@caddis/cli 0.4.75 → 0.4.77

package/dist/cli.js

@@ -51,8 +51,8 @@ var require_error = __commonJS({
        * @param {string} code an id string representing the error
        * @param {string} message human-readable description of the error
        */
-      constructor(exitCode, code, message) {
-        super(message);
+      constructor(exitCode, code, message3) {
+        super(message3);
         Error.captureStackTrace(this, this.constructor);
         this.name = this.constructor.name;
         this.code = code;
@@ -65,8 +65,8 @@ var require_error = __commonJS({
        * Constructs the InvalidArgumentError class
        * @param {string} [message] explanation of why argument is invalid
        */
-      constructor(message) {
-        super(1, "commander.invalidArgument", message);
+      constructor(message3) {
+        super(1, "commander.invalidArgument", message3);
         Error.captureStackTrace(this, this.constructor);
         this.name = this.constructor.name;
       }
@@ -639,8 +639,8 @@ var require_help = __commonJS({
        * @param {string} str
        * @returns {number}
        */
-      displayWidth(str) {
-        return stripColor(str).length;
+      displayWidth(str3) {
+        return stripColor(str3).length;
       }
       /**
        * Style the title for displaying in the help. Called with 'Usage:', 'Options:', etc.
@@ -648,11 +648,11 @@ var require_help = __commonJS({
        * @param {string} str
        * @returns {string}
        */
-      styleTitle(str) {
-        return str;
+      styleTitle(str3) {
+        return str3;
       }
-      styleUsage(str) {
-        return str.split(" ").map((word) => {
+      styleUsage(str3) {
+        return str3.split(" ").map((word) => {
           if (word === "[options]") return this.styleOptionText(word);
           if (word === "[command]") return this.styleSubcommandText(word);
           if (word[0] === "[" || word[0] === "<")
@@ -660,46 +660,46 @@ var require_help = __commonJS({
           return this.styleCommandText(word);
         }).join(" ");
       }
-      styleCommandDescription(str) {
-        return this.styleDescriptionText(str);
+      styleCommandDescription(str3) {
+        return this.styleDescriptionText(str3);
       }
-      styleOptionDescription(str) {
-        return this.styleDescriptionText(str);
+      styleOptionDescription(str3) {
+        return this.styleDescriptionText(str3);
       }
-      styleSubcommandDescription(str) {
-        return this.styleDescriptionText(str);
+      styleSubcommandDescription(str3) {
+        return this.styleDescriptionText(str3);
       }
-      styleArgumentDescription(str) {
-        return this.styleDescriptionText(str);
+      styleArgumentDescription(str3) {
+        return this.styleDescriptionText(str3);
       }
-      styleDescriptionText(str) {
-        return str;
+      styleDescriptionText(str3) {
+        return str3;
       }
-      styleOptionTerm(str) {
-        return this.styleOptionText(str);
+      styleOptionTerm(str3) {
+        return this.styleOptionText(str3);
       }
-      styleSubcommandTerm(str) {
-        return str.split(" ").map((word) => {
+      styleSubcommandTerm(str3) {
+        return str3.split(" ").map((word) => {
           if (word === "[options]") return this.styleOptionText(word);
           if (word[0] === "[" || word[0] === "<")
             return this.styleArgumentText(word);
           return this.styleSubcommandText(word);
         }).join(" ");
       }
-      styleArgumentTerm(str) {
-        return this.styleArgumentText(str);
+      styleArgumentTerm(str3) {
+        return this.styleArgumentText(str3);
       }
-      styleOptionText(str) {
-        return str;
+      styleOptionText(str3) {
+        return str3;
       }
-      styleArgumentText(str) {
-        return str;
+      styleArgumentText(str3) {
+        return str3;
       }
-      styleSubcommandText(str) {
-        return str;
+      styleSubcommandText(str3) {
+        return str3;
       }
-      styleCommandText(str) {
-        return str;
+      styleCommandText(str3) {
+        return str3;
       }
       /**
        * Calculate the pad width from the maximum term length.
