@agentdocumentformat/cli 0.8.2 → 0.8.4

package/dist/chunks/{chunk-7JZXMDDF.mjs → chunk-7ADDKFT5.mjs}

@@ -4,6 +4,9 @@ import { dirname as __adfDirname } from 'node:path';
 const require = __adfCreateRequire(import.meta.url);
 const __filename = __adfFileURLToPath(import.meta.url);
 const __dirname = __adfDirname(__filename);
+import {
+  parseOwnerCommandRow
+} from "./chunk-NRTRTR7C.mjs";
 import {
   attachmentsOf,
   displayAttachment,
@@ -14,34 +17,6 @@ import {
   __export
 } from "./chunk-M2RX3S2T.mjs";
 
-// src/shared/utils/owner-command-row.ts
-var owner_command_row_exports = {};
-__export(owner_command_row_exports, {
-  OWNER_COMMAND_MARKER: () => OWNER_COMMAND_MARKER,
-  formatOwnerCommandRow: () => formatOwnerCommandRow,
-  isOwnerCommandRow: () => isOwnerCommandRow,
-  parseOwnerCommandRow: () => parseOwnerCommandRow
-});
-var OWNER_COMMAND_MARKER = "[Owner command] ";
-function formatOwnerCommandRow(header, body) {
-  return `${OWNER_COMMAND_MARKER}${JSON.stringify(header)}
-${body}`;
-}
-function parseOwnerCommandRow(text) {
-  if (!text.startsWith(OWNER_COMMAND_MARKER)) return null;
-  let newline = text.indexOf(`
-`);
-  try {
-    let header = JSON.parse(text.slice(OWNER_COMMAND_MARKER.length, newline < 0 ? void 0 : newline));
-    return !header || header.v !== 1 || typeof header.id != "string" || typeof header.command != "string" || typeof header.lambda != "string" || typeof header.authorized != "boolean" || typeof header.duration_ms != "number" || !Number.isFinite(header.duration_ms) || header.duration_ms < 0 || !["ok", "error", "denied"].includes(header.status) ? null : { header, body: newline < 0 ? "" : text.slice(newline + 1) };
-  } catch {
-    return null;
-  }
-}
-function isOwnerCommandRow(text) {
-  return parseOwnerCommandRow(text) !== null;
-}
-
 // src/shared/utils/loop-parser.ts
 var loop_parser_exports = {};
 __export(loop_parser_exports, {
@@ -447,11 +422,110 @@ function loopToLLMMessages(entries) {
   }));
 }
 
