AACnB,MAAM,UAAU,cAAc;IAC5B,QAAQ,CAAC,KAAK,EAAE,CAAC;AACnB,CAAC"}

package/dist/openclaw-gateway-stability.d.ts

@@ -0,0 +1,94 @@
+/**
+ * OpenClaw Gateway instability — detect a restart storm and say why.
+ *
+ * A Gateway restart is invisible from inside the daemon: the socket closes,
+ * `disconnectGatewayAdapter` tears the virtual session down, the probe finds
+ * the port again a few seconds later and everything reconnects. Each cycle
+ * looks like a healthy recovery, and a surface that watched it saw the
+ * OpenClaw row flip to `gateway_not_found` and back. On 2026-09-02 that
+ * happened eleven times in ninety minutes and nothing anywhere said so —
+ * the daemon log carried eleven `connected` lines, every dashboard showed
+ * a connected Gateway between flaps, and the cause (two OpenClaw installs
+ * fighting over `~/.openclaw/state`, a launchd KeepAlive respawning a
+ * Gateway whose startup migration could not run because the other copy
+ * held the state, and a plugin install restarting it on top) was written
+ * only in OpenClaw's own log, which no surface reads.
+ *
+ * Two pieces, both pure so a test can drive them with a clock and a string:
+ *
+ * - `GatewayFlapTracker` counts disconnects inside a rolling window. Three
+ *   in ten minutes is the line between "a plugin install restarted it" and
+ *   "something is wrong": a single deliberate restart never crosses it, and
+ *   the measured storm crossed it inside four minutes.
+ * - `diagnoseGatewayLog` reads the Gateway's own log tail for the sentences
+ *   OpenClaw prints when it knows what is happening. Structural causes
+ *   (another Gateway owns the state directory, the restart-loop breaker
+ *   tripped, a startup migration refused to complete) outrank routine ones
+ *   (a config-change restart, a plain SIGTERM) regardless of which line is
+ *   newer, because the routine restart is usually the symptom that the
+ *   structural cause produced.
+ *
+ * The daemon surfaces the result three ways so it cannot hide: a loud log
+ * line, an `instability` field on `/status` and `/health`, and one `error`
+ * timeline row per escalation on the virtual `openclaw-gateway` session —
+ * the timeline is the one channel every surface already renders, Android
+ * and e-ink included, without a protocol change.
+ */
+export declare const GATEWAY_FLAP_WINDOW_MS: number;
+export declare const GATEWAY_FLAP_THRESHOLD = 3;
+/** Bytes read from the end of the Gateway log when diagnosing a storm. */
+export declare const GATEWAY_LOG_TAIL_BYTES: number;
+export type GatewayInstabilityKind = 'state_owner_conflict' | 'restart_loop' | 'migration_failed' | 'config_restart' | 'external_sigterm';
+export interface GatewayLogDiagnosis {
+    kind: GatewayInstabilityKind;
+    /** The Gateway log line that carries the reason, trimmed. */
+    line: string;
+    /** What an operator should do about it, one sentence. */
+    hint: string;
+}
+export interface GatewayInstability {
+    flapsInWindow: number;
+    windowMs: number;
+    /** Epoch ms of the oldest disconnect still inside the window. */
+    since: number;
+    /** Epoch ms of the disconnect that produced this assessment. */
+    lastFlapAt: number;
+    diagnosis: GatewayLogDiagnosis | null;
+}
+export declare class GatewayFlapTracker {
+    private readonly windowMs;
+    private readonly threshold;
+    private stamps;
+    constructor(windowMs?: number, threshold?: number);
+    /** Record a disconnect at `nowMs`; returns the count inside the window including it. */
+    record(nowMs: number): number;
+    /**
+     * How many disconnects are inside the window, and whether that crosses the
+     * line. `since` is the oldest one still counted — the start of the storm.
