@ait-co/devtools 0.1.92 → 0.1.94

package/dist/panel/index.js

@@ -26561,7 +26561,7 @@ function readGlobalString(key) {
 }
 const TELEMETRY_ENDPOINT = readGlobalString("__TELEMETRY_ENDPOINT__") ?? "https://t.aitc.dev";
 function getVersion() {
-	return "0.1.92";
+	return "0.1.94";
 }
 let panelVisibleSince = null;
 let accumulatedMs = 0;
@@ -30850,7 +30850,7 @@ function Panel() {
 								color: "#666",
 								fontWeight: 400
 							},
-							children: ["v", "0.1.92"]
+							children: ["v", "0.1.94"]
 						}),
 						/* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", {
 							type: "button",

package/dist/{tunnel-DwmbHIBp.cjs → tunnel-D2G3RuGF.cjs}

@@ -41,6 +41,11 @@ const LAUNCHER_URL = "https://devtools.aitc.dev/launcher/";
 * When `opts.name` is given (non-blank), it is added as `&name=` so the launcher
 * partner bar shows the app name instead of the generic default (#498).
 *
+* When `opts.webViewType` is `'game'`, `&navBarType=game` is appended so the
+* launcher enters game nav chrome (floating capsule, no full bar) automatically
+* on scan. `'partner'` is the launcher's implicit default and is not added to
+* keep the URL clean (#584).
+*
 * Back-compat: the second argument may also be a plain string (`relayWssUrl`)
 * for callers that haven't migrated to the options object yet.
 */
@@ -49,6 +54,7 @@ function buildLauncherDeepLink(tunnelUrl, optsOrRelay) {
 	let url = `${LAUNCHER_URL}?url=${encodeURIComponent(tunnelUrl)}`;
 	if (opts.relayWssUrl) url += `&debug=1&relay=${encodeURIComponent(opts.relayWssUrl)}`;
 	if (opts.name !== void 0 && opts.name.trim() !== "") url += `&name=${encodeURIComponent(opts.name.trim())}`;
+	if (opts.webViewType === "game") url += "&navBarType=game";
 	return url;
 }
 /**
@@ -61,7 +67,8 @@ async function printTunnelBanner(url, opts = {}) {
 	const log = opts.log ?? ((m) => console.log(m));
 	const deepLink = buildLauncherDeepLink(url, {
 		relayWssUrl: opts.relayWssUrl,
-		name: opts.name
+		name: opts.name,
+		webViewType: opts.webViewType
 	});
 	log([
 		"",
@@ -273,4 +280,4 @@ exports.printTunnelBanner = printTunnelBanner;
 exports.startQuickTunnel = startQuickTunnel;
 exports.startTunnelDashboard = startTunnelDashboard;
 
-//# sourceMappingURL=tunnel-DwmbHIBp.cjs.map
+//# sourceMappingURL=tunnel-D2G3RuGF.cjs.map

package/dist/tunnel-D2G3RuGF.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"tunnel-D2G3RuGF.cjs","names":[],"sources":["../src/unplugin/tunnel.ts"],"sourcesContent":["/**\n * Cloudflare quick-tunnel helper for the devtools unplugin.\n *\n * Loaded lazily (`await import('./tunnel.js')`) only when the `tunnel` option is\n * on, so `cloudflared` / `qrcode-terminal` are never pulled in for the common\n * case. This is the one place in `@ait-co/devtools` that depends on Node-only\n * APIs (`child_process` via the `cloudflared` wrapper) — keep it thin and out of\n * jsdom unit tests; the spawn path is verified by hand / e2e (same spirit as the\n * \"web 모드는 e2e\" rule in CLAUDE.md). The pure helpers below\n * (`parseTrycloudflareUrl`, `printTunnelBanner`) are unit-tested.\n */\n\nimport { existsSync } from 'node:fs';\nimport { mkdir } from 'node:fs/promises';\nimport { dirname } from 'node:path';\n\n/** Matches the public URL cloudflared prints for an unauthenticated quick tunnel. */\nconst TRYCLOUDFLARE_RE = /https:\\/\\/[a-z0-9-]+\\.trycloudflare\\.com/i;\n\n/**\n * Extract the `https://<sub>.trycloudflare.com` URL from a line of cloudflared\n * output, or `null` if the line doesn't contain one. Pulled out as a pure\n * function so it can be unit-tested without spawning anything.\n */\nexport function parseTrycloudflareUrl(line: string): string | null {\n  const m = line.match(TRYCLOUDFLARE_RE);\n  return m ? m[0] : null;\n}\n\nexport interface PrintTunnelBannerOptions {\n  /** Print an ASCII QR encoding the tunnel URL (default: true). */\n  qr?: boolean;\n  /** Sink for the banner text (default: `console.log`). Injected for testing. */\n  log?: (msg: string) => void;\n  /**\n   * The `wss://` relay URL of the env-2 CDP tunnel, if `tunnel.cdp` is on. When\n   * present the QR deep-link additionally carries `&debug=1&relay=<wss>` so the\n   * framed PWA passes the in-app debug gate and attaches a Chii target — the\n   * same single scan opens screen preview *and* CDP debugging.\n   */\n  relayWssUrl?: string;\n  /**\n   * Human-readable app name to embed as `name=` in the launcher deep-link (#498).\n   * When provided (non-blank), the launcher partner bar shows this name instead of\n   * the generic default.\n   */\n  name?: string;\n  /**\n   * The miniapp's webViewType. When `'game'`, the deep-link carries `&navBarType=game`\n   * so the launcher enters game nav chrome automatically on scan (#584).\n   * `'partner'` (the default) is the launcher's implicit default — not added to\n   * keep the URL clean.\n   */\n  webViewType?: 'partner' | 'game';\n}\n\nconst LAUNCHER_URL = 'https://devtools.aitc.dev/launcher/';\n\n/**\n * Options for {@link buildLauncherDeepLink}.\n */\nexport interface BuildLauncherDeepLinkOptions {\n  /**\n   * `wss://` relay URL for env-2 CDP wiring. When present the deep-link carries\n   * `&debug=1&relay=<wss>`.\n   */\n  relayWssUrl?: string;\n  /**\n   * Human-readable app name shown in the partner nav bar (`name=` param, #498).\n   * Blank / whitespace-only values are not added.\n   */\n  name?: string;\n  /**\n   * The miniapp's webViewType. When `'game'`, adds `&navBarType=game` to the\n   * deep-link so the launcher enters game nav chrome automatically on scan (#584).\n   * `'partner'` (the launcher's implicit default) is not added to keep the URL\n   * clean.\n   */\n  webViewType?: 'partner' | 'game';\n}\n\n/**\n * Build the deep-link URL that QR codes encode: when the launcher PWA is\n * already on the phone's home screen, scanning this opens it directly into the\n * live view for `tunnelUrl` (the launcher consumes `?url=` and clears it).\n * Plain-text raw URL is no longer enough — the launcher gates its setup UI to\n * the installed PWA, so a raw tunnel URL opened in a normal browser tab would\n * land on a \"please install\" screen.\n *\n * When `opts.relayWssUrl` is given (env-2 CDP wiring), the deep-link also carries\n * `&debug=1&relay=<wss>`; the launcher folds those onto the framed tunnel URL so\n * the in-app debug gate's Layer C (`debug=1` opt-in + `relay=<wss>`) is met and\n * a Chii target.js is injected into the live view.\n *\n * When `opts.name` is given (non-blank), it is added as `&name=` so the launcher\n * partner bar shows the app name instead of the generic default (#498).\n *\n * When `opts.webViewType` is `'game'`, `&navBarType=game` is appended so the\n * launcher enters game nav chrome (floating capsule, no full bar) automatically\n * on scan. `'partner'` is the launcher's implicit default and is not added to\n * keep the URL clean (#584).\n *\n * Back-compat: the second argument may also be a plain string (`relayWssUrl`)\n * for callers that haven't migrated to the options object yet.\n */\nexport function buildLauncherDeepLink(\n  tunnelUrl: string,\n  optsOrRelay?: string | BuildLauncherDeepLinkOptions,\n): string {\n  // Normalise the overloaded second argument.\n  const opts: BuildLauncherDeepLinkOptions =\n    typeof optsOrRelay === 'string' ? { relayWssUrl: optsOrRelay } : (optsOrRelay ?? {});\n\n  const base = `${LAUNCHER_URL}?url=${encodeURIComponent(tunnelUrl)}`;\n  let url = base;\n  if (opts.relayWssUrl) {\n    url += `&debug=1&relay=${encodeURIComponent(opts.relayWssUrl)}`;\n  }\n  if (opts.name !== undefined && opts.name.trim() !== '') {\n    url += `&name=${encodeURIComponent(opts.name.trim())}`;\n  }\n  if (opts.webViewType === 'game') {\n    url += '&navBarType=game';\n  }\n  return url;\n}\n\n/**\n * Print the terminal banner announcing the live tunnel: the public URL, an ASCII\n * QR encoding a launcher deep-link, and a one-line note that quick tunnels are\n * ephemeral, unauthenticated and not for production. Pure w.r.t. side effects\n * other than the injected `log` sink and `qrcode-terminal` — unit-tested.\n */\nexport async function printTunnelBanner(\n  url: string,\n  opts: PrintTunnelBannerOptions = {},\n): Promise<void> {\n  const log = opts.log ?? ((m: string) => console.log(m));\n  const deepLink = buildLauncherDeepLink(url, {\n    relayWssUrl: opts.relayWssUrl,\n    name: opts.name,\n    webViewType: opts.webViewType,\n  });\n  const lines: string[] = [\n    '',\n    '  ┌─ @ait-co/devtools · live tunnel ────────────────────────────',\n    `  │  ${url}`,\n    '  │',\n    `  │  Install the launcher PWA once:  ${LAUNCHER_URL}`,\n    '  │  Then scan the QR below — it opens the launcher directly',\n    '  │  into this tunnel URL (no manual paste needed).',\n    ...(opts.relayWssUrl\n      ? [\n          '  │  The same scan also attaches CDP — connect your AI host',\n          '  │  to the relay and debug the live view on-device.',\n        ]\n      : []),\n    '  │  Quick tunnels are unauthenticated, change every run, and are',\n    '  │  not for production use.',\n    '  └──────────────────────────────────────────────────────────────',\n    '',\n  ];\n  log(lines.join('\\n'));\n\n  if (opts.qr !== false) {\n    // qrcode-terminal is only pulled in on this code path (ambient types live\n    // in src/qrcode-terminal.d.ts).\n    const qrcode = (await import('qrcode-terminal')).default;\n    await new Promise<void>((resolve) => {\n      qrcode.generate(deepLink, { small: true }, (out) => {\n        log(out);\n        resolve();\n      });\n    });\n  }\n}\n\n/**\n * Heuristic: can this process open a GUI browser? Mirrors `canOpenBrowser` in\n * `src/mcp/tools.ts` but is re-declared here (not imported) so the tunnel path\n * does not statically pull the heavy MCP `tools.ts` module graph into the lazy\n * `import('./tunnel.js')` chunk. Kept in sync with the MCP copy.\n *\n *   - macOS / Windows → assume yes (env-2 dev normally runs on the user's Mac).\n *   - Linux → require `DISPLAY` or `WAYLAND_DISPLAY`.\n *   - CI (`CI=true`/`CI=1`) → no.\n */\nfunction canOpenBrowser(): boolean {\n  if (process.env.CI === 'true' || process.env.CI === '1') return false;\n  const platform = process.platform;\n  if (platform === 'darwin' || platform === 'win32') return true;\n  if (platform === 'linux') {\n    return Boolean(process.env.DISPLAY ?? process.env.WAYLAND_DISPLAY);\n  }\n  return false;\n}\n\n/** Handle returned by {@link startTunnelDashboard}. */\nexport interface TunnelDashboard {\n  /** `http://127.0.0.1:<port>` — the local dashboard URL opened in the browser. */\n  url: string;\n  /** Tear down the local HTTP server. Idempotent via the underlying server. */\n  close: () => Promise<void>;\n}\n\nexport interface StartTunnelDashboardOptions {\n  /** The public `https://*.trycloudflare.com` app tunnel URL the launcher frames. */\n  tunnelUrl: string;\n  /** The `wss://` relay URL of the env-2 CDP tunnel. REQUIRED — the dashboard is a CDP-only UX. */\n  relayWssUrl: string;\n  /** Mirror of `tunnel.qr` — when `false` the dashboard is skipped (no browser open). */\n  qr?: boolean;\n  /**\n   * Override the GUI/opt-out gate (testing only). When omitted the real\n   * `canOpenBrowser()` + `AIT_AUTO_DEVTOOLS` checks decide.\n   */\n  shouldOpen?: () => boolean;\n  /** Sink for the one-line \"opened in browser\" note (default: `console.log`). Injected for testing. */\n  log?: (msg: string) => void;\n  /**\n   * Human-readable app name to embed as `name=` in the launcher deep-link (#498).\n   * When provided (non-blank), the launcher partner bar shows this name instead of\n   * the generic default.\n   */\n  name?: string;\n}\n\n/**\n * Env-2 UX parity with env 3/4 (issue #408): when CDP wiring is on and a GUI is\n * available, start the SAME `127.0.0.1` HTML dashboard (QR image + connect steps\n * + FAQ) that the MCP `build_attach_url` path serves, and auto-open it in the\n * browser. headless / opt-out falls back to the terminal ASCII QR (printed\n * separately by {@link printTunnelBanner}).\n *\n * Every part the install-graph invariant depends on (`qrcode`, the MCP HTTP\n * server, the opener) is reached only through dynamic `import()` here, inside\n * the already-lazy `tunnel.js` chunk — nothing is added to the common build\n * graph or the MCP-only install graph.\n *\n * TOTP encapsulation: the dashboard's `getDashboardState` closure mints a FRESH\n * TOTP `at=` code on every call via `generateTotp(secret, Date.now())` and folds\n * it into a fresh `buildLauncherAttachUrl(...)`. Because the QR is re-rendered on\n * each SSE push / page reload from this closure, the code a phone scans is always\n * within its 30 s window — no stale code is baked into static HTML.\n *\n * SECRET-HANDLING: the tunnel host, relay wssUrl, TOTP code, and `.ait_relay`\n * value/path are NEVER written to stdout/stderr/logs here. They live only inside\n * the attach URL (HTML body + `/qr.png` query, per qr-http-server's invariant).\n * The only thing opened/logged is `http://127.0.0.1:<port>` (local, safe).\n *\n * @returns the dashboard handle when it started (caller wires `close()` into the\n *   tunnel cleanup), or `undefined` when skipped (no relay, `qr:false`, headless,\n *   opt-out, or a start failure) — in which case ASCII QR fallback stands alone.\n */\nexport async function startTunnelDashboard(\n  opts: StartTunnelDashboardOptions,\n): Promise<TunnelDashboard | undefined> {\n  const log = opts.log ?? ((m: string) => console.log(m));\n\n  // Gate: dashboard is a CDP-only UX (needs a relay to attach to).\n  if (!opts.relayWssUrl) return undefined;\n  // Opt-out via `tunnel.qr:false` (same toggle that suppresses the ASCII QR).\n  if (opts.qr === false) return undefined;\n\n  // GUI + AIT_AUTO_DEVTOOLS gate. Reuse the MCP opener's opt-out predicate so\n  // the env-2 path honours the same `AIT_AUTO_DEVTOOLS=0` switch as env 3/4.\n  const { isAutoDevtoolsDisabled } = await import('../mcp/devtools-opener.js');\n  const gateOpen = opts.shouldOpen ?? (() => !isAutoDevtoolsDisabled() && canOpenBrowser());\n  if (!gateOpen()) return undefined;\n\n  const { startQrHttpServer } = await import('../mcp/qr-http-server.js');\n  const { buildLauncherAttachUrl } = await import('../mcp/deeplink.js');\n  const { generateTotp } = await import('../mcp/totp.js');\n\n  // getDashboardState — mints a fresh TOTP + attach URL on every call so the QR\n  // the dashboard renders (on load and on each SSE push) is never expired.\n  // SECRET-HANDLING: the secret is read from env AT CALL TIME (it was injected\n  // by ensureRelaySecret in the same CDP block) and is used only to compute the\n  // at= code folded into attachUrl. tunnel.up is always true here — the relay\n  // tunnel is already up by the time this runs.\n  const getDashboardState = () => {\n    const secret = process.env.AIT_DEBUG_TOTP_SECRET;\n    const totpCode = secret ? generateTotp(secret, Date.now()) : undefined;\n    const attachUrl = buildLauncherAttachUrl(opts.tunnelUrl, opts.relayWssUrl, totpCode, {\n      name: opts.name,\n    });\n    // pages: null — env 2(unplugin)는 데몬이 아니라 vite 플러그인 안이라\n    // startChiiRelay 핸들이 connected target을 노출하지 않는다. 라이브 page 목록을\n    // 알 수 없으므로 거짓 빈 목록 대신 \"연결된 Pages\" 섹션 자체를 숨긴다(#411).\n    // env 3/4(debug-server.ts)는 router.active.listTargets()로 실제 목록을 채운다.\n    // mode: 'relay-mobile' — 이 대시보드는 항상 환경 2(AITC Sandbox PWA) 전용이므로\n    // /attach 카피가 launcher PWA 절차(sandbox family)로 분기된다(#468).\n    // inspectorUrl: null — env 2에서는 unplugin relay가 connected target ID를 노출하지\n    // 않아 buildChiiInspectorUrl에 필요한 targetId를 알 수 없다. target attach 후\n    // target ID가 필요하므로 env 3/4에서만 non-null이 된다(#503).\n    return {\n      tunnel: { up: true, wssUrl: opts.relayWssUrl },\n      pages: null,\n      attachUrl,\n      inspectorUrl: null,\n      mode: 'relay-mobile' as const,\n    };\n  };\n\n  let server: Awaited<ReturnType<typeof startQrHttpServer>>;\n  try {\n    server = await startQrHttpServer(getDashboardState);\n  } catch {\n    // SECRET-HANDLING: do not surface the error (could embed paths/hosts). The\n    // ASCII QR printed by printTunnelBanner stays as the fallback.\n    return undefined;\n  }\n\n  // TOTP periodic refresh timer — pushes a fresh at= code to SSE clients every\n  // 20 s so a page left open never stales past the 90 s acceptance window (#448).\n  // tunnel.ts always has relayWssUrl available here (gated above), so no\n  // lastAttachParts guard is needed — getDashboardState mints a fresh TOTP on\n  // every call unconditionally.\n  // SECRET-HANDLING: callback is a plain trigger only — TOTP value and at= code\n  // must never be logged or written to stdout.\n  const TOTP_REFRESH_INTERVAL_MS = 20_000;\n  let totpRefreshHandle: ReturnType<typeof setInterval> | null = setInterval(() => {\n    server.notifyStateChange();\n  }, TOTP_REFRESH_INTERVAL_MS);\n  totpRefreshHandle.unref();\n\n  const dashboardUrl = `http://127.0.0.1:${server.port}`;\n\n  const { openUrlInBrowser } = await import('../mcp/devtools-opener.js');\n  const opened = openUrlInBrowser(dashboardUrl);\n  // SECRET-HANDLING: only the local 127.0.0.1 URL is logged — never the tunnel\n  // host, relay wssUrl, or TOTP code.\n  log(\n    opened\n      ? `  │  Opened a QR dashboard in your browser: ${dashboardUrl}`\n      : `  │  Open this QR dashboard in your browser: ${dashboardUrl}`,\n  );\n\n  return {\n    url: dashboardUrl,\n    close: () => {\n      if (totpRefreshHandle) {\n        clearInterval(totpRefreshHandle);\n        totpRefreshHandle = null;\n      }\n      return server.close();\n    },\n  };\n}\n\nexport interface QuickTunnel {\n  /** The public `https://*.trycloudflare.com` URL. */\n  url: string;\n  /** Stop the underlying `cloudflared` process. Idempotent. */\n  stop: () => void;\n}\n\n/**\n * Sanitize cloudflared stderr output for error diagnostics (#421).\n *\n * Masks `*.trycloudflare.com` hostnames and full `https://` / `wss://` URLs\n * that carry those hostnames so tunnel host values never appear in error\n * messages. Diagnostic content (error codes, reasons, JSON blobs) is preserved.\n *\n * SECRET-HANDLING: tunnel host is SECRET-class per harness policy — only\n * placeholder text is emitted.\n */\nexport function sanitizeCloudflaredOutput(line: string): string {\n  // Full URL forms: https://xxx.trycloudflare.com/… and wss://xxx.trycloudflare.com/…\n  let s = line.replace(/(?:https?|wss?):\\/\\/[a-z0-9-]+\\.trycloudflare\\.com(?:\\/[^\\s]*)*/gi, (m) =>\n    m.replace(/[a-z0-9-]+\\.trycloudflare\\.com/i, '<HOST>.trycloudflare.com'),\n  );\n  // Bare hostname without scheme (e.g. printed in cloudflared JSON logs)\n  s = s.replace(/[a-z0-9-]+\\.trycloudflare\\.com/gi, '<HOST>.trycloudflare.com');\n  return s;\n}\n\nconst URL_TIMEOUT_MS = 20_000;\n\n/**\n * Start an unauthenticated Cloudflare quick tunnel to `http://localhost:<port>`\n * and resolve once the public URL is known. Downloads the `cloudflared` binary\n * on first use if it is not already installed. Rejects with a friendly error if\n * no URL appears within {@link URL_TIMEOUT_MS}.\n */\nexport async function startQuickTunnel(port: number): Promise<QuickTunnel> {\n  const cloudflared = await import('cloudflared');\n  const { bin, install, Tunnel } = cloudflared;\n\n  if (!existsSync(bin)) {\n    await mkdir(dirname(bin), { recursive: true });\n    await install(bin);\n  }\n\n  const tunnel = Tunnel.quick(`http://localhost:${port}`);\n  let stopped = false;\n  const stop = () => {\n    if (stopped) return;\n    stopped = true;\n    try {\n      tunnel.stop();\n    } catch {\n      // process may already be gone\n    }\n  };\n\n  return new Promise<QuickTunnel>((resolve, reject) => {\n    // #421: accumulate stderr to attach as diagnostics on failure.\n    // SECRET-HANDLING: lines are sanitized before inclusion in error messages.\n    const stderrLines: string[] = [];\n\n    /**\n     * Format the last `n` sanitized stderr lines as a diagnostic appendix.\n     * Returns an empty string when no lines have been collected.\n     */\n    const stderrTail = (n = 15): string => {\n      if (stderrLines.length === 0) return '';\n      const tail = stderrLines.slice(-n).map(sanitizeCloudflaredOutput).join('');\n      return `\\ncloudflared 출력 (마지막 ${Math.min(n, stderrLines.length)}줄):\\n${tail}`;\n    };\n\n    const timer = setTimeout(() => {\n      cleanup();\n      stop();\n      reject(\n        new Error(\n          `[@ait-co/devtools] cloudflared did not report a tunnel URL within ${\n            URL_TIMEOUT_MS / 1000\n          }s. Check your network connection, or run \\`cloudflared tunnel --url http://localhost:${port}\\` manually.${stderrTail()}`,\n        ),\n      );\n    }, URL_TIMEOUT_MS);\n\n    const onUrl = (line: string) => {\n      const found = parseTrycloudflareUrl(line);\n      if (!found) return;\n      clearTimeout(timer);\n      // Stop scanning further output once we have the URL.\n      cleanup();\n      resolve({ url: found, stop });\n    };\n\n    // Accumulate stderr lines for diagnostics (#421). Named so it can be\n    // removed from the listener list when cleanup() runs.\n    const pushStderr = (line: string) => {\n      stderrLines.push(line);\n    };\n\n    const cleanup = () => {\n      tunnel.off('stdout', onUrl);\n      tunnel.off('stderr', onUrl);\n      tunnel.off('stderr', pushStderr);\n    };\n\n    // The library emits a parsed `url` event; we also scan raw stdout/stderr in\n    // case the output format shifts.\n    tunnel.once('url', onUrl);\n    tunnel.on('stdout', onUrl);\n    tunnel.on('stderr', onUrl);\n    // Second stderr listener: accumulate all lines for error diagnostics.\n    tunnel.on('stderr', pushStderr);\n    tunnel.once('error', (err: Error) => {\n      clearTimeout(timer);\n      cleanup();\n      stop();\n      reject(err);\n    });\n    tunnel.once('exit', (code: number | null) => {\n      if (stopped) return;\n      clearTimeout(timer);\n      cleanup();\n      reject(\n        new Error(\n          `[@ait-co/devtools] cloudflared exited (code ${code ?? 'null'}) before reporting a tunnel URL.${stderrTail()}`,\n        ),\n      );\n    });\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAiBA,MAAM,mBAAmB;;;;;;AAOzB,SAAgB,sBAAsB,MAA6B;CACjE,MAAM,IAAI,KAAK,MAAM,iBAAiB;AACtC,QAAO,IAAI,EAAE,KAAK;;AA8BpB,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;AAiDrB,SAAgB,sBACd,WACA,aACQ;CAER,MAAM,OACJ,OAAO,gBAAgB,WAAW,EAAE,aAAa,aAAa,GAAI,eAAe,EAAE;CAGrF,IAAI,MADS,GAAG,aAAa,OAAO,mBAAmB,UAAU;AAEjE,KAAI,KAAK,YACP,QAAO,kBAAkB,mBAAmB,KAAK,YAAY;AAE/D,KAAI,KAAK,SAAS,KAAA,KAAa,KAAK,KAAK,MAAM,KAAK,GAClD,QAAO,SAAS,mBAAmB,KAAK,KAAK,MAAM,CAAC;AAEtD,KAAI,KAAK,gBAAgB,OACvB,QAAO;AAET,QAAO;;;;;;;;AAST,eAAsB,kBACpB,KACA,OAAiC,EAAE,EACpB;CACf,MAAM,MAAM,KAAK,SAAS,MAAc,QAAQ,IAAI,EAAE;CACtD,MAAM,WAAW,sBAAsB,KAAK;EAC1C,aAAa,KAAK;EAClB,MAAM,KAAK;EACX,aAAa,KAAK;EACnB,CAAC;AAoBF,KAnBwB;EACtB;EACA;EACA,QAAQ;EACR;EACA,wCAAwC;EACxC;EACA;EACA,GAAI,KAAK,cACL,CACE,+DACA,uDACD,GACD,EAAE;EACN;EACA;EACA;EACA;EACD,CACS,KAAK,KAAK,CAAC;AAErB,KAAI,KAAK,OAAO,OAAO;EAGrB,MAAM,UAAU,MAAM,OAAO,oBAAoB;AACjD,QAAM,IAAI,SAAe,YAAY;AACnC,UAAO,SAAS,UAAU,EAAE,OAAO,MAAM,GAAG,QAAQ;AAClD,QAAI,IAAI;AACR,aAAS;KACT;IACF;;;;;;;;;;;;;AAcN,SAAS,iBAA0B;AACjC,KAAI,QAAQ,IAAI,OAAO,UAAU,QAAQ,IAAI,OAAO,IAAK,QAAO;CAChE,MAAM,WAAW,QAAQ;AACzB,KAAI,aAAa,YAAY,aAAa,QAAS,QAAO;AAC1D,KAAI,aAAa,QACf,QAAO,QAAQ,QAAQ,IAAI,WAAW,QAAQ,IAAI,gBAAgB;AAEpE,QAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4DT,eAAsB,qBACpB,MACsC;CACtC,MAAM,MAAM,KAAK,SAAS,MAAc,QAAQ,IAAI,EAAE;AAGtD,KAAI,CAAC,KAAK,YAAa,QAAO,KAAA;AAE9B,KAAI,KAAK,OAAO,MAAO,QAAO,KAAA;CAI9B,MAAM,EAAE,2BAA2B,MAAA,QAAA,SAAA,CAAA,WAAA,QAAM,iCAAA,CAAA;AAEzC,KAAI,EADa,KAAK,qBAAqB,CAAC,wBAAwB,IAAI,gBAAgB,IACzE,CAAE,QAAO,KAAA;CAExB,MAAM,EAAE,sBAAsB,MAAA,QAAA,SAAA,CAAA,WAAA,QAAM,gCAAA,CAAA;CACpC,MAAM,EAAE,2BAA2B,MAAA,QAAA,SAAA,CAAA,WAAA,QAAM,0BAAA,CAAA;CACzC,MAAM,EAAE,iBAAiB,MAAA,QAAA,SAAA,CAAA,WAAA,QAAM,sBAAA,CAAA;CAQ/B,MAAM,0BAA0B;EAC9B,MAAM,SAAS,QAAQ,IAAI;EAC3B,MAAM,WAAW,SAAS,aAAa,QAAQ,KAAK,KAAK,CAAC,GAAG,KAAA;EAC7D,MAAM,YAAY,uBAAuB,KAAK,WAAW,KAAK,aAAa,UAAU,EACnF,MAAM,KAAK,MACZ,CAAC;AAUF,SAAO;GACL,QAAQ;IAAE,IAAI;IAAM,QAAQ,KAAK;IAAa;GAC9C,OAAO;GACP;GACA,cAAc;GACd,MAAM;GACP;;CAGH,IAAI;AACJ,KAAI;AACF,WAAS,MAAM,kBAAkB,kBAAkB;SAC7C;AAGN;;CAWF,IAAI,oBAA2D,kBAAkB;AAC/E,SAAO,mBAAmB;IAFK,IAGL;AAC5B,mBAAkB,OAAO;CAEzB,MAAM,eAAe,oBAAoB,OAAO;CAEhD,MAAM,EAAE,qBAAqB,MAAA,QAAA,SAAA,CAAA,WAAA,QAAM,iCAAA,CAAA;AAInC,KAHe,iBAAiB,aAAa,GAKvC,+CAA+C,iBAC/C,gDAAgD,eACrD;AAED,QAAO;EACL,KAAK;EACL,aAAa;AACX,OAAI,mBAAmB;AACrB,kBAAc,kBAAkB;AAChC,wBAAoB;;AAEtB,UAAO,OAAO,OAAO;;EAExB;;;;;;;;;;;;AAoBH,SAAgB,0BAA0B,MAAsB;CAE9D,IAAI,IAAI,KAAK,QAAQ,sEAAsE,MACzF,EAAE,QAAQ,mCAAmC,2BAA2B,CACzE;AAED,KAAI,EAAE,QAAQ,oCAAoC,2BAA2B;AAC7E,QAAO;;AAGT,MAAM,iBAAiB;;;;;;;AAQvB,eAAsB,iBAAiB,MAAoC;CAEzE,MAAM,EAAE,KAAK,SAAS,WADF,MAAM,OAAO;AAGjC,KAAI,EAAA,GAAA,QAAA,YAAY,IAAI,EAAE;AACpB,SAAA,GAAA,iBAAA,QAAA,GAAA,UAAA,SAAoB,IAAI,EAAE,EAAE,WAAW,MAAM,CAAC;AAC9C,QAAM,QAAQ,IAAI;;CAGpB,MAAM,SAAS,OAAO,MAAM,oBAAoB,OAAO;CACvD,IAAI,UAAU;CACd,MAAM,aAAa;AACjB,MAAI,QAAS;AACb,YAAU;AACV,MAAI;AACF,UAAO,MAAM;UACP;;AAKV,QAAO,IAAI,SAAsB,SAAS,WAAW;EAGnD,MAAM,cAAwB,EAAE;;;;;EAMhC,MAAM,cAAc,IAAI,OAAe;AACrC,OAAI,YAAY,WAAW,EAAG,QAAO;GACrC,MAAM,OAAO,YAAY,MAAM,CAAC,EAAE,CAAC,IAAI,0BAA0B,CAAC,KAAK,GAAG;AAC1E,UAAO,yBAAyB,KAAK,IAAI,GAAG,YAAY,OAAO,CAAC,OAAO;;EAGzE,MAAM,QAAQ,iBAAiB;AAC7B,YAAS;AACT,SAAM;AACN,0BACE,IAAI,MACF,qEACE,iBAAiB,IAClB,uFAAuF,KAAK,cAAc,YAAY,GACxH,CACF;KACA,eAAe;EAElB,MAAM,SAAS,SAAiB;GAC9B,MAAM,QAAQ,sBAAsB,KAAK;AACzC,OAAI,CAAC,MAAO;AACZ,gBAAa,MAAM;AAEnB,YAAS;AACT,WAAQ;IAAE,KAAK;IAAO;IAAM,CAAC;;EAK/B,MAAM,cAAc,SAAiB;AACnC,eAAY,KAAK,KAAK;;EAGxB,MAAM,gBAAgB;AACpB,UAAO,IAAI,UAAU,MAAM;AAC3B,UAAO,IAAI,UAAU,MAAM;AAC3B,UAAO,IAAI,UAAU,WAAW;;AAKlC,SAAO,KAAK,OAAO,MAAM;AACzB,SAAO,GAAG,UAAU,MAAM;AAC1B,SAAO,GAAG,UAAU,MAAM;AAE1B,SAAO,GAAG,UAAU,WAAW;AAC/B,SAAO,KAAK,UAAU,QAAe;AACnC,gBAAa,MAAM;AACnB,YAAS;AACT,SAAM;AACN,UAAO,IAAI;IACX;AACF,SAAO,KAAK,SAAS,SAAwB;AAC3C,OAAI,QAAS;AACb,gBAAa,MAAM;AACnB,YAAS;AACT,0BACE,IAAI,MACF,+CAA+C,QAAQ,OAAO,kCAAkC,YAAY,GAC7G,CACF;IACD;GACF"}

