@aligndottech/cli 0.49.0 → 0.51.0

package/dist/lib/join-flow.js

@@ -0,0 +1,282 @@
+import { createGatewayClient } from './gateway-client.js';
+import { validateDestinationName } from './destination-name.js';
+import { assertTransport, describeHost, needsTypeBack, parseJoinLink, slugOrgName, TransportError } from './destination-trust.js';
+import { visible } from './share/visible.js';
+const PEEK_MAX_BYTES = 16 * 1024;
+const ORG_NOTE = 'chosen by that organisation, not verified by Align';
+const PEEK_TIMEOUT_MS = 10_000;
+const ORG_NAME_MAX = 100;
+const TOKEN_SHAPE = /^[\x21-\x7e]{8,512}$/;
+export async function runJoin(deps, input) {
+    const refuse = (reason) => {
+        deps.out(`\nNothing was saved and no browser was opened.\n  ${reason}\n`);
+        return { ok: false, reason };
+    };
+    // After the browser step: a browser WAS opened, and if the server already issued a token it is still live there. Say both.
+    const refuseLate = (reason, issued) => {
+        const live = issued
+            ? `\n  ${issued.host} issued a token to this computer and it was not saved. It stays valid until ${issued.expiresAt ? issued.expiresAt.slice(0, 10) : 'it expires'} (or until the organisation's admin revokes the invite); nothing here can revoke it.`
+            : '';
+        deps.out(`\nNothing was saved. A browser was opened.\n  ${reason}${live}\n`);
+        return { ok: false, reason };
+    };
+    // First, before any request: a join gives a server a credential and a place to send shares, so it is a person's act, at a
+    // terminal of their own. An agent (or a script) that has been handed a link must not be able to finish it, whichever host
+    // the link names, and the refusal says nothing about a way around it.
+    if (deps.wrapped)
+        return refuse('align join has to be run by you, in your own terminal, not from inside an agent.');
+    if (!deps.isTTY)
+        return refuse('align join needs a terminal: both input and output must be a terminal, so a person answers the questions.');
+    let link;
+    try {
+        link = parseJoinLink(input.link, input.gateway === undefined ? {} : { gateway: input.gateway });
+    }
+    catch (e) {
+        return refuse(e instanceof TransportError ? e.message : 'That link could not be read.');
+    }
+    const gwHost = new URL(link.gatewayUrl).host;
+    if (input.name !== undefined) {
+        const bad = validateDestinationName(input.name);
+        if (bad)
+            return refuse(`The name "${visible(input.name.slice(0, 40))}" cannot be used: ${bad}.`);
+    }
+    const peeked = await peek(link.gatewayUrl, link.token);
+    if (typeof peeked === 'string')
+        return refuse(peeked);
+    // The gateway's own account of itself has to match the link, or the link is lying about one of them.
+    let peekApp;
+    try {
+        peekApp = assertTransport(peeked.appUrl);
+    }
+    catch (e) {
+        return refuse(`The server's web app address is not acceptable: ${e.message}`);
+    }
+    const peekAppHost = new URL(peekApp).host;
+    if (peekAppHost !== link.appHost) {
+        return refuse(`The link points at the web app ${link.appHost}, but ${gwHost} says its web app is ${peekAppHost}. Both are shown so you can see which to trust; neither was used.`);
+    }
+    if (peeked.gatewayClaim !== undefined && peeked.gatewayClaim !== link.gatewayUrl) {
+        return refuse(`The link names the server ${gwHost}, but that server says it is ${new URL(peeked.gatewayClaim).host}. Neither was used.`);
+    }
+    // A gateway that wrote gw= into the link also reports its own address when asked. An answer with none, to a link that carried one, is not that gateway.
+    if (peeked.gatewayClaim === undefined && link.gatewayFromLink) {
+        return refuse(`The link names the server ${gwHost}, but that server did not say it is the one that made the link. Ask for a new link.`);
+    }
+    const claimed = visible(peeked.orgName).slice(0, ORG_NAME_MAX);
+    const gwShown = describeHost(gwHost);
+    const appShown = describeHost(peekAppHost);
+    deps.out('\nJoining a team graph');
+    deps.out(`  Gateway:  ${gwShown.text}`);
+    deps.out(`  Web app:  ${appShown.text}`);
+    deps.out(`  Org:      "${claimed || '(no name given)'}" (${ORG_NOTE})`);
+    for (const w of new Set([gwShown.warning, appShown.warning]))
+        if (w)
+            deps.out(`  Warning:  ${w}`);
+    const hostTyped = { done: false };
+    if (needsTypeBack(gwHost, peekAppHost)) {
+        const typed = await typeBack(deps, gwHost);
+        if (typed === null || typed.trim().toLowerCase() !== gwHost)
+            return refuse(`That is not ${gwHost}, so nothing was done.`);
+        hostTyped.done = true;
+    }
+    else {
+        // An Align address does not make the org name Align's: any hosted org picks its own name and can issue invites.
+        const yes = await deps.promptLine(`Join "${claimed}" at ${gwHost}? The name is ${ORG_NOTE}. Type y to continue: `);
+        if (yes === null || !/^y(es)?$/i.test(yes.trim()))
+            return refuse('You did not answer y, so nothing was done.');
+    }
+    const derived = input.name ?? slugOrgName(claimed);
+    if (!derived)
+        return refuse('Could not make a name from the org name. Choose one with --name <name>.');
+    const name = derived;
+    if (deps.config.hasTeamDestination(name)) {
+        if (!input.replace)
+            return refuse(`You already have a destination called "${name}". Use --replace to replace it, or --name <other> to keep both.`);
+        const refusal = await confirmReplace(deps, name, gwHost, claimed, hostTyped.done);
+        if (refusal)
+            return refuse(refusal);
+    }
+    const received = await receive(deps, link.token, peekApp, link.gatewayUrl);
+    if (typeof received === 'string')
+        return refuseLate(received);
+    const me = await verifyToken(link.gatewayUrl, received.token);
+    if (typeof me === 'string')
+        return refuseLate(`${gwHost} ${me}`, { host: gwHost, ...(received.expiresAt ? { expiresAt: received.expiresAt } : {}) });
+    const tenantName = visible(me.tenantName).slice(0, ORG_NAME_MAX);
+    if (tenantName.trim() !== claimed.trim()) {
+        deps.out(`\n  Heads up: the invite said "${claimed}" but you are signed in to "${tenantName}". Both come from ${gwHost}, so neither proves who runs it.`);
+    }
+    deps.config.saveTeamDestination(name, {
+        gatewayUrl: link.gatewayUrl,
+        appUrl: peekApp,
+        authToken: received.token,
+        tenantId: me.tenantId,
+        orgNameClaimed: claimed,
+    }, deps.now());
+    await chooseShareDestination(deps, name, claimed, gwHost);
+    deps.out(`\nJoined as "${name}" (${visible(me.email)}, ${tenantName}).`);
+    if (received.expiresAt)
+        deps.out(`  This access expires on ${received.expiresAt.slice(0, 10)}. Renew it with: align login --env ${name}`);
+    deps.out(`  Use it with: align <command> --env ${name}`);
+    return received.expiresAt ? { ok: true, name, expiresAt: received.expiresAt } : { ok: true, name };
+}
+/** Replacing a destination points a saved name at a server a person has not used under that name. Never silent. */
+async function confirmReplace(deps, name, newHost, claimed, hostAlreadyTyped) {
+    let oldHost = '(unknown)';