+     */
+    assess(nowMs: number): {
+        flapsInWindow: number;
+        unstable: boolean;
+        since: number | null;
+    };
+    private prune;
+}
+/**
+ * Scan a Gateway log tail for the sentence that explains a restart storm.
+ * Returns the highest-priority kind present, carrying its most recent line.
+ * `null` means the tail has no known sentinel — the storm is real but the
+ * log does not say why, and the surfaces should say exactly that.
+ */
+export declare function diagnoseGatewayLog(text: string): GatewayLogDiagnosis | null;
+/** Default locations of the Gateway's launchd stdout log, most likely first. */
+export declare function defaultGatewayLogPaths(home?: string): string[];
+/**
+ * Read the last `maxBytes` of the first readable log path. Best-effort:
+ * an unreadable or absent log yields an empty string, never a throw —
+ * the storm is still reported, only without a reason.
+ */
+export declare function readGatewayLogTail(paths?: string[], maxBytes?: number): Promise<string>;
+/** One line for the timeline row and the daemon log; ≤ ~180 chars. */
+export declare function formatGatewayInstability(i: GatewayInstability): string;
+export declare function describeKind(kind: GatewayInstabilityKind): string;
+//# sourceMappingURL=openclaw-gateway-stability.d.ts.map

package/dist/openclaw-gateway-stability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openclaw-gateway-stability.d.ts","sourceRoot":"","sources":["../src/openclaw-gateway-stability.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAMH,eAAO,MAAM,sBAAsB,QAAc,CAAC;AAClD,eAAO,MAAM,sBAAsB,IAAI,CAAC;AAExC,0EAA0E;AAC1E,eAAO,MAAM,sBAAsB,QAAY,CAAC;AAEhD,MAAM,MAAM,sBAAsB,GAC9B,sBAAsB,GACtB,cAAc,GACd,kBAAkB,GAClB,gBAAgB,GAChB,kBAAkB,CAAC;AAEvB,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,sBAAsB,CAAC;IAC7B,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAC;IACb,yDAAyD;IACzD,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,kBAAkB;IACjC,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,iEAAiE;IACjE,KAAK,EAAE,MAAM,CAAC;IACd,gEAAgE;IAChE,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,mBAAmB,GAAG,IAAI,CAAC;CACvC;AA8CD,qBAAa,kBAAkB;IAI3B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAJ5B,OAAO,CAAC,MAAM,CAAgB;gBAGX,QAAQ,GAAE,MAA+B,EACzC,SAAS,GAAE,MAA+B;IAG7D,wFAAwF;IACxF,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAM7B;;;OAGG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;IASzF,OAAO,CAAC,KAAK;CAId;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,mBAAmB,GAAG,IAAI,CAW3E;AAED,gFAAgF;AAChF,wBAAgB,sBAAsB,CAAC,IAAI,GAAE,MAAkB,GAAG,MAAM,EAAE,CAEzE;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,GAAE,MAAM,EAA6B,EAC1C,QAAQ,GAAE,MAA+B,GACxC,OAAO,CAAC,MAAM,CAAC,CAiBjB;AAED,sEAAsE;AACtE,wBAAgB,wBAAwB,CAAC,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAKtE;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,sBAAsB,GAAG,MAAM,CAQjE"}

package/dist/openclaw-gateway-stability.js

@@ -0,0 +1,176 @@
+/**
+ * OpenClaw Gateway instability — detect a restart storm and say why.
+ *
+ * A Gateway restart is invisible from inside the daemon: the socket closes,
+ * `disconnectGatewayAdapter` tears the virtual session down, the probe finds
+ * the port again a few seconds later and everything reconnects. Each cycle
+ * looks like a healthy recovery, and a surface that watched it saw the
+ * OpenClaw row flip to `gateway_not_found` and back. On 2026-09-02 that
+ * happened eleven times in ninety minutes and nothing anywhere said so —
+ * the daemon log carried eleven `connected` lines, every dashboard showed
+ * a connected Gateway between flaps, and the cause (two OpenClaw installs
+ * fighting over `~/.openclaw/state`, a launchd KeepAlive respawning a
+ * Gateway whose startup migration could not run because the other copy
+ * held the state, and a plugin install restarting it on top) was written
+ * only in OpenClaw's own log, which no surface reads.