package/dist/{tunnel-BC7bu3O9.js → tunnel-nX6LVnwi.js}

@@ -41,6 +41,11 @@ const LAUNCHER_URL = "https://devtools.aitc.dev/launcher/";
 * When `opts.name` is given (non-blank), it is added as `&name=` so the launcher
 * partner bar shows the app name instead of the generic default (#498).
 *
+* When `opts.webViewType` is `'game'`, `&navBarType=game` is appended so the
+* launcher enters game nav chrome (floating capsule, no full bar) automatically
+* on scan. `'partner'` is the launcher's implicit default and is not added to
+* keep the URL clean (#584).
+*
 * Back-compat: the second argument may also be a plain string (`relayWssUrl`)
 * for callers that haven't migrated to the options object yet.
 */
@@ -49,6 +54,7 @@ function buildLauncherDeepLink(tunnelUrl, optsOrRelay) {
 	let url = `${LAUNCHER_URL}?url=${encodeURIComponent(tunnelUrl)}`;
 	if (opts.relayWssUrl) url += `&debug=1&relay=${encodeURIComponent(opts.relayWssUrl)}`;
 	if (opts.name !== void 0 && opts.name.trim() !== "") url += `&name=${encodeURIComponent(opts.name.trim())}`;
+	if (opts.webViewType === "game") url += "&navBarType=game";
 	return url;
 }
 /**
@@ -61,7 +67,8 @@ async function printTunnelBanner(url, opts = {}) {
 	const log = opts.log ?? ((m) => console.log(m));
 	const deepLink = buildLauncherDeepLink(url, {
 		relayWssUrl: opts.relayWssUrl,
-		name: opts.name
+		name: opts.name,
+		webViewType: opts.webViewType
 	});
 	log([
 		"",
@@ -271,4 +278,4 @@ async function startQuickTunnel(port) {
 //#endregion
 export { printTunnelBanner, startQuickTunnel, startTunnelDashboard };
 
-//# sourceMappingURL=tunnel-BC7bu3O9.js.map
+//# sourceMappingURL=tunnel-nX6LVnwi.js.map