+    try {
+        oldHost = new URL(deps.config.getEnvironment(name).gatewayUrl).host;
+    }
+    catch { /* unreadable entry: shown as unknown */ }
+    deps.out(`\n  Replacing "${name}":  ${describeHost(oldHost).text}  ->  ${describeHost(newHost).text}`);
+    if (!hostAlreadyTyped) {
+        const typed = await deps.promptLine('Type the new gateway host to confirm the replacement: ');
+        if (typed === null || typed.trim().toLowerCase() !== newHost)
+            return `That is not ${newHost}, so "${name}" was not replaced.`;
+    }
+    if (deps.config.getShareDestination() === name) {
+        const ok = await deps.confirm(`"${name}" is where "align share" sends decisions. Send them to "${claimed}" at ${newHost} instead?`);
+        if (!ok)
+            return `"${name}" was not replaced: it is where your shares go, and you did not agree to move them.`;
+    }
+    return null;
+}
+async function typeBack(deps, gwHost) {
+    deps.out(`\n  ${gwHost} is not an Align address. If you did not expect this link, stop here.`);
+    return deps.promptLine('Type the gateway host to confirm: ');
+}
+/** Reads at most `max` bytes, and stops reading (cancels the stream) the moment it would pass that. Null when the body is too big. */
+async function readCapped(res, max) {
+    const reader = res.body?.getReader();
+    if (!reader)
+        return '';
+    const parts = [];
+    let total = 0;
+    for (;;) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        total += value.byteLength;
+        if (total > max) {
+            await reader.cancel().catch(() => undefined);
+            return null;
+        }
+        parts.push(value);
+    }
+    return Buffer.concat(parts).toString('utf8');
+}
+async function peek(gatewayUrl, token) {
+    const host = new URL(gatewayUrl).host;
+    let res;
+    try {
+        res = await fetch(`${gatewayUrl}/auth/invite-peek?token=${encodeURIComponent(token)}`, {
+            headers: { accept: 'application/json' },
+            redirect: 'error',
+            signal: AbortSignal.timeout(PEEK_TIMEOUT_MS),
+        });
+    }
+    catch {
+        return `Could not reach ${host}.`;
+    }
+    if (res.status === 404)
+        return 'That invite was not found. It may have expired, been used, or been revoked. Ask for a new link.';
+    if (!res.ok)
+        return `${host} answered ${res.status} when asked about the invite.`;
+    let body;
+    try {
+        const text = await readCapped(res, PEEK_MAX_BYTES);
+        if (text === null)
+            return `${host} sent an unexpectedly large answer.`;
+        body = JSON.parse(text);
+    }
+    catch {
+        return `${host} did not answer with an invite description.`;
+    }
+    const b = body;
+    if (typeof b !== 'object' || b === null)
+        return `${host} did not answer with an invite description.`;
+    if (typeof b.app_url !== 'string' || b.app_url === '') {
+        return `${host} did not say where its web app is. It may be too old to join from the CLI; ask its admin to update it.`;
+    }
+    let gatewayClaim;
+    if (b.gateway_url !== undefined) {
+        if (typeof b.gateway_url !== 'string')
+            return `${host} sent a malformed server address.`;
+        try {
+            gatewayClaim = assertTransport(b.gateway_url);
+        }
+        catch (e) {
+            return `The server address ${host} reports is not acceptable: ${e.message}`;
+        }
+    }
+    return { orgName: typeof b.org_name === 'string' ? b.org_name : '', appUrl: b.app_url, gatewayClaim };
+}
+async function receive(deps, token, appUrl, gatewayUrl) {
+    let result;
+    try {
+        result = await deps.waitForCallback({
+            ports: deps.callbackPorts,
+            timeoutMs: deps.timeoutMs,
+            onBound: async (port, nonce) => {
+                // cli_gw: the gateway THIS CLI validated. The web app is the one party that knows its own gateway, so it can refuse a
+                // link whose gw= was swapped for another server's, which no check on this side can tell from the real one.
+                const url = `${appUrl}/join?token=${token}&cli_port=${port}&cli_nonce=${nonce}&cli_gw=${encodeURIComponent(gatewayUrl)}`;
+                deps.out(`\nOpening your browser at:\n  ${url}`);
+                if (!(await deps.openUrl(url)))
+                    deps.out('  Could not open a browser here. Open that link yourself.');
+                deps.out('Waiting for you to approve in the browser (5 min)...');
+            },
+        });
+    }
+    catch (e) {
+        return `No approval arrived: ${e.message}.`;
+    }
+    const t = result.data['token'];
+    if (typeof t !== 'string' || !TOKEN_SHAPE.test(t))
+        return 'The browser sent back no usable token. Run the command again.';
+    const raw = result.data['expires_at'];
+    let expiresAt;
+    if (typeof raw === 'string' && !Number.isNaN(Date.parse(raw)))
+        expiresAt = new Date(raw).toISOString();
+    return expiresAt ? { token: t, expiresAt } : { token: t };
+}
+const ID_SHAPE = /^[\x21-\x7e]{1,128}$/;
+const EMAIL_SHAPE = /^[^\s\p{C}]{3,254}$/u;
+/**
+ * "Verified" means the gateway answered /auth/me like an Align gateway would, with this token and no other, not that it said 2xx.
+ * Every field that is saved or printed is checked for type and shape first, so a hostile server cannot save an object as a tenant
+ * id or put escape sequences on the person's screen. Anything else is a string saying why, and nothing is saved.
+ */
+export async function verifyToken(gatewayUrl, token) {
+    let raw;
+    try {
+        raw = await createGatewayClient({ gatewayUrl, authToken: token, tenantId: null, mode: 'auth' }).whoami();
+    }
+    catch (e) {
+        return `did not accept the new token (${visible(String(e.message).slice(0, 120))}).`;
+    }
+    const r = raw;
+    const email = r?.user?.email;
+    const id = r?.tenant?.id;
+    const name = r?.tenant?.name;
+    if (typeof email !== 'string' || !EMAIL_SHAPE.test(email) || typeof id !== 'string' || !ID_SHAPE.test(id) || typeof name !== 'string') {
+        return 'answered, but not the way an Align gateway answers who you are. The token was not saved.';
+    }
+    return { email, tenantId: id, tenantName: name };
+}
+async function chooseShareDestination(deps, name, claimed, gwHost) {
+    const current = deps.config.getShareDestination();
+    // Where shares go is a decision about where decisions are sent, so it is made by a yes at this terminal and never by default.
+    // (A replace of the share destination was already agreed to, and keeps pointing at the name it had.)
+    if (current !== name) {
+        const q = current === null
+            ? `Send "align share" to "${claimed}" at ${gwHost} from now on?`
+            : `Send "align share" to "${claimed}" at ${gwHost} from now on? It currently goes to "${current}".`;
+        if (!(await deps.confirm(q))) {
+            deps.out(`  "align share" ${current === null ? 'has no destination yet' : `still goes to "${current}"`}. Send one share to "${name}" with --to ${name}.`);
+            return;
+        }
+        deps.config.setShareDestination(name);
+    }
+    deps.out(`  Shares from this machine now go to "${claimed}" at ${gwHost}.`);
+}
+//# sourceMappingURL=join-flow.js.map