+ *
+ * Two pieces, both pure so a test can drive them with a clock and a string:
+ *
+ * - `GatewayFlapTracker` counts disconnects inside a rolling window. Three
+ *   in ten minutes is the line between "a plugin install restarted it" and
+ *   "something is wrong": a single deliberate restart never crosses it, and
+ *   the measured storm crossed it inside four minutes.
+ * - `diagnoseGatewayLog` reads the Gateway's own log tail for the sentences
+ *   OpenClaw prints when it knows what is happening. Structural causes
+ *   (another Gateway owns the state directory, the restart-loop breaker
+ *   tripped, a startup migration refused to complete) outrank routine ones
+ *   (a config-change restart, a plain SIGTERM) regardless of which line is
+ *   newer, because the routine restart is usually the symptom that the
+ *   structural cause produced.
+ *
+ * The daemon surfaces the result three ways so it cannot hide: a loud log
+ * line, an `instability` field on `/status` and `/health`, and one `error`
+ * timeline row per escalation on the virtual `openclaw-gateway` session —
+ * the timeline is the one channel every surface already renders, Android
+ * and e-ink included, without a protocol change.
+ */
+import { open } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+export const GATEWAY_FLAP_WINDOW_MS = 10 * 60_000;
+export const GATEWAY_FLAP_THRESHOLD = 3;
+/** Bytes read from the end of the Gateway log when diagnosing a storm. */
+export const GATEWAY_LOG_TAIL_BYTES = 64 * 1024;
+/**
+ * Sentinels in priority order. The first kind found anywhere in the tail
+ * wins, so a structural cause explains a storm even when the most recent
+ * line is the routine restart it caused.
+ */
+const SENTINELS = [
+    {
+        kind: 'state_owner_conflict',
+        pattern: /another Gateway owns that state directory/i,
+        hint: 'Two OpenClaw Gateways are using one ~/.openclaw/state — usually two installs ' +
+            '(a global npm/pnpm copy beside the app-managed ~/.openclaw/tools runtime). ' +
+            'Keep one; make sure `openclaw` on PATH is ~/.openclaw/bin/openclaw.',
+    },
+    {
+        kind: 'restart_loop',
+        pattern: /restart-loop breaker tripped/i,
+        hint: 'OpenClaw\'s own breaker saw repeated unclean boots; launchd KeepAlive is ' +
+            'respawning a Gateway that cannot come up. Read ~/Library/Logs/openclaw/gateway.log.',
+    },
+    {
+        kind: 'migration_failed',
+        pattern: /startup migrations did not complete cleanly|migration requires stopped-writer maintenance/i,
+        hint: 'A startup migration refused to run because another writer holds the state. ' +
+            'Stop every other Gateway, then restart this one once.',
+    },
+    {
+        kind: 'config_restart',
+        pattern: /config change requires gateway restart|received SIGUSR1; restarting|Restart the gateway to (apply|load)/i,
+        hint: 'A config or plugin change asked the Gateway to restart. Expected once; a storm of these is not.',
+    },
+    {
+        kind: 'external_sigterm',
+        pattern: /received SIGTERM; shutting down/i,
+        hint: 'Something sent the Gateway SIGTERM (a CLI restart, an updater, or launchd). Check who.',
+    },
+];
+export class GatewayFlapTracker {
+    windowMs;
+    threshold;
+    stamps = [];
+    constructor(windowMs = GATEWAY_FLAP_WINDOW_MS, threshold = GATEWAY_FLAP_THRESHOLD) {
+        this.windowMs = windowMs;
+        this.threshold = threshold;
+    }
+    /** Record a disconnect at `nowMs`; returns the count inside the window including it. */
+    record(nowMs) {
+        this.stamps.push(nowMs);
+        this.prune(nowMs);
+        return this.stamps.length;
+    }
+    /**
+     * How many disconnects are inside the window, and whether that crosses the
+     * line. `since` is the oldest one still counted — the start of the storm.