package/dist/tunnel-nX6LVnwi.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tunnel-nX6LVnwi.js","names":[],"sources":["../src/unplugin/tunnel.ts"],"sourcesContent":["/**\n * Cloudflare quick-tunnel helper for the devtools unplugin.\n *\n * Loaded lazily (`await import('./tunnel.js')`) only when the `tunnel` option is\n * on, so `cloudflared` / `qrcode-terminal` are never pulled in for the common\n * case. This is the one place in `@ait-co/devtools` that depends on Node-only\n * APIs (`child_process` via the `cloudflared` wrapper) — keep it thin and out of\n * jsdom unit tests; the spawn path is verified by hand / e2e (same spirit as the\n * \"web 모드는 e2e\" rule in CLAUDE.md). The pure helpers below\n * (`parseTrycloudflareUrl`, `printTunnelBanner`) are unit-tested.\n */\n\nimport { existsSync } from 'node:fs';\nimport { mkdir } from 'node:fs/promises';\nimport { dirname } from 'node:path';\n\n/** Matches the public URL cloudflared prints for an unauthenticated quick tunnel. */\nconst TRYCLOUDFLARE_RE = /https:\\/\\/[a-z0-9-]+\\.trycloudflare\\.com/i;\n\n/**\n * Extract the `https://<sub>.trycloudflare.com` URL from a line of cloudflared\n * output, or `null` if the line doesn't contain one. Pulled out as a pure\n * function so it can be unit-tested without spawning anything.\n */\nexport function parseTrycloudflareUrl(line: string): string | null {\n  const m = line.match(TRYCLOUDFLARE_RE);\n  return m ? m[0] : null;\n}\n\nexport interface PrintTunnelBannerOptions {\n  /** Print an ASCII QR encoding the tunnel URL (default: true). */\n  qr?: boolean;\n  /** Sink for the banner text (default: `console.log`). Injected for testing. */\n  log?: (msg: string) => void;\n  /**\n   * The `wss://` relay URL of the env-2 CDP tunnel, if `tunnel.cdp` is on. When\n   * present the QR deep-link additionally carries `&debug=1&relay=<wss>` so the\n   * framed PWA passes the in-app debug gate and attaches a Chii target — the\n   * same single scan opens screen preview *and* CDP debugging.\n   */\n  relayWssUrl?: string;\n  /**\n   * Human-readable app name to embed as `name=` in the launcher deep-link (#498).\n   * When provided (non-blank), the launcher partner bar shows this name instead of\n   * the generic default.\n   */\n  name?: string;\n  /**\n   * The miniapp's webViewType. When `'game'`, the deep-link carries `&navBarType=game`\n   * so the launcher enters game nav chrome automatically on scan (#584).\n   * `'partner'` (the default) is the launcher's implicit default — not added to\n   * keep the URL clean.\n   */\n  webViewType?: 'partner' | 'game';\n}\n\nconst LAUNCHER_URL = 'https://devtools.aitc.dev/launcher/';\n\n/**\n * Options for {@link buildLauncherDeepLink}.\n */\nexport interface BuildLauncherDeepLinkOptions {\n  /**\n   * `wss://` relay URL for env-2 CDP wiring. When present the deep-link carries\n   * `&debug=1&relay=<wss>`.\n   */\n  relayWssUrl?: string;\n  /**\n   * Human-readable app name shown in the partner nav bar (`name=` param, #498).\n   * Blank / whitespace-only values are not added.\n   */\n  name?: string;\n  /**\n   * The miniapp's webViewType. When `'game'`, adds `&navBarType=game` to the\n   * deep-link so the launcher enters game nav chrome automatically on scan (#584).\n   * `'partner'` (the launcher's implicit default) is not added to keep the URL\n   * clean.\n   */\n  webViewType?: 'partner' | 'game';\n}\n\n/**\n * Build the deep-link URL that QR codes encode: when the launcher PWA is\n * already on the phone's home screen, scanning this opens it directly into the\n * live view for `tunnelUrl` (the launcher consumes `?url=` and clears it).\n * Plain-text raw URL is no longer enough — the launcher gates its setup UI to\n * the installed PWA, so a raw tunnel URL opened in a normal browser tab would\n * land on a \"please install\" screen.\n *\n * When `opts.relayWssUrl` is given (env-2 CDP wiring), the deep-link also carries\n * `&debug=1&relay=<wss>`; the launcher folds those onto the framed tunnel URL so\n * the in-app debug gate's Layer C (`debug=1` opt-in + `relay=<wss>`) is met and\n * a Chii target.js is injected into the live view.\n *\n * When `opts.name` is given (non-blank), it is added as `&name=` so the launcher\n * partner bar shows the app name instead of the generic default (#498).\n *\n * When `opts.webViewType` is `'game'`, `&navBarType=game` is appended so the\n * launcher enters game nav chrome (floating capsule, no full bar) automatically\n * on scan. `'partner'` is the launcher's implicit default and is not added to\n * keep the URL clean (#584).\n *\n * Back-compat: the second argument may also be a plain string (`relayWssUrl`)\n * for callers that haven't migrated to the options object yet.\n */\nexport function buildLauncherDeepLink(\n  tunnelUrl: string,\n  optsOrRelay?: string | BuildLauncherDeepLinkOptions,\n): string {\n  // Normalise the overloaded second argument.\n  const opts: BuildLauncherDeepLinkOptions =\n    typeof optsOrRelay === 'string' ? { relayWssUrl: optsOrRelay } : (optsOrRelay ?? {});\n\n  const base = `${LAUNCHER_URL}?url=${encodeURIComponent(tunnelUrl)}`;\n  let url = base;\n  if (opts.relayWssUrl) {\n    url += `&debug=1&relay=${encodeURIComponent(opts.relayWssUrl)}`;\n  }\n  if (opts.name !== undefined && opts.name.trim() !== '') {\n    url += `&name=${encodeURIComponent(opts.name.trim())}`;\n  }\n  if (opts.webViewType === 'game') {\n    url += '&navBarType=game';\n  }\n  return url;\n}\n\n/**\n * Print the terminal banner announcing the live tunnel: the public URL, an ASCII\n * QR encoding a launcher deep-link, and a one-line note that quick tunnels are\n * ephemeral, unauthenticated and not for production. Pure w.r.t. side effects\n * other than the injected `log` sink and `qrcode-terminal` — unit-tested.\n */\nexport async function printTunnelBanner(\n  url: string,\n  opts: PrintTunnelBannerOptions = {},\n): Promise<void> {\n  const log = opts.log ?? ((m: string) => console.log(m));\n  const deepLink = buildLauncherDeepLink(url, {\n    relayWssUrl: opts.relayWssUrl,\n    name: opts.name,\n    webViewType: opts.webViewType,\n  });\n  const lines: string[] = [\n    '',\n    '  ┌─ @ait-co/devtools · live tunnel ────────────────────────────',\n    `  │  ${url}`,\n    '  │',\n    `  │  Install the launcher PWA once:  ${LAUNCHER_URL}`,\n    '  │  Then scan the QR below — it opens the launcher directly',\n    '  │  into this tunnel URL (no manual paste needed).',\n    ...(opts.relayWssUrl\n      ? [\n          '  │  The same scan also attaches CDP — connect your AI host',\n          '  │  to the relay and debug the live view on-device.',\n        ]\n      : []),\n    '  │  Quick tunnels are unauthenticated, change every run, and are',\n    '  │  not for production use.',\n    '  └──────────────────────────────────────────────────────────────',\n    '',\n  ];\n  log(lines.join('\\n'));\n\n  if (opts.qr !== false) {\n    // qrcode-terminal is only pulled in on this code path (ambient types live\n    // in src/qrcode-terminal.d.ts).\n    const qrcode = (await import('qrcode-terminal')).default;\n    await new Promise<void>((resolve) => {\n      qrcode.generate(deepLink, { small: true }, (out) => {\n        log(out);\n        resolve();\n      });\n    });\n  }\n}\n\n/**\n * Heuristic: can this process open a GUI browser? Mirrors `canOpenBrowser` in\n * `src/mcp/tools.ts` but is re-declared here (not imported) so the tunnel path\n * does not statically pull the heavy MCP `tools.ts` module graph into the lazy\n * `import('./tunnel.js')` chunk. Kept in sync with the MCP copy.\n *\n *   - macOS / Windows → assume yes (env-2 dev normally runs on the user's Mac).\n *   - Linux → require `DISPLAY` or `WAYLAND_DISPLAY`.\n *   - CI (`CI=true`/`CI=1`) → no.\n */\nfunction canOpenBrowser(): boolean {\n  if (process.env.CI === 'true' || process.env.CI === '1') return false;\n  const platform = process.platform;\n  if (platform === 'darwin' || platform === 'win32') return true;\n  if (platform === 'linux') {\n    return Boolean(process.env.DISPLAY ?? process.env.WAYLAND_DISPLAY);\n  }\n  return false;\n}\n\n/** Handle returned by {@link startTunnelDashboard}. */\nexport interface TunnelDashboard {\n  /** `http://127.0.0.1:<port>` — the local dashboard URL opened in the browser. */\n  url: string;\n  /** Tear down the local HTTP server. Idempotent via the underlying server. */\n  close: () => Promise<void>;\n}\n\nexport interface StartTunnelDashboardOptions {\n  /** The public `https://*.trycloudflare.com` app tunnel URL the launcher frames. */\n  tunnelUrl: string;\n  /** The `wss://` relay URL of the env-2 CDP tunnel. REQUIRED — the dashboard is a CDP-only UX. */\n  relayWssUrl: string;\n  /** Mirror of `tunnel.qr` — when `false` the dashboard is skipped (no browser open). */\n  qr?: boolean;\n  /**\n   * Override the GUI/opt-out gate (testing only). When omitted the real\n   * `canOpenBrowser()` + `AIT_AUTO_DEVTOOLS` checks decide.\n   */\n  shouldOpen?: () => boolean;\n  /** Sink for the one-line \"opened in browser\" note (default: `console.log`). Injected for testing. */\n  log?: (msg: string) => void;\n  /**\n   * Human-readable app name to embed as `name=` in the launcher deep-link (#498).\n   * When provided (non-blank), the launcher partner bar shows this name instead of\n   * the generic default.\n   */\n  name?: string;\n}\n\n/**\n * Env-2 UX parity with env 3/4 (issue #408): when CDP wiring is on and a GUI is\n * available, start the SAME `127.0.0.1` HTML dashboard (QR image + connect steps\n * + FAQ) that the MCP `build_attach_url` path serves, and auto-open it in the\n * browser. headless / opt-out falls back to the terminal ASCII QR (printed\n * separately by {@link printTunnelBanner}).\n *\n * Every part the install-graph invariant depends on (`qrcode`, the MCP HTTP\n * server, the opener) is reached only through dynamic `import()` here, inside\n * the already-lazy `tunnel.js` chunk — nothing is added to the common build\n * graph or the MCP-only install graph.\n *\n * TOTP encapsulation: the dashboard's `getDashboardState` closure mints a FRESH\n * TOTP `at=` code on every call via `generateTotp(secret, Date.now())` and folds\n * it into a fresh `buildLauncherAttachUrl(...)`. Because the QR is re-rendered on\n * each SSE push / page reload from this closure, the code a phone scans is always\n * within its 30 s window — no stale code is baked into static HTML.\n *\n * SECRET-HANDLING: the tunnel host, relay wssUrl, TOTP code, and `.ait_relay`\n * value/path are NEVER written to stdout/stderr/logs here. They live only inside\n * the attach URL (HTML body + `/qr.png` query, per qr-http-server's invariant).\n * The only thing opened/logged is `http://127.0.0.1:<port>` (local, safe).\n *\n * @returns the dashboard handle when it started (caller wires `close()` into the\n *   tunnel cleanup), or `undefined` when skipped (no relay, `qr:false`, headless,\n *   opt-out, or a start failure) — in which case ASCII QR fallback stands alone.\n */\nexport async function startTunnelDashboard(\n  opts: StartTunnelDashboardOptions,\n): Promise<TunnelDashboard | undefined> {\n  const log = opts.log ?? ((m: string) => console.log(m));\n\n  // Gate: dashboard is a CDP-only UX (needs a relay to attach to).\n  if (!opts.relayWssUrl) return undefined;\n  // Opt-out via `tunnel.qr:false` (same toggle that suppresses the ASCII QR).\n  if (opts.qr === false) return undefined;\n\n  // GUI + AIT_AUTO_DEVTOOLS gate. Reuse the MCP opener's opt-out predicate so\n  // the env-2 path honours the same `AIT_AUTO_DEVTOOLS=0` switch as env 3/4.\n  const { isAutoDevtoolsDisabled } = await import('../mcp/devtools-opener.js');\n  const gateOpen = opts.shouldOpen ?? (() => !isAutoDevtoolsDisabled() && canOpenBrowser());\n  if (!gateOpen()) return undefined;\n\n  const { startQrHttpServer } = await import('../mcp/qr-http-server.js');\n  const { buildLauncherAttachUrl } = await import('../mcp/deeplink.js');\n  const { generateTotp } = await import('../mcp/totp.js');\n\n  // getDashboardState — mints a fresh TOTP + attach URL on every call so the QR\n  // the dashboard renders (on load and on each SSE push) is never expired.\n  // SECRET-HANDLING: the secret is read from env AT CALL TIME (it was injected\n  // by ensureRelaySecret in the same CDP block) and is used only to compute the\n  // at= code folded into attachUrl. tunnel.up is always true here — the relay\n  // tunnel is already up by the time this runs.\n  const getDashboardState = () => {\n    const secret = process.env.AIT_DEBUG_TOTP_SECRET;\n    const totpCode = secret ? generateTotp(secret, Date.now()) : undefined;\n    const attachUrl = buildLauncherAttachUrl(opts.tunnelUrl, opts.relayWssUrl, totpCode, {\n      name: opts.name,\n    });\n    // pages: null — env 2(unplugin)는 데몬이 아니라 vite 플러그인 안이라\n    // startChiiRelay 핸들이 connected target을 노출하지 않는다. 라이브 page 목록을\n    // 알 수 없으므로 거짓 빈 목록 대신 \"연결된 Pages\" 섹션 자체를 숨긴다(#411).\n    // env 3/4(debug-server.ts)는 router.active.listTargets()로 실제 목록을 채운다.\n    // mode: 'relay-mobile' — 이 대시보드는 항상 환경 2(AITC Sandbox PWA) 전용이므로\n    // /attach 카피가 launcher PWA 절차(sandbox family)로 분기된다(#468).\n    // inspectorUrl: null — env 2에서는 unplugin relay가 connected target ID를 노출하지\n    // 않아 buildChiiInspectorUrl에 필요한 targetId를 알 수 없다. target attach 후\n    // target ID가 필요하므로 env 3/4에서만 non-null이 된다(#503).\n    return {\n      tunnel: { up: true, wssUrl: opts.relayWssUrl },\n      pages: null,\n      attachUrl,\n      inspectorUrl: null,\n      mode: 'relay-mobile' as const,\n    };\n  };\n\n  let server: Awaited<ReturnType<typeof startQrHttpServer>>;\n  try {\n    server = await startQrHttpServer(getDashboardState);\n  } catch {\n    // SECRET-HANDLING: do not surface the error (could embed paths/hosts). The\n    // ASCII QR printed by printTunnelBanner stays as the fallback.\n    return undefined;\n  }\n\n  // TOTP periodic refresh timer — pushes a fresh at= code to SSE clients every\n  // 20 s so a page left open never stales past the 90 s acceptance window (#448).\n  // tunnel.ts always has relayWssUrl available here (gated above), so no\n  // lastAttachParts guard is needed — getDashboardState mints a fresh TOTP on\n  // every call unconditionally.\n  // SECRET-HANDLING: callback is a plain trigger only — TOTP value and at= code\n  // must never be logged or written to stdout.\n  const TOTP_REFRESH_INTERVAL_MS = 20_000;\n  let totpRefreshHandle: ReturnType<typeof setInterval> | null = setInterval(() => {\n    server.notifyStateChange();\n  }, TOTP_REFRESH_INTERVAL_MS);\n  totpRefreshHandle.unref();\n\n  const dashboardUrl = `http://127.0.0.1:${server.port}`;\n\n  const { openUrlInBrowser } = await import('../mcp/devtools-opener.js');\n  const opened = openUrlInBrowser(dashboardUrl);\n  // SECRET-HANDLING: only the local 127.0.0.1 URL is logged — never the tunnel\n  // host, relay wssUrl, or TOTP code.\n  log(\n    opened\n      ? `  │  Opened a QR dashboard in your browser: ${dashboardUrl}`\n      : `  │  Open this QR dashboard in your browser: ${dashboardUrl}`,\n  );\n\n  return {\n    url: dashboardUrl,\n    close: () => {\n      if (totpRefreshHandle) {\n        clearInterval(totpRefreshHandle);\n        totpRefreshHandle = null;\n      }\n      return server.close();\n    },\n  };\n}\n\nexport interface QuickTunnel {\n  /** The public `https://*.trycloudflare.com` URL. */\n  url: string;\n  /** Stop the underlying `cloudflared` process. Idempotent. */\n  stop: () => void;\n}\n\n/**\n * Sanitize cloudflared stderr output for error diagnostics (#421).\n *\n * Masks `*.trycloudflare.com` hostnames and full `https://` / `wss://` URLs\n * that carry those hostnames so tunnel host values never appear in error\n * messages. Diagnostic content (error codes, reasons, JSON blobs) is preserved.\n *\n * SECRET-HANDLING: tunnel host is SECRET-class per harness policy — only\n * placeholder text is emitted.\n */\nexport function sanitizeCloudflaredOutput(line: string): string {\n  // Full URL forms: https://xxx.trycloudflare.com/… and wss://xxx.trycloudflare.com/…\n  let s = line.replace(/(?:https?|wss?):\\/\\/[a-z0-9-]+\\.trycloudflare\\.com(?:\\/[^\\s]*)*/gi, (m) =>\n    m.replace(/[a-z0-9-]+\\.trycloudflare\\.com/i, '<HOST>.trycloudflare.com'),\n  );\n  // Bare hostname without scheme (e.g. printed in cloudflared JSON logs)\n  s = s.replace(/[a-z0-9-]+\\.trycloudflare\\.com/gi, '<HOST>.trycloudflare.com');\n  return s;\n}\n\nconst URL_TIMEOUT_MS = 20_000;\n\n/**\n * Start an unauthenticated Cloudflare quick tunnel to `http://localhost:<port>`\n * and resolve once the public URL is known. Downloads the `cloudflared` binary\n * on first use if it is not already installed. Rejects with a friendly error if\n * no URL appears within {@link URL_TIMEOUT_MS}.\n */\nexport async function startQuickTunnel(port: number): Promise<QuickTunnel> {\n  const cloudflared = await import('cloudflared');\n  const { bin, install, Tunnel } = cloudflared;\n\n  if (!existsSync(bin)) {\n    await mkdir(dirname(bin), { recursive: true });\n    await install(bin);\n  }\n\n  const tunnel = Tunnel.quick(`http://localhost:${port}`);\n  let stopped = false;\n  const stop = () => {\n    if (stopped) return;\n    stopped = true;\n    try {\n      tunnel.stop();\n    } catch {\n      // process may already be gone\n    }\n  };\n\n  return new Promise<QuickTunnel>((resolve, reject) => {\n    // #421: accumulate stderr to attach as diagnostics on failure.\n    // SECRET-HANDLING: lines are sanitized before inclusion in error messages.\n    const stderrLines: string[] = [];\n\n    /**\n     * Format the last `n` sanitized stderr lines as a diagnostic appendix.\n     * Returns an empty string when no lines have been collected.\n     */\n    const stderrTail = (n = 15): string => {\n      if (stderrLines.length === 0) return '';\n      const tail = stderrLines.slice(-n).map(sanitizeCloudflaredOutput).join('');\n      return `\\ncloudflared 출력 (마지막 ${Math.min(n, stderrLines.length)}줄):\\n${tail}`;\n    };\n\n    const timer = setTimeout(() => {\n      cleanup();\n      stop();\n      reject(\n        new Error(\n          `[@ait-co/devtools] cloudflared did not report a tunnel URL within ${\n            URL_TIMEOUT_MS / 1000\n          }s. Check your network connection, or run \\`cloudflared tunnel --url http://localhost:${port}\\` manually.${stderrTail()}`,\n        ),\n      );\n    }, URL_TIMEOUT_MS);\n\n    const onUrl = (line: string) => {\n      const found = parseTrycloudflareUrl(line);\n      if (!found) return;\n      clearTimeout(timer);\n      // Stop scanning further output once we have the URL.\n      cleanup();\n      resolve({ url: found, stop });\n    };\n\n    // Accumulate stderr lines for diagnostics (#421). Named so it can be\n    // removed from the listener list when cleanup() runs.\n    const pushStderr = (line: string) => {\n      stderrLines.push(line);\n    };\n\n    const cleanup = () => {\n      tunnel.off('stdout', onUrl);\n      tunnel.off('stderr', onUrl);\n      tunnel.off('stderr', pushStderr);\n    };\n\n    // The library emits a parsed `url` event; we also scan raw stdout/stderr in\n    // case the output format shifts.\n    tunnel.once('url', onUrl);\n    tunnel.on('stdout', onUrl);\n    tunnel.on('stderr', onUrl);\n    // Second stderr listener: accumulate all lines for error diagnostics.\n    tunnel.on('stderr', pushStderr);\n    tunnel.once('error', (err: Error) => {\n      clearTimeout(timer);\n      cleanup();\n      stop();\n      reject(err);\n    });\n    tunnel.once('exit', (code: number | null) => {\n      if (stopped) return;\n      clearTimeout(timer);\n      cleanup();\n      reject(\n        new Error(\n          `[@ait-co/devtools] cloudflared exited (code ${code ?? 'null'}) before reporting a tunnel URL.${stderrTail()}`,\n        ),\n      );\n    });\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAiBA,MAAM,mBAAmB;;;;;;AAOzB,SAAgB,sBAAsB,MAA6B;CACjE,MAAM,IAAI,KAAK,MAAM,iBAAiB;AACtC,QAAO,IAAI,EAAE,KAAK;;AA8BpB,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;AAiDrB,SAAgB,sBACd,WACA,aACQ;CAER,MAAM,OACJ,OAAO,gBAAgB,WAAW,EAAE,aAAa,aAAa,GAAI,eAAe,EAAE;CAGrF,IAAI,MADS,GAAG,aAAa,OAAO,mBAAmB,UAAU;AAEjE,KAAI,KAAK,YACP,QAAO,kBAAkB,mBAAmB,KAAK,YAAY;AAE/D,KAAI,KAAK,SAAS,KAAA,KAAa,KAAK,KAAK,MAAM,KAAK,GAClD,QAAO,SAAS,mBAAmB,KAAK,KAAK,MAAM,CAAC;AAEtD,KAAI,KAAK,gBAAgB,OACvB,QAAO;AAET,QAAO;;;;;;;;AAST,eAAsB,kBACpB,KACA,OAAiC,EAAE,EACpB;CACf,MAAM,MAAM,KAAK,SAAS,MAAc,QAAQ,IAAI,EAAE;CACtD,MAAM,WAAW,sBAAsB,KAAK;EAC1C,aAAa,KAAK;EAClB,MAAM,KAAK;EACX,aAAa,KAAK;EACnB,CAAC;AAoBF,KAnBwB;EACtB;EACA;EACA,QAAQ;EACR;EACA,wCAAwC;EACxC;EACA;EACA,GAAI,KAAK,cACL,CACE,+DACA,uDACD,GACD,EAAE;EACN;EACA;EACA;EACA;EACD,CACS,KAAK,KAAK,CAAC;AAErB,KAAI,KAAK,OAAO,OAAO;EAGrB,MAAM,UAAU,MAAM,OAAO,oBAAoB;AACjD,QAAM,IAAI,SAAe,YAAY;AACnC,UAAO,SAAS,UAAU,EAAE,OAAO,MAAM,GAAG,QAAQ;AAClD,QAAI,IAAI;AACR,aAAS;KACT;IACF;;;;;;;;;;;;;AAcN,SAAS,iBAA0B;AACjC,KAAI,QAAQ,IAAI,OAAO,UAAU,QAAQ,IAAI,OAAO,IAAK,QAAO;CAChE,MAAM,WAAW,QAAQ;AACzB,KAAI,aAAa,YAAY,aAAa,QAAS,QAAO;AAC1D,KAAI,aAAa,QACf,QAAO,QAAQ,QAAQ,IAAI,WAAW,QAAQ,IAAI,gBAAgB;AAEpE,QAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4DT,eAAsB,qBACpB,MACsC;CACtC,MAAM,MAAM,KAAK,SAAS,MAAc,QAAQ,IAAI,EAAE;AAGtD,KAAI,CAAC,KAAK,YAAa,QAAO,KAAA;AAE9B,KAAI,KAAK,OAAO,MAAO,QAAO,KAAA;CAI9B,MAAM,EAAE,2BAA2B,MAAM,OAAO;AAEhD,KAAI,EADa,KAAK,qBAAqB,CAAC,wBAAwB,IAAI,gBAAgB,IACzE,CAAE,QAAO,KAAA;CAExB,MAAM,EAAE,sBAAsB,MAAM,OAAO;CAC3C,MAAM,EAAE,2BAA2B,MAAM,OAAO;CAChD,MAAM,EAAE,iBAAiB,MAAM,OAAO;CAQtC,MAAM,0BAA0B;EAC9B,MAAM,SAAS,QAAQ,IAAI;EAC3B,MAAM,WAAW,SAAS,aAAa,QAAQ,KAAK,KAAK,CAAC,GAAG,KAAA;EAC7D,MAAM,YAAY,uBAAuB,KAAK,WAAW,KAAK,aAAa,UAAU,EACnF,MAAM,KAAK,MACZ,CAAC;AAUF,SAAO;GACL,QAAQ;IAAE,IAAI;IAAM,QAAQ,KAAK;IAAa;GAC9C,OAAO;GACP;GACA,cAAc;GACd,MAAM;GACP;;CAGH,IAAI;AACJ,KAAI;AACF,WAAS,MAAM,kBAAkB,kBAAkB;SAC7C;AAGN;;CAWF,IAAI,oBAA2D,kBAAkB;AAC/E,SAAO,mBAAmB;IAFK,IAGL;AAC5B,mBAAkB,OAAO;CAEzB,MAAM,eAAe,oBAAoB,OAAO;CAEhD,MAAM,EAAE,qBAAqB,MAAM,OAAO;AAI1C,KAHe,iBAAiB,aAAa,GAKvC,+CAA+C,iBAC/C,gDAAgD,eACrD;AAED,QAAO;EACL,KAAK;EACL,aAAa;AACX,OAAI,mBAAmB;AACrB,kBAAc,kBAAkB;AAChC,wBAAoB;;AAEtB,UAAO,OAAO,OAAO;;EAExB;;;;;;;;;;;;AAoBH,SAAgB,0BAA0B,MAAsB;CAE9D,IAAI,IAAI,KAAK,QAAQ,sEAAsE,MACzF,EAAE,QAAQ,mCAAmC,2BAA2B,CACzE;AAED,KAAI,EAAE,QAAQ,oCAAoC,2BAA2B;AAC7E,QAAO;;AAGT,MAAM,iBAAiB;;;;;;;AAQvB,eAAsB,iBAAiB,MAAoC;CAEzE,MAAM,EAAE,KAAK,SAAS,WADF,MAAM,OAAO;AAGjC,KAAI,CAAC,WAAW,IAAI,EAAE;AACpB,QAAM,MAAM,QAAQ,IAAI,EAAE,EAAE,WAAW,MAAM,CAAC;AAC9C,QAAM,QAAQ,IAAI;;CAGpB,MAAM,SAAS,OAAO,MAAM,oBAAoB,OAAO;CACvD,IAAI,UAAU;CACd,MAAM,aAAa;AACjB,MAAI,QAAS;AACb,YAAU;AACV,MAAI;AACF,UAAO,MAAM;UACP;;AAKV,QAAO,IAAI,SAAsB,SAAS,WAAW;EAGnD,MAAM,cAAwB,EAAE;;;;;EAMhC,MAAM,cAAc,IAAI,OAAe;AACrC,OAAI,YAAY,WAAW,EAAG,QAAO;GACrC,MAAM,OAAO,YAAY,MAAM,CAAC,EAAE,CAAC,IAAI,0BAA0B,CAAC,KAAK,GAAG;AAC1E,UAAO,yBAAyB,KAAK,IAAI,GAAG,YAAY,OAAO,CAAC,OAAO;;EAGzE,MAAM,QAAQ,iBAAiB;AAC7B,YAAS;AACT,SAAM;AACN,0BACE,IAAI,MACF,qEACE,iBAAiB,IAClB,uFAAuF,KAAK,cAAc,YAAY,GACxH,CACF;KACA,eAAe;EAElB,MAAM,SAAS,SAAiB;GAC9B,MAAM,QAAQ,sBAAsB,KAAK;AACzC,OAAI,CAAC,MAAO;AACZ,gBAAa,MAAM;AAEnB,YAAS;AACT,WAAQ;IAAE,KAAK;IAAO;IAAM,CAAC;;EAK/B,MAAM,cAAc,SAAiB;AACnC,eAAY,KAAK,KAAK;;EAGxB,MAAM,gBAAgB;AACpB,UAAO,IAAI,UAAU,MAAM;AAC3B,UAAO,IAAI,UAAU,MAAM;AAC3B,UAAO,IAAI,UAAU,WAAW;;AAKlC,SAAO,KAAK,OAAO,MAAM;AACzB,SAAO,GAAG,UAAU,MAAM;AAC1B,SAAO,GAAG,UAAU,MAAM;AAE1B,SAAO,GAAG,UAAU,WAAW;AAC/B,SAAO,KAAK,UAAU,QAAe;AACnC,gBAAa,MAAM;AACnB,YAAS;AACT,SAAM;AACN,UAAO,IAAI;IACX;AACF,SAAO,KAAK,SAAS,SAAwB;AAC3C,OAAI,QAAS;AACb,gBAAa,MAAM;AACnB,YAAS;AACT,0BACE,IAAI,MACF,+CAA+C,QAAQ,OAAO,kCAAkC,YAAY,GAC7G,CACF;IACD;GACF"}

package/dist/unplugin/index.cjs

@@ -166,6 +166,7 @@ const aitDevtoolsPlugin = (0, unplugin.createUnplugin)((options) => {
 	let lastState = null;
 	const tunnelOpt = resolveTunnelOption(options?.tunnel, process.env);
 	const shouldTunnel = isDev && !!tunnelOpt;
+	const webViewType = options?.webViewType ?? "partner";
 	const tunnelConfig = typeof tunnelOpt === "object" ? tunnelOpt : {};
 	return {
 		name: "ait-co-devtools",
@@ -186,8 +187,12 @@ const aitDevtoolsPlugin = (0, unplugin.createUnplugin)((options) => {
 		},
 		vite: {
 			config() {
-				if (!shouldTunnel) return;
-				return { server: { allowedHosts: [".trycloudflare.com"] } };
+				const define = { __WEB_VIEW_TYPE__: JSON.stringify(webViewType) };
+				if (!shouldTunnel) return { define };
+				return {
+					define,
+					server: { allowedHosts: [".trycloudflare.com"] }
+				};
 			},
 			configureServer(server) {
 				let machineConsent = null;
@@ -309,7 +314,7 @@ const aitDevtoolsPlugin = (0, unplugin.createUnplugin)((options) => {
 							console.warn("[@ait-co/devtools] tunnel: could not determine the dev server port; skipping.");
 							return;
 						}
-						Promise.resolve().then(() => require("../tunnel-DwmbHIBp.cjs")).then(async ({ startQuickTunnel, printTunnelBanner, startTunnelDashboard }) => {
+						Promise.resolve().then(() => require("../tunnel-D2G3RuGF.cjs")).then(async ({ startQuickTunnel, printTunnelBanner, startTunnelDashboard }) => {
 							const t = await startQuickTunnel(port);
 							tunnel = t;
 							let relayWssUrl;
@@ -353,7 +358,8 @@ const aitDevtoolsPlugin = (0, unplugin.createUnplugin)((options) => {
 							await printTunnelBanner(t.url, {
 								qr: tunnelConfig.qr,
 								relayWssUrl,
-								name: tunnelAppName
+								name: tunnelAppName,
+								webViewType
 							});
 							const { writeRelayUrls, deleteRelayUrls } = await Promise.resolve().then(() => require("../relay-url-store-D2lX9POP.cjs"));
 							await writeRelayUrls({