@@ -722,8 +722,8 @@ var require_help = __commonJS({
        * @param {string} str
        * @returns {boolean}
        */
-      preformatted(str) {
-        return /\n[^\S\r\n]/.test(str);
+      preformatted(str3) {
+        return /\n[^\S\r\n]/.test(str3);
       }
       /**
        * Format the "item", which consists of a term and description. Pad the term and wrap the description, indenting the following lines.
@@ -769,9 +769,9 @@ ${itemIndentStr}`);
        * @param {number} width
        * @returns {string}
        */
-      boxWrap(str, width) {
-        if (width < this.minWidthToWrap) return str;
-        const rawLines = str.split(/\r\n|\n/);
+      boxWrap(str3, width) {
+        if (width < this.minWidthToWrap) return str3;
+        const rawLines = str3.split(/\r\n|\n/);
         const chunkPattern = /[\s]*[^\s]+/g;
         const wrappedLines = [];
         rawLines.forEach((line2) => {
@@ -799,9 +799,9 @@ ${itemIndentStr}`);
         return wrappedLines.join("\n");
       }
     };
-    function stripColor(str) {
+    function stripColor(str3) {
       const sgrPattern = /\x1b\[\d*(;\d*)*m/g;
-      return str.replace(sgrPattern, "");
+      return str3.replace(sgrPattern, "");
     }
     exports.Help = Help2;
     exports.stripColor = stripColor;
@@ -1073,9 +1073,9 @@ var require_option = __commonJS({
         return option.negate === (negativeValue === value);
       }
     };
-    function camelcase(str) {
-      return str.split("-").reduce((str2, word) => {
-        return str2 + word[0].toUpperCase() + word.slice(1);
+    function camelcase(str3) {
+      return str3.split("-").reduce((str4, word) => {
+        return str4 + word[0].toUpperCase() + word.slice(1);
       });
     }
     function splitOptionFlags(flags) {
@@ -1209,7 +1209,7 @@ var require_command = __commonJS({
     "use strict";
     var EventEmitter = __require("events").EventEmitter;
     var childProcess = __require("child_process");
-    var path7 = __require("path");
+    var path19 = __require("path");
     var fs = __require("fs");
     var process3 = __require("process");
     var { Argument: Argument2, humanReadableArgName } = require_argument();
@@ -1258,14 +1258,14 @@ var require_command = __commonJS({
         this._showSuggestionAfterError = true;
         this._savedState = null;
         this._outputConfiguration = {
-          writeOut: (str) => process3.stdout.write(str),
-          writeErr: (str) => process3.stderr.write(str),
-          outputError: (str, write) => write(str),
+          writeOut: (str3) => process3.stdout.write(str3),
+          writeErr: (str3) => process3.stderr.write(str3),
+          outputError: (str3, write) => write(str3),
           getOutHelpWidth: () => process3.stdout.isTTY ? process3.stdout.columns : void 0,
           getErrHelpWidth: () => process3.stderr.isTTY ? process3.stderr.columns : void 0,
           getOutHasColors: () => useColor() ?? (process3.stdout.isTTY && process3.stdout.hasColors?.()),
           getErrHasColors: () => useColor() ?? (process3.stderr.isTTY && process3.stderr.hasColors?.()),
-          stripColor: (str) => stripColor(str)
+          stripColor: (str3) => stripColor(str3)
         };
         this._hidden = false;
         this._helpOption = void 0;
@@ -1654,9 +1654,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @return never
        * @private
        */
-      _exit(exitCode, code, message) {
+      _exit(exitCode, code, message3) {
         if (this._exitCallback) {
-          this._exitCallback(new CommanderError2(exitCode, code, message));
+          this._exitCallback(new CommanderError2(exitCode, code, message3));
         }
         process3.exit(exitCode);
       }
@@ -1716,8 +1716,8 @@ Expecting one of '${allowedValues.join("', '")}'`);
           return target.parseArg(value, previous);
         } catch (err) {
           if (err.code === "commander.invalidArgument") {
-            const message = `${invalidArgumentMessage} ${err.message}`;
-            this.error(message, { exitCode: err.exitCode, code: err.code });
+            const message3 = `${invalidArgumentMessage} ${err.message}`;
+            this.error(message3, { exitCode: err.exitCode, code: err.code });
           }
           throw err;
         }
@@ -2222,9 +2222,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