+// src/shared/utils/ask-form.ts
+var ask_form_exports = {};
+__export(ask_form_exports, {
+  ASK_ALL_SKIPPED: () => ASK_ALL_SKIPPED,
+  ASK_SKIPPED: () => ASK_SKIPPED,
+  AskAnswerError: () => AskAnswerError,
+  askQuestions: () => askQuestions,
+  formatAskAnswers: () => formatAskAnswers,
+  normalizeAskAnswers: () => normalizeAskAnswers,
+  parseAskResult: () => parseAskResult,
+  summarizeAsk: () => summarizeAsk
+});
+var ASK_SKIPPED = "(skipped)", ASK_ALL_SKIPPED = "The human skipped all questions.", AskAnswerError = class extends Error {
+  constructor(message) {
+    super(message), this.name = "AskAnswerError";
+  }
+};
+function askQuestions(input) {
+  let obj = input && typeof input == "object" ? input : {};
+  if (Array.isArray(obj.questions)) {
+    let out = [];
+    for (let raw of obj.questions) {
+      if (!raw || typeof raw != "object") continue;
+      let q = raw;
+      if (typeof q.question != "string") continue;
+      let options = Array.isArray(q.options) ? q.options.flatMap((o) => {
+        if (o && typeof o == "object" && typeof o.label == "string") {
+          let { label, description } = o;
+          return [typeof description == "string" && description ? { label, description } : { label }];
+        }
+        return [];
+      }) : [];
+      out.push({
+        question: q.question,
+        ...options.length > 0 ? { options } : {},
+        ...options.length > 0 && q.multiple === !0 ? { multiple: !0 } : {}
+      });
+    }
+    return out;
+  }
+  return typeof obj.question == "string" ? [{ question: obj.question }] : [];
+}
+function summarizeAsk(questions) {
+  if (questions.length === 0) return "";
+  let first = questions[0].question;
+  return questions.length > 1 ? `${first} (+${questions.length - 1} more)` : first;
+}
+function normalizeAskAnswers(questions, raw) {
+  if (!Array.isArray(raw)) throw new AskAnswerError("answers must be an array with one entry per question");
+  if (raw.length !== questions.length)
+    throw new AskAnswerError(`answers has ${raw.length} entries but the ask has ${questions.length} question${questions.length === 1 ? "" : "s"}`);
+  return questions.map((q, i) => {
+    let value = raw[i], n = i + 1;
+    if (value == null) return null;
+    if (typeof value == "string") return value.trim() || null;
+    if (!Array.isArray(value) || value.some((v) => typeof v != "string"))
+      throw new AskAnswerError(`answer ${n} must be a string, an array of strings, or null`);
+    let picks = value.map((v) => v.trim()).filter(Boolean);
+    return picks.length === 0 ? null : q.multiple ? picks : picks.join(", ");
+  });
+}
+function answerText(q, answer) {
+  if (answer === null) return ASK_SKIPPED;
+  let labels = new Set((q.options ?? []).map((o) => o.label)), picks = Array.isArray(answer) ? answer : [answer];
+  return q.options ? picks.map((p) => labels.has(p) ? p : `Other: ${p}`).join(", ") : picks.join(", ");
+}
+function formatAskAnswers(questions, answers) {
+  return answers.every((a) => a === null) ? ASK_ALL_SKIPPED : questions.map((q, i) => `Q: ${q.question}
+A: ${answerText(q, answers[i] ?? null)}`).join(`
+
+`);
+}
+var LEGACY_PREFIX = "Human answered: ";
+function parseAskResult(questions, result) {
+  if (result === ASK_ALL_SKIPPED) return questions.map(() => null);
+  if (result.startsWith(LEGACY_PREFIX)) {
+    let text = result.slice(LEGACY_PREFIX.length);
+    return questions.map((_, i) => i === 0 && text && text !== "[skipped]" ? text : null);
+  }
+  let out = [], cursor = 0;
+  for (let i = 0; i < questions.length; i++) {
+    let head = `Q: ${questions[i].question}
+A: `, start = result.indexOf(head, cursor);
+    if (start < 0) {
+      out.push(null);
+      continue;
+    }
+    let bodyStart = start + head.length, next = i + 1 < questions.length ? result.indexOf(`
+
+Q: ${questions[i + 1].question}
+A: `, bodyStart) : -1, body = next < 0 ? result.slice(bodyStart) : result.slice(bodyStart, next);
+    out.push(body === ASK_SKIPPED ? null : body), cursor = next < 0 ? result.length : next;
+  }
+  return out;
+}
+
 export {
-  formatOwnerCommandRow,
-  owner_command_row_exports,
   formatTurnErrorRow,
   providerContextCategory,
   parseLoopToDisplay,
-  loop_parser_exports
+  loop_parser_exports,
+  AskAnswerError,
+  summarizeAsk,
+  normalizeAskAnswers,
+  formatAskAnswers,
+  ask_form_exports
 };

package/dist/chunks/chunk-A53XYNJL.mjs

@@ -0,0 +1,26 @@
+import { createRequire as __adfCreateRequire } from 'node:module';
+import { fileURLToPath as __adfFileURLToPath } from 'node:url';
+import { dirname as __adfDirname } from 'node:path';
+const require = __adfCreateRequire(import.meta.url);
+const __filename = __adfFileURLToPath(import.meta.url);
+const __dirname = __adfDirname(__filename);
+
+// src/main/utils/network.ts
+import { hostname, networkInterfaces } from "node:os";
+function getLanAddresses() {
+  let ifaces = networkInterfaces(), addresses = [];
+  for (let [iface, infos] of Object.entries(ifaces))
+    if (infos)
+      for (let info of infos)
+        info.internal || info.family === "IPv6" && info.address.toLowerCase().startsWith("fe80") || addresses.push({
+          iface,
+          address: info.address,
+          family: info.family === "IPv4" ? "IPv4" : "IPv6",
+          mac: info.mac
+        });
+  return addresses.sort((a, b) => a.family !== b.family ? a.family === "IPv4" ? -1 : 1 : a.iface.localeCompare(b.iface)), { hostname: hostname(), addresses };
+}
+
+export {
+  getLanAddresses
+};

package/dist/chunks/{chunk-MZRXFWPQ.mjs → chunk-AN6USKYQ.mjs}

@@ -4,6 +4,9 @@ import { dirname as __adfDirname } from 'node:path';
 const require = __adfCreateRequire(import.meta.url);
 const __filename = __adfFileURLToPath(import.meta.url);
 const __dirname = __adfDirname(__filename);
+import {
+  compareVersions
+} from "./chunk-26RK7T5L.mjs";
 