package/dist/unplugin/index.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs","names":[],"sources":["../../src/shared/parent-watcher.ts","../../src/telemetry/state.ts","../../src/unplugin/index.ts"],"sourcesContent":["/**\n * Shared parent-PID watcher — used by both the MCP debug daemon and the\n * unplugin tunnel path to self-terminate when the parent process (e.g. Claude\n * Code, vite) has died or been reparented without sending SIGTERM/SIGHUP.\n *\n * Intentionally react-free and Node-stdlib-only so this module is safe to\n * import from the MCP daemon bundle (`dist/mcp/cli.js`) without violating the\n * install-graph invariant.\n */\n\n// ---------------------------------------------------------------------------\n// isPidAlive — extracted from src/mcp/server-lock.ts\n// ---------------------------------------------------------------------------\n\n/**\n * Returns `true` when the given PID refers to a running process.\n *\n * Uses `process.kill(pid, 0)` — a no-op signal that succeeds when the process\n * exists and we have permission to signal it; throws ESRCH when it doesn't exist.\n */\nexport function isPidAlive(pid: number): boolean {\n  try {\n    process.kill(pid, 0);\n    return true;\n  } catch (err: unknown) {\n    // ESRCH = no such process → stale lock.\n    // EPERM = process exists but we can't signal it (still alive).\n    if ((err as NodeJS.ErrnoException).code === 'EPERM') return true;\n    return false;\n  }\n}\n\n// ---------------------------------------------------------------------------\n// startParentWatcher — extracted from src/mcp/debug-server.ts\n// ---------------------------------------------------------------------------\n\n/**\n * Starts a periodic watcher that detects when the parent process (e.g. Claude\n * Code) has died without sending SIGTERM/SIGHUP, and calls `onOrphaned` so the\n * daemon can self-terminate rather than running as a zombie.\n *\n * Mirrors the `startAttachWatcher` pattern: `setInterval`-based, returns\n * `{ stop(): void }`, injectable deps for testability.\n *\n * @param onOrphaned - Called once when the parent is gone.\n * @param opts.intervalMs   - Poll interval in milliseconds (default 5 000).\n * @param opts.initialPpid  - Parent PID to watch (default `process.ppid`).\n * @param opts.isAlive      - Predicate to test if a PID is running (default `isPidAlive`).\n * @param opts.getPpid      - Supplier of current ppid (default `() => process.ppid`).\n *                            Detects ppid changes as well as death.\n * @param opts.log          - Logger (default `process.stderr.write`).\n *\n * @returns `stop` — call during shutdown to clear the interval.\n */\nexport function startParentWatcher(\n  onOrphaned: () => void,\n  opts?: {\n    intervalMs?: number;\n    initialPpid?: number;\n    isAlive?: (pid: number) => boolean;\n    getPpid?: () => number;\n    log?: (msg: string) => void;\n  },\n): { stop(): void } {\n  const {\n    intervalMs = 5_000,\n    initialPpid = process.ppid,\n    isAlive = isPidAlive,\n    getPpid = () => process.ppid,\n    log = (msg: string) => process.stderr.write(msg),\n  } = opts ?? {};\n\n  // PID 1 is init/launchd — running under a process manager or as a detached\n  // daemon. There is no meaningful parent to watch; skip the watcher entirely.\n  if (initialPpid <= 1) {\n    log('[ait-debug] parent-pid watcher: no parent to watch (ppid<=1), skipping\\n');\n    return { stop() {} };\n  }\n\n  let fired = false;\n\n  const handle = setInterval(() => {\n    if (fired) return;\n\n    const currentPpid = getPpid();\n    const orphaned = currentPpid !== initialPpid || !isAlive(initialPpid);\n\n    if (orphaned) {\n      fired = true;\n      clearInterval(handle);\n      log(\n        `[ait-debug] parent-pid watcher: parent PID ${initialPpid} is gone (currentPpid=${currentPpid}) — shutting down\\n`,\n      );\n      onOrphaned();\n    }\n  }, intervalMs);\n\n  return {\n    stop() {\n      clearInterval(handle);\n    },\n  };\n}\n\n// ---------------------------------------------------------------------------\n// startMaxAgeWatchdog — FIX 4: daemon lifetime cap\n// ---------------------------------------------------------------------------\n\n/**\n * Starts a periodic watchdog that calls `onExpired` once after `maxAgeMs`\n * milliseconds have elapsed since the watchdog was created.\n *\n * Motivation (issue #571): cloudflared quick-tunnel lifetimes are finite (a\n * few hours). A daemon that has been running for days will have outlived its\n * tunnel regardless of whether the tunnel process exited cleanly. This watchdog\n * caps the daemon's maximum age and forces a fresh start so the tunnel is\n * replaced before it silently expires.\n *\n * @param onExpired  - Called once when the maximum age is reached. The caller\n *                     should call `shutdown()` then `process.exit(0)`.\n * @param opts.maxAgeMs    - Maximum daemon lifetime in ms. Default 6 h.\n * @param opts.intervalMs  - Check interval in ms. Default 60 000 (1 min).\n * @param opts.now         - Time source (injectable for tests). Default `Date.now`.\n *\n * @returns `stop` — call during shutdown to clear the interval.\n */\nexport function startMaxAgeWatchdog(\n  onExpired: () => void,\n  opts: {\n    maxAgeMs?: number;\n    intervalMs?: number;\n    now?: () => number;\n  } = {},\n): { stop(): void } {\n  const {\n    maxAgeMs = 6 * 60 * 60 * 1_000, // 6 hours\n    intervalMs = 60_000,\n    now = () => Date.now(),\n  } = opts;\n\n  const startedAt = now();\n  let fired = false;\n\n  const handle = setInterval(() => {\n    if (fired) return;\n    if (now() - startedAt >= maxAgeMs) {\n      fired = true;\n      clearInterval(handle);\n      onExpired();\n    }\n  }, intervalMs);\n\n  return {\n    stop() {\n      clearInterval(handle);\n    },\n  };\n}\n","/**\n * Telemetry consent state machine + localStorage I/O.\n *\n * localStorage keys are LOCKED — do not rename without updating the privacy page.\n */\n\nexport type ConsentState = 'granted' | 'denied' | 'undecided';\n\n// Key names — locked per privacy page spec\nconst KEY_CONSENT = '__ait_telemetry:consent';\nconst KEY_REPROMPT_AFTER = '__ait_telemetry:reprompt_after';\nconst KEY_POLICY_VERSION = '__ait_telemetry:policy_version';\nconst KEY_ANON_ID = '__ait_telemetry:anon_id';\n\n// Tier 0 keys\nexport const KEY_T0_LAST_SENT = '__ait_telemetry:t0_last_sent';\nexport const KEY_T0_OFF = '__ait_telemetry:t0_off';\n\n// ---------------------------------------------------------------------------\n// Tier 0 opt-out helpers\n// ---------------------------------------------------------------------------\n\n/**\n * Returns true if Tier 0 ping is enabled.\n * Disabled when `localStorage.__ait_telemetry:t0_off = '1'`\n * or `process.env.AITC_TELEMETRY === 'off'`.\n */\nexport function isTier0Enabled(): boolean {\n  if (typeof process !== 'undefined' && process.env.AITC_TELEMETRY === 'off') return false;\n  try {\n    return localStorage.getItem(KEY_T0_OFF) !== '1';\n  } catch {\n    return true;\n  }\n}\n\n/**\n * Sets or clears the Tier 0 opt-out marker.\n */\nexport function setTier0Enabled(enabled: boolean): void {\n  try {\n    if (enabled) {\n      localStorage.removeItem(KEY_T0_OFF);\n    } else {\n      localStorage.setItem(KEY_T0_OFF, '1');\n    }\n  } catch {\n    /* storage unavailable */\n  }\n}\n\n/**\n * Returns true if Tier 0 has already been sent today (YYYY-MM-DD).\n */\nexport function hasSentTier0Today(): boolean {\n  try {\n    const stored = localStorage.getItem(KEY_T0_LAST_SENT);\n    if (!stored) return false;\n    const today = new Date().toISOString().slice(0, 10);\n    return stored === today;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Records that Tier 0 was sent today.\n */\nexport function markTier0Sent(): void {\n  try {\n    const today = new Date().toISOString().slice(0, 10);\n    localStorage.setItem(KEY_T0_LAST_SENT, today);\n  } catch {\n    /* storage unavailable */\n  }\n}\n\n/**\n * Current policy version. Bump this string whenever the privacy policy changes.\n * Users who previously granted on an older version will be re-prompted once.\n */\nexport const CURRENT_POLICY_VERSION = '2026-05-18';\n\n/** 30 days in milliseconds */\nconst THIRTY_DAYS_MS = 30 * 24 * 60 * 60 * 1000;\n\n// ---------------------------------------------------------------------------\n// Reads\n// ---------------------------------------------------------------------------\n\nexport function readConsentState(): ConsentState {\n  const raw = localStorage.getItem(KEY_CONSENT);\n  if (raw === 'granted' || raw === 'denied') return raw;\n  return 'undecided';\n}\n\nexport function readRepromptAfter(): number {\n  const raw = localStorage.getItem(KEY_REPROMPT_AFTER);\n  if (raw === null) return 0;\n  const n = Number(raw);\n  return Number.isFinite(n) ? n : 0;\n}\n\nexport function readPolicyVersion(): string | null {\n  return localStorage.getItem(KEY_POLICY_VERSION);\n}\n\n/**\n * Returns the stored anon_id, or generates + persists a new UUID v4 on first call.\n * Once generated it is never overwritten.\n */\nexport function getOrCreateAnonId(): string {\n  const existing = localStorage.getItem(KEY_ANON_ID);\n  if (existing) return existing;\n  const id = crypto.randomUUID();\n  localStorage.setItem(KEY_ANON_ID, id);\n  return id;\n}\n\n// ---------------------------------------------------------------------------\n// Writes / transitions\n// ---------------------------------------------------------------------------\n\n/**\n * Resolve effective consent, handling the policy-version bump rule:\n *   - If stored = \"granted\" but stored version ≠ CURRENT → revert to undecided\n *   - If stored = \"denied\" and version changed → stay denied (no re-prompt)\n *\n * Call this at init time to normalise state before checking whether to show a toast.\n * Returns the effective ConsentState after applying the version-bump rule.\n */\nexport function resolveEffectiveConsent(): ConsentState {\n  const raw = localStorage.getItem(KEY_CONSENT);\n  if (raw === 'granted') {\n    const storedVersion = readPolicyVersion();\n    if (storedVersion !== CURRENT_POLICY_VERSION) {\n      // Policy changed — treat as undecided so user gets re-prompted once\n      localStorage.removeItem(KEY_CONSENT);\n      localStorage.removeItem(KEY_POLICY_VERSION);\n      return 'undecided';\n    }\n    return 'granted';\n  }\n  if (raw === 'denied') return 'denied';\n  return 'undecided';\n}\n\n/**\n * User clicked \"Yes, send\".\n * Sets consent = granted, records policy version.\n */\nexport function acceptConsent(): void {\n  localStorage.setItem(KEY_CONSENT, 'granted');\n  localStorage.setItem(KEY_POLICY_VERSION, CURRENT_POLICY_VERSION);\n  // Ensure reprompt_after is cleared (shouldn't matter, but keep state clean)\n  localStorage.removeItem(KEY_REPROMPT_AFTER);\n}\n\n/**\n * User clicked \"No, thanks\".\n * First denial: sets reprompt_after = now + 30 days.\n * Second denial (reprompt_after was already set to a past finite value that triggered\n *   re-prompt): sets reprompt_after = MAX_SAFE_INTEGER → permanent silence.\n */\nexport function denyConsent(): void {\n  localStorage.setItem(KEY_CONSENT, 'denied');\n  const existing = readRepromptAfter();\n  if (existing > 0 && existing < Number.MAX_SAFE_INTEGER) {\n    // This is the second denial — silence permanently\n    localStorage.setItem(KEY_REPROMPT_AFTER, String(Number.MAX_SAFE_INTEGER));\n  } else {\n    // First denial\n    localStorage.setItem(KEY_REPROMPT_AFTER, String(Date.now() + THIRTY_DAYS_MS));\n  }\n}\n\n/**\n * Environment-tab toggle: free transition between granted/denied.\n * Does NOT touch reprompt_after.\n */\nexport function setConsentViaToggle(granted: boolean): void {\n  if (granted) {\n    localStorage.setItem(KEY_CONSENT, 'granted');\n    localStorage.setItem(KEY_POLICY_VERSION, CURRENT_POLICY_VERSION);\n  } else {\n    localStorage.setItem(KEY_CONSENT, 'denied');\n  }\n}\n\n/**\n * Returns true if the toast should be shown now.\n * Conditions:\n *   - undecided (no prior choice or policy bumped to a newer version)\n *   - denied + reprompt_after set + reprompt_after < now (one re-prompt after\n *     the configured silence window; `denyConsent` flips to permanent silence\n *     on the second denial by setting reprompt_after to MAX_SAFE_INTEGER).\n */\nexport function shouldShowToast(): boolean {\n  const state = resolveEffectiveConsent();\n  if (state === 'undecided') {\n    const repromptAfter = readRepromptAfter();\n    if (repromptAfter === 0) return true;\n    return Date.now() > repromptAfter;\n  }\n  if (state === 'denied') {\n    const repromptAfter = readRepromptAfter();\n    if (repromptAfter === 0 || repromptAfter >= Number.MAX_SAFE_INTEGER) return false;\n    return Date.now() > repromptAfter;\n  }\n  return false;\n}\n\n/**\n * Sends the DELETE request to remove the user's data from the server, and\n * rotates the local anon_id on success so any subsequent events are unlinkable\n * from the deleted history.\n */\nexport async function deleteMyData(endpoint: string): Promise<boolean> {\n  const anonId = localStorage.getItem(KEY_ANON_ID);\n  if (!anonId) return false;\n  try {\n    const res = await fetch(`${endpoint}/e?anon_id=${encodeURIComponent(anonId)}`, {\n      method: 'DELETE',\n    });\n    if (!res.ok) return false;\n    localStorage.setItem(KEY_ANON_ID, crypto.randomUUID());\n    return true;\n  } catch {\n    return false;\n  }\n}\n","/**\n * @ait-co/devtools unplugin\n *\n * 모든 주요 번들러를 지원하는 단일 플러그인.\n * @apps-in-toss/web-framework → @ait-co/devtools/mock 으로 alias 설정.\n *\n * Usage:\n *   import aitDevtools from '@ait-co/devtools/unplugin';\n *\n *   // Vite\n *   export default { plugins: [aitDevtools.vite()] };\n *\n *   // Webpack / Next.js\n *   config.plugins.push(aitDevtools.webpack());\n *\n *   // Rspack\n *   config.plugins.push(aitDevtools.rspack());\n *\n *   // esbuild\n *   { plugins: [aitDevtools.esbuild()] }\n *\n *   // Rollup\n *   { plugins: [aitDevtools.rollup()] }\n */\n\nimport { fileURLToPath } from 'node:url';\nimport { createUnplugin } from 'unplugin';\nimport { startParentWatcher } from '../shared/parent-watcher.js';\nimport {\n  ensureMachineConsent,\n  type MachineTelemetryState,\n  writeMachineState,\n} from '../telemetry/machine-state.js';\nimport { CURRENT_POLICY_VERSION } from '../telemetry/state.js';\n\n/**\n * Resolve `@ait-co/devtools/mock` to its real file path at plugin-load time.\n *\n * Returning the bare specifier from `resolveId` would stop the bundler from\n * walking node_modules for it — Vite 8+ treats such a non-null string as the\n * final resolved id and serves it via the virtual `/@id/` prefix, which 404s\n * because we don't provide a `load` hook. Resolving to an absolute path here\n * lets every supported bundler load the file the normal way.\n */\nconst MOCK_PATH = (() => {\n  try {\n    return fileURLToPath(import.meta.resolve('@ait-co/devtools/mock'));\n  } catch {\n    // Fallback for runtimes where `import.meta.resolve` is unavailable.\n    return '@ait-co/devtools/mock';\n  }\n})();\n\nexport interface AitDevtoolsOptions {\n  /**\n   * 패널 자동 주입 여부 (default: true)\n   * true이면 진입점에 floating panel import를 자동 추가한다.\n   */\n  panel?: boolean;\n  /**\n   * production 환경에서도 devtools를 강제로 활성화 (default: false)\n   */\n  forceEnable?: boolean;\n  /**\n   * mock alias 활성화 여부. default: true (development), false (production + forceEnable)\n   */\n  mock?: boolean;\n  /**\n   * Vite dev server에 MCP state endpoint를 추가할지 여부 (default: false).\n   *\n   * `true`로 설정하면:\n   *  - GET  /api/ait-devtools/state  — 마지막으로 브라우저가 push한 mock state 스냅샷 반환\n   *  - POST /api/ait-devtools/state  — 브라우저 panel이 상태 변경 시 자동 push (panel 내부 처리)\n   *\n   * 이 endpoint를 `@ait-co/devtools` MCP stdio server가 읽어 AI 에이전트에 mock state를 노출한다.\n   * Vite 전용: webpack/rspack/esbuild/rollup 환경에서는 무시된다.\n   */\n  mcp?: boolean;\n  /**\n   * Vite dev 서버를 Cloudflare quick tunnel(`*.trycloudflare.com`, 계정 불필요)로\n   * 외부 노출해 실제 폰에서 미리보기. **Vite dev 모드 전용** — production은\n   * `forceEnable`이어도 터널을 띄우지 않는다 (의도치 않은 노출 방지). 다른 번들러는\n   * 무시. `true`면 기본 동작, 객체로 세부 설정 가능.\n   */\n  tunnel?:\n    | boolean\n    | {\n        /** 노출할 포트 (미지정 시 dev 서버가 실제 listen한 포트 자동 감지). */\n        port?: number;\n        /** 터미널 ASCII QR 출력 (default: true). */\n        qr?: boolean;\n        /**\n         * 환경 2(실기기 PWA)에 CDP 디버깅 배선 (default: false).\n         *\n         * `true`면 dev 서버 HTTP 터널과 **별도로** Chii relay를 띄우고 그 relay에\n         * 두 번째 quick tunnel을 붙여, launcher QR deep-link에 `&debug=1&relay=<wss>`를\n         * 실어 보낸다. 폰의 PWA iframe이 in-app debug gate를 통과해 target.js를 주입받고,\n         * AI host MCP가 그 relay에 client로 붙으면 실기기 WebKit 위에서 CDP 디버깅이 열린다.\n         * mock SDK는 그대로라 `call_sdk`는 환경 2에서 mock을 친다 (fidelity 사다리의\n         * 설계 의도 — SDK fidelity가 필요하면 환경 3로 올라간다).\n         */\n        cdp?: boolean;\n      };\n}\n\nconst FRAMEWORK_ID = '@apps-in-toss/web-framework';\nconst BRIDGE_ID = '@apps-in-toss/web-bridge'; // back-compat (2.x)\nconst ANALYTICS_ID = '@apps-in-toss/web-analytics'; // back-compat (2.x)\nconst WEBVIEW_BRIDGE_ID = '@apps-in-toss/webview-bridge'; // 3.0+\n\n/** MCP state endpoint path — browser panel POSTs here, MCP server GETs here */\nconst MCP_STATE_PATH = '/api/ait-devtools/state';\n\n/**\n * Machine-level telemetry consent endpoint (#542).\n *\n * GET  → returns current machine consent state as JSON (for the panel to read\n *         and skip the toast when already decided).\n * POST → panel or environment-tab toggle writes new consent back to the machine\n *        file (body: { consent: 'granted' | 'denied', policy_version: string }).\n *\n * Always registered (not gated on `mcp: true`) — the panel needs this\n * unconditionally when the dev server is running.\n */\nconst TELEMETRY_CONSENT_PATH = '/api/ait-devtools/telemetry-consent';\n\n/**\n * Resolves the effective tunnel option (#425).\n *\n * An explicit `tunnel` value (including `false`) always takes priority over\n * env vars — the `??` operator means `undefined` (= omitted) falls through,\n * but `false` / `true` / an object are preserved as-is (non-breaking).\n *\n * When the option is omitted:\n * - `AIT_TUNNEL=1` enables the base screen-preview tunnel.\n * - `AIT_TUNNEL_CDP=1` (requires `AIT_TUNNEL`) upgrades to the CDP relay.\n * - Neither set → `false` (disabled).\n *\n * Extracted as a pure function so it can be unit-tested without standing up\n * a full Vite dev server.\n *\n * @param explicit - The `tunnel` option as passed by the consumer (or `undefined` when omitted).\n * @param env - The process environment (injectable for testing).\n */\nexport function resolveTunnelOption(\n  explicit: AitDevtoolsOptions['tunnel'],\n  env: Record<string, string | undefined>,\n): AitDevtoolsOptions['tunnel'] {\n  return explicit ?? (env.AIT_TUNNEL ? { cdp: !!env.AIT_TUNNEL_CDP } : false);\n}\n\nconst aitDevtoolsPlugin = createUnplugin((options?: AitDevtoolsOptions) => {\n  const isDev = process.env.NODE_ENV !== 'production';\n  const shouldEnable = isDev || (options?.forceEnable ?? false);\n  const shouldMock = shouldEnable && (options?.mock ?? isDev);\n  const shouldPanel = shouldEnable && (options?.panel ?? true);\n  const shouldMcp = shouldEnable && (options?.mcp ?? false);\n\n  // In-memory store for the last state snapshot pushed by the browser panel.\n  // Only allocated when mcp: true to avoid any overhead in the common case.\n  let lastState: string | null = null;\n\n  // Tunnel is dev-only and Vite-only. Never under production — even with\n  // forceEnable — so a production build can't accidentally expose itself.\n  //\n  // Tunnel toggle resolution (#425): an explicit `tunnel` option always wins;\n  // when omitted, fall back to the AIT_TUNNEL / AIT_TUNNEL_CDP env vars so a\n  // consumer needs no `tunnel:` line in vite.config to enable env-2 preview.\n  // AIT_TUNNEL gates the base (screen preview); AIT_TUNNEL_CDP upgrades to the\n  // CDP relay. Production safety is unchanged — the existing\n  // `shouldTunnel = isDev && !!tunnelOpt` guard below still blocks prod builds.\n  const tunnelOpt = resolveTunnelOption(options?.tunnel, process.env);\n  const shouldTunnel = isDev && !!tunnelOpt;\n  const tunnelConfig = typeof tunnelOpt === 'object' ? tunnelOpt : {};\n\n  return {\n    name: 'ait-co-devtools',\n    enforce: 'pre' as const,\n\n    resolveId(id: string) {\n      if (!shouldMock) return null;\n      // @apps-in-toss/web-framework → @ait-co/devtools/mock (absolute path)\n      if (\n        id === FRAMEWORK_ID ||\n        id === WEBVIEW_BRIDGE_ID ||\n        id === BRIDGE_ID ||\n        id === ANALYTICS_ID\n      ) {\n        return MOCK_PATH;\n      }\n      return null;\n    },\n\n    transformInclude(id: string) {\n      if (!shouldPanel) return false;\n      // 진입점 파일에만 패널 import를 주입\n      return (\n        /\\.(tsx?|jsx?)$/.test(id) &&\n        /\\/(main|index|entry|app)\\.[tj]sx?$/i.test(id) &&\n        !id.includes('node_modules')\n      );\n    },\n\n    transform(code: string) {\n      // transformInclude가 이미 shouldPanel을 확인하지만, 안전망으로 유지\n      if (!shouldPanel) return null;\n      // 이미 패널이 import 되어있으면 스킵\n      if (code.includes('@ait-co/devtools/panel')) return null;\n      // transformInclude가 진입점 파일만 통과시키므로 바로 prepend\n      return `import '@ait-co/devtools/panel';\\n${code}`;\n    },\n\n    // Vite-only: register the MCP state HTTP endpoint on the dev server, and\n    // optionally start a Cloudflare quick tunnel once the dev server is listening.\n    // Non-Vite bundlers do not have a dev server concept so this is silently\n    // skipped (unplugin passes `vite` key only when building for Vite).\n    vite: {\n      config() {\n        if (!shouldTunnel) return;\n        // Vite blocks requests whose Host header isn't in `server.allowedHosts`\n        // (defaults to localhost only). The quick-tunnel hostname is random per\n        // run, so allow the whole `.trycloudflare.com` suffix while the tunnel\n        // is on. (A leading `.` makes Vite match the domain and its subdomains.)\n        return { server: { allowedHosts: ['.trycloudflare.com'] } };\n      },\n\n      configureServer(server: import('vite').ViteDevServer) {\n        // Machine-level telemetry consent endpoint (#542): always registered when\n        // the dev server is enabled so the panel can read/write consent across\n        // origin rotations (tunnel host changes, port changes).\n        //\n        // We lazily initialise `machineConsent` once the server is ready. The\n        // TTY prompt runs synchronously inside the `listening` event so it\n        // appears in the same terminal window before any dev-server noise.\n        let machineConsent: MachineTelemetryState | null = null;\n\n        // Start the machine-consent bootstrap as soon as configureServer runs.\n        // Fire-and-forget; errors are caught and logged. The endpoint guards\n        // against `machineConsent === null` with a 503 during the brief boot.\n        if (shouldEnable) {\n          server.httpServer?.once('listening', () => {\n            ensureMachineConsent(CURRENT_POLICY_VERSION)\n              .then((state) => {\n                machineConsent = state;\n              })\n              .catch((err: unknown) => {\n                // Non-fatal — panel will fall back to localStorage behaviour.\n                console.warn(\n                  `[@ait-co/devtools] machine consent init failed: ${\n                    err instanceof Error ? err.message : String(err)\n                  }`,\n                );\n              });\n          });\n\n          // Telemetry consent endpoint — CORS open (localhost only in practice).\n          server.middlewares.use(TELEMETRY_CONSENT_PATH, (req, res) => {\n            res.setHeader('Access-Control-Allow-Origin', '*');\n            res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');\n            res.setHeader('Access-Control-Allow-Headers', 'Content-Type');\n\n            if (req.method === 'OPTIONS') {\n              res.writeHead(204);\n              res.end();\n              return;\n            }\n\n            if (req.method === 'GET') {\n              if (machineConsent === null) {\n                // Still booting — panel should fall back to localStorage.