         let launchWithNode = false;
         const sourceExt = [".js", ".ts", ".tsx", ".mjs", ".cjs"];
         function findFile(baseDir, baseName) {
-          const localBin = path7.resolve(baseDir, baseName);
+          const localBin = path19.resolve(baseDir, baseName);
           if (fs.existsSync(localBin)) return localBin;
-          if (sourceExt.includes(path7.extname(baseName))) return void 0;
+          if (sourceExt.includes(path19.extname(baseName))) return void 0;
           const foundExt = sourceExt.find(
             (ext) => fs.existsSync(`${localBin}${ext}`)
           );
@@ -2242,17 +2242,17 @@ Expecting one of '${allowedValues.join("', '")}'`);
           } catch {
             resolvedScriptPath = this._scriptPath;
           }
-          executableDir = path7.resolve(
-            path7.dirname(resolvedScriptPath),
+          executableDir = path19.resolve(
+            path19.dirname(resolvedScriptPath),
             executableDir
           );
         }
         if (executableDir) {
           let localFile = findFile(executableDir, executableFile);
           if (!localFile && !subcommand._executableFile && this._scriptPath) {
-            const legacyName = path7.basename(
+            const legacyName = path19.basename(
               this._scriptPath,
-              path7.extname(this._scriptPath)
+              path19.extname(this._scriptPath)
             );
             if (legacyName !== this._name) {
               localFile = findFile(
@@ -2263,7 +2263,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
           }
           executableFile = localFile || executableFile;
         }
-        launchWithNode = sourceExt.includes(path7.extname(executableFile));
+        launchWithNode = sourceExt.includes(path19.extname(executableFile));
         let proc;
         if (process3.platform !== "win32") {
           if (launchWithNode) {
@@ -2793,9 +2793,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @param {string} [errorOptions.code] - an id string representing the error
        * @param {number} [errorOptions.exitCode] - used with process.exit
        */
-      error(message, errorOptions) {
+      error(message3, errorOptions) {
         this._outputConfiguration.outputError(
-          `${message}
+          `${message3}
 `,
           this._outputConfiguration.writeErr
         );
@@ -2809,7 +2809,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
         const config = errorOptions || {};
         const exitCode = config.exitCode || 1;
         const code = config.code || "commander.error";
-        this._exit(exitCode, code, message);
+        this._exit(exitCode, code, message3);
       }
       /**
        * Apply any option related environment variables, if option does
@@ -2865,8 +2865,8 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @private
        */
       missingArgument(name) {
-        const message = `error: missing required argument '${name}'`;
-        this.error(message, { code: "commander.missingArgument" });
+        const message3 = `error: missing required argument '${name}'`;
+        this.error(message3, { code: "commander.missingArgument" });
       }
       /**
        * `Option` is missing an argument.
@@ -2875,8 +2875,8 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @private
        */
       optionMissingArgument(option) {
-        const message = `error: option '${option.flags}' argument missing`;
-        this.error(message, { code: "commander.optionMissingArgument" });
+        const message3 = `error: option '${option.flags}' argument missing`;
+        this.error(message3, { code: "commander.optionMissingArgument" });
       }
       /**
        * `Option` does not have a value, and is a mandatory option.
@@ -2885,8 +2885,8 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @private
        */
       missingMandatoryOptionValue(option) {
-        const message = `error: required option '${option.flags}' not specified`;
-        this.error(message, { code: "commander.missingMandatoryOptionValue" });
+        const message3 = `error: required option '${option.flags}' not specified`;
+        this.error(message3, { code: "commander.missingMandatoryOptionValue" });
       }
       /**
        * `Option` conflicts with another option.