 // src/main/providers/claude-subscription/auth-manager.ts
 import { execFile as execFile2, spawn } from "node:child_process";
@@ -58,14 +61,6 @@ function runVersion(path) {
     });
   });
 }
-function compareVersions(a, b) {
-  let pa = a.split(".").map(Number), pb = b.split(".").map(Number);
-  for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
-    let d = (pa[i] ?? 0) - (pb[i] ?? 0);
-    if (d !== 0) return d < 0 ? -1 : 1;
-  }
-  return 0;
-}
 var cached = null, inflight = null, CACHE_MS = 6e4;
 async function runProbe() {
   let paths = await candidatePaths(), versions = await Promise.all(paths.map(runVersion)), install = null;
@@ -93,6 +88,34 @@ async function requireClaudeCode() {
     );
   return probe.install;
 }
+var NATIVE_INSTALL = isWindows ? { cmd: "powershell.exe", args: ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-Command", "irm https://claude.ai/install.ps1 | iex"] } : { cmd: "bash", args: ["-c", "set -o pipefail; curl -fsSL https://claude.ai/install.sh | bash"] }, INSTALL_TIMEOUT_MS = 10 * 6e4;
+function runInstallStep(cmd, args) {
+  return new Promise((resolve) => {
+    execFile(cmd, args, { timeout: INSTALL_TIMEOUT_MS, windowsHide: !0, env: claudeCodeEnv(), maxBuffer: 4 * 1024 * 1024 }, (err, stdout, stderr) => {
+      resolve({ ok: !err, output: `${stdout}
+${stderr}${err && !stdout && !stderr ? err.message : ""}` });
+    });
+  });
+}
+function lastLine(output) {
+  return output.replace(/\u001b\[[0-9;?]*[ -/]*[@-~]/g, "").trim().split(`
+`).map((l) => l.trim()).filter(Boolean).pop() ?? "";
+}
+var installing = null;
+function installClaudeCode() {
+  return installing || (installing = runInstall().finally(() => {
+    installing = null;
+  })), installing;
+}
+async function runInstall() {
+  let probe = await probeClaudeCode(!0);
+  if (probe.found && probe.supported || probe.found && (await runInstallStep(probe.install.path, ["update"]), probe = await probeClaudeCode(!0), probe.found && probe.supported))
+    return probe.install;
+  let { ok, output } = await runInstallStep(NATIVE_INSTALL.cmd, NATIVE_INSTALL.args);
+  if (probe = await probeClaudeCode(!0), probe.found && probe.supported) return probe.install;
+  let detail = lastLine(output);
+  throw probe.found ? new Error(`Claude Code ${probe.install.version} is installed; ADF needs ${MIN_CLAUDE_CODE_VERSION} or newer.${detail ? ` ${detail}` : ""}`) : new Error(`Claude Code could not be installed${ok ? "" : `: ${detail || "the installer failed"}`}. Install it from ${CLAUDE_CODE_INSTALL_URL}.`);
+}
 var CLAUDE_ENV_DENY = /^(CLAUDE_CODE_|ANTHROPIC_|CLAUDECODE$)/i;
 function claudeCodeEnv(extra) {
   let env = {};
@@ -180,6 +203,15 @@ var ClaudeAuthManager = class {
       ...cli.subscriptionType ? { plan: cli.subscriptionType } : {}
     } : { authenticated: !1, installed: !0, ...version, ...pending, ...this.lastFlowError ? { flowError: this.lastFlowError } : {} };
   }
+  /** Install or update Claude Code on this machine, then report the fresh status. */
+  async install() {
+    try {
+      await installClaudeCode();
+    } finally {
+      this.invalidateStatus();
+    }
+    return this.getAuthStatus({ fresh: !0 });
+  }
   async isAuthenticated() {
     return (await this.getAuthStatus()).authenticated;
   }

package/dist/chunks/{chunk-2Z7X3UUR.mjs → chunk-DHO5Z6HP.mjs}

@@ -4,18 +4,6 @@ import { dirname as __adfDirname } from 'node:path';
 const require = __adfCreateRequire(import.meta.url);
 const __filename = __adfFileURLToPath(import.meta.url);
 const __dirname = __adfDirname(__filename);
-import {
-  WELCOME_OVERLAY
-} from "./chunk-O7XKQ6CH.mjs";
-import {
-  mcp_config_exports,
-  mcp_registry_exports,
-  provider_catalog_exports
-} from "./chunk-SOSPQPEN.mjs";
-import {
-  Box_default,
-  Text
-} from "./chunk-3AT7IIP7.mjs";
 import {
   useTheme
 } from "./chunk-NZLEPJ5M.mjs";
@@ -25,6 +13,20 @@ import {
 import {
   cjs
 } from "./chunk-SGUTYISF.mjs";
+import {
+  WELCOME_OVERLAY
+} from "./chunk-O7XKQ6CH.mjs";
+import {
+  mcp_registry_exports,
+  provider_catalog_exports
+} from "./chunk-TDRQG5UO.mjs";
+import {
+  mcp_config_exports
+} from "./chunk-HONGRUAE.mjs";
+import {
+  Box_default,
+  Text
+} from "./chunk-WZ6S3SQP.mjs";
 import {
   require_react
 } from "./chunk-6GJ4QHRI.mjs";