+     */
+    assess(nowMs) {
+        this.prune(nowMs);
+        return {
+            flapsInWindow: this.stamps.length,
+            unstable: this.stamps.length >= this.threshold,
+            since: this.stamps.length > 0 ? this.stamps[0] : null,
+        };
+    }
+    prune(nowMs) {
+        const cutoff = nowMs - this.windowMs;
+        while (this.stamps.length > 0 && this.stamps[0] < cutoff)
+            this.stamps.shift();
+    }
+}
+/**
+ * Scan a Gateway log tail for the sentence that explains a restart storm.
+ * Returns the highest-priority kind present, carrying its most recent line.
+ * `null` means the tail has no known sentinel — the storm is real but the
+ * log does not say why, and the surfaces should say exactly that.
+ */
+export function diagnoseGatewayLog(text) {
+    if (!text)
+        return null;
+    const lines = text.split(/\r?\n/);
+    for (const sentinel of SENTINELS) {
+        for (let i = lines.length - 1; i >= 0; i--) {
+            if (sentinel.pattern.test(lines[i])) {
+                return { kind: sentinel.kind, line: lines[i].trim().slice(0, 300), hint: sentinel.hint };
+            }
+        }
+    }
+    return null;
+}
+/** Default locations of the Gateway's launchd stdout log, most likely first. */
+export function defaultGatewayLogPaths(home = homedir()) {
+    return [join(home, 'Library', 'Logs', 'openclaw', 'gateway.log')];
+}
+/**
+ * Read the last `maxBytes` of the first readable log path. Best-effort:
+ * an unreadable or absent log yields an empty string, never a throw —
+ * the storm is still reported, only without a reason.
+ */
+export async function readGatewayLogTail(paths = defaultGatewayLogPaths(), maxBytes = GATEWAY_LOG_TAIL_BYTES) {
+    for (const path of paths) {
+        let handle;
+        try {
+            handle = await open(path, 'r');
+            const { size } = await handle.stat();
+            const length = Math.min(size, maxBytes);
+            const buffer = Buffer.alloc(length);
+            await handle.read(buffer, 0, length, size - length);
+            return buffer.toString('utf8');
+        }
+        catch {
+            continue;
+        }
+        finally {
+            await handle?.close().catch(() => { });
+        }
+    }
+    return '';
+}
+/** One line for the timeline row and the daemon log; ≤ ~180 chars. */
+export function formatGatewayInstability(i) {
+    const minutes = Math.max(1, Math.round((i.lastFlapAt - i.since) / 60_000));
+    const head = `OpenClaw Gateway unstable · ${i.flapsInWindow} restarts in ${minutes} min`;
+    const why = i.diagnosis ? describeKind(i.diagnosis.kind) : 'reason not in the Gateway log';
+    return `${head} — ${why}`;
+}
+export function describeKind(kind) {
+    switch (kind) {
+        case 'state_owner_conflict': return 'two Gateways own ~/.openclaw/state (duplicate install?)';
+        case 'restart_loop': return 'OpenClaw restart-loop breaker tripped';
+        case 'migration_failed': return 'startup migration blocked by another writer';
+        case 'config_restart': return 'config/plugin change restarts';
+        case 'external_sigterm': return 'repeated external SIGTERM';
+    }
+}
+//# sourceMappingURL=openclaw-gateway-stability.js.map