@@ -2919,8 +2919,8 @@ Expecting one of '${allowedValues.join("', '")}'`);
           }
           return `option '${bestOption.flags}'`;
         };
-        const message = `error: ${getErrorMessage(option)} cannot be used with ${getErrorMessage(conflictingOption)}`;
-        this.error(message, { code: "commander.conflictingOption" });
+        const message3 = `error: ${getErrorMessage(option)} cannot be used with ${getErrorMessage(conflictingOption)}`;
+        this.error(message3, { code: "commander.conflictingOption" });
       }
       /**
        * Unknown option `flag`.
@@ -2941,8 +2941,8 @@ Expecting one of '${allowedValues.join("', '")}'`);
           } while (command && !command._enablePositionalOptions);
           suggestion = suggestSimilar(flag, candidateFlags);
         }
-        const message = `error: unknown option '${flag}'${suggestion}`;
-        this.error(message, { code: "commander.unknownOption" });
+        const message3 = `error: unknown option '${flag}'${suggestion}`;
+        this.error(message3, { code: "commander.unknownOption" });
       }
       /**
        * Excess arguments, more than expected.
@@ -2955,8 +2955,8 @@ Expecting one of '${allowedValues.join("', '")}'`);
         const expected = this.registeredArguments.length;
         const s = expected === 1 ? "" : "s";
         const forSubcommand = this.parent ? ` for '${this.name()}'` : "";
-        const message = `error: too many arguments${forSubcommand}. Expected ${expected} argument${s} but got ${receivedArgs.length}.`;
-        this.error(message, { code: "commander.excessArguments" });
+        const message3 = `error: too many arguments${forSubcommand}. Expected ${expected} argument${s} but got ${receivedArgs.length}.`;
+        this.error(message3, { code: "commander.excessArguments" });
       }
       /**
        * Unknown command.
@@ -2974,8 +2974,8 @@ Expecting one of '${allowedValues.join("', '")}'`);
           });
           suggestion = suggestSimilar(unknownName, candidateNames);
         }
-        const message = `error: unknown command '${unknownName}'${suggestion}`;
-        this.error(message, { code: "commander.unknownCommand" });
+        const message3 = `error: unknown command '${unknownName}'${suggestion}`;
+        this.error(message3, { code: "commander.unknownCommand" });
       }
       /**
        * Get or set the program version.
@@ -2989,18 +2989,18 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @param {string} [description]
        * @return {(this | string | undefined)} `this` command for chaining, or version string if no arguments
        */
-      version(str, flags, description) {
-        if (str === void 0) return this._version;
-        this._version = str;
+      version(str3, flags, description) {
+        if (str3 === void 0) return this._version;
+        this._version = str3;
         flags = flags || "-V, --version";
         description = description || "output the version number";
         const versionOption = this.createOption(flags, description);
         this._versionOptionName = versionOption.attributeName();
         this._registerOption(versionOption);
         this.on("option:" + versionOption.name(), () => {
-          this._outputConfiguration.writeOut(`${str}
+          this._outputConfiguration.writeOut(`${str3}
 `);
-          this._exit(0, "commander.version", str);
+          this._exit(0, "commander.version", str3);
         });
         return this;
       }
@@ -3011,10 +3011,10 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @param {object} [argsDescription]
        * @return {(string|Command)}
        */
-      description(str, argsDescription) {
-        if (str === void 0 && argsDescription === void 0)
+      description(str3, argsDescription) {
+        if (str3 === void 0 && argsDescription === void 0)
           return this._description;
-        this._description = str;