package/dist/chunks/{chunk-F5ELW46V.mjs → chunk-GJYMGPH4.mjs}

@@ -23,5 +23,6 @@ var import_stream = __toESM(require_stream(), 1), import_extension = __toESM(req
 var wrapper_default = import_websocket.default;
 
 export {
+  import_websocket_server,
   wrapper_default
 };

package/dist/chunks/chunk-HONGRUAE.mjs

@@ -0,0 +1,175 @@
+import { createRequire as __adfCreateRequire } from 'node:module';
+import { fileURLToPath as __adfFileURLToPath } from 'node:url';
+import { dirname as __adfDirname } from 'node:path';
+const require = __adfCreateRequire(import.meta.url);
+const __filename = __adfFileURLToPath(import.meta.url);
+const __dirname = __adfDirname(__filename);
+import {
+  __export
+} from "./chunk-M2RX3S2T.mjs";
+
+// src/shared/utils/mcp-config.ts
+var mcp_config_exports = {};
+__export(mcp_config_exports, {
+  MCP_EXECUTABLE_IDENTITY_FIELDS: () => MCP_EXECUTABLE_IDENTITY_FIELDS,
+  buildEnvSchemaFromKeys: () => buildEnvSchemaFromKeys,
+  buildHeaderEnvSchemaFromEntries: () => buildHeaderEnvSchemaFromEntries,
+  buildMcpServerConfigFromRegistration: () => buildMcpServerConfigFromRegistration,
+  deriveRegistrationTestPlan: () => deriveRegistrationTestPlan,
+  getMcpRegistrationEnvKeys: () => getMcpRegistrationEnvKeys,
+  isRegistrationAgentVisible: () => isRegistrationAgentVisible,
+  isSensitiveMcpHeader: () => isSensitiveMcpHeader,
+  mcpCredentialNamespace: () => mcpCredentialNamespace,
+  mcpCredentialRef: () => mcpCredentialRef,
+  pinServerConfigToRegistration: () => pinServerConfigToRegistration,
+  reconcileHostApprovedRegistrations: () => reconcileHostApprovedRegistrations,
+  registrationSourceIdentity: () => registrationSourceIdentity,
+  sameExecutableIdentity: () => sameExecutableIdentity,
+  suggestedAgentVisible: () => suggestedAgentVisible
+});
+function sourcePackage(source) {
+  let s = source;
+  return s.npm_package ?? s.npmPackage ?? s.pypi_package ?? s.pypiPackage;
+}
+function mcpCredentialNamespace(source) {
+  return sourcePackage(source) ?? source.name;
+}
+function mcpCredentialRef(source, key) {
+  return `mcp:${mcpCredentialNamespace(source)}:${key}`;
+}
+function isSensitiveMcpHeader(header) {
+  let normalized = header.trim().toLowerCase();
+  return normalized === "authorization" || normalized === "proxy-authorization" || normalized === "x-api-key" || normalized === "api-key" || normalized === "apikey" || normalized === "x-auth-token" || normalized === "x-access-token" || normalized.includes("token") || normalized.includes("secret") || normalized.includes("credential");
+}
+function buildEnvSchemaFromKeys(source, keys, scope, requiredKeys = keys) {
+  let required = new Set(requiredKeys);
+  return [...new Set(keys.filter(Boolean))].map((key) => ({
+    key,
+    scope,
+    required: required.has(key) || void 0,
+    credential_ref: scope === "app" ? mcpCredentialRef(source, key) : void 0
+  }));
+}
+function buildHeaderEnvSchemaFromEntries(source, entries, appScoped = !0) {
+  return entries.filter((entry) => entry.header && entry.env).map((entry) => ({
+    header: entry.header,
+    env: entry.env,
+    required: !0,
+    credential_ref: appScoped ? mcpCredentialRef(source, entry.env) : void 0
+  }));
+}
+function getMcpRegistrationEnvKeys(registration) {
+  return [.../* @__PURE__ */ new Set([
+    ...(registration.env ?? []).map((entry) => entry.key).filter(Boolean),
+    ...registration.bearerTokenEnvVar ? [registration.bearerTokenEnvVar] : [],