package/dist/lib/join-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"join-flow.js","sourceRoot":"","sources":["../../src/lib/join-flow.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAClI,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAkC7C,MAAM,cAAc,GAAG,EAAE,GAAG,IAAI,CAAC;AACjC,MAAM,QAAQ,GAAG,oDAAoD,CAAC;AACtE,MAAM,eAAe,GAAG,MAAM,CAAC;AAC/B,MAAM,YAAY,GAAG,GAAG,CAAC;AACzB,MAAM,WAAW,GAAG,sBAAsB,CAAC;AAI3C,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAc,EAAE,KAAgB;IAC5D,MAAM,MAAM,GAAG,CAAC,MAAc,EAAc,EAAE;QAC5C,IAAI,CAAC,GAAG,CAAC,qDAAqD,MAAM,IAAI,CAAC,CAAC;QAC1E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC/B,CAAC,CAAC;IACF,2HAA2H;IAC3H,MAAM,UAAU,GAAG,CAAC,MAAc,EAAE,MAA6C,EAAc,EAAE;QAC/F,MAAM,IAAI,GAAG,MAAM;YACjB,CAAC,CAAC,OAAO,MAAM,CAAC,IAAI,+EAA+E,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,sFAAsF;YACxP,CAAC,CAAC,EAAE,CAAC;QACP,IAAI,CAAC,GAAG,CAAC,iDAAiD,MAAM,GAAG,IAAI,IAAI,CAAC,CAAC;QAC7E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC/B,CAAC,CAAC;IAEF,0HAA0H;IAC1H,0HAA0H;IAC1H,sEAAsE;IACtE,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,kFAAkF,CAAC,CAAC;IACpH,IAAI,CAAC,IAAI,CAAC,KAAK;QAAE,OAAO,MAAM,CAAC,2GAA2G,CAAC,CAAC;IAE5I,IAAI,IAAI,CAAC;IACT,IAAI,CAAC;QACH,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAClG,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,MAAM,CAAC,CAAC,YAAY,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC;IAE7C,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,uBAAuB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,GAAG;YAAE,OAAO,MAAM,CAAC,aAAa,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,qBAAqB,GAAG,GAAG,CAAC,CAAC;IACnG,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACvD,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;IAEtD,qGAAqG;IACrG,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,MAAM,CAAC,mDAAoD,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC;IAC1C,IAAI,WAAW,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,kCAAkC,IAAI,CAAC,OAAO,SAAS,MAAM,wBAAwB,WAAW,mEAAmE,CAAC,CAAC;IACrL,CAAC;IACD,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI,MAAM,CAAC,YAAY,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;QACjF,OAAO,MAAM,CAAC,6BAA6B,MAAM,gCAAgC,IAAI,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,qBAAqB,CAAC,CAAC;IAC3I,CAAC;IACD,wJAAwJ;IACxJ,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;QAC9D,OAAO,MAAM,CAAC,6BAA6B,MAAM,qFAAqF,CAAC,CAAC;IAC1I,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;IAC3C,IAAI,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;IACnC,IAAI,CAAC,GAAG,CAAC,eAAe,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACxC,IAAI,CAAC,GAAG,CAAC,eAAe,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACzC,IAAI,CAAC,GAAG,CAAC,gBAAgB,OAAO,IAAI,iBAAiB,MAAM,QAAQ,GAAG,CAAC,CAAC;IACxE,KAAK,MAAM,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAAE,IAAI,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;IAElG,MAAM,SAAS,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAClC,IAAI,aAAa,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC3C,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,MAAM;YAAE,OAAO,MAAM,CAAC,eAAe,MAAM,wBAAwB,CAAC,CAAC;QAC1H,SAAS,CAAC,IAAI,GAAG,IAAI,CAAC;IACxB,CAAC;SAAM,CAAC;QACN,gHAAgH;QAChH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,OAAO,QAAQ,MAAM,iBAAiB,QAAQ,wBAAwB,CAAC,CAAC;QACnH,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YAAE,OAAO,MAAM,CAAC,4CAA4C,CAAC,CAAC;IACjH,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC;IACnD,IAAI,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,yEAAyE,CAAC,CAAC;IACvG,MAAM,IAAI,GAAG,OAAO,CAAC;IACrB,IAAI,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC,0CAA0C,IAAI,iEAAiE,CAAC,CAAC;QACnJ,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QAClF,IAAI,OAAO;YAAE,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAC3E,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC;IAE9D,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9D,IAAI,OAAO,EAAE,KAAK,QAAQ;QAAE,OAAO,UAAU,CAAC,GAAG,MAAM,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAErJ,MAAM,UAAU,GAAG,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IACjE,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QACzC,IAAI,CAAC,GAAG,CAAC,kCAAkC,OAAO,+BAA+B,UAAU,qBAAqB,MAAM,kCAAkC,CAAC,CAAC;IAC5J,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,IAAI,EAAE;QACpC,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,MAAM,EAAE,OAAO;QACf,SAAS,EAAE,QAAQ,CAAC,KAAK;QACzB,QAAQ,EAAE,EAAE,CAAC,QAAQ;QACrB,cAAc,EAAE,OAAO;KACxB,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAEf,MAAM,sBAAsB,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAE1D,IAAI,CAAC,GAAG,CAAC,gBAAgB,IAAI,MAAM,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,UAAU,IAAI,CAAC,CAAC;IACzE,IAAI,QAAQ,CAAC,SAAS;QAAE,IAAI,CAAC,GAAG,CAAC,4BAA4B,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,sCAAsC,IAAI,EAAE,CAAC,CAAC;IAC1I,IAAI,CAAC,GAAG,CAAC,wCAAwC,IAAI,EAAE,CAAC,CAAC;IACzD,OAAO,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACrG,CAAC;AAED,mHAAmH;AACnH,KAAK,UAAU,cAAc,CAAC,IAAc,EAAE,IAAY,EAAE,OAAe,EAAE,OAAe,EAAE,gBAAyB;IACrH,IAAI,OAAO,GAAG,WAAW,CAAC;IAC1B,IAAI,CAAC;QAAC,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,IAAa,