+        this._description = str3;
         if (argsDescription) {
           this._argsDescription = argsDescription;
         }
@@ -3026,9 +3026,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @param {string} [str]
        * @return {(string|Command)}
        */
-      summary(str) {
-        if (str === void 0) return this._summary;
-        this._summary = str;
+      summary(str3) {
+        if (str3 === void 0) return this._summary;
+        this._summary = str3;
         return this;
       }
       /**
@@ -3076,8 +3076,8 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @param {string} [str]
        * @return {(string|Command)}
        */
-      usage(str) {
-        if (str === void 0) {
+      usage(str3) {
+        if (str3 === void 0) {
           if (this._usage) return this._usage;
           const args = this.registeredArguments.map((arg) => {
             return humanReadableArgName(arg);
@@ -3088,7 +3088,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
             this.registeredArguments.length ? args : []
           ).join(" ");
         }
-        this._usage = str;
+        this._usage = str3;
         return this;
       }
       /**
@@ -3097,9 +3097,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @param {string} [str]
        * @return {(string|Command)}
        */
-      name(str) {
-        if (str === void 0) return this._name;
-        this._name = str;
+      name(str3) {
+        if (str3 === void 0) return this._name;
+        this._name = str3;
         return this;
       }
       /**
@@ -3178,7 +3178,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @return {Command}
        */
       nameFromFilename(filename) {
-        this._name = path7.basename(filename, path7.extname(filename));
+        this._name = path19.basename(filename, path19.extname(filename));
         return this;
       }
       /**
@@ -3192,9 +3192,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @param {string} [path]
        * @return {(string|null|Command)}
        */
-      executableDir(path8) {
-        if (path8 === void 0) return this._executableDir;
-        this._executableDir = path8;
+      executableDir(path20) {
+        if (path20 === void 0) return this._executableDir;
+        this._executableDir = path20;
         return this;
       }
       /**
@@ -3233,17 +3233,17 @@ Expecting one of '${allowedValues.join("', '")}'`);
         let hasColors;
         let helpWidth;
         if (error) {
-          baseWrite = (str) => this._outputConfiguration.writeErr(str);
+          baseWrite = (str3) => this._outputConfiguration.writeErr(str3);
           hasColors = this._outputConfiguration.getErrHasColors();
           helpWidth = this._outputConfiguration.getErrHelpWidth();
         } else {
-          baseWrite = (str) => this._outputConfiguration.writeOut(str);
+          baseWrite = (str3) => this._outputConfiguration.writeOut(str3);
           hasColors = this._outputConfiguration.getOutHasColors();
           helpWidth = this._outputConfiguration.getOutHelpWidth();
         }
-        const write = (str) => {
-          if (!hasColors) str = this._outputConfiguration.stripColor(str);
-          return baseWrite(str);
+        const write = (str3) => {
+          if (!hasColors) str3 = this._outputConfiguration.stripColor(str3);
+          return baseWrite(str3);
         };
         return { error, write, hasColors, helpWidth };
       }
@@ -4874,10 +4874,10 @@ function keysFilePath(env) {
   const expanded = expandHome(configured);
   return isAbsolute(expanded) ? expanded : expanded;
 }
-function parseKeysFile(path7) {
+function parseKeysFile(path19) {
   let text;
   try {
-    text = readFileSync3(path7, "utf8");
+    text = readFileSync3(path19, "utf8");
   } catch {
     return {};
   }
@@ -4959,8 +4959,8 @@ async function probeKey(baseUrl, model, apiKey) {
     }
     return { ok: false, rejected: false, detail: `could not validate (HTTP ${res.status})` };
   } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    return { ok: false, rejected: false, detail: `could not validate (${message})` };
+    const message3 = error instanceof Error ? error.message : String(error);
+    return { ok: false, rejected: false, detail: `could not validate (${message3})` };
   } finally {
     clearTimeout(timer);
   }
@@ -4989,18 +4989,18 @@ function upsertKeyLines(existing, updates) {
   if (!text.endsWith("\n")) text += "\n";
   return text;
 }
-function restrictPermissions(path7) {
+function restrictPermissions(path19) {
   if (process.platform === "win32") return null;
   try {
-    chmodSync(path7, 384);
+    chmodSync(path19, 384);
     return null;
   } catch (error) {
     return error instanceof Error ? error.message : String(error);
   }
 }
 async function keys(options = {}) {
-  const path7 = keysFilePath(process.env);
-  const fileKeys = parseKeysFile(path7);
+  const path19 = keysFilePath(process.env);
+  const fileKeys = parseKeysFile(path19);
   const names = Object.keys(PROVIDERS).sort();
   const current = names.map((name) => {
     const preset = PROVIDERS[name];
@@ -5016,7 +5016,7 @@ async function keys(options = {}) {
   if (options.check) {
     const configured = current.filter((entry) => entry.value);
     if (!configured.length) {
-      process.stdout.write(`no provider keys configured (looked in $ENV and ${path7})
+      process.stdout.write(`no provider keys configured (looked in $ENV and ${path19})
 `);
       return 1;
     }
@@ -5031,7 +5031,7 @@ async function keys(options = {}) {
     return bad ? 1 : 0;
   }
   Ie("caddis keys");
-  process.stdout.write(`  keys file: ${path7}
+  process.stdout.write(`  keys file: ${path19}
 
 `);
   for (const entry of current) {
@@ -5091,20 +5091,20 @@ async function keys(options = {}) {
     return 0;
   }
   if (options.dryRun) {
-    Se(`dry run \u2014 would write ${Object.keys(collected).join(", ")} to ${path7}`);
+    Se(`dry run \u2014 would write ${Object.keys(collected).join(", ")} to ${path19}`);
     return 0;
   }
   let existing = "";
   try {
-    existing = readFileSync4(path7, "utf8");
+    existing = readFileSync4(path19, "utf8");
   } catch {
     existing = "";
   }
-  mkdirSync2(dirname(path7), { recursive: true });
-  writeFileSync(path7, upsertKeyLines(existing, collected), { encoding: "utf8" });
-  const permWarning = restrictPermissions(path7);
+  mkdirSync2(dirname(path19), { recursive: true });
+  writeFileSync(path19, upsertKeyLines(existing, collected), { encoding: "utf8" });
+  const permWarning = restrictPermissions(path19);
   process.stdout.write(`
-  wrote ${Object.keys(collected).join(", ")} to ${path7}
+  wrote ${Object.keys(collected).join(", ")} to ${path19}
 `);
   if (permWarning) process.stdout.write(color.yellow(`  could not set 0600 on the keys file: ${permWarning}
 `));
@@ -5707,6 +5707,2568 @@ var init_status = __esm({
   }
 });
 
+// src/hub/paths.ts
+import path7 from "path";
+function hubDir(home = caddisHome()) {
+  return path7.join(home, ".caddis", "hub");
+}
+var configPath, registryPath, keyPath, lockPath;
+var init_paths = __esm({
+  "src/hub/paths.ts"() {
+    "use strict";
+    init_sessions();
+    configPath = (home) => path7.join(hubDir(home), "config.json");
+    registryPath = (home) => path7.join(hubDir(home), "repos.json");
+    keyPath = (home) => path7.join(hubDir(home), "key");
+    lockPath = (home) => path7.join(hubDir(home), "hub.lock");
+  }
+});
+
+// src/hub/autostart.ts
+import { existsSync as existsSync6, mkdirSync as mkdirSync3, rmSync as rmSync3, writeFileSync as writeFileSync2 } from "fs";
+import path8 from "path";
+function buildVbs(node, entry) {
+  const q2 = (s) => `""${s.replace(/"/g, '""""')}""`;
+  return `CreateObject("WScript.Shell").Run "${q2(node)} ${q2(entry)} hub serve", 0, False\r
+`;
+}
+function schtasksCreateArgs(vbs) {