+    ...(registration.headerEnv ?? []).map((entry) => entry.value).filter(Boolean)
+  ])];
+}
+function buildMcpServerConfigFromRegistration(registration) {
+  let isHttp = registration.type === "http" || !!registration.url, serverCfg = {
+    name: registration.name,
+    transport: isHttp ? "http" : "stdio"
+  };
+  if (isHttp) {
+    serverCfg.url = registration.url, serverCfg.source = registration.url ? `http:${registration.url}` : "http";
+    let staticHeaders = {};
+    for (let { key, value } of registration.headers ?? [])
+      key && value && !isSensitiveMcpHeader(key) && (staticHeaders[key] = value);
+    Object.keys(staticHeaders).length && (serverCfg.headers = staticHeaders), registration.headerEnv?.length && (serverCfg.header_env = buildHeaderEnvSchemaFromEntries(
+      registration,
+      registration.headerEnv.map(({ key, value }) => ({ header: key, env: value })),
+      (registration.credentialStorage ?? "app") !== "agent"
+    )), registration.oauth ? serverCfg.oauth = !0 : registration.bearerTokenEnvVar && (serverCfg.bearer_token_env_var = registration.bearerTokenEnvVar);
+  } else registration.npmPackage ? (serverCfg.source = `npm:${registration.npmPackage}`, serverCfg.npm_package = registration.npmPackage) : registration.pypiPackage ? (serverCfg.source = `uvx:${registration.pypiPackage}`, serverCfg.pypi_package = registration.pypiPackage) : (serverCfg.source = "custom", serverCfg.command = registration.command, serverCfg.args = registration.args);
+  isHttp || (registration.command && (serverCfg.command = registration.command), registration.args?.length && (serverCfg.args = registration.args));
+  let envKeys = getMcpRegistrationEnvKeys(registration);
+  if (envKeys.length) {
+    let scope = (registration.credentialStorage ?? "app") === "agent" ? "agent" : "app";
+    scope === "agent" && (serverCfg.env_keys = envKeys), serverCfg.env_schema = buildEnvSchemaFromKeys(registration, envKeys, scope);
+  }
+  return registration.toolCallTimeout && (serverCfg.tool_call_timeout_ms = registration.toolCallTimeout * 1e3), !isHttp && registration.runLocation && (serverCfg.run_location = registration.runLocation), registration.credentialFiles?.length && (serverCfg.credential_files = registration.credentialFiles.map((f) => ({
+    path: f.path,
+    ...f.required !== void 0 ? { required: f.required } : {},
+    ...f.writeBack !== void 0 ? { write_back: f.writeBack } : {}
+  }))), serverCfg;
+}
+function pinServerConfigToRegistration(connCfg, registration) {
+  let canonical = buildMcpServerConfigFromRegistration(registration), agentEnvSchema = (connCfg.env_schema ?? []).filter((e) => e.scope === "agent"), mergedEnvSchema = [
+    ...canonical.env_schema ?? [],
+    ...agentEnvSchema.filter(
+      (a) => !(canonical.env_schema ?? []).some((c) => c.key === a.key && c.scope === a.scope)
+    )
+  ];
+  return {
+    ...canonical,
+    // Agent-owned state kept from the .adf copy:
+    env: connCfg.env,
+    env_keys: connCfg.env_keys,
+    available_tools: connCfg.available_tools,
+    restricted: connCfg.restricted,
+    ...mergedEnvSchema.length ? { env_schema: mergedEnvSchema } : {}
+  };
+}
+function suggestedAgentVisible(reg) {
+  return reg.type === "http" || !!reg.url ? !0 : reg.runLocation !== "host";
+}
+function isRegistrationAgentVisible(reg) {
+  return reg.agentVisible ?? suggestedAgentVisible(reg);
+}
+var MCP_EXECUTABLE_IDENTITY_FIELDS = ["type", "url", "command", "args", "npmPackage", "pypiPackage", "oauth"];