package/dist/openclaw-gateway-stability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openclaw-gateway-stability.js","sourceRoot":"","sources":["../src/openclaw-gateway-stability.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,GAAG,MAAM,CAAC;AAClD,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAExC,0EAA0E;AAC1E,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,CAAC;AA2BhD;;;;GAIG;AACH,MAAM,SAAS,GAIV;IACH;QACE,IAAI,EAAE,sBAAsB;QAC5B,OAAO,EAAE,4CAA4C;QACrD,IAAI,EACF,+EAA+E;YAC/E,6EAA6E;YAC7E,qEAAqE;KACxE;IACD;QACE,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,+BAA+B;QACxC,IAAI,EACF,2EAA2E;YAC3E,qFAAqF;KACxF;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,OAAO,EAAE,4FAA4F;QACrG,IAAI,EACF,6EAA6E;YAC7E,uDAAuD;KAC1D;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,0GAA0G;QACnH,IAAI,EAAE,iGAAiG;KACxG;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,OAAO,EAAE,kCAAkC;QAC3C,IAAI,EAAE,wFAAwF;KAC/F;CACF,CAAC;AAEF,MAAM,OAAO,kBAAkB;IAIV;IACA;IAJX,MAAM,GAAa,EAAE,CAAC;IAE9B,YACmB,WAAmB,sBAAsB,EACzC,YAAoB,sBAAsB;QAD1C,aAAQ,GAAR,QAAQ,CAAiC;QACzC,cAAS,GAAT,SAAS,CAAiC;IAC1D,CAAC;IAEJ,wFAAwF;IACxF,MAAM,CAAC,KAAa;QAClB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAClB,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;IAC5B,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,KAAa;QAClB,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAClB,OAAO;YACL,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;YACjC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,SAAS;YAC9C,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI;SACtD,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,KAAa;QACzB,MAAM,MAAM,GAAG,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC;QACrC,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM;YAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IAChF,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3C,IAAI,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC3F,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,sBAAsB,CAAC,OAAe,OAAO,EAAE;IAC7D,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC,CAAC;AACpE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,QAAkB,sBAAsB,EAAE,EAC1C,WAAmB,sBAAsB;IAEzC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC/B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YACrC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YACxC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,GAAG,MAAM,CAAC,CAAC;YACpD,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,wBAAwB,CAAC,CAAqB;IAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC;IAC3E,MAAM,IAAI,GAAG,+BAA+B,CAAC,CAAC,aAAa,gBAAgB,OAAO,MAAM,CAAC;IACzF,MAAM,GAAG,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,+BAA+B,CAAC;IAC3F,OAAO,GAAG,IAAI,MAAM,GAAG,EAAE,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAA4B;IACvD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,sBAAsB,CAAC,CAAC,OAAO,yDAAyD,CAAC;QAC9F,KAAK,cAAc,CAAC,CAAC,OAAO,uCAAuC,CAAC;QACpE,KAAK,kBAAkB,CAAC,CAAC,OAAO,6CAA6C,CAAC;QAC9E,KAAK,gBAAgB,CAAC,CAAC,OAAO,+BAA+B,CAAC;QAC9D,KAAK,kBAAkB,CAAC,CAAC,OAAO,2BAA2B,CAAC;IAC9D,CAAC;AACH,CAAC"}

package/dist/pairing-knocks.d.ts

@@ -0,0 +1,80 @@
+/**
+ * A knock is worth showing for this long after its last attempt. Long enough
+ * that the operator can walk to the machine; short enough that a device carried
+ * out of the building stops being offered.
+ */
+export declare const KNOCK_TTL_MS: number;
+/** Cap on simultaneously-tracked peers. */
+export declare const MAX_KNOCKS = 12;
+export interface PairingKnock {
+    /**
+     * What an approval will be recorded against. `device:<id>` when the client
+     * identified itself, `ip:<addr>` otherwise — never the bare string, so the
+     * two can never collide or be confused downstream.
+     */
+    key: string;
+    ip: string;
+    deviceId: string | null;
+    attempts: number;
+    firstSeen: number;
+    lastSeen: number;
+    /**
+     * True when the peer presented a token we do not accept, rather than no token
+     * at all. Reads very differently to an operator: usually a provisioned device
+     * whose credential went stale, not a new device.