\n                res.writeHead(503, { 'Content-Type': 'application/json' });\n                res.end(JSON.stringify({ error: 'Machine consent not yet initialised.' }));\n                return;\n              }\n              res.writeHead(200, { 'Content-Type': 'application/json' });\n              res.end(JSON.stringify(machineConsent));\n              return;\n            }\n\n            if (req.method === 'POST') {\n              const chunks: Buffer[] = [];\n              req.on('data', (chunk: Buffer) => chunks.push(chunk));\n              req.on('end', () => {\n                try {\n                  const body = Buffer.concat(chunks).toString('utf-8');\n                  const payload = JSON.parse(body) as {\n                    consent?: string;\n                    policy_version?: string;\n                  };\n\n                  const consent = payload.consent;\n                  if (consent !== 'granted' && consent !== 'denied' && consent !== 'undecided') {\n                    res.writeHead(400, { 'Content-Type': 'application/json' });\n                    res.end(\n                      JSON.stringify({\n                        error: 'Invalid consent value. Expected granted | denied | undecided.',\n                      }),\n                    );\n                    return;\n                  }\n\n                  writeMachineState({\n                    consent,\n                    policy_version: payload.policy_version ?? CURRENT_POLICY_VERSION,\n                  })\n                    .then(async () => {\n                      // Update the in-memory cache.\n                      const { readMachineState } = await import('../telemetry/machine-state.js');\n                      machineConsent = await readMachineState();\n                      res.writeHead(204);\n                      res.end();\n                    })\n                    .catch((err: unknown) => {\n                      res.writeHead(500, { 'Content-Type': 'application/json' });\n                      res.end(\n                        JSON.stringify({\n                          error: `Write failed: ${err instanceof Error ? err.message : String(err)}`,\n                        }),\n                      );\n                    });\n                  return;\n                } catch {\n                  res.writeHead(400, { 'Content-Type': 'application/json' });\n                  res.end(JSON.stringify({ error: 'Invalid JSON body.' }));\n                }\n              });\n              return;\n            }\n\n            res.writeHead(405, { 'Content-Type': 'application/json' });\n            res.end(JSON.stringify({ error: 'Method not allowed' }));\n          });\n        }\n\n        // MCP state endpoint: browser panel POSTs state here, MCP stdio server GETs it.\n        if (shouldMcp) {\n          server.middlewares.use(MCP_STATE_PATH, (req, res) => {\n            // Allow Claude Code / AI agents (running locally) to read state\n            res.setHeader('Access-Control-Allow-Origin', '*');\n            res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');\n            res.setHeader('Access-Control-Allow-Headers', 'Content-Type');\n\n            if (req.method === 'OPTIONS') {\n              res.writeHead(204);\n              res.end();\n              return;\n            }\n\n            if (req.method === 'GET') {\n              if (lastState === null) {\n                res.writeHead(503, { 'Content-Type': 'application/json' });\n                res.end(\n                  JSON.stringify({\n                    error: 'No state received yet. Open the app in a browser first.',\n                  }),\n                );\n                return;\n              }\n              res.writeHead(200, { 'Content-Type': 'application/json' });\n              res.end(lastState);\n              return;\n            }\n\n            if (req.method === 'POST') {\n              const chunks: Buffer[] = [];\n              req.on('data', (chunk: Buffer) => chunks.push(chunk));\n              req.on('end', () => {\n                try {\n                  const body = Buffer.concat(chunks).toString('utf-8');\n                  // Validate it's parseable JSON before caching\n                  JSON.parse(body);\n                  lastState = body;\n                  res.writeHead(204);\n                  res.end();\n                } catch {\n                  res.writeHead(400, { 'Content-Type': 'application/json' });\n                  res.end(JSON.stringify({ error: 'Invalid JSON' }));\n                }\n              });\n              return;\n            }\n\n            res.writeHead(405, { 'Content-Type': 'application/json' });\n            res.end(JSON.stringify({ error: 'Method not allowed' }));\n          });\n        }\n\n        // Tunnel: start a Cloudflare quick tunnel once the dev server is listening.\n        if (shouldTunnel) {\n          let tunnel: { stop: () => void } | null = null;\n          // env-2 CDP wiring (tunnel.cdp): a second tunnel + Chii relay, torn\n          // down alongside the HTTP tunnel. Fire-and-forget close on teardown.\n          let relayTunnel: { stop: () => void } | null = null;\n          let relay: { close: () => Promise<void> } | null = null;\n          // env-2 HTML dashboard (issue #408): local 127.0.0.1 HTTP server that\n          // serves the QR + connect-steps + FAQ page (env 3/4 UX parity), opened\n          // in the browser when CDP is wired + GUI present. Torn down with the\n          // tunnel. Only set when the dashboard actually started.\n          let qrDashboard: { close: () => Promise<void> } | null = null;\n          // env-2 URL file store (#424): captured after the first writeRelayUrls\n          // call so cleanup() can call deleteRelayUrls without a re-import.\n          // SECRET-HANDLING: the stored function reference never carries URL values.\n          let relayUrlDeleteFn: ((projectRoot: string) => Promise<void>) | null = null;\n          // #420: parent-PID watcher — self-terminate when vite's parent dies so\n          // cloudflared children don't become zombies holding stale tunnels.\n          let parentWatcher: { stop(): void } | null = null;\n          const httpServer = server.httpServer;\n\n          httpServer?.once('listening', () => {\n            const address = httpServer?.address();\n            const port =\n              tunnelConfig.port ??\n              (address && typeof address === 'object' ? address.port : undefined);\n            if (!port) {\n              console.warn(\n                '[@ait-co/devtools] tunnel: could not determine the dev server port; skipping.',\n              );\n              return;\n            }\n            // Dynamic import keeps `cloudflared` / `qrcode-terminal` off the\n            // module graph unless the tunnel is actually used.\n            import('./tunnel.js')\n              .then(async ({ startQuickTunnel, printTunnelBanner, startTunnelDashboard }) => {\n                const t = await startQuickTunnel(port);\n                tunnel = t;\n\n                // env-2 CDP: boot a Chii relay (OS-assigned local port) and a\n                // second quick tunnel to it. The relay's https tunnel URL becomes\n                // the `wss://` relay the launcher QR carries (&debug=1&relay=).\n                let relayWssUrl: string | undefined;\n                // SECRET-HANDLING: relayHttpUrl carries the relay host — never logged.\n                let relayHttpUrl: string | undefined;\n                // LOCAL relay base — loopback URL, safe to surface (issue #530).\n                let relayLocalHttpUrl: string | undefined;\n                if (tunnelConfig.cdp) {\n                  try {\n                    // Relay-auth baseline (issue #250): the env-2 CDP relay is\n                    // reachable over a public `*.trycloudflare.com` tunnel, so a\n                    // configured TOTP secret is MANDATORY and the relay enforces\n                    // it on every WS upgrade.\n                    //\n                    // First-run auto-mint (issue #394, project-local #396): if\n                    // AIT_DEBUG_TOTP_SECRET is not yet set, ensureRelaySecret()\n                    // mints a 256-bit random secret, persists it to the project-\n                    // local file <project>/.ait_relay (0600, anchored at the\n                    // nearest package.json directory above server.config.root),\n                    // and injects it into process.env so the following\n                    // assertRelayAuthConfigured() call succeeds. On subsequent\n                    // runs the persisted value is loaded silently — no manual\n                    // export needed. The MCP daemon reads the SAME file read-only\n                    // via loadRelaySecretReadOnly() when switching to a relay env.\n                    // SECRET-HANDLING: neither ensureRelaySecret nor the\n                    // guard/predicate log the secret value.\n                    const { ensureRelaySecret } = await import('../mcp/relay-secret-store.js');\n                    await ensureRelaySecret({ projectRoot: server.config.root });\n                    const { assertRelayAuthConfigured, buildRelayVerifyAuth } = await import(\n                      '../mcp/totp.js'\n                    );\n                    assertRelayAuthConfigured();\n                    const verifyAuth = buildRelayVerifyAuth();\n                    const { startChiiRelay } = await import('../mcp/chii-relay.js');\n                    // Issue #467: this relay lives in the vite process, so the\n                    // MCP daemon's get_debug_status counter cannot see its 401s.\n                    // Surface a throttled hint in the vite terminal instead.\n                    // SECRET-HANDLING: fixed message only — no URL, code, host.\n                    let lastAuthRejectWarnAt = 0;\n                    const r = await startChiiRelay({\n                      port: 0,\n                      verifyAuth,\n                      onAuthReject: () => {\n                        const nowMs = Date.now();\n                        if (nowMs - lastAuthRejectWarnAt < 10_000) return;\n                        lastAuthRejectWarnAt = nowMs;\n                        console.warn(\n                          '[@ait-co/devtools] tunnel: relay 인증(TOTP) 거부 감지 — 폰에서 QR을 다시 스캔하세요 (코드는 ~3분마다 만료)',\n                        );\n                      },\n                    });\n                    relay = r;\n                    const rt = await startQuickTunnel(r.port);\n                    relayTunnel = rt;\n                    // SECRET-HANDLING: rt.url is the https relay base — stored in\n                    // relayHttpUrl for .ait_urls write below; never logged.\n                    relayHttpUrl = rt.url;\n                    relayWssUrl = rt.url.replace(/^https:/, 'wss:');\n                    // LOCAL relay base for MCP inspector URL assembly (issue #530):\n                    // the relay process runs on this machine, so the inspector\n                    // front_end + client WS can use the loopback address directly —\n                    // no tunnel round-trip for the developer's browser.\n                    // Safe to surface: loopback URL contains no tunnel host.\n                    relayLocalHttpUrl = `http://127.0.0.1:${r.port}`;\n                  } catch (err: unknown) {\n                    console.warn(\n                      `[@ait-co/devtools] tunnel: CDP relay not started — screen preview works without on-device debugging: ${\n                        err instanceof Error ? err.message : String(err)\n                      }`,\n                    );\n                  }\n                }\n\n                // Read the app name from the project's package.json to add to\n                // the launcher deep-link (#498). Failure is silently ignored.\n                let tunnelAppName: string | undefined;\n                try {\n                  const { readFileSync } = await import('node:fs');\n                  const pkgPath = `${server.config.root}/package.json`;\n                  const pkgRaw = readFileSync(pkgPath, 'utf8');\n                  const pkg = JSON.parse(pkgRaw) as Record<string, unknown>;\n                  const rawName = typeof pkg.name === 'string' ? pkg.name : '';\n                  const stripped = rawName.includes('/')\n                    ? rawName.slice(rawName.indexOf('/') + 1)\n                    : rawName;\n                  tunnelAppName = stripped.trim() || undefined;\n                } catch {\n                  // Silently ignore — fail-open.\n                }\n\n                await printTunnelBanner(t.url, {\n                  qr: tunnelConfig.qr,\n                  relayWssUrl,\n                  name: tunnelAppName,\n                });\n\n                // env-2 URL file-based discovery (#424): write .ait_urls so the\n                // MCP daemon can discover the relay/tunnel URLs without manual env\n                // var copy-paste. SECRET-HANDLING: URL values are never logged.\n                // Capture deleteRelayUrls in the outer-scope fn so cleanup() can\n                // call it without re-importing (no async in signal handlers).\n                const { writeRelayUrls, deleteRelayUrls } = await import(\n                  '../mcp/relay-url-store.js'\n                );\n                await writeRelayUrls({\n                  projectRoot: server.config.root,\n                  tunnelBaseUrl: t.url,\n                  ...(relayHttpUrl !== undefined ? { relayBaseUrl: relayHttpUrl } : {}),\n                  // Issue #530: local relay base for inspector URL (loopback, no tunnel host).\n                  ...(relayLocalHttpUrl !== undefined ? { relayLocalUrl: relayLocalHttpUrl } : {}),\n                });\n                relayUrlDeleteFn = (root: string) => deleteRelayUrls({ projectRoot: root });\n\n                // env-2 HTML dashboard (issue #408): when CDP is wired and a GUI\n                // is present, serve the same QR+FAQ dashboard env 3/4 uses and\n                // open it in the browser. No-op (returns undefined) for the\n                // screen-only tunnel, headless, qr:false, or AIT_AUTO_DEVTOOLS=0\n                // — the ASCII QR above remains the fallback in those cases.\n                if (relayWssUrl) {\n                  qrDashboard =\n                    (await startTunnelDashboard({\n                      tunnelUrl: t.url,\n                      relayWssUrl,\n                      qr: tunnelConfig.qr,\n                      name: tunnelAppName,\n                    })) ?? null;\n                }\n\n                // #420: start watching the parent PID now that tunnel resources\n                // are allocated. When the parent dies/reparents, clean up\n                // synchronously (stops cloudflared children) then exit.\n                parentWatcher = startParentWatcher(() => {\n                  cleanup();\n                  process.exit(0);\n                });\n              })\n              .catch((err: unknown) => {\n                console.warn(\n                  `[@ait-co/devtools] tunnel failed to start: ${\n                    err instanceof Error ? err.message : String(err)\n                  }`,\n                );\n              });\n          });\n\n          const cleanup = () => {\n            parentWatcher?.stop();\n            tunnel?.stop();\n            relayTunnel?.stop();\n            void relay?.close();\n            void qrDashboard?.close();\n            // env-2 URL file cleanup (#424): remove .ait_urls on teardown so a\n            // stale file doesn't cause the MCP daemon to attempt a doomed attach.\n            // SECRET-HANDLING: relayUrlDeleteFn never logs the path or URL values.\n            void relayUrlDeleteFn?.(server.config.root);\n          };\n          httpServer?.once('close', cleanup);\n          process.once('SIGINT', cleanup);\n          process.once('SIGTERM', cleanup);\n          process.once('SIGHUP', cleanup);\n          process.once('exit', cleanup);\n        }\n      },\n    },\n  };\n});\n\nexport const vite = aitDevtoolsPlugin.vite;\nexport const webpack = aitDevtoolsPlugin.webpack;\nexport const rollup = aitDevtoolsPlugin.rollup;\nexport const esbuild = aitDevtoolsPlugin.esbuild;\nexport const rspack = aitDevtoolsPlugin.rspack;\n\nexport default aitDevtoolsPlugin;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAoBA,SAAgB,WAAW,KAAsB;AAC/C,KAAI;AACF,UAAQ,KAAK,KAAK,EAAE;AACpB,SAAO;UACA,KAAc;AAGrB,MAAK,IAA8B,SAAS,QAAS,QAAO;AAC5D,SAAO;;;;;;;;;;;;;;;;;;;;;AA0BX,SAAgB,mBACd,YACA,MAOkB;CAClB,MAAM,EACJ,aAAa,KACb,cAAc,QAAQ,MACtB,UAAU,YACV,gBAAgB,QAAQ,MACxB,OAAO,QAAgB,QAAQ,OAAO,MAAM,IAAI,KAC9C,QAAQ,EAAE;AAId,KAAI,eAAe,GAAG;AACpB,MAAI,2EAA2E;AAC/E,SAAO,EAAE,OAAO,IAAI;;CAGtB,IAAI,QAAQ;CAEZ,MAAM,SAAS,kBAAkB;AAC/B,MAAI,MAAO;EAEX,MAAM,cAAc,SAAS;AAG7B,MAFiB,gBAAgB,eAAe,CAAC,QAAQ,YAAY,EAEvD;AACZ,WAAQ;AACR,iBAAc,OAAO;AACrB,OACE,8CAA8C,YAAY,wBAAwB,YAAY,qBAC/F;AACD,eAAY;;IAEb,WAAW;AAEd,QAAO,EACL,OAAO;AACL,gBAAc,OAAO;IAExB;;;;;;;;ACpBH,MAAa,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACrCtC,MAAM,mBAAmB;AACvB,KAAI;AACF,UAAA,GAAA,SAAA,eAAA,EAAA,CAAiC,QAAQ,wBAAwB,CAAC;SAC5D;AAEN,SAAO;;IAEP;AAsDJ,MAAM,eAAe;AACrB,MAAM,YAAY;AAClB,MAAM,eAAe;AACrB,MAAM,oBAAoB;;AAG1B,MAAM,iBAAiB;;;;;;;;;;;;AAavB,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;AAoB/B,SAAgB,oBACd,UACA,KAC8B;AAC9B,QAAO,aAAa,IAAI,aAAa,EAAE,KAAK,CAAC,CAAC,IAAI,gBAAgB,GAAG;;AAGvE,MAAM,qBAAA,GAAA,SAAA,iBAAoC,YAAiC;CACzE,MAAM,QAAQ,QAAQ,IAAI,aAAa;CACvC,MAAM,eAAe,UAAU,SAAS,eAAe;CACvD,MAAM,aAAa,iBAAiB,SAAS,QAAQ;CACrD,MAAM,cAAc,iBAAiB,SAAS,SAAS;CACvD,MAAM,YAAY,iBAAiB,SAAS,OAAO;CAInD,IAAI,YAA2B;CAW/B,MAAM,YAAY,oBAAoB,SAAS,QAAQ,QAAQ,IAAI;CACnE,MAAM,eAAe,SAAS,CAAC,CAAC;CAChC,MAAM,eAAe,OAAO,cAAc,WAAW,YAAY,EAAE;AAEnE,QAAO;EACL,MAAM;EACN,SAAS;EAET,UAAU,IAAY;AACpB,OAAI,CAAC,WAAY,QAAO;AAExB,OACE,OAAO,gBACP,OAAO,qBACP,OAAO,aACP,OAAO,aAEP,QAAO;AAET,UAAO;;EAGT,iBAAiB,IAAY;AAC3B,OAAI,CAAC,YAAa,QAAO;AAEzB,UACE,iBAAiB,KAAK,GAAG,IACzB,sCAAsC,KAAK,GAAG,IAC9C,CAAC,GAAG,SAAS,eAAe;;EAIhC,UAAU,MAAc;AAEtB,OAAI,CAAC,YAAa,QAAO;AAEzB,OAAI,KAAK,SAAS,yBAAyB,CAAE,QAAO;AAEpD,UAAO,qCAAqC;;EAO9C,MAAM;GACJ,SAAS;AACP,QAAI,CAAC,aAAc;AAKnB,WAAO,EAAE,QAAQ,EAAE,cAAc,CAAC,qBAAqB,EAAE,EAAE;;GAG7D,gBAAgB,QAAsC;IAQpD,IAAI,iBAA+C;AAKnD,QAAI,cAAc;AAChB,YAAO,YAAY,KAAK,mBAAmB;AACzC,4BAAA,qBAAqB,uBAAuB,CACzC,MAAM,UAAU;AACf,wBAAiB;QACjB,CACD,OAAO,QAAiB;AAEvB,eAAQ,KACN,mDACE,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI,GAEnD;QACD;OACJ;AAGF,YAAO,YAAY,IAAI,yBAAyB,KAAK,QAAQ;AAC3D,UAAI,UAAU,+BAA+B,IAAI;AACjD,UAAI,UAAU,gCAAgC,qBAAqB;AACnE,UAAI,UAAU,gCAAgC,eAAe;AAE7D,UAAI,IAAI,WAAW,WAAW;AAC5B,WAAI,UAAU,IAAI;AAClB,WAAI,KAAK;AACT;;AAGF,UAAI,IAAI,WAAW,OAAO;AACxB,WAAI,mBAAmB,MAAM;AAE3B,YAAI,UAAU,KAAK,EAAE,gBAAgB,oBAAoB,CAAC;AAC1D,YAAI,IAAI,KAAK,UAAU,EAAE,OAAO,wCAAwC,CAAC,CAAC;AAC1E;;AAEF,WAAI,UAAU,KAAK,EAAE,gBAAgB,oBAAoB,CAAC;AAC1D,WAAI,IAAI,KAAK,UAAU,eAAe,CAAC;AACvC;;AAGF,UAAI,IAAI,WAAW,QAAQ;OACzB,MAAM,SAAmB,EAAE;AAC3B,WAAI,GAAG,SAAS,UAAkB,OAAO,KAAK,MAAM,CAAC;AACrD,WAAI,GAAG,aAAa;AAClB,YAAI;SACF,MAAM,OAAO,OAAO,OAAO,OAAO,CAAC,SAAS,QAAQ;SACpD,MAAM,UAAU,KAAK,MAAM,KAAK;SAKhC,MAAM,UAAU,QAAQ;AACxB,aAAI,YAAY,aAAa,YAAY,YAAY,YAAY,aAAa;AAC5E,cAAI,UAAU,KAAK,EAAE,gBAAgB,oBAAoB,CAAC;AAC1D,cAAI,IACF,KAAK,UAAU,EACb,OAAO,iEACR,CAAC,CACH;AACD;;AAGF,+BAAA,kBAAkB;UAChB;UACA,gBAAgB,QAAQ,kBAAA;UACzB,CAAC,CACC,KAAK,YAAY;UAEhB,MAAM,EAAE,qBAAqB,MAAA,QAAA,SAAA,CAAA,WAAA,QAAM,gCAAA,CAAA,CAAA,MAAA,MAAA,EAAA,sBAAA;AACnC,2BAAiB,MAAM,kBAAkB;AACzC,cAAI,UAAU,IAAI;AAClB,cAAI,KAAK;WACT,CACD,OAAO,QAAiB;AACvB,cAAI,UAAU,KAAK,EAAE,gBAAgB,oBAAoB,CAAC;AAC1D,cAAI,IACF,KAAK,UAAU,EACb,OAAO,iBAAiB,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI,IACzE,CAAC,CACH;WACD;AACJ;gBACM;AACN,aAAI,UAAU,KAAK,EAAE,gBAAgB,oBAAoB,CAAC;AAC1D,aAAI,IAAI,KAAK,UAAU,EAAE,OAAO,sBAAsB,CAAC,CAAC;;SAE1D;AACF;;AAGF,UAAI,UAAU,KAAK,EAAE,gBAAgB,oBAAoB,CAAC;AAC1D,UAAI,IAAI,KAAK,UAAU,EAAE,OAAO,sBAAsB,CAAC,CAAC;OACxD;;AAIJ,QAAI,UACF,QAAO,YAAY,IAAI,iBAAiB,KAAK,QAAQ;AAEnD,SAAI,UAAU,+BAA+B,IAAI;AACjD,SAAI,UAAU,gCAAgC,qBAAqB;AACnE,SAAI,UAAU,gCAAgC,eAAe;AAE7D,SAAI,IAAI,WAAW,WAAW;AAC5B,UAAI,UAAU,IAAI;AAClB,UAAI,KAAK;AACT;;AAGF,SAAI,IAAI,WAAW,OAAO;AACxB,UAAI,cAAc,MAAM;AACtB,WAAI,UAAU,KAAK,EAAE,gBAAgB,oBAAoB,CAAC;AAC1D,WAAI,IACF,KAAK,UAAU,EACb,OAAO,2DACR,CAAC,CACH;AACD;;AAEF,UAAI,UAAU,KAAK,EAAE,gBAAgB,oBAAoB,CAAC;AAC1D,UAAI,IAAI,UAAU;AAClB;;AAGF,SAAI,IAAI,WAAW,QAAQ;MACzB,MAAM,SAAmB,EAAE;AAC3B,UAAI,GAAG,SAAS,UAAkB,OAAO,KAAK,MAAM,CAAC;AACrD,UAAI,GAAG,aAAa;AAClB,WAAI;QACF,MAAM,OAAO,OAAO,OAAO,OAAO,CAAC,SAAS,QAAQ;AAEpD,aAAK,MAAM,KAAK;AAChB,oBAAY;AACZ,YAAI,UAAU,IAAI;AAClB,YAAI,KAAK;eACH;AACN,YAAI,UAAU,KAAK,EAAE,gBAAgB,oBAAoB,CAAC;AAC1D,YAAI,IAAI,KAAK,UAAU,EAAE,OAAO,gBAAgB,CAAC,CAAC;;QAEpD;AACF;;AAGF,SAAI,UAAU,KAAK,EAAE,gBAAgB,oBAAoB,CAAC;AAC1D,SAAI,IAAI,KAAK,UAAU,EAAE,OAAO,sBAAsB,CAAC,CAAC;MACxD;AAIJ,QAAI,cAAc;KAChB,IAAI,SAAsC;KAG1C,IAAI,cAA2C;KAC/C,IAAI,QAA+C;KAKnD,IAAI,cAAqD;KAIzD,IAAI,mBAAoE;KAGxE,IAAI,gBAAyC;KAC7C,MAAM,aAAa,OAAO;AAE1B,iBAAY,KAAK,mBAAmB;MAClC,MAAM,UAAU,YAAY,SAAS;MACrC,MAAM,OACJ,aAAa,SACZ,WAAW,OAAO,YAAY,WAAW,QAAQ,OAAO,KAAA;AAC3D,UAAI,CAAC,MAAM;AACT,eAAQ,KACN,gFACD;AACD;;AAIF,cAAA,SAAA,CAAA,WAAA,QAAA,yBAAA,CAAA,CACG,KAAK,OAAO,EAAE,kBAAkB,mBAAmB,2BAA2B;OAC7E,MAAM,IAAI,MAAM,iBAAiB,KAAK;AACtC,gBAAS;OAKT,IAAI;OAEJ,IAAI;OAEJ,IAAI;AACJ,WAAI,aAAa,IACf,KAAI;QAkBF,MAAM,EAAE,sBAAsB,MAAA,QAAA,SAAA,CAAA,WAAA,QAAM,qCAAA,CAAA;AACpC,cAAM,kBAAkB,EAAE,aAAa,OAAO,OAAO,MAAM,CAAC;QAC5D,MAAM,EAAE,2BAA2B,yBAAyB,MAAA,QAAA,SAAA,CAAA,WAAA,QAAM,uBAAA,CAAA;AAGlE,mCAA2B;QAC3B,MAAM,aAAa,sBAAsB;QACzC,MAAM,EAAE,mBAAmB,MAAA,QAAA,SAAA,CAAA,WAAA,QAAM,6BAAA,CAAA;QAKjC,IAAI,uBAAuB;QAC3B,MAAM,IAAI,MAAM,eAAe;SAC7B,MAAM;SACN;SACA,oBAAoB;UAClB,MAAM,QAAQ,KAAK,KAAK;AACxB,cAAI,QAAQ,uBAAuB,IAAQ;AAC3C,iCAAuB;AACvB,kBAAQ,KACN,oFACD;;SAEJ,CAAC;AACF,gBAAQ;QACR,MAAM,KAAK,MAAM,iBAAiB,EAAE,KAAK;AACzC,sBAAc;AAGd,uBAAe,GAAG;AAClB,sBAAc,GAAG,IAAI,QAAQ,WAAW,OAAO;AAM/C,4BAAoB,oBAAoB,EAAE;gBACnC,KAAc;AACrB,gBAAQ,KACN,wGACE,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI,GAEnD;;OAML,IAAI;AACJ,WAAI;QACF,MAAM,EAAE,iBAAiB,MAAM,OAAO;QAEtC,MAAM,SAAS,aADC,GAAG,OAAO,OAAO,KAAK,gBACD,OAAO;QAC5C,MAAM,MAAM,KAAK,MAAM,OAAO;QAC9B,MAAM,UAAU,OAAO,IAAI,SAAS,WAAW,IAAI,OAAO;AAI1D,yBAHiB,QAAQ,SAAS,IAAI,GAClC,QAAQ,MAAM,QAAQ,QAAQ,IAAI,GAAG,EAAE,GACvC,SACqB,MAAM,IAAI,KAAA;eAC7B;AAIR,aAAM,kBAAkB,EAAE,KAAK;QAC7B,IAAI,aAAa;QACjB;QACA,MAAM;QACP,CAAC;OAOF,MAAM,EAAE,gBAAgB,oBAAoB,MAAA,QAAA,SAAA,CAAA,WAAA,QAAM,kCAAA,CAAA;AAGlD,aAAM,eAAe;QACnB,aAAa,OAAO,OAAO;QAC3B,eAAe,EAAE;QACjB,GAAI,iBAAiB,KAAA,IAAY,EAAE,cAAc,cAAc,GAAG,EAAE;QAEpE,GAAI,sBAAsB,KAAA,IAAY,EAAE,eAAe,mBAAmB,GAAG,EAAE;QAChF,CAAC;AACF,2BAAoB,SAAiB,gBAAgB,EAAE,aAAa,MAAM,CAAC;AAO3E,WAAI,YACF,eACG,MAAM,qBAAqB;QAC1B,WAAW,EAAE;QACb;QACA,IAAI,aAAa;QACjB,MAAM;QACP,CAAC,IAAK;AAMX,uBAAgB,yBAAyB;AACvC,iBAAS;AACT,gBAAQ,KAAK,EAAE;SACf;QACF,CACD,OAAO,QAAiB;AACvB,eAAQ,KACN,8CACE,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI,GAEnD;QACD;OACJ;KAEF,MAAM,gBAAgB;AACpB,qBAAe,MAAM;AACrB,cAAQ,MAAM;AACd,mBAAa,MAAM;AACd,aAAO,OAAO;AACd,mBAAa,OAAO;AAIpB,yBAAmB,OAAO,OAAO,KAAK;;AAE7C,iBAAY,KAAK,SAAS,QAAQ;AAClC,aAAQ,KAAK,UAAU,QAAQ;AAC/B,aAAQ,KAAK,WAAW,QAAQ;AAChC,aAAQ,KAAK,UAAU,QAAQ;AAC/B,aAAQ,KAAK,QAAQ,QAAQ;;;GAGlC;EACF;EACD;AAEF,MAAa,OAAO,kBAAkB;AACtC,MAAa,UAAU,kBAAkB;AACzC,MAAa,SAAS,kBAAkB;AACxC,MAAa,UAAU,kBAAkB;AACzC,MAAa,SAAS,kBAAkB"}