+function sameExecutableIdentity(a, b) {
+  let argsA = a.args ?? [], argsB = b.args ?? [];
+  return a.type === b.type && a.url === b.url && !!a.oauth == !!b.oauth && a.command === b.command && a.npmPackage === b.npmPackage && a.pypiPackage === b.pypiPackage && argsA.length === argsB.length && argsA.every((arg, i) => arg === argsB[i]);
+}
+function deriveRegistrationTestPlan(reg, opts) {
+  if (reg.type === "http" || !!reg.url) {
+    let notes2 = reg.oauth ? ["Interactive OAuth sign-in runs in a browser during this test."] : [];
+    return { location: "remote http", authMode: reg.oauth ? "run" : "none", materializeFiles: !1, notes: notes2 };
+  }
+  if (opts?.mcpOnHost && opts.hostAccessEnabled && reg.runLocation !== "shared")
+    return { location: "host", authMode: reg.auth ? "run" : "none", materializeFiles: !0, notes: [] };
+  if (reg.runLocation === "host") {
+    if (!opts?.hostAccessEnabled) {
+      let notes2 = ["Host access is disabled app-wide \u2014 this test ran in the shared container. Turn on Host access in Settings \u2192 Compute to test on the host."];
+      return reg.auth && notes2.push("Authorization for containerized servers happens per-agent when an agent attaches this server."), { location: "shared container", authMode: reg.auth ? "skip" : "none", materializeFiles: !1, notes: notes2 };
+    }
+    return {
+      location: "host",
+      authMode: reg.auth ? "run" : "none",
+      materializeFiles: !0,
+      notes: []
+    };
+  }
+  let notes = [];
+  return reg.auth && notes.push("Authorization for containerized servers happens per-agent when an agent attaches this server."), reg.credentialFiles?.length && notes.push("Credential files for containerized servers are captured per-agent at attach; this test verifies the package launches and lists tools."), { location: "shared container", authMode: reg.auth ? "skip" : "none", materializeFiles: !1, notes };
+}
+function registrationSourceIdentity(reg) {
+  return reg.type === "http" || reg.url ? reg.url ? `http:${reg.url}` : "http" : reg.npmPackage ? `npm:${reg.npmPackage}` : reg.pypiPackage ? `uvx:${reg.pypiPackage}` : "custom";
+}
+function reconcileHostApprovedRegistrations(prev, next, approved, approvedSources) {
+  let result = [...approved], sources = { ...approvedSources ?? {} }, prevByName = new Map(prev.filter((r) => r.name).map((r) => [r.name, r])), nextByName = new Map(next.filter((r) => r.name).map((r) => [r.name, r])), add = (name, reg) => {
+    result.includes(name) || result.push(name), sources[name] = registrationSourceIdentity(reg);
+  }, remove = (name) => {
+    let i = result.indexOf(name);
+    i >= 0 && result.splice(i, 1), delete sources[name];
+  };
+  for (let [name, reg] of nextByName) {
+    let wasHost = prevByName.get(name)?.runLocation === "host", isHost = reg.runLocation === "host" && reg.type !== "http";
+    isHost && !wasHost ? add(name, reg) : !isHost && wasHost ? remove(name) : isHost && wasHost && result.includes(name) && (sources[name] = registrationSourceIdentity(reg));
+  }
+  for (let [name, reg] of prevByName)
+    !nextByName.has(name) && reg.runLocation === "host" && remove(name);
+  return { approved: result, sources };
+}
+
+export {
+  mcpCredentialRef,
+  isSensitiveMcpHeader,
+  buildEnvSchemaFromKeys,
+  buildHeaderEnvSchemaFromEntries,
+  buildMcpServerConfigFromRegistration,
+  pinServerConfigToRegistration,
+  isRegistrationAgentVisible,
+  deriveRegistrationTestPlan,
+  mcp_config_exports
+};