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,wCAAwC,CAAC,CAAC;IACxI,IAAI,CAAC,GAAG,CAAC,kBAAkB,IAAI,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC,IAAI,SAAS,YAAY,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACvG,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,wDAAwD,CAAC,CAAC;QAC9F,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO;YAAE,OAAO,eAAe,OAAO,SAAS,IAAI,qBAAqB,CAAC;IAChI,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE,KAAK,IAAI,EAAE,CAAC;QAC/C,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,2DAA2D,OAAO,QAAQ,OAAO,WAAW,CAAC,CAAC;QACpI,IAAI,CAAC,EAAE;YAAE,OAAO,IAAI,IAAI,qFAAqF,CAAC;IAChH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAc,EAAE,MAAc;IACpD,IAAI,CAAC,GAAG,CAAC,OAAO,MAAM,uEAAuE,CAAC,CAAC;IAC/F,OAAO,IAAI,CAAC,UAAU,CAAC,oCAAoC,CAAC,CAAC;AAC/D,CAAC;AAED,sIAAsI;AACtI,KAAK,UAAU,UAAU,CAAC,GAAa,EAAE,GAAW;IAClD,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;IACrC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,SAAS,CAAC;QACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,IAAI;YAAE,MAAM;QAChB,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;QAC1B,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;YAAC,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;QAC/E,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC/C,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,UAAkB,EAAE,KAAa;IACnD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC;IACtC,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,UAAU,2BAA2B,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAAE;YACrF,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACvC,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,eAAe,CAAC;SAC7C,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,mBAAmB,IAAI,GAAG,CAAC;IACpC,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,iGAAiG,CAAC;IACjI,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,GAAG,IAAI,aAAa,GAAG,CAAC,MAAM,+BAA+B,CAAC;IAClF,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QACnD,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,GAAG,IAAI,qCAAqC,CAAC;QACvE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,IAAI,6CAA6C,CAAC;IAC9D,CAAC;IACD,MAAM,CAAC,GAAG,IAA+E,CAAC;IAC1F,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,GAAG,IAAI,6CAA6C,CAAC;IACrG,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,KAAK,EAAE,EAAE,CAAC;QACtD,OAAO,GAAG,IAAI,wGAAwG,CAAC;IACzH,CAAC;IACD,IAAI,YAAgC,CAAC;IACrC,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QAChC,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ;YAAE,OAAO,GAAG,IAAI,mCAAmC,CAAC;QACzF,IAAI,CAAC;YACH,YAAY,GAAG,eAAe,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,sBAAsB,IAAI,+BAAgC,CAAW,CAAC,OAAO,EAAE,CAAC;QACzF,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC;AACxG,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,IAAc,EAAE,KAAa,EAAE,MAAc,EAAE,UAAkB;IACtF,IAAI,MAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC;YAClC,KAAK,EAAE,IAAI,CAAC,aAAa;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;gBAC7B,sHAAsH;gBACtH,2GAA2G;gBAC3G,MAAM,GAAG,GAAG,GAAG,MAAM,eAAe,KAAK,aAAa,IAAI,cAAc,KAAK,WAAW,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC;gBACzH,IAAI,CAAC,GAAG,CAAC,iCAAiC,GAAG,EAAE,CAAC,CAAC;gBACjD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;oBAAE,IAAI,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC;gBACtG,IAAI,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC;YACnE,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,wBAAyB,CAAW,CAAC,OAAO,GAAG,CAAC;IACzD,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,+DAA+D,CAAC;IAC1H,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACtC,IAAI,SAA6B,CAAC;IAClC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAAE,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IACvG,OAAO,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AAC5D,CAAC;AAID,MAAM,QAAQ,GAAG,sBAAsB,CAAC;AACxC,MAAM,WAAW,GAAG,sBAAsB,CAAC;AAE3C;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,UAAkB,EAAE,KAAa;IACjE,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,mBAAmB,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3G,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,iCAAiC,OAAO,CAAC,MAAM,CAAE,CAAW,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC;IAClG,CAAC;IACD,MAAM,CAAC,GAAG,GAAuF,CAAC;IAClG,MAAM,KAAK,GAAG,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC;IAC7B,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC;IAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtI,OAAO,0FAA0F,CAAC;IACpG,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;AACnD,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,IAAc,EAAE,IAAY,EAAE,OAAe,EAAE,MAAc;IACjG,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC;IAClD,8HAA8H;IAC9H,qGAAqG;IACrG,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,OAAO,KAAK,IAAI;YACxB,CAAC,CAAC,0BAA0B,OAAO,QAAQ,MAAM,eAAe;YAChE,CAAC,CAAC,0BAA0B,OAAO,QAAQ,MAAM,uCAAuC,OAAO,IAAI,CAAC;QACtG,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7B,IAAI,CAAC,GAAG,CAAC,mBAAmB,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,kBAAkB,OAAO,GAAG,wBAAwB,IAAI,eAAe,IAAI,GAAG,CAAC,CAAC;YAC1J,OAAO;QACT,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,yCAAyC,OAAO,QAAQ,MAAM,GAAG,CAAC,CAAC;AAC9E,CAAC"}