+{"version":3,"file":"index.cjs","names":[],"sources":["../../src/shared/parent-watcher.ts","../../src/telemetry/state.ts","../../src/unplugin/index.ts"],"sourcesContent":["/**\n * Shared parent-PID watcher — used by both the MCP debug daemon and the\n * unplugin tunnel path to self-terminate when the parent process (e.g. Claude\n * Code, vite) has died or been reparented without sending SIGTERM/SIGHUP.\n *\n * Intentionally react-free and Node-stdlib-only so this module is safe to\n * import from the MCP daemon bundle (`dist/mcp/cli.js`) without violating the\n * install-graph invariant.\n */\n\n// ---------------------------------------------------------------------------\n// isPidAlive — extracted from src/mcp/server-lock.ts\n// ---------------------------------------------------------------------------\n\n/**\n * Returns `true` when the given PID refers to a running process.\n *\n * Uses `process.kill(pid, 0)` — a no-op signal that succeeds when the process\n * exists and we have permission to signal it; throws ESRCH when it doesn't exist.\n */\nexport function isPidAlive(pid: number): boolean {\n  try {\n    process.kill(pid, 0);\n    return true;\n  } catch (err: unknown) {\n    // ESRCH = no such process → stale lock.\n    // EPERM = process exists but we can't signal it (still alive).\n    if ((err as NodeJS.ErrnoException).code === 'EPERM') return true;\n    return false;\n  }\n}\n\n// ---------------------------------------------------------------------------\n// startParentWatcher — extracted from src/mcp/debug-server.ts\n// ---------------------------------------------------------------------------\n\n/**\n * Starts a periodic watcher that detects when the parent process (e.g. Claude\n * Code) has died without sending SIGTERM/SIGHUP, and calls `onOrphaned` so the\n * daemon can self-terminate rather than running as a zombie.\n *\n * Mirrors the `startAttachWatcher` pattern: `setInterval`-based, returns\n * `{ stop(): void }`, injectable deps for testability.\n *\n * @param onOrphaned - Called once when the parent is gone.\n * @param opts.intervalMs   - Poll interval in milliseconds (default 5 000).\n * @param opts.initialPpid  - Parent PID to watch (default `process.ppid`).\n * @param opts.isAlive      - Predicate to test if a PID is running (default `isPidAlive`).\n * @param opts.getPpid      - Supplier of current ppid (default `() => process.ppid`).\n *                            Detects ppid changes as well as death.\n * @param opts.log          - Logger (default `process.stderr.write`).\n *\n * @returns `stop` — call during shutdown to clear the interval.\n */\nexport function startParentWatcher(\n  onOrphaned: () => void,\n  opts?: {\n    intervalMs?: number;\n    initialPpid?: number;\n    isAlive?: (pid: number) => boolean;\n    getPpid?: () => number;\n    log?: (msg: string) => void;\n  },\n): { stop(): void } {\n  const {\n    intervalMs = 5_000,\n    initialPpid = process.ppid,\n    isAlive = isPidAlive,\n    getPpid = () => process.ppid,\n    log = (msg: string) => process.stderr.write(msg),\n  } = opts ?? {};\n\n  // PID 1 is init/launchd — running under a process manager or as a detached\n  // daemon. There is no meaningful parent to watch; skip the watcher entirely.\n  if (initialPpid <= 1) {\n    log('[ait-debug] parent-pid watcher: no parent to watch (ppid<=1), skipping\\n');\n    return { stop() {} };\n  }\n\n  let fired = false;\n\n  const handle = setInterval(() => {\n    if (fired) return;\n\n    const currentPpid = getPpid();\n    const orphaned = currentPpid !== initialPpid || !isAlive(initialPpid);\n\n    if (orphaned) {\n      fired = true;\n      clearInterval(handle);\n      log(\n        `[ait-debug] parent-pid watcher: parent PID ${initialPpid} is gone (currentPpid=${currentPpid}) — shutting down\\n`,\n      );\n      onOrphaned();\n    }\n  }, intervalMs);\n\n  return {\n    stop() {\n      clearInterval(handle);\n    },\n  };\n}\n\n// ---------------------------------------------------------------------------\n// startMaxAgeWatchdog — FIX 4: daemon lifetime cap\n// ---------------------------------------------------------------------------\n\n/**\n * Starts a periodic watchdog that calls `onExpired` once after `maxAgeMs`\n * milliseconds have elapsed since the watchdog was created.\n *\n * Motivation (issue #571): cloudflared quick-tunnel lifetimes are finite (a\n * few hours). A daemon that has been running for days will have outlived its\n * tunnel regardless of whether the tunnel process exited cleanly. This watchdog\n * caps the daemon's maximum age and forces a fresh start so the tunnel is\n * replaced before it silently expires.\n *\n * @param onExpired  - Called once when the maximum age is reached. The caller\n *                     should call `shutdown()` then `process.exit(0)`.\n * @param opts.maxAgeMs    - Maximum daemon lifetime in ms. Default 6 h.\n * @param opts.intervalMs  - Check interval in ms. Default 60 000 (1 min).\n * @param opts.now         - Time source (injectable for tests). Default `Date.now`.\n *\n * @returns `stop` — call during shutdown to clear the interval.\n */\nexport function startMaxAgeWatchdog(\n  onExpired: () => void,\n  opts: {\n    maxAgeMs?: number;\n    intervalMs?: number;\n    now?: () => number;\n  } = {},\n): { stop(): void } {\n  const {\n    maxAgeMs = 6 * 60 * 60 * 1_000, // 6 hours\n    intervalMs = 60_000,\n    now = () => Date.now(),\n  } = opts;\n\n  const startedAt = now();\n  let fired = false;\n\n  const handle = setInterval(() => {\n    if (fired) return;\n    if (now() - startedAt >= maxAgeMs) {\n      fired = true;\n      clearInterval(handle);\n      onExpired();\n    }\n  }, intervalMs);\n\n  return {\n    stop() {\n      clearInterval(handle);\n    },\n  };\n}\n","/**\n * Telemetry consent state machine + localStorage I/O.\n *\n * localStorage keys are LOCKED — do not rename without updating the privacy page.\n */\n\nexport type ConsentState = 'granted' | 'denied' | 'undecided';\n\n// Key names — locked per privacy page spec\nconst KEY_CONSENT = '__ait_telemetry:consent';\nconst KEY_REPROMPT_AFTER = '__ait_telemetry:reprompt_after';\nconst KEY_POLICY_VERSION = '__ait_telemetry:policy_version';\nconst KEY_ANON_ID = '__ait_telemetry:anon_id';\n\n// Tier 0 keys\nexport const KEY_T0_LAST_SENT = '__ait_telemetry:t0_last_sent';\nexport const KEY_T0_OFF = '__ait_telemetry:t0_off';\n\n// ---------------------------------------------------------------------------\n// Tier 0 opt-out helpers\n// ---------------------------------------------------------------------------\n\n/**\n * Returns true if Tier 0 ping is enabled.\n * Disabled when `localStorage.__ait_telemetry:t0_off = '1'`\n * or `process.env.AITC_TELEMETRY === 'off'`.\n */\nexport function isTier0Enabled(): boolean {\n  if (typeof process !== 'undefined' && process.env.AITC_TELEMETRY === 'off') return false;\n  try {\n    return localStorage.getItem(KEY_T0_OFF) !== '1';\n  } catch {\n    return true;\n  }\n}\n\n/**\n * Sets or clears the Tier 0 opt-out marker.\n */\nexport function setTier0Enabled(enabled: boolean): void {\n  try {\n    if (enabled) {\n      localStorage.removeItem(KEY_T0_OFF);\n    } else {\n      localStorage.setItem(KEY_T0_OFF, '1');\n    }\n  } catch {\n    /* storage unavailable */\n  }\n}\n\n/**\n * Returns true if Tier 0 has already been sent today (YYYY-MM-DD).\n */\nexport function hasSentTier0Today(): boolean {\n  try {\n    const stored = localStorage.getItem(KEY_T0_LAST_SENT);\n    if (!stored) return false;\n    const today = new Date().toISOString().slice(0, 10);\n    return stored === today;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Records that Tier 0 was sent today.\n */\nexport function markTier0Sent(): void {\n  try {\n    const today = new Date().toISOString().slice(0, 10);\n    localStorage.setItem(KEY_T0_LAST_SENT, today);\n  } catch {\n    /* storage unavailable */\n  }\n}\n\n/**\n * Current policy version. Bump this string whenever the privacy policy changes.\n * Users who previously granted on an older version will be re-prompted once.\n */\nexport const CURRENT_POLICY_VERSION = '2026-05-18';\n\n/** 30 days in milliseconds */\nconst THIRTY_DAYS_MS = 30 * 24 * 60 * 60 * 1000;\n\n// ---------------------------------------------------------------------------\n// Reads\n// ---------------------------------------------------------------------------\n\nexport function readConsentState(): ConsentState {\n  const raw = localStorage.getItem(KEY_CONSENT);\n  if (raw === 'granted' || raw === 'denied') return raw;\n  return 'undecided';\n}\n\nexport function readRepromptAfter(): number {\n  const raw = localStorage.getItem(KEY_REPROMPT_AFTER);\n  if (raw === null) return 0;\n  const n = Number(raw);\n  return Number.isFinite(n) ? n : 0;\n}\n\nexport function readPolicyVersion(): string | null {\n  return localStorage.getItem(KEY_POLICY_VERSION);\n}\n\n/**\n * Returns the stored anon_id, or generates + persists a new UUID v4 on first call.\n * Once generated it is never overwritten.\n */\nexport function getOrCreateAnonId(): string {\n  const existing = localStorage.getItem(KEY_ANON_ID);\n  if (existing) return existing;\n  const id = crypto.randomUUID();\n  localStorage.setItem(KEY_ANON_ID, id);\n  return id;\n}\n\n// ---------------------------------------------------------------------------\n// Writes / transitions\n// ---------------------------------------------------------------------------\n\n/**\n * Resolve effective consent, handling the policy-version bump rule:\n *   - If stored = \"granted\" but stored version ≠ CURRENT → revert to undecided\n *   - If stored = \"denied\" and version changed → stay denied (no re-prompt)\n *\n * Call this at init time to normalise state before checking whether to show a toast.\n * Returns the effective ConsentState after applying the version-bump rule.\n */\nexport function resolveEffectiveConsent(): ConsentState {\n  const raw = localStorage.getItem(KEY_CONSENT);\n  if (raw === 'granted') {\n    const storedVersion = readPolicyVersion();\n    if (storedVersion !== CURRENT_POLICY_VERSION) {\n      // Policy changed — treat as undecided so user gets re-prompted once\n      localStorage.removeItem(KEY_CONSENT);\n      localStorage.removeItem(KEY_POLICY_VERSION);\n      return 'undecided';\n    }\n    return 'granted';\n  }\n  if (raw === 'denied') return 'denied';\n  return 'undecided';\n}\n\n/**\n * User clicked \"Yes, send\".\n * Sets consent = granted, records policy version.\n */\nexport function acceptConsent(): void {\n  localStorage.setItem(KEY_CONSENT, 'granted');\n  localStorage.setItem(KEY_POLICY_VERSION, CURRENT_POLICY_VERSION);\n  // Ensure reprompt_after is cleared (shouldn't matter, but keep state clean)\n  localStorage.removeItem(KEY_REPROMPT_AFTER);\n}\n\n/**\n * User clicked \"No, thanks\".\n * First denial: sets reprompt_after = now + 30 days.\n * Second denial (reprompt_after was already set to a past finite value that triggered\n *   re-prompt): sets reprompt_after = MAX_SAFE_INTEGER → permanent silence.\n */\nexport function denyConsent(): void {\n  localStorage.setItem(KEY_CONSENT, 'denied');\n  const existing = readRepromptAfter();\n  if (existing > 0 && existing < Number.MAX_SAFE_INTEGER) {\n    // This is the second denial — silence permanently\n    localStorage.setItem(KEY_REPROMPT_AFTER, String(Number.MAX_SAFE_INTEGER));\n  } else {\n    // First denial\n    localStorage.setItem(KEY_REPROMPT_AFTER, String(Date.now() + THIRTY_DAYS_MS));\n  }\n}\n\n/**\n * Environment-tab toggle: free transition between granted/denied.\n * Does NOT touch reprompt_after.\n */\nexport function setConsentViaToggle(granted: boolean): void {\n  if (granted) {\n    localStorage.setItem(KEY_CONSENT, 'granted');\n    localStorage.setItem(KEY_POLICY_VERSION, CURRENT_POLICY_VERSION);\n  } else {\n    localStorage.setItem(KEY_CONSENT, 'denied');\n  }\n}\n\n/**\n * Returns true if the toast should be shown now.\n * Conditions:\n *   - undecided (no prior choice or policy bumped to a newer version)\n *   - denied + reprompt_after set + reprompt_after < now (one re-prompt after\n *     the configured silence window; `denyConsent` flips to permanent silence\n *     on the second denial by setting reprompt_after to MAX_SAFE_INTEGER).\n */\nexport function shouldShowToast(): boolean {\n  const state = resolveEffectiveConsent();\n  if (state === 'undecided') {\n    const repromptAfter = readRepromptAfter();\n    if (repromptAfter === 0) return true;\n    return Date.now() > repromptAfter;\n  }\n  if (state === 'denied') {\n    const repromptAfter = readRepromptAfter();\n    if (repromptAfter === 0 || repromptAfter >= Number.MAX_SAFE_INTEGER) return false;\n    return Date.now() > repromptAfter;\n  }\n  return false;\n}\n\n/**\n * Sends the DELETE request to remove the user's data from the server, and\n * rotates the local anon_id on success so any subsequent events are unlinkable\n * from the deleted history.\n */\nexport async function deleteMyData(endpoint: string): Promise<boolean> {\n  const anonId = localStorage.getItem(KEY_ANON_ID);\n  if (!anonId) return false;\n  try {\n    const res = await fetch(`${endpoint}/e?anon_id=${encodeURIComponent(anonId)}`, {\n      method: 'DELETE',\n    });\n    if (!res.ok) return false;\n    localStorage.setItem(KEY_ANON_ID, crypto.randomUUID());\n    return true;\n  } catch {\n    return false;\n  }\n}\n","/**\n * @ait-co/devtools unplugin\n *\n * 모든 주요 번들러를 지원하는 단일 플러그인.\n * @apps-in-toss/web-framework → @ait-co/devtools/mock 으로 alias 설정.\n *\n * Usage:\n *   import aitDevtools from '@ait-co/devtools/unplugin';\n *\n *   // Vite\n *   export default { plugins: [aitDevtools.vite()] };\n *\n *   // Webpack / Next.js\n *   config.plugins.push(aitDevtools.webpack());\n *\n *   // Rspack\n *   config.plugins.push(aitDevtools.rspack());\n *\n *   // esbuild\n *   { plugins: [aitDevtools.esbuild()] }\n *\n *   // Rollup\n *   { plugins: [aitDevtools.rollup()] }\n */\n\nimport { fileURLToPath } from 'node:url';\nimport { createUnplugin } from 'unplugin';\nimport { startParentWatcher } from '../shared/parent-watcher.js';\nimport {\n  ensureMachineConsent,\n  type MachineTelemetryState,\n  writeMachineState,\n} from '../telemetry/machine-state.js';\nimport { CURRENT_POLICY_VERSION } from '../telemetry/state.js';\n\n/**\n * Resolve `@ait-co/devtools/mock` to its real file path at plugin-load time.\n *\n * Returning the bare specifier from `resolveId` would stop the bundler from\n * walking node_modules for it — Vite 8+ treats such a non-null string as the\n * final resolved id and serves it via the virtual `/@id/` prefix, which 404s\n * because we don't provide a `load` hook. Resolving to an absolute path here\n * lets every supported bundler load the file the normal way.\n */\nconst MOCK_PATH = (() => {\n  try {\n    return fileURLToPath(import.meta.resolve('@ait-co/devtools/mock'));\n  } catch {\n    // Fallback for runtimes where `import.meta.resolve` is unavailable.\n    return '@ait-co/devtools/mock';\n  }\n})();\n\nexport interface AitDevtoolsOptions {\n  /**\n   * 패널 자동 주입 여부 (default: true)\n   * true이면 진입점에 floating panel import를 자동 추가한다.\n   */\n  panel?: boolean;\n  /**\n   * production 환경에서도 devtools를 강제로 활성화 (default: false)\n   */\n  forceEnable?: boolean;\n  /**\n   * mock alias 활성화 여부. default: true (development), false (production + forceEnable)\n   */\n  mock?: boolean;\n  /**\n   * Vite dev server에 MCP state endpoint를 추가할지 여부 (default: false).\n   *\n   * `true`로 설정하면:\n   *  - GET  /api/ait-devtools/state  — 마지막으로 브라우저가 push한 mock state 스냅샷 반환\n   *  - POST /api/ait-devtools/state  — 브라우저 panel이 상태 변경 시 자동 push (panel 내부 처리)\n   *\n   * 이 endpoint를 `@ait-co/devtools` MCP stdio server가 읽어 AI 에이전트에 mock state를 노출한다.\n   * Vite 전용: webpack/rspack/esbuild/rollup 환경에서는 무시된다.\n   */\n  mcp?: boolean;\n  /**\n   * 미니앱의 webViewType (`granite.config.ts`의 `webViewProps.type`)을 빌드 상수\n   * `__WEB_VIEW_TYPE__`로 주입한다 (#580). **Vite 전용** (다른 번들러는 무시).\n   *\n   * 이 상수는 in-app self-report(`@ait-co/devtools/in-app`)가 읽어 launcher(env-2\n   * PWA)에 webViewType을 postMessage로 알리고, launcher가 game 타입 미니앱에서\n   * 수동 `?navBarType=game` URL 편집 없이 game 모드로 자동 진입하게 한다.\n   *\n   * 미지정 시 `'partner'`(web-framework `webViewProps.type`의 `@default`)로 주입한다.\n   * `game`이면 게임 모드로 자동 진입한다. (granite.config.ts를 config 시점에\n   * 자동으로 읽는 것은 TS 모듈 로더가 필요해 보류 — 명시 옵션으로 신뢰성 확보, #580.)\n   */\n  webViewType?: 'partner' | 'game';\n  /**\n   * Vite dev 서버를 Cloudflare quick tunnel(`*.trycloudflare.com`, 계정 불필요)로\n   * 외부 노출해 실제 폰에서 미리보기. **Vite dev 모드 전용** — production은\n   * `forceEnable`이어도 터널을 띄우지 않는다 (의도치 않은 노출 방지). 다른 번들러는\n   * 무시. `true`면 기본 동작, 객체로 세부 설정 가능.\n   */\n  tunnel?:\n    | boolean\n    | {\n        /** 노출할 포트 (미지정 시 dev 서버가 실제 listen한 포트 자동 감지). */\n        port?: number;\n        /** 터미널 ASCII QR 출력 (default: true). */\n        qr?: boolean;\n        /**\n         * 환경 2(실기기 PWA)에 CDP 디버깅 배선 (default: false).\n         *\n         * `true`면 dev 서버 HTTP 터널과 **별도로** Chii relay를 띄우고 그 relay에\n         * 두 번째 quick tunnel을 붙여, launcher QR deep-link에 `&debug=1&relay=<wss>`를\n         * 실어 보낸다. 폰의 PWA iframe이 in-app debug gate를 통과해 target.js를 주입받고,\n         * AI host MCP가 그 relay에 client로 붙으면 실기기 WebKit 위에서 CDP 디버깅이 열린다.\n         * mock SDK는 그대로라 `call_sdk`는 환경 2에서 mock을 친다 (fidelity 사다리의\n         * 설계 의도 — SDK fidelity가 필요하면 환경 3로 올라간다).\n         */\n        cdp?: boolean;\n      };\n}\n\nconst FRAMEWORK_ID = '@apps-in-toss/web-framework';\nconst BRIDGE_ID = '@apps-in-toss/web-bridge'; // back-compat (2.x)\nconst ANALYTICS_ID = '@apps-in-toss/web-analytics'; // back-compat (2.x)\nconst WEBVIEW_BRIDGE_ID = '@apps-in-toss/webview-bridge'; // 3.0+\n\n/** MCP state endpoint path — browser panel POSTs here, MCP server GETs here */\nconst MCP_STATE_PATH = '/api/ait-devtools/state';\n\n/**\n * Machine-level telemetry consent endpoint (#542).\n *\n * GET  → returns current machine consent state as JSON (for the panel to read\n *         and skip the toast when already decided).\n * POST → panel or environment-tab toggle writes new consent back to the machine\n *        file (body: { consent: 'granted' | 'denied', policy_version: string }).\n *\n * Always registered (not gated on `mcp: true`) — the panel needs this\n * unconditionally when the dev server is running.\n */\nconst TELEMETRY_CONSENT_PATH = '/api/ait-devtools/telemetry-consent';\n\n/**\n * Resolves the effective tunnel option (#425).\n *\n * An explicit `tunnel` value (including `false`) always takes priority over\n * env vars — the `??` operator means `undefined` (= omitted) falls through,\n * but `false` / `true` / an object are preserved as-is (non-breaking).\n *\n * When the option is omitted:\n * - `AIT_TUNNEL=1` enables the base screen-preview tunnel.\n * - `AIT_TUNNEL_CDP=1` (requires `AIT_TUNNEL`) upgrades to the CDP relay.\n * - Neither set → `false` (disabled).\n *\n * Extracted as a pure function so it can be unit-tested without standing up\n * a full Vite dev server.\n *\n * @param explicit - The `tunnel` option as passed by the consumer (or `undefined` when omitted).\n * @param env - The process environment (injectable for testing).\n */\nexport function resolveTunnelOption(\n  explicit: AitDevtoolsOptions['tunnel'],\n  env: Record<string, string | undefined>,\n): AitDevtoolsOptions['tunnel'] {\n  return explicit ?? (env.AIT_TUNNEL ? { cdp: !!env.AIT_TUNNEL_CDP } : false);\n}\n\nconst aitDevtoolsPlugin = createUnplugin((options?: AitDevtoolsOptions) => {\n  const isDev = process.env.NODE_ENV !== 'production';\n  const shouldEnable = isDev || (options?.forceEnable ?? false);\n  const shouldMock = shouldEnable && (options?.mock ?? isDev);\n  const shouldPanel = shouldEnable && (options?.panel ?? true);\n  const shouldMcp = shouldEnable && (options?.mcp ?? false);\n\n  // In-memory store for the last state snapshot pushed by the browser panel.\n  // Only allocated when mcp: true to avoid any overhead in the common case.\n  let lastState: string | null = null;\n\n  // Tunnel is dev-only and Vite-only. Never under production — even with\n  // forceEnable — so a production build can't accidentally expose itself.\n  //\n  // Tunnel toggle resolution (#425): an explicit `tunnel` option always wins;\n  // when omitted, fall back to the AIT_TUNNEL / AIT_TUNNEL_CDP env vars so a\n  // consumer needs no `tunnel:` line in vite.config to enable env-2 preview.\n  // AIT_TUNNEL gates the base (screen preview); AIT_TUNNEL_CDP upgrades to the\n  // CDP relay. Production safety is unchanged — the existing\n  // `shouldTunnel = isDev && !!tunnelOpt` guard below still blocks prod builds.\n  const tunnelOpt = resolveTunnelOption(options?.tunnel, process.env);\n  const shouldTunnel = isDev && !!tunnelOpt;\n\n  // #580: webViewType build constant. Injected as a Vite `define` so the\n  // in-app self-report can post it to the launcher for game-mode auto-entry.\n  // Defaults to 'partner' (web-framework webViewProps.type @default).\n  const webViewType = options?.webViewType ?? 'partner';\n  const tunnelConfig = typeof tunnelOpt === 'object' ? tunnelOpt : {};\n\n  return {\n    name: 'ait-co-devtools',\n    enforce: 'pre' as const,\n\n    resolveId(id: string) {\n      if (!shouldMock) return null;\n      // @apps-in-toss/web-framework → @ait-co/devtools/mock (absolute path)\n      if (\n        id === FRAMEWORK_ID ||\n        id === WEBVIEW_BRIDGE_ID ||\n        id === BRIDGE_ID ||\n        id === ANALYTICS_ID\n      ) {\n        return MOCK_PATH;\n      }\n      return null;\n    },\n\n    transformInclude(id: string) {\n      if (!shouldPanel) return false;\n      // 진입점 파일에만 패널 import를 주입\n      return (\n        /\\.(tsx?|jsx?)$/.test(id) &&\n        /\\/(main|index|entry|app)\\.[tj]sx?$/i.test(id) &&\n        !id.includes('node_modules')\n      );\n    },\n\n    transform(code: string) {\n      // transformInclude가 이미 shouldPanel을 확인하지만, 안전망으로 유지\n      if (!shouldPanel) return null;\n      // 이미 패널이 import 되어있으면 스킵\n      if (code.includes('@ait-co/devtools/panel')) return null;\n      // transformInclude가 진입점 파일만 통과시키므로 바로 prepend\n      return `import '@ait-co/devtools/panel';\\n${code}`;\n    },\n\n    // Vite-only: register the MCP state HTTP endpoint on the dev server, and\n    // optionally start a Cloudflare quick tunnel once the dev server is listening.\n    // Non-Vite bundlers do not have a dev server concept so this is silently\n    // skipped (unplugin passes `vite` key only when building for Vite).\n    vite: {\n      config() {\n        // #580: inject the webViewType build constant for every Vite build so\n        // the in-app self-report (@ait-co/devtools/in-app) can read it and post\n        // it to the launcher (env-2 PWA) for game-mode auto-entry. JSON.stringify\n        // makes it a string literal at the define substitution site.\n        const define = { __WEB_VIEW_TYPE__: JSON.stringify(webViewType) };\n        if (!shouldTunnel) return { define };\n        // Vite blocks requests whose Host header isn't in `server.allowedHosts`\n        // (defaults to localhost only). The quick-tunnel hostname is random per\n        // run, so allow the whole `.trycloudflare.com` suffix while the tunnel\n        // is on. (A leading `.` makes Vite match the domain and its subdomains.)\n        return { define, server: { allowedHosts: ['.trycloudflare.com'] } };\n      },\n\n      configureServer(server: import('vite').ViteDevServer) {\n        // Machine-level telemetry consent endpoint (#542): always registered when\n        // the dev server is enabled so the panel can read/write consent across\n        // origin rotations (tunnel host changes, port changes).\n        //\n        // We lazily initialise `machineConsent` once the server is ready. The\n        // TTY prompt runs synchronously inside the `listening` event so it\n        // appears in the same terminal window before any dev-server noise.\n        let machineConsent: MachineTelemetryState | null = null;\n\n        // Start the machine-consent bootstrap as soon as configureServer runs.\n        // Fire-and-forget; errors are caught and logged. The endpoint guards\n        // against `machineConsent === null` with a 503 during the brief boot.\n        if (shouldEnable) {\n          server.httpServer?.once('listening', () => {\n            ensureMachineConsent(CURRENT_POLICY_VERSION)\n              .then((state) => {\n                machineConsent = state;\n              })\n              .catch((err: unknown) => {\n                // Non-fatal — panel will fall back to localStorage behaviour.\n                console.warn(\n                  `[@ait-co/devtools] machine consent init failed: ${\n                    err instanceof Error ? err.message : String(err)\n                  }`,\n                );\n              });\n          });\n\n          // Telemetry consent endpoint — CORS open (localhost only in practice).