package/dist/chunks/{chunk-AEAJDCVK.mjs → chunk-IM5JKLXO.mjs}

@@ -9,7 +9,7 @@ import {
   openKeychainBackend,
   readLocalProof,
   testSeamsAllowed
-} from "./chunk-BS3USVEA.mjs";
+} from "./chunk-P4G5ZEBI.mjs";
 import {
   daemonSettingsDir,
   readDaemonToken

package/dist/chunks/chunk-J2N63ZUD.mjs

@@ -0,0 +1,12 @@
+import { createRequire as __adfCreateRequire } from 'node:module';
+import { fileURLToPath as __adfFileURLToPath } from 'node:url';
+import { dirname as __adfDirname } from 'node:path';
+const require = __adfCreateRequire(import.meta.url);
+const __filename = __adfFileURLToPath(import.meta.url);
+const __dirname = __adfDirname(__filename);
+import {
+  exitIfUnsafeBrotliRuntime
+} from "./chunk-ZECGH3LT.mjs";
+
+// src/main/utils/brotli-runtime-check.ts
+exitIfUnsafeBrotliRuntime();

package/dist/chunks/{chunk-IMVMSU3A.mjs → chunk-JK6K2BMV.mjs}

@@ -7,13 +7,7 @@ const __dirname = __adfDirname(__filename);
 import {
   DaemonError,
   MAIN_LOOP
-} from "./chunk-75DC5EWN.mjs";
-import {
-  cjs
-} from "./chunk-SGUTYISF.mjs";
-import {
-  daemon_url_exports
-} from "./chunk-AEAJDCVK.mjs";
+} from "./chunk-KBXC5EHK.mjs";
 import {
   __export
 } from "./chunk-M2RX3S2T.mjs";
@@ -212,15 +206,17 @@ var EventStream = class {
     let previous = this.epoch;
     if (this.epoch = epoch, name === "stream.hello") {
       if (previous && previous !== epoch) {
-        this.forgetCursorKeys(), this.lastCursor = -1, this.reportResume({ exact: !1, reason: "epoch_changed", epoch });
+        this.forgetCursorKeys(), this.lastCursor = 0, this.reportResume({ exact: !1, reason: "epoch_changed", epoch });
         return;
       }
-      let oldest = typeof data.oldestCursor == "number" ? data.oldestCursor : null, latest = typeof data.latestCursor == "number" ? data.latestCursor : 0, since = this.lastCursor, lost = since >= 0 && since < latest && (oldest === null || since < oldest - 1);
+      let oldest = typeof data.oldestCursor == "number" ? data.oldestCursor : null, latest = typeof data.latestCursor == "number" ? data.latestCursor : 0, since = this.lastCursor;
+      !previous && since < 0 && this.options.since === void 0 && !this.options.replay && (this.lastCursor = latest);
+      let lost = since >= 0 && since < latest && (oldest === null || since < oldest - 1);
       this.reportResume(lost ? { exact: !1, reason: "evicted", epoch } : { exact: !0, epoch });
       return;
     }
     let reason = data.reason === "epoch_changed" ? "epoch_changed" : "evicted";
-    reason === "epoch_changed" && (this.forgetCursorKeys(), this.lastCursor = -1);
+    reason === "epoch_changed" && (this.forgetCursorKeys(), this.lastCursor = 0);
     let gap = { reason, epoch };
     (typeof data.requestedCursor == "number" || data.requestedCursor === null) && (gap.requestedCursor = data.requestedCursor), (typeof data.oldestCursor == "number" || data.oldestCursor === null) && (gap.oldestCursor = data.oldestCursor), typeof data.latestCursor == "number" && (gap.latestCursor = data.latestCursor), typeof data.dropped == "number" && (gap.dropped = data.dropped);
     try {
@@ -877,9 +873,9 @@ var DaemonClient = class {
   asks(agentId) {
     return this.get(`/agents/${enc(agentId)}/asks`);
   }
-  /** `loop` picks the asking loop when request ids repeat across loops. */
-  answerAsk(agentId, requestId, answer, loop) {
-    return this.post(`/agents/${enc(agentId)}/asks/${enc(requestId)}/respond`, { answer, ...loop ? { loop } : {} });
+  /** One answer per question (`null` = skipped). `loop` picks the asking loop when request ids repeat across loops. */
+  answerAsk(agentId, requestId, answers, loop) {
+    return this.post(`/agents/${enc(agentId)}/asks/${enc(requestId)}/respond`, { answers, ...loop ? { loop } : {} });
   }
   respondSuspend(agentId, resume) {
     return this.post(`/agents/${enc(agentId)}/suspend/respond`, { resume });
@@ -1020,30 +1016,8 @@ function errorMessage2(err) {
   return String(err);
 }
 
-// src/main/tui/api/client.ts
-var { daemonCredentials, resolveDaemonUrl } = cjs(daemon_url_exports), shared = cjs(client_exports), staticCredentials2 = shared.staticCredentials, DaemonClient2 = class _DaemonClient extends shared.DaemonClient {
-  /** `resolved`: options already built for the shared client (derive); `options` is then ignored. */
-  constructor(options = {}, resolved) {
-    super(resolved ?? _DaemonClient.resolve(options));
-  }
-  static resolve(options) {
-    let baseUrl = resolveDaemonUrl(options.baseUrl, options.env), lookup = { localToken: options.localToken, env: options.env, fetch: options.fetch };
-    return {
-      baseUrl,
-      // `--token` belongs to this URL; another daemon (withBaseUrl) gets its
-      // own `--token`, or ADF_DAEMON_TOKEN, or its own local token file (and
-      // local proof, when it is this machine's daemon), never this one.
-      credentials: daemonCredentials(baseUrl, { ...lookup, token: options.token }),
-      credentialsFor: (url, token) => daemonCredentials(url, { ...lookup, token }),
-      fetch: options.fetch,
-      timeoutMs: options.timeoutMs
-    };
-  }
-  derive(options) {
-    return new _DaemonClient({}, options);
-  }
-};
-
 export {
-  DaemonClient2 as DaemonClient
+  staticCredentials,
+  DaemonClient,
+  client_exports
 };