package/dist/lib/launch/adapters/aider.d.ts

@@ -0,0 +1,17 @@
+import type { LaunchContext, LaunchSpec } from './claude-code.js';
+export type AiderLaunchContext = Pick<LaunchContext, 'passthrough' | 'cachePath'>;
+/**
+ * Aider has no MCP, so it gets instructions and no graph tools. The model cannot call Align, so the
+ * text asks it to send the user to Align in another terminal.
+ */
+export declare const AIDER_INSTRUCTIONS = "# Align (decision graph)\n\nThis project's decisions live in Align, but this Aider session has no MCP and so no graph tools:\nyou cannot query Align yourself.\n\n- Before a change that could touch a past decision (architecture, data model, a dependency, a\n  config value someone chose), stop and ask the user to run, in another terminal:\n  `align ask \"<what you are about to change and why>\"`\n- After editing, suggest the user runs `align check` in another terminal to compare the diff\n  against recorded decisions.\n- If the user reports a conflict, follow the recorded decision or confirm with them first.\n";
+/**
+ * Aider, per session, instructions only (aider 0.86.2, `aider --help`): `--read FILE` loads a
+ * read-only file into the chat, and can be given more than once, so the user's own `--read`
+ * files are kept. It is added even when one of those carries Align's general block (AGENTS.md):
+ * that block tells the model to call MCP tools Aider does not have, and this file corrects it.
+ * The flag goes first, where a user's `--` cannot turn it into a file name.
+ * Nothing else is passed: no `--lint-cmd` (plan Open Question 8), no `--yes-always`.
+ */
+export declare function buildAiderLaunch(c: AiderLaunchContext): LaunchSpec;
+//# sourceMappingURL=aider.d.ts.map

package/dist/lib/launch/adapters/aider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aider.d.ts","sourceRoot":"","sources":["../../../../src/lib/launch/adapters/aider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAElE,MAAM,MAAM,kBAAkB,GAAG,IAAI,CAAC,aAAa,EAAE,aAAa,GAAG,WAAW,CAAC,CAAC;AAIlF;;;GAGG;AACH,eAAO,MAAM,kBAAkB,4mBAW9B,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,kBAAkB,GAAG,UAAU,CAGlE"}

package/dist/lib/launch/adapters/aider.js

@@ -0,0 +1,30 @@
+const FILE = 'aider-align-instructions.md';
+/**
+ * Aider has no MCP, so it gets instructions and no graph tools. The model cannot call Align, so the
+ * text asks it to send the user to Align in another terminal.
+ */
+export const AIDER_INSTRUCTIONS = `# Align (decision graph)
+
+This project's decisions live in Align, but this Aider session has no MCP and so no graph tools:
+you cannot query Align yourself.
+
+- Before a change that could touch a past decision (architecture, data model, a dependency, a
+  config value someone chose), stop and ask the user to run, in another terminal:
+  \`align ask "<what you are about to change and why>"\`
+- After editing, suggest the user runs \`align check\` in another terminal to compare the diff
+  against recorded decisions.
+- If the user reports a conflict, follow the recorded decision or confirm with them first.
+`;
+/**
+ * Aider, per session, instructions only (aider 0.86.2, `aider --help`): `--read FILE` loads a
+ * read-only file into the chat, and can be given more than once, so the user's own `--read`
+ * files are kept. It is added even when one of those carries Align's general block (AGENTS.md):
+ * that block tells the model to call MCP tools Aider does not have, and this file corrects it.
+ * The flag goes first, where a user's `--` cannot turn it into a file name.
+ * Nothing else is passed: no `--lint-cmd` (plan Open Question 8), no `--yes-always`.
+ */
+export function buildAiderLaunch(c) {
+    const spec = { bin: 'aider', args: [...c.passthrough], env: { ALIGN_WRAPPED: '1' }, files: [] };
+    return { ...spec, args: ['--read', c.cachePath(FILE), ...c.passthrough], files: [{ name: FILE, content: AIDER_INSTRUCTIONS }] };
+}
+//# sourceMappingURL=aider.js.map

package/dist/lib/launch/adapters/aider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aider.js","sourceRoot":"","sources":["../../../../src/lib/launch/adapters/aider.ts"],"names":[],"mappings":"AAIA,MAAM,IAAI,GAAG,6BAA6B,CAAC;AAE3C;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;;;;;;;;;;;CAWjC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,CAAqB;IACpD,MAAM,IAAI,GAAe,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAC5G,OAAO,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC,EAAE,CAAC;AAClI,CAAC"}

package/dist/lib/launch/adapters/auggie.d.ts

@@ -0,0 +1,18 @@
+import type { AuggieProjectState } from '../auggie-state.js';
+import type { LaunchContext, LaunchSpec } from './claude-code.js';
+export interface AuggieLaunchContext extends Pick<LaunchContext, 'passthrough'>, AuggieProjectState {
+}
+/**
+ * Auggie, written ONCE (auggie 0.36.0): align-local goes into the user settings file under
+ * `mcpServers` through the safe writer, once, with an exact `align use --undo`.
+ *
+ * Not `--mcp-config`, though Auggie has it: its help says it "Overwrites default mcp
+ * configuration in settings.json", and in its bundle the settings servers are not read at all
+ * when the flag is given. The user's own servers would vanish for the session.
+ *
+ * A commented settings file is never rewritten: one line with Auggie's own command instead. No
+ * flag is injected: no `--permission`, no `--allow-indexing`; Auggie's own prompts stay the
+ * user's. Instructions come from AGENTS.md.
+ */
+export declare function buildAuggieLaunch(c: AuggieLaunchContext): LaunchSpec;
+//# sourceMappingURL=auggie.d.ts.map

package/dist/lib/launch/adapters/auggie.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auggie.d.ts","sourceRoot":"","sources":["../../../../src/lib/launch/adapters/auggie.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAE7D,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAElE,MAAM,WAAW,mBAAoB,SAAQ,IAAI,CAAC,aAAa,EAAE,aAAa,CAAC,EAAE,kBAAkB;CAAG;AAItG;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,mBAAmB,GAAG,UAAU,CAgBpE"}