\n          server.middlewares.use(TELEMETRY_CONSENT_PATH, (req, res) => {\n            res.setHeader('Access-Control-Allow-Origin', '*');\n            res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');\n            res.setHeader('Access-Control-Allow-Headers', 'Content-Type');\n\n            if (req.method === 'OPTIONS') {\n              res.writeHead(204);\n              res.end();\n              return;\n            }\n\n            if (req.method === 'GET') {\n              if (machineConsent === null) {\n                // Still booting — panel should fall back to localStorage.\n                res.writeHead(503, { 'Content-Type': 'application/json' });\n                res.end(JSON.stringify({ error: 'Machine consent not yet initialised.' }));\n                return;\n              }\n              res.writeHead(200, { 'Content-Type': 'application/json' });\n              res.end(JSON.stringify(machineConsent));\n              return;\n            }\n\n            if (req.method === 'POST') {\n              const chunks: Buffer[] = [];\n              req.on('data', (chunk: Buffer) => chunks.push(chunk));\n              req.on('end', () => {\n                try {\n                  const body = Buffer.concat(chunks).toString('utf-8');\n                  const payload = JSON.parse(body) as {\n                    consent?: string;\n                    policy_version?: string;\n                  };\n\n                  const consent = payload.consent;\n                  if (consent !== 'granted' && consent !== 'denied' && consent !== 'undecided') {\n                    res.writeHead(400, { 'Content-Type': 'application/json' });\n                    res.end(\n                      JSON.stringify({\n                        error: 'Invalid consent value. Expected granted | denied | undecided.',\n                      }),\n                    );\n                    return;\n                  }\n\n                  writeMachineState({\n                    consent,\n                    policy_version: payload.policy_version ?? CURRENT_POLICY_VERSION,\n                  })\n                    .then(async () => {\n                      // Update the in-memory cache.\n                      const { readMachineState } = await import('../telemetry/machine-state.js');\n                      machineConsent = await readMachineState();\n                      res.writeHead(204);\n                      res.end();\n                    })\n                    .catch((err: unknown) => {\n                      res.writeHead(500, { 'Content-Type': 'application/json' });\n                      res.end(\n                        JSON.stringify({\n                          error: `Write failed: ${err instanceof Error ? err.message : String(err)}`,\n                        }),\n                      );\n                    });\n                  return;\n                } catch {\n                  res.writeHead(400, { 'Content-Type': 'application/json' });\n                  res.end(JSON.stringify({ error: 'Invalid JSON body.' }));\n                }\n              });\n              return;\n            }\n\n            res.writeHead(405, { 'Content-Type': 'application/json' });\n            res.end(JSON.stringify({ error: 'Method not allowed' }));\n          });\n        }\n\n        // MCP state endpoint: browser panel POSTs state here, MCP stdio server GETs it.\n        if (shouldMcp) {\n          server.middlewares.use(MCP_STATE_PATH, (req, res) => {\n            // Allow Claude Code / AI agents (running locally) to read state\n            res.setHeader('Access-Control-Allow-Origin', '*');\n            res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');\n            res.setHeader('Access-Control-Allow-Headers', 'Content-Type');\n\n            if (req.method === 'OPTIONS') {\n              res.writeHead(204);\n              res.end();\n              return;\n            }\n\n            if (req.method === 'GET') {\n              if (lastState === null) {\n                res.writeHead(503, { 'Content-Type': 'application/json' });\n                res.end(\n                  JSON.stringify({\n                    error: 'No state received yet. Open the app in a browser first.',\n                  }),\n                );\n                return;\n              }\n              res.writeHead(200, { 'Content-Type': 'application/json' });\n              res.end(lastState);\n              return;\n            }\n\n            if (req.method === 'POST') {\n              const chunks: Buffer[] = [];\n              req.on('data', (chunk: Buffer) => chunks.push(chunk));\n              req.on('end', () => {\n                try {\n                  const body = Buffer.concat(chunks).toString('utf-8');\n                  // Validate it's parseable JSON before caching\n                  JSON.parse(body);\n                  lastState = body;\n                  res.writeHead(204);\n                  res.end();\n                } catch {\n                  res.writeHead(400, { 'Content-Type': 'application/json' });\n                  res.end(JSON.stringify({ error: 'Invalid JSON' }));\n                }\n              });\n              return;\n            }\n\n            res.writeHead(405, { 'Content-Type': 'application/json' });\n            res.end(JSON.stringify({ error: 'Method not allowed' }));\n          });\n        }\n\n        // Tunnel: start a Cloudflare quick tunnel once the dev server is listening.\n        if (shouldTunnel) {\n          let tunnel: { stop: () => void } | null = null;\n          // env-2 CDP wiring (tunnel.cdp): a second tunnel + Chii relay, torn\n          // down alongside the HTTP tunnel. Fire-and-forget close on teardown.\n          let relayTunnel: { stop: () => void } | null = null;\n          let relay: { close: () => Promise<void> } | null = null;\n          // env-2 HTML dashboard (issue #408): local 127.0.0.1 HTTP server that\n          // serves the QR + connect-steps + FAQ page (env 3/4 UX parity), opened\n          // in the browser when CDP is wired + GUI present. Torn down with the\n          // tunnel. Only set when the dashboard actually started.\n          let qrDashboard: { close: () => Promise<void> } | null = null;\n          // env-2 URL file store (#424): captured after the first writeRelayUrls\n          // call so cleanup() can call deleteRelayUrls without a re-import.\n          // SECRET-HANDLING: the stored function reference never carries URL values.\n          let relayUrlDeleteFn: ((projectRoot: string) => Promise<void>) | null = null;\n          // #420: parent-PID watcher — self-terminate when vite's parent dies so\n          // cloudflared children don't become zombies holding stale tunnels.\n          let parentWatcher: { stop(): void } | null = null;\n          const httpServer = server.httpServer;\n\n          httpServer?.once('listening', () => {\n            const address = httpServer?.address();\n            const port =\n              tunnelConfig.port ??\n              (address && typeof address === 'object' ? address.port : undefined);\n            if (!port) {\n              console.warn(\n                '[@ait-co/devtools] tunnel: could not determine the dev server port; skipping.',\n              );\n              return;\n            }\n            // Dynamic import keeps `cloudflared` / `qrcode-terminal` off the\n            // module graph unless the tunnel is actually used.\n            import('./tunnel.js')\n              .then(async ({ startQuickTunnel, printTunnelBanner, startTunnelDashboard }) => {\n                const t = await startQuickTunnel(port);\n                tunnel = t;\n\n                // env-2 CDP: boot a Chii relay (OS-assigned local port) and a\n                // second quick tunnel to it. The relay's https tunnel URL becomes\n                // the `wss://` relay the launcher QR carries (&debug=1&relay=).\n                let relayWssUrl: string | undefined;\n                // SECRET-HANDLING: relayHttpUrl carries the relay host — never logged.\n                let relayHttpUrl: string | undefined;\n                // LOCAL relay base — loopback URL, safe to surface (issue #530).\n                let relayLocalHttpUrl: string | undefined;\n                if (tunnelConfig.cdp) {\n                  try {\n                    // Relay-auth baseline (issue #250): the env-2 CDP relay is\n                    // reachable over a public `*.trycloudflare.com` tunnel, so a\n                    // configured TOTP secret is MANDATORY and the relay enforces\n                    // it on every WS upgrade.\n                    //\n                    // First-run auto-mint (issue #394, project-local #396): if\n                    // AIT_DEBUG_TOTP_SECRET is not yet set, ensureRelaySecret()\n                    // mints a 256-bit random secret, persists it to the project-\n                    // local file <project>/.ait_relay (0600, anchored at the\n                    // nearest package.json directory above server.config.root),\n                    // and injects it into process.env so the following\n                    // assertRelayAuthConfigured() call succeeds. On subsequent\n                    // runs the persisted value is loaded silently — no manual\n                    // export needed. The MCP daemon reads the SAME file read-only\n                    // via loadRelaySecretReadOnly() when switching to a relay env.\n                    // SECRET-HANDLING: neither ensureRelaySecret nor the\n                    // guard/predicate log the secret value.\n                    const { ensureRelaySecret } = await import('../mcp/relay-secret-store.js');\n                    await ensureRelaySecret({ projectRoot: server.config.root });\n                    const { assertRelayAuthConfigured, buildRelayVerifyAuth } = await import(\n                      '../mcp/totp.js'\n                    );\n                    assertRelayAuthConfigured();\n                    const verifyAuth = buildRelayVerifyAuth();\n                    const { startChiiRelay } = await import('../mcp/chii-relay.js');\n                    // Issue #467: this relay lives in the vite process, so the\n                    // MCP daemon's get_debug_status counter cannot see its 401s.\n                    // Surface a throttled hint in the vite terminal instead.\n                    // SECRET-HANDLING: fixed message only — no URL, code, host.\n                    let lastAuthRejectWarnAt = 0;\n                    const r = await startChiiRelay({\n                      port: 0,\n                      verifyAuth,\n                      onAuthReject: () => {\n                        const nowMs = Date.now();\n                        if (nowMs - lastAuthRejectWarnAt < 10_000) return;\n                        lastAuthRejectWarnAt = nowMs;\n                        console.warn(\n                          '[@ait-co/devtools] tunnel: relay 인증(TOTP) 거부 감지 — 폰에서 QR을 다시 스캔하세요 (코드는 ~3분마다 만료)',\n                        );\n                      },\n                    });\n                    relay = r;\n                    const rt = await startQuickTunnel(r.port);\n                    relayTunnel = rt;\n                    // SECRET-HANDLING: rt.url is the https relay base — stored in\n                    // relayHttpUrl for .ait_urls write below; never logged.\n                    relayHttpUrl = rt.url;\n                    relayWssUrl = rt.url.replace(/^https:/, 'wss:');\n                    // LOCAL relay base for MCP inspector URL assembly (issue #530):\n                    // the relay process runs on this machine, so the inspector\n                    // front_end + client WS can use the loopback address directly —\n                    // no tunnel round-trip for the developer's browser.\n                    // Safe to surface: loopback URL contains no tunnel host.\n                    relayLocalHttpUrl = `http://127.0.0.1:${r.port}`;\n                  } catch (err: unknown) {\n                    console.warn(\n                      `[@ait-co/devtools] tunnel: CDP relay not started — screen preview works without on-device debugging: ${\n                        err instanceof Error ? err.message : String(err)\n                      }`,\n                    );\n                  }\n                }\n\n                // Read the app name from the project's package.json to add to\n                // the launcher deep-link (#498). Failure is silently ignored.\n                let tunnelAppName: string | undefined;\n                try {\n                  const { readFileSync } = await import('node:fs');\n                  const pkgPath = `${server.config.root}/package.json`;\n                  const pkgRaw = readFileSync(pkgPath, 'utf8');\n                  const pkg = JSON.parse(pkgRaw) as Record<string, unknown>;\n                  const rawName = typeof pkg.name === 'string' ? pkg.name : '';\n                  const stripped = rawName.includes('/')\n                    ? rawName.slice(rawName.indexOf('/') + 1)\n                    : rawName;\n                  tunnelAppName = stripped.trim() || undefined;\n                } catch {\n                  // Silently ignore — fail-open.\n                }\n\n                await printTunnelBanner(t.url, {\n                  qr: tunnelConfig.qr,\n                  relayWssUrl,\n                  name: tunnelAppName,\n                  webViewType,\n                });\n\n                // env-2 URL file-based discovery (#424): write .ait_urls so the\n                // MCP daemon can discover the relay/tunnel URLs without manual env\n                // var copy-paste. SECRET-HANDLING: URL values are never logged.\n                // Capture deleteRelayUrls in the outer-scope fn so cleanup() can\n                // call it without re-importing (no async in signal handlers).\n                const { writeRelayUrls, deleteRelayUrls } = await import(\n                  '../mcp/relay-url-store.js'\n                );\n                await writeRelayUrls({\n                  projectRoot: server.config.root,\n                  tunnelBaseUrl: t.url,\n                  ...(relayHttpUrl !== undefined ? { relayBaseUrl: relayHttpUrl } : {}),\n                  // Issue #530: local relay base for inspector URL (loopback, no tunnel host).\n                  ...(relayLocalHttpUrl !== undefined ? { relayLocalUrl: relayLocalHttpUrl } : {}),\n                });\n                relayUrlDeleteFn = (root: string) => deleteRelayUrls({ projectRoot: root });\n\n                // env-2 HTML dashboard (issue #408): when CDP is wired and a GUI\n                // is present, serve the same QR+FAQ dashboard env 3/4 uses and\n                // open it in the browser. No-op (returns undefined) for the\n                // screen-only tunnel, headless, qr:false, or AIT_AUTO_DEVTOOLS=0\n                // — the ASCII QR above remains the fallback in those cases.\n                if (relayWssUrl) {\n                  qrDashboard =\n                    (await startTunnelDashboard({\n                      tunnelUrl: t.url,\n                      relayWssUrl,\n                      qr: tunnelConfig.qr,\n                      name: tunnelAppName,\n                    })) ?? null;\n                }\n\n                // #420: start watching the parent PID now that tunnel resources\n                // are allocated. When the parent dies/reparents, clean up\n                // synchronously (stops cloudflared children) then exit.\n                parentWatcher = startParentWatcher(() => {\n                  cleanup();\n                  process.exit(0);\n                });\n              })\n              .catch((err: unknown) => {\n                console.warn(\n                  `[@ait-co/devtools] tunnel failed to start: ${\n                    err instanceof Error ? err.message : String(err)\n                  }`,\n                );\n              });\n          });\n\n          const cleanup = () => {\n            parentWatcher?.stop();\n            tunnel?.stop();\n            relayTunnel?.stop();\n            void relay?.close();\n            void qrDashboard?.close();\n            // env-2 URL file cleanup (#424): remove .ait_urls on teardown so a\n            // stale file doesn't cause the MCP daemon to attempt a doomed attach.\n            // SECRET-HANDLING: relayUrlDeleteFn never logs the path or URL values.\n            void relayUrlDeleteFn?.(server.config.root);\n          };\n          httpServer?.once('close', cleanup);\n          process.once('SIGINT', cleanup);\n          process.once('SIGTERM', cleanup);\n          process.once('SIGHUP', cleanup);\n          process.once('exit', cleanup);\n        }\n      },\n    },\n  };\n});\n\nexport const vite = aitDevtoolsPlugin.vite;\nexport const webpack = aitDevtoolsPlugin.webpack;\nexport const rollup = aitDevtoolsPlugin.rollup;\nexport const esbuild = aitDevtoolsPlugin.esbuild;\nexport const rspack = aitDevtoolsPlugin.rspack;\n\nexport default aitDevtoolsPlugin;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAoBA,SAAgB,WAAW,KAAsB;AAC/C,KAAI;AACF,UAAQ,KAAK,KAAK,EAAE;AACpB,SAAO;UACA,KAAc;AAGrB,MAAK,IAA8B,SAAS,QAAS,QAAO;AAC5D,SAAO;;;;;;;;;;;;;;;;;;;;;AA0BX,SAAgB,mBACd,YACA,MAOkB;CAClB,MAAM,EACJ,aAAa,KACb,cAAc,QAAQ,MACtB,UAAU,YACV,gBAAgB,QAAQ,MACxB,OAAO,QAAgB,QAAQ,OAAO,MAAM,IAAI,KAC9C,QAAQ,EAAE;AAId,KAAI,eAAe,GAAG;AACpB,MAAI,2EAA2E;AAC/E,SAAO,EAAE,OAAO,IAAI;;CAGtB,IAAI,QAAQ;CAEZ,MAAM,SAAS,kBAAkB;AAC/B,MAAI,MAAO;EAEX,MAAM,cAAc,SAAS;AAG7B,MAFiB,gBAAgB,eAAe,CAAC,QAAQ,YAAY,EAEvD;AACZ,WAAQ;AACR,iBAAc,OAAO;AACrB,OACE,8CAA8C,YAAY,wBAAwB,YAAY,qBAC/F;AACD,eAAY;;IAEb,WAAW;AAEd,QAAO,EACL,OAAO;AACL,gBAAc,OAAO;IAExB;;;;;;;;ACpBH,MAAa,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACrCtC,MAAM,mBAAmB;AACvB,KAAI;AACF,UAAA,GAAA,SAAA,eAAA,EAAA,CAAiC,QAAQ,wBAAwB,CAAC;SAC5D;AAEN,SAAO;;IAEP;AAmEJ,MAAM,eAAe;AACrB,MAAM,YAAY;AAClB,MAAM,eAAe;AACrB,MAAM,oBAAoB;;AAG1B,MAAM,iBAAiB;;;;;;;;;;;;AAavB,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;AAoB/B,SAAgB,oBACd,UACA,KAC8B;AAC9B,QAAO,aAAa,IAAI,aAAa,EAAE,KAAK,CAAC,CAAC,IAAI,gBAAgB,GAAG;;AAGvE,MAAM,qBAAA,GAAA,SAAA,iBAAoC,YAAiC;CACzE,MAAM,QAAQ,QAAQ,IAAI,aAAa;CACvC,MAAM,eAAe,UAAU,SAAS,eAAe;CACvD,MAAM,aAAa,iBAAiB,SAAS,QAAQ;CACrD,MAAM,cAAc,iBAAiB,SAAS,SAAS;CACvD,MAAM,YAAY,iBAAiB,SAAS,OAAO;CAInD,IAAI,YAA2B;CAW/B,MAAM,YAAY,oBAAoB,SAAS,QAAQ,QAAQ,IAAI;CACnE,MAAM,eAAe,SAAS,CAAC,CAAC;CAKhC,MAAM,cAAc,SAAS,eAAe;CAC5C,MAAM,eAAe,OAAO,cAAc,WAAW,YAAY,EAAE;AAEnE,QAAO;EACL,MAAM;EACN,SAAS;EAET,UAAU,IAAY;AACpB,OAAI,CAAC,WAAY,QAAO;AAExB,OACE,OAAO,gBACP,OAAO,qBACP,OAAO,aACP,OAAO,aAEP,QAAO;AAET,UAAO;;EAGT,iBAAiB,IAAY;AAC3B,OAAI,CAAC,YAAa,QAAO;AAEzB,UACE,iBAAiB,KAAK,GAAG,IACzB,sCAAsC,KAAK,GAAG,IAC9C,CAAC,GAAG,SAAS,eAAe;;EAIhC,UAAU,MAAc;AAEtB,OAAI,CAAC,YAAa,QAAO;AAEzB,OAAI,KAAK,SAAS,yBAAyB,CAAE,QAAO;AAEpD,UAAO,qCAAqC;;EAO9C,MAAM;GACJ,SAAS;IAKP,MAAM,SAAS,EAAE,mBAAmB,KAAK,UAAU,YAAY,EAAE;AACjE,QAAI,CAAC,aAAc,QAAO,EAAE,QAAQ;AAKpC,WAAO;KAAE;KAAQ,QAAQ,EAAE,cAAc,CAAC,qBAAqB,EAAE;KAAE;;GAGrE,gBAAgB,QAAsC;IAQpD,IAAI,iBAA+C;AAKnD,QAAI,cAAc;AAChB,YAAO,YAAY,KAAK,mBAAmB;AACzC,4BAAA,qBAAqB,uBAAuB,CACzC,MAAM,UAAU;AACf,wBAAiB;QACjB,CACD,OAAO,QAAiB;AAEvB,eAAQ,KACN,mDACE,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI,GAEnD;QACD;OACJ;AAGF,YAAO,YAAY,IAAI,yBAAyB,KAAK,QAAQ;AAC3D,UAAI,UAAU,+BAA+B,IAAI;AACjD,UAAI,UAAU,gCAAgC,qBAAqB;AACnE,UAAI,UAAU,gCAAgC,eAAe;AAE7D,UAAI,IAAI,WAAW,WAAW;AAC5B,WAAI,UAAU,IAAI;AAClB,WAAI,KAAK;AACT;;AAGF,UAAI,IAAI,WAAW,OAAO;AACxB,WAAI,mBAAmB,MAAM;AAE3B,YAAI,UAAU,KAAK,EAAE,gBAAgB,oBAAoB,CAAC;AAC1D,YAAI,IAAI,KAAK,UAAU,EAAE,OAAO,wCAAwC,CAAC,CAAC;AAC1E;;AAEF,WAAI,UAAU,KAAK,EAAE,gBAAgB,oBAAoB,CAAC;AAC1D,WAAI,IAAI,KAAK,UAAU,eAAe,CAAC;AACvC;;AAGF,UAAI,IAAI,WAAW,QAAQ;OACzB,MAAM,SAAmB,EAAE;AAC3B,WAAI,GAAG,SAAS,UAAkB,OAAO,KAAK,MAAM,CAAC;AACrD,WAAI,GAAG,aAAa;AAClB,YAAI;SACF,MAAM,OAAO,OAAO,OAAO,OAAO,CAAC,SAAS,QAAQ;SACpD,MAAM,UAAU,KAAK,MAAM,KAAK;SAKhC,MAAM,UAAU,QAAQ;AACxB,aAAI,YAAY,aAAa,YAAY,YAAY,YAAY,aAAa;AAC5E,cAAI,UAAU,KAAK,EAAE,gBAAgB,oBAAoB,CAAC;AAC1D,cAAI,IACF,KAAK,UAAU,EACb,OAAO,iEACR,CAAC,CACH;AACD;;AAGF,+BAAA,kBAAkB;UAChB;UACA,gBAAgB,QAAQ,kBAAA;UACzB,CAAC,CACC,KAAK,YAAY;UAEhB,MAAM,EAAE,qBAAqB,MAAA,QAAA,SAAA,CAAA,WAAA,QAAM,gCAAA,CAAA,CAAA,MAAA,MAAA,EAAA,sBAAA;AACnC,2BAAiB,MAAM,kBAAkB;AACzC,cAAI,UAAU,IAAI;AAClB,cAAI,KAAK;WACT,CACD,OAAO,QAAiB;AACvB,cAAI,UAAU,KAAK,EAAE,gBAAgB,oBAAoB,CAAC;AAC1D,cAAI,IACF,KAAK,UAAU,EACb,OAAO,iBAAiB,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI,IACzE,CAAC,CACH;WACD;AACJ;gBACM;AACN,aAAI,UAAU,KAAK,EAAE,gBAAgB,oBAAoB,CAAC;AAC1D,aAAI,IAAI,KAAK,UAAU,EAAE,OAAO,sBAAsB,CAAC,CAAC;;SAE1D;AACF;;AAGF,UAAI,UAAU,KAAK,EAAE,gBAAgB,oBAAoB,CAAC;AAC1D,UAAI,IAAI,KAAK,UAAU,EAAE,OAAO,sBAAsB,CAAC,CAAC;OACxD;;AAIJ,QAAI,UACF,QAAO,YAAY,IAAI,iBAAiB,KAAK,QAAQ;AAEnD,SAAI,UAAU,+BAA+B,IAAI;AACjD,SAAI,UAAU,gCAAgC,qBAAqB;AACnE,SAAI,UAAU,gCAAgC,eAAe;AAE7D,SAAI,IAAI,WAAW,WAAW;AAC5B,UAAI,UAAU,IAAI;AAClB,UAAI,KAAK;AACT;;AAGF,SAAI,IAAI,WAAW,OAAO;AACxB,UAAI,cAAc,MAAM;AACtB,WAAI,UAAU,KAAK,EAAE,gBAAgB,oBAAoB,CAAC;AAC1D,WAAI,IACF,KAAK,UAAU,EACb,OAAO,2DACR,CAAC,CACH;AACD;;AAEF,UAAI,UAAU,KAAK,EAAE,gBAAgB,oBAAoB,CAAC;AAC1D,UAAI,IAAI,UAAU;AAClB;;AAGF,SAAI,IAAI,WAAW,QAAQ;MACzB,MAAM,SAAmB,EAAE;AAC3B,UAAI,GAAG,SAAS,UAAkB,OAAO,KAAK,MAAM,CAAC;AACrD,UAAI,GAAG,aAAa;AAClB,WAAI;QACF,MAAM,OAAO,OAAO,OAAO,OAAO,CAAC,SAAS,QAAQ;AAEpD,aAAK,MAAM,KAAK;AAChB,oBAAY;AACZ,YAAI,UAAU,IAAI;AAClB,YAAI,KAAK;eACH;AACN,YAAI,UAAU,KAAK,EAAE,gBAAgB,oBAAoB,CAAC;AAC1D,YAAI,IAAI,KAAK,UAAU,EAAE,OAAO,gBAAgB,CAAC,CAAC;;QAEpD;AACF;;AAGF,SAAI,UAAU,KAAK,EAAE,gBAAgB,oBAAoB,CAAC;AAC1D,SAAI,IAAI,KAAK,UAAU,EAAE,OAAO,sBAAsB,CAAC,CAAC;MACxD;AAIJ,QAAI,cAAc;KAChB,IAAI,SAAsC;KAG1C,IAAI,cAA2C;KAC/C,IAAI,QAA+C;KAKnD,IAAI,cAAqD;KAIzD,IAAI,mBAAoE;KAGxE,IAAI,gBAAyC;KAC7C,MAAM,aAAa,OAAO;AAE1B,iBAAY,KAAK,mBAAmB;MAClC,MAAM,UAAU,YAAY,SAAS;MACrC,MAAM,OACJ,aAAa,SACZ,WAAW,OAAO,YAAY,WAAW,QAAQ,OAAO,KAAA;AAC3D,UAAI,CAAC,MAAM;AACT,eAAQ,KACN,gFACD;AACD;;AAIF,cAAA,SAAA,CAAA,WAAA,QAAA,yBAAA,CAAA,CACG,KAAK,OAAO,EAAE,kBAAkB,mBAAmB,2BAA2B;OAC7E,MAAM,IAAI,MAAM,iBAAiB,KAAK;AACtC,gBAAS;OAKT,IAAI;OAEJ,IAAI;OAEJ,IAAI;AACJ,WAAI,aAAa,IACf,KAAI;QAkBF,MAAM,EAAE,sBAAsB,MAAA,QAAA,SAAA,CAAA,WAAA,QAAM,qCAAA,CAAA;AACpC,cAAM,kBAAkB,EAAE,aAAa,OAAO,OAAO,MAAM,CAAC;QAC5D,MAAM,EAAE,2BAA2B,yBAAyB,MAAA,QAAA,SAAA,CAAA,WAAA,QAAM,uBAAA,CAAA;AAGlE,mCAA2B;QAC3B,MAAM,aAAa,sBAAsB;QACzC,MAAM,EAAE,mBAAmB,MAAA,QAAA,SAAA,CAAA,WAAA,QAAM,6BAAA,CAAA;QAKjC,IAAI,uBAAuB;QAC3B,MAAM,IAAI,MAAM,eAAe;SAC7B,MAAM;SACN;SACA,oBAAoB;UAClB,MAAM,QAAQ,KAAK,KAAK;AACxB,cAAI,QAAQ,uBAAuB,IAAQ;AAC3C,iCAAuB;AACvB,kBAAQ,KACN,oFACD;;SAEJ,CAAC;AACF,gBAAQ;QACR,MAAM,KAAK,MAAM,iBAAiB,EAAE,KAAK;AACzC,sBAAc;AAGd,uBAAe,GAAG;AAClB,sBAAc,GAAG,IAAI,QAAQ,WAAW,OAAO;AAM/C,4BAAoB,oBAAoB,EAAE;gBACnC,KAAc;AACrB,gBAAQ,KACN,wGACE,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI,GAEnD;;OAML,IAAI;AACJ,WAAI;QACF,MAAM,EAAE,iBAAiB,MAAM,OAAO;QAEtC,MAAM,SAAS,aADC,GAAG,OAAO,OAAO,KAAK,gBACD,OAAO;QAC5C,MAAM,MAAM,KAAK,MAAM,OAAO;QAC9B,MAAM,UAAU,OAAO,IAAI,SAAS,WAAW,IAAI,OAAO;AAI1D,yBAHiB,QAAQ,SAAS,IAAI,GAClC,QAAQ,MAAM,QAAQ,QAAQ,IAAI,GAAG,EAAE,GACvC,SACqB,MAAM,IAAI,KAAA;eAC7B;AAIR,aAAM,kBAAkB,EAAE,KAAK;QAC7B,IAAI,aAAa;QACjB;QACA,MAAM;QACN;QACD,CAAC;OAOF,MAAM,EAAE,gBAAgB,oBAAoB,MAAA,QAAA,SAAA,CAAA,WAAA,QAAM,kCAAA,CAAA;AAGlD,aAAM,eAAe;QACnB,aAAa,OAAO,OAAO;QAC3B,eAAe,EAAE;QACjB,GAAI,iBAAiB,KAAA,IAAY,EAAE,cAAc,cAAc,GAAG,EAAE;QAEpE,GAAI,sBAAsB,KAAA,IAAY,EAAE,eAAe,mBAAmB,GAAG,EAAE;QAChF,CAAC;AACF,2BAAoB,SAAiB,gBAAgB,EAAE,aAAa,MAAM,CAAC;AAO3E,WAAI,YACF,eACG,MAAM,qBAAqB;QAC1B,WAAW,EAAE;QACb;QACA,IAAI,aAAa;QACjB,MAAM;QACP,CAAC,IAAK;AAMX,uBAAgB,yBAAyB;AACvC,iBAAS;AACT,gBAAQ,KAAK,EAAE;SACf;QACF,CACD,OAAO,QAAiB;AACvB,eAAQ,KACN,8CACE,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI,GAEnD;QACD;OACJ;KAEF,MAAM,gBAAgB;AACpB,qBAAe,MAAM;AACrB,cAAQ,MAAM;AACd,mBAAa,MAAM;AACd,aAAO,OAAO;AACd,mBAAa,OAAO;AAIpB,yBAAmB,OAAO,OAAO,KAAK;;AAE7C,iBAAY,KAAK,SAAS,QAAQ;AAClC,aAAQ,KAAK,UAAU,QAAQ;AAC/B,aAAQ,KAAK,WAAW,QAAQ;AAChC,aAAQ,KAAK,UAAU,QAAQ;AAC/B,aAAQ,KAAK,QAAQ,QAAQ;;;GAGlC;EACF;EACD;AAEF,MAAa,OAAO,kBAAkB;AACtC,MAAa,UAAU,kBAAkB;AACzC,MAAa,SAAS,kBAAkB;AACxC,MAAa,UAAU,kBAAkB;AACzC,MAAa,SAAS,kBAAkB"}