+     */
+    staleToken: boolean;
+    /** Display only — `key` already encodes which kind this is. */
+    deviceScoped: boolean;
+}
+export interface PairingApproval {
+    key: string;
+    /**
+     * Where it last connected from. Display only — an approval keyed on a device
+     * id must not start depending on the address, or it would silently reacquire
+     * the NAT and DHCP problems it exists to escape.
+     */
+    lastIP: string;
+    approvedAt: number;
+    deviceId: string | null;
+}
+/**
+ * The one place a key is spelled, so the gate, the store and the UI cannot
+ * disagree about what "this peer" means.
+ */
+export declare function peerKey(ip: string, deviceId: unknown): string;
+/**
+ * Called from the refusal path. Cheap on purpose — it runs for every rejected
+ * handshake, and a looping device produces one every few seconds.
+ */
+export declare function recordKnock(ip: string, deviceId: unknown, staleToken: boolean, now?: number): void;
+/** Live knocks, newest first. Expiry is applied here — see the header. */
+export declare function pairingKnocks(now?: number): PairingKnock[];
+/**
+ * Drop a knock without approving it. Not a block: the peer may knock again,
+ * which is deliberate — a permanent denylist keyed on an address a stranger can
+ * change is security theatre, and it would silently strand a real device that
+ * later inherits that address.
+ */
+export declare function dismissKnock(key: string): boolean;
+/**
+ * Approving is what a pairing code would have done, minus the typing: from here
+ * on this peer authenticates by its key. Persisted immediately.
+ */
+export declare function approvePeer(key: string, now?: number): boolean;
+export declare function revokePeer(key: string): boolean;
+/**
+ * The question the WebSocket gate asks.
+ *
+ * A device id wins when the client sent one; the address is consulted only as
+ * the legacy path, so a client that adopts the header stops depending on its
+ * address the moment it does. Both are checked rather than one, because a
+ * device approved by address before it learned to send an id must not be locked
+ * out by the upgrade that taught it.
+ */
+export declare function isApprovedPeer(ip: string, deviceId: unknown): boolean;
+export declare function pairingApprovals(): PairingApproval[];
+/** Read the device id a client offered on the handshake, if any. */
+export declare function deviceIdFromHeaders(headers: Record<string, string | string[] | undefined> | undefined, headerName: string): string | null;
+export declare function resetPairingKnocksForTests(): void;
+//# sourceMappingURL=pairing-knocks.d.ts.map

package/dist/pairing-knocks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pairing-knocks.d.ts","sourceRoot":"","sources":["../src/pairing-knocks.ts"],"names":[],"mappings":"AAgEA;;;;GAIG;AACH,eAAO,MAAM,YAAY,QAAc,CAAC;AAExC,2CAA2C;AAC3C,eAAO,MAAM,UAAU,KAAK,CAAC;AAE7B,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,UAAU,EAAE,OAAO,CAAC;IACpB,+DAA+D;IAC/D,YAAY,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED;;;GAGG;AACH,wBAAgB,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,MAAM,CAI7D;AA8ID;;;GAGG;AACH,wBAAgB,WAAW,CACzB,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE,OAAO,EACjB,UAAU,EAAE,OAAO,EACnB,GAAG,SAAa,GACf,IAAI,CAwBN;AAED,0EAA0E;AAC1E,wBAAgB,aAAa,CAAC,GAAG,SAAa,GAAG,YAAY,EAAE,CAK9D;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEjD;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,SAAa,GAAG,OAAO,CAQlE;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAK/C;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,OAAO,CAMrE;AAED,wBAAgB,gBAAgB,IAAI,eAAe,EAAE,CAEpD;AAED,oEAAoE;AACpE,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,SAAS,EAClE,UAAU,EAAE,MAAM,GACjB,MAAM,GAAG,IAAI,CAGf;AAED,wBAAgB,0BAA0B,IAAI,IAAI,CAGjD"}