package/dist/lib/launch/adapters/auggie.js

@@ -0,0 +1,34 @@
+import { alignServerEntry } from '../../mcp-setup.js';
+const INJECTED_SERVER_NAME = 'align-local';
+/**
+ * Auggie, written ONCE (auggie 0.36.0): align-local goes into the user settings file under
+ * `mcpServers` through the safe writer, once, with an exact `align use --undo`.
+ *
+ * Not `--mcp-config`, though Auggie has it: its help says it "Overwrites default mcp
+ * configuration in settings.json", and in its bundle the settings servers are not read at all
+ * when the flag is given. The user's own servers would vanish for the session.
+ *
+ * A commented settings file is never rewritten: one line with Auggie's own command instead. No
+ * flag is injected: no `--permission`, no `--allow-indexing`; Auggie's own prompts stay the
+ * user's. Instructions come from AGENTS.md.
+ */
+export function buildAuggieLaunch(c) {
+    const writes = [];
+    const notes = [];
+    if (c.conflict) {
+        notes.push(`${c.conflict} defines its own align-local MCP server, so Align did not add its graph to Auggie. Remove that entry to use the graph.`);
+    }
+    else if (!c.present && c.commented) {
+        notes.push(`${c.settingsFile} has comments or trailing commas, and Align does not rewrite a file it would strip them from. Add the graph yourself: auggie mcp add align-local --command align --args "mcp --env local"`);
+    }
+    else if (!c.present) {
+        writes.push({ kind: 'mcp-entry', file: c.settingsFile, topKey: 'mcpServers', name: INJECTED_SERVER_NAME, entry: alignServerEntry('mcpServers', 'local') });
+    }
+    // The user's own --mcp-config replaces the settings servers for this session (see above), so
+    // whatever is in the settings file, the graph is not loaded. Say so; the file is left as it is.
+    if (c.passthrough.some((a) => a === '--mcp-config' || a.startsWith('--mcp-config='))) {
+        notes.push("--mcp-config replaces the MCP servers in Auggie's settings for this session, so Align's graph is not loaded. Add align-local to that config to use it here.");
+    }
+    return { bin: 'auggie', args: [...c.passthrough], env: { ALIGN_WRAPPED: '1' }, files: [], ...(writes.length > 0 ? { writes } : {}), ...(notes.length > 0 ? { notes } : {}) };
+}
+//# sourceMappingURL=auggie.js.map

package/dist/lib/launch/adapters/auggie.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auggie.js","sourceRoot":"","sources":["../../../../src/lib/launch/adapters/auggie.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAOtD,MAAM,oBAAoB,GAAG,aAAa,CAAC;AAE3C;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAAsB;IACtD,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,wHAAwH,CAAC,CAAC;IACpJ,CAAC;SAAM,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;QACrC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,YAAY,2LAA2L,CAAC,CAAC;IAC3N,CAAC;SAAM,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,gBAAgB,CAAC,YAAY,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7J,CAAC;IACD,6FAA6F;IAC7F,gGAAgG;IAChG,IAAI,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,cAAc,IAAI,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC;QACrF,KAAK,CAAC,IAAI,CAAC,6JAA6J,CAAC,CAAC;IAC5K,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC/K,CAAC"}

package/dist/lib/launch/adapters/cline.d.ts

@@ -0,0 +1,10 @@
+import type { ClineProjectState } from '../cline-state.js';
+import type { LaunchContext, LaunchSpec } from './claude-code.js';
+export interface ClineLaunchContext extends Pick<LaunchContext, 'passthrough'>, ClineProjectState {
+    /** The launcher's environment: the user's own values for the MCP child's env block. */
+    env?: Record<string, string | undefined>;
+    /** The file a launch without the one-session flag would use (for the note). */
+    defaultMcpFile?: string;
+}
+export declare function buildClineLaunch(c: ClineLaunchContext): LaunchSpec;
+//# sourceMappingURL=cline.d.ts.map

package/dist/lib/launch/adapters/cline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cline.d.ts","sourceRoot":"","sources":["../../../../src/lib/launch/adapters/cline.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAG3D,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAElE,MAAM,WAAW,kBAAmB,SAAQ,IAAI,CAAC,aAAa,EAAE,aAAa,CAAC,EAAE,iBAAiB;IAC/F,uFAAuF;IACvF,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC,+EAA+E;IAC/E,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAmBD,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,kBAAkB,GAAG,UAAU,CAkBlE"}

package/dist/lib/launch/adapters/cline.js

@@ -0,0 +1,41 @@
+import { alignServerEntry } from '../../mcp-setup.js';
+import { mcpChildEnv } from '../mcp-child-env.js';
+const INJECTED_SERVER_NAME = 'align-local';
+/**
+ * Cline CLI, written ONCE (cline 3.0.70): align-local goes into its MCP settings file through the
+ * safe writer, once, with an exact `align use --undo`. The flat `{command, args}` entry loads
+ * (checked with `cline config --json`).
+ *
+ * A `--config` or `--data-dir` the user passes picks a directory for that session; align writes
+ * nothing there (a permanent entry in a one-session directory), and says so.
+ *
+ * Not CLINE_MCP_SETTINGS_PATH pointed at a copy: a `cline mcp add` during the session would land
+ * in the copy and be lost. Never `--config`: that directory also holds the user's auth. No flag
+ * is injected, so Cline's own approval settings stay the user's.
+ */
+/** The note names the file the user's own default launch would get. */
+const clineMcpFileDefault = (c) => c.defaultMcpFile ?? c.mcpFile;
+export function buildClineLaunch(c) {
+    const writes = [];
+    const notes = [];
+    if (c.conflict && c.envConflictKey) {
+        notes.push(`${c.conflict}: its align-local entry carries an env value Align did not write (${c.envConflictKey}), so Align did not add its graph to Cline. Remove that entry and Align will add its own.`);
+    }
+    else if (c.conflict) {
+        notes.push(`${c.conflict} defines its own align-local MCP server, so Align did not add its graph to Cline. Remove that entry to use the graph.`);
+    }
+    else if (!c.present && c.oneSession) {
+        const flag = c.passthrough.some((a) => a === '--config' || a.startsWith('--config=')) ? '--config' : '--data-dir';
+        notes.push(`Align does not add its graph to a Cline directory chosen for one session (${flag}). Run cline without it once, or add align-local to ${clineMcpFileDefault(c)} yourself.`);
+    }
+    else if (c.stale && !c.oneSession) {
+        // Align's own entry from an older key set, or with values that changed: rewrite it (backup and undo as for any write).
+        writes.push({ kind: 'mcp-entry', file: c.mcpFile, topKey: 'mcpServers', name: INJECTED_SERVER_NAME, entry: { ...alignServerEntry('mcpServers', 'local'), env: mcpChildEnv(c.env ?? {}) }, replace: true });
+    }
+    else if (!c.present) {
+        // With its env block: Cline's MCP children (spawned by its hub) inherit a repo `.env`.
+        writes.push({ kind: 'mcp-entry', file: c.mcpFile, topKey: 'mcpServers', name: INJECTED_SERVER_NAME, entry: { ...alignServerEntry('mcpServers', 'local'), env: mcpChildEnv(c.env ?? {}) } });
+    }
+    return { bin: 'cline', args: [...c.passthrough], env: { ALIGN_WRAPPED: '1' }, files: [], ...(writes.length > 0 ? { writes } : {}), ...(notes.length > 0 ? { notes } : {}) };
+}
+//# sourceMappingURL=cline.js.map