package/dist/chunks/{chunk-75DC5EWN.mjs → chunk-KBXC5EHK.mjs}

@@ -40,5 +40,6 @@ var SUPPORTED_CLIENT_API_VERSION = 2;
 export {
   MAIN_LOOP,
   DaemonError,
+  SUPPORTED_CLIENT_API_VERSION,
   types_exports
 };

package/dist/chunks/chunk-NRTRTR7C.mjs

@@ -0,0 +1,43 @@
+import { createRequire as __adfCreateRequire } from 'node:module';
+import { fileURLToPath as __adfFileURLToPath } from 'node:url';
+import { dirname as __adfDirname } from 'node:path';
+const require = __adfCreateRequire(import.meta.url);
+const __filename = __adfFileURLToPath(import.meta.url);
+const __dirname = __adfDirname(__filename);
+import {
+  __export
+} from "./chunk-M2RX3S2T.mjs";
+
+// src/shared/utils/owner-command-row.ts
+var owner_command_row_exports = {};
+__export(owner_command_row_exports, {
+  OWNER_COMMAND_MARKER: () => OWNER_COMMAND_MARKER,
+  formatOwnerCommandRow: () => formatOwnerCommandRow,
+  isOwnerCommandRow: () => isOwnerCommandRow,
+  parseOwnerCommandRow: () => parseOwnerCommandRow
+});
+var OWNER_COMMAND_MARKER = "[Owner command] ";
+function formatOwnerCommandRow(header, body) {
+  return `${OWNER_COMMAND_MARKER}${JSON.stringify(header)}
+${body}`;
+}
+function parseOwnerCommandRow(text) {
+  if (!text.startsWith(OWNER_COMMAND_MARKER)) return null;
+  let newline = text.indexOf(`
+`);
+  try {
+    let header = JSON.parse(text.slice(OWNER_COMMAND_MARKER.length, newline < 0 ? void 0 : newline));
+    return !header || header.v !== 1 || typeof header.id != "string" || typeof header.command != "string" || typeof header.lambda != "string" || typeof header.authorized != "boolean" || typeof header.duration_ms != "number" || !Number.isFinite(header.duration_ms) || header.duration_ms < 0 || !["ok", "error", "denied"].includes(header.status) ? null : { header, body: newline < 0 ? "" : text.slice(newline + 1) };
+  } catch {
+    return null;
+  }
+}
+function isOwnerCommandRow(text) {
+  return parseOwnerCommandRow(text) !== null;
+}
+
+export {
+  formatOwnerCommandRow,
+  parseOwnerCommandRow,
+  owner_command_row_exports
+};

package/dist/chunks/{chunk-BS3USVEA.mjs → chunk-P4G5ZEBI.mjs}

@@ -66,7 +66,7 @@ function readLocalProof(settingsDir, port = DEFAULT_PORT) {
 }
 function isLocalOnlyRoute(path) {
   let p = path.split("?")[0];
-  return p === "/daemon/shutdown" || p === "/client/reload-credentials" || p === "/client/sessions" || /^\/client\/sessions\/[^/]+\/exit-when-closed$/.test(p) || /^\/client\/sessions\/[^/]+\/quit$/.test(p) || /^\/identity\/(create|restore|import|unlock|lock|confirm-backup|trust-daemon|untrust-daemon)$/.test(p) || /^\/agents\/[^/]+\/identity\/reveal$/.test(p) || p === "/files/agent/identity/reveal" || p === "/settings/providers/keys/reveal" || p === "/remote-access" || p.startsWith("/remote-access/") || p === "/network/peers";
+  return p === "/web/launch" || p === "/daemon/shutdown" || p === "/client/reload-credentials" || p === "/client/sessions" || /^\/client\/sessions\/[^/]+\/exit-when-closed$/.test(p) || /^\/client\/sessions\/[^/]+\/quit$/.test(p) || /^\/identity\/(create|restore|import|unlock|lock|confirm-backup|trust-daemon|untrust-daemon)$/.test(p) || /^\/agents\/[^/]+\/identity\/reveal$/.test(p) || p === "/files/agent/identity/reveal" || p === "/settings/providers/keys/reveal" || p === "/remote-access" || p.startsWith("/remote-access/") || p === "/network/peers";
 }
 function isDeviceRefusedRoute(method, path) {
   let p = path.split("?")[0];