package/dist/unplugin/index.d.cts

@@ -10128,6 +10128,19 @@ interface AitDevtoolsOptions {
    * Vite 전용: webpack/rspack/esbuild/rollup 환경에서는 무시된다.
    */
   mcp?: boolean;
+  /**
+   * 미니앱의 webViewType (`granite.config.ts`의 `webViewProps.type`)을 빌드 상수
+   * `__WEB_VIEW_TYPE__`로 주입한다 (#580). **Vite 전용** (다른 번들러는 무시).
+   *
+   * 이 상수는 in-app self-report(`@ait-co/devtools/in-app`)가 읽어 launcher(env-2
+   * PWA)에 webViewType을 postMessage로 알리고, launcher가 game 타입 미니앱에서
+   * 수동 `?navBarType=game` URL 편집 없이 game 모드로 자동 진입하게 한다.
+   *
+   * 미지정 시 `'partner'`(web-framework `webViewProps.type`의 `@default`)로 주입한다.
+   * `game`이면 게임 모드로 자동 진입한다. (granite.config.ts를 config 시점에
+   * 자동으로 읽는 것은 TS 모듈 로더가 필요해 보류 — 명시 옵션으로 신뢰성 확보, #580.)
+   */
+  webViewType?: 'partner' | 'game';
   /**
    * Vite dev 서버를 Cloudflare quick tunnel(`*.trycloudflare.com`, 계정 불필요)로
    * 외부 노출해 실제 폰에서 미리보기. **Vite dev 모드 전용** — production은