package/dist/lib/launch/adapters/cline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cline.js","sourceRoot":"","sources":["../../../../src/lib/launch/adapters/cline.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAGtD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAUlD,MAAM,oBAAoB,GAAG,aAAa,CAAC;AAE3C;;;;;;;;;;;GAWG;AACH,uEAAuE;AACvE,MAAM,mBAAmB,GAAG,CAAC,CAAqB,EAAU,EAAE,CAAC,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC,OAAO,CAAC;AAE7F,MAAM,UAAU,gBAAgB,CAAC,CAAqB;IACpD,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,qEAAqE,CAAC,CAAC,cAAc,2FAA2F,CAAC,CAAC;IAC5M,CAAC;SAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,uHAAuH,CAAC,CAAC;IACnJ,CAAC;SAAM,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,UAAU,IAAI,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC;QAClH,KAAK,CAAC,IAAI,CAAC,6EAA6E,IAAI,uDAAuD,mBAAmB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IACzL,CAAC;SAAM,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;QACpC,uHAAuH;QACvH,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,EAAE,GAAG,gBAAgB,CAAC,YAAY,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7M,CAAC;SAAM,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QACtB,uFAAuF;QACvF,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,EAAE,GAAG,gBAAgB,CAAC,YAAY,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9L,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC9K,CAAC"}

package/dist/lib/launch/adapters/continue.d.ts

@@ -0,0 +1,22 @@
+import type { ContinueProjectState } from '../continue-state.js';
+import type { LaunchContext, LaunchSpec } from './claude-code.js';
+export interface ContinueLaunchContext extends Pick<LaunchContext, 'passthrough' | 'cachePath'>, ContinueProjectState {
+    /** The launcher's environment: the user's own values for the MCP child's env block. */
+    env?: Record<string, string | undefined>;
+}
+/**
+ * Continue CLI (`cn`), per session, nothing written to the user's config (cn 1.5.47): `--mcp`
+ * takes a local block when the value is a path (`/`, `.`, `~` or `file://`), and cn merges it into
+ * whatever config it loaded. Verified against a stub model: the request carried the user's server
+ * and align-local. `file://` + the raw path is used because it is the form that also reads a
+ * Windows path: cn's decodePackageIdentifier strips the first 7 characters of a `file://` value and
+ * uses the rest as the path, so `file://C:\\...` gives `C:\\...`. pathToFileURL would give
+ * `file:///C:/...`, which cn decodes to `/C:/...`, a path that does not exist on Windows.
+ *
+ * The flag goes first: `--mcp` is a root option, and cn accepted it in front of a subcommand
+ * (`cn --mcp f ls --help`). When the loaded config.yaml already defines align-local, nothing is
+ * added (canonical: no duplicate; anything else wins over ours, so one line says why). No
+ * `--auto`/`--allow`: cn's own tool policy stays the user's.
+ */
+export declare function buildContinueLaunch(c: ContinueLaunchContext): LaunchSpec;
+//# sourceMappingURL=continue.d.ts.map

package/dist/lib/launch/adapters/continue.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"continue.d.ts","sourceRoot":"","sources":["../../../../src/lib/launch/adapters/continue.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAGjE,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAElE,MAAM,WAAW,qBAAsB,SAAQ,IAAI,CAAC,aAAa,EAAE,aAAa,GAAG,WAAW,CAAC,EAAE,oBAAoB;IACnH,uFAAuF;IACvF,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CAC1C;AAID;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,qBAAqB,GAAG,UAAU,CAyBxE"}

package/dist/lib/launch/adapters/continue.js

@@ -0,0 +1,46 @@
+import { alignServerEntry } from '../../mcp-setup.js';
+import { mcpChildEnv } from '../mcp-child-env.js';
+import { unreadableNote } from './notes.js';
+const FILE = 'continue-align-local.yaml';
+/**
+ * Continue CLI (`cn`), per session, nothing written to the user's config (cn 1.5.47): `--mcp`
+ * takes a local block when the value is a path (`/`, `.`, `~` or `file://`), and cn merges it into
+ * whatever config it loaded. Verified against a stub model: the request carried the user's server
+ * and align-local. `file://` + the raw path is used because it is the form that also reads a
+ * Windows path: cn's decodePackageIdentifier strips the first 7 characters of a `file://` value and
+ * uses the rest as the path, so `file://C:\\...` gives `C:\\...`. pathToFileURL would give
+ * `file:///C:/...`, which cn decodes to `/C:/...`, a path that does not exist on Windows.
+ *
+ * The flag goes first: `--mcp` is a root option, and cn accepted it in front of a subcommand
+ * (`cn --mcp f ls --help`). When the loaded config.yaml already defines align-local, nothing is
+ * added (canonical: no duplicate; anything else wins over ours, so one line says why). No
+ * `--auto`/`--allow`: cn's own tool policy stays the user's.
+ */
+export function buildContinueLaunch(c) {
+    const spec = { bin: 'cn', args: [...c.passthrough], env: { ALIGN_WRAPPED: '1' }, files: [] };
+    if (c.unreadable) {
+        return { ...spec, notes: [unreadableNote(c.unreadable)] };
+    }
+    if (c.conflict) {
+        return { ...spec, notes: [`${c.conflict} defines its own align-local MCP server, so Align did not add its graph to Continue CLI. Remove that entry to use the graph.`] };
+    }
+    if (c.present)
+        return spec;
+    const { command, args } = alignServerEntry('mcpServers', 'local');
+    const content = [
+        'name: align-local',
+        'version: 0.0.1',
+        'schema: v1',
+        'mcpServers:',
+        '  - name: align-local',
+        `    command: ${JSON.stringify(command)}`,
+        `    args: [${args.map((a) => JSON.stringify(a)).join(', ')}]`,
+        // cn spawns its MCP servers with its own environment, repo `.env` included: name every
+        // variable align reads (JSON-quoted values are valid YAML scalars).
+        '    env:',
+        ...Object.entries(mcpChildEnv(c.env ?? {})).map(([k, v]) => `      ${k}: ${JSON.stringify(v)}`),
+        '',
+    ].join('\n');
+    return { ...spec, args: ['--mcp', `file://${c.cachePath(FILE)}`, ...c.passthrough], files: [{ name: FILE, content }] };
+}
+//# sourceMappingURL=continue.js.map

package/dist/lib/launch/adapters/continue.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"continue.js","sourceRoot":"","sources":["../../../../src/lib/launch/adapters/continue.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAQ5C,MAAM,IAAI,GAAG,2BAA2B,CAAC;AAEzC;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB,CAAC,CAAwB;IAC1D,MAAM,IAAI,GAAe,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IACzG,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;QACjB,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;IAC5D,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QACf,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,8HAA8H,CAAC,EAAE,CAAC;IAC3K,CAAC;IACD,IAAI,CAAC,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,gBAAgB,CAAC,YAAY,EAAE,OAAO,CAAwC,CAAC;IACzG,MAAM,OAAO,GAAG;QACd,mBAAmB;QACnB,gBAAgB;QAChB,YAAY;QACZ,aAAa;QACb,uBAAuB;QACvB,gBAAgB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE;QACzC,cAAc,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;QAC9D,uFAAuF;QACvF,oEAAoE;QACpE,UAAU;QACV,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/F,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,OAAO,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;AACzH,CAAC"}

package/dist/lib/launch/adapters/gemini-cli.d.ts

@@ -1,24 +1,23 @@
 import { type GeminiProjectState } from '../gemini-state.js';
 import type { LaunchContext, LaunchSpec } from './claude-code.js';
 export interface GeminiLaunchContext extends Pick<LaunchContext, 'passthrough' | 'cachePath'>, GeminiProjectState {
-    /** The environment the child will inherit: the user's own GEMINI_CLI_* are read from here. */
-    env: Record<string, string | undefined>;
-    platform: string;
 }
 export declare const GEMINI_TRUST_NOTE = "Gemini turns off MCP servers, Align's included, in folders you haven't trusted. Trust this folder in Gemini to use the graph here.";
 /**
- * Gemini CLI, per session, nothing written to the user's own config (gemini 0.58.0):
- * GEMINI_CLI_SYSTEM_SETTINGS_PATH names the system settings file, and Gemini MERGES its
- * mcpServers with the user's (verified: `gemini mcp list` shows both). That variable REPLACES
- * the system file Gemini would otherwise read (the user's own value, or the platform default an
- * admin may have filled), so align points it at a COPY of that file with align-local added,
- * never at a file of align's alone. Gemini also derives system-defaults.json from that file's
- * directory, so the original location is pinned with GEMINI_CLI_SYSTEM_DEFAULTS_PATH unless the
- * user set it. A system file align cannot read or parse is never replaced: no injection, and
- * one line saying why (the same rule as OpenCode's OPENCODE_CONFIG_CONTENT).
+ * Gemini CLI, written ONCE (gemini 0.63.0): the `align-local` entry goes into the user's
+ * settings file by the safe writer, with a backup and an exact `align use --undo`.
  *
- * Trust: Gemini turns off every MCP server in a folder it does not trust. align says so in one
- * line and never trusts a folder for the user (no --skip-trust, no GEMINI_CLI_TRUST_WORKSPACE).
+ * Not per session. The first design pointed GEMINI_CLI_SYSTEM_SETTINGS_PATH at a copy in the
+ * launch cache, and Gemini 0.63.0 skips any system settings file unless the file and every
+ * directory above it is root-owned and not group/other writable (gemini-system-file.ts), so
+ * Gemini users got no graph and only Gemini's own warning as a clue. A per-session
+ * GEMINI_CLI_HOME was rejected too: it would have to mirror the user's whole ~/.gemini (oauth
+ * credentials, history, trusted folders, extensions) and anything Gemini writes there during
+ * the session, a changed theme or a first login, would be lost with the session directory.
+ *
+ * Nothing else changes: no flags, no GEMINI_CLI_* variable (so a repo .env cannot substitute
+ * one either), no --skip-trust. Trust: Gemini turns off every MCP server in a folder it does
+ * not trust. align says so in one line and never trusts a folder for the user.
  * Instructions come from the managed GEMINI.md block. Pass-through args are the whole of the args.
  */
 export declare function buildGeminiLaunch(c: GeminiLaunchContext): LaunchSpec;

package/dist/lib/launch/adapters/gemini-cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gemini-cli.d.ts","sourceRoot":"","sources":["../../../../src/lib/launch/adapters/gemini-cli.ts"],"names":[],"mappings":"AACA,OAAO,EAA+B,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAG1F,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAElE,MAAM,WAAW,mBAAoB,SAAQ,IAAI,CAAC,aAAa,EAAE,aAAa,GAAG,WAAW,CAAC,EAAE,kBAAkB;IAC/G,8FAA8F;IAC9F,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACxC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAKD,eAAO,MAAM,iBAAiB,uIAAuI,CAAC;AActK;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,mBAAmB,GAAG,UAAU,CAkCpE"}
+{"version":3,"file":"gemini-cli.d.ts","sourceRoot":"","sources":["../../../../src/lib/launch/adapters/gemini-cli.ts"],"names":[],"mappings":"AAEA,OAAO,EAAe,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAElE,MAAM,WAAW,mBAAoB,SAAQ,IAAI,CAAC,aAAa,EAAE,aAAa,GAAG,WAAW,CAAC,EAAE,kBAAkB;CAAG;AAKpH,eAAO,MAAM,iBAAiB,uIAAuI,CAAC;AAEtK;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,mBAAmB,GAAG,UAAU,CAgCpE"}