+  return ["/Create", "/SC", "ONLOGON", "/RL", "LIMITED", "/TN", TASK_NAME, "/TR", `wscript.exe "${vbs}"`, "/F"];
+}
+function buildPlist(node, entry) {
+  const args = [node, entry, "hub", "serve"].map((a) => `    <string>${xml(a)}</string>`).join("\n");
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>${MAC_LABEL}</string>
+  <key>ProgramArguments</key>
+  <array>
+${args}
+  </array>
+  <key>RunAtLoad</key>
+  <true/>
+</dict>
+</plist>
+`;
+}
+function desktopArg(a) {
+  const escaped = a.replace(/([`$"\\])/g, "\\$1").replace(/%/g, "%%");
+  return `"${escaped.replace(/\\/g, "\\\\")}"`;
+}
+function buildDesktop(node, entry) {
+  const exec = [node, entry, "hub", "serve"].map(desktopArg).join(" ");
+  return `[Desktop Entry]
+Type=Application
+Name=caddis hub
+Exec=${exec}
+X-GNOME-Autostart-enabled=true
+NoDisplay=true
+`;
+}
+function writeText(file, text) {
+  mkdirSync3(path8.dirname(file), { recursive: true });
+  writeFileSync2(file, text, "utf8");
+}
+async function enableAutostart(deps = {}) {
+  const home = deps.home ?? caddisHome();
+  const node = deps.node ?? process.execPath;
+  const rawEntry = deps.entry ?? process.argv[1];
+  if (!rawEntry) return { ok: false, message: "cannot find the caddis CLI entry script" };
+  const entry = path8.resolve(rawEntry);
+  const runCmd = deps.runCmd ?? defaultRun;
+  const kind = kindOf(deps.platform ?? process.platform);
+  if (kind === "win") {
+    const vbs = vbsPath(home);
+    writeText(vbs, buildVbs(node, entry));
+    const r2 = await runCmd("schtasks", schtasksCreateArgs(vbs));
+    return r2.ok ? { ok: true, message: `caddis hub autostart enabled (logon task ${TASK_NAME})` } : { ok: false, message: `schtasks /Create failed (exit ${r2.code})` };
+  }
+  if (kind === "mac") {
+    const file2 = plistPath(home);
+    writeText(file2, buildPlist(node, entry));
+    const r2 = await runCmd("launchctl", ["load", "-w", file2]);
+    return r2.ok ? { ok: true, message: `caddis hub autostart enabled (${file2})` } : { ok: false, message: `launchctl load failed (exit ${r2.code})` };
+  }
+  const file = desktopPath(home);
+  writeText(file, buildDesktop(node, entry));
+  return { ok: true, message: `caddis hub autostart enabled (${file})` };
+}
+async function disableAutostart(deps = {}) {
+  const home = deps.home ?? caddisHome();
+  const runCmd = deps.runCmd ?? defaultRun;
+  const kind = kindOf(deps.platform ?? process.platform);
+  if (kind === "win") {
+    const r2 = await runCmd("schtasks", schtasksDeleteArgs());
+    rmSync3(vbsPath(home), { force: true });
+    return r2.ok ? { ok: true, message: "caddis hub autostart disabled" } : { ok: true, message: "caddis hub autostart was not enabled (no logon task to delete)" };
+  }
+  if (kind === "mac") {
+    const file = plistPath(home);
+    if (existsSync6(file)) await runCmd("launchctl", ["unload", "-w", file]);
+    rmSync3(file, { force: true });
+    return { ok: true, message: "caddis hub autostart disabled" };
+  }
+  rmSync3(desktopPath(home), { force: true });
+  return { ok: true, message: "caddis hub autostart disabled" };
+}
+async function autostartStatus(deps = {}) {
+  const home = deps.home ?? caddisHome();
+  const runCmd = deps.runCmd ?? defaultRun;
+  const kind = kindOf(deps.platform ?? process.platform);
+  const enabled = kind === "win" ? (await runCmd("schtasks", schtasksQueryArgs())).ok : existsSync6(kind === "mac" ? plistPath(home) : desktopPath(home));
+  return { ok: enabled, message: enabled ? "caddis hub autostart is enabled" : "caddis hub autostart is not enabled" };
+}
+var TASK_NAME, MAC_LABEL, CMD_TIMEOUT_MS, vbsPath, schtasksDeleteArgs, schtasksQueryArgs, xml, plistPath, desktopPath, defaultRun, kindOf;
+var init_autostart = __esm({
+  "src/hub/autostart.ts"() {
+    "use strict";
+    init_exec();
+    init_sessions();
+    init_paths();
+    TASK_NAME = "caddis-hub";
+    MAC_LABEL = "dev.caddis.hub";
+    CMD_TIMEOUT_MS = 3e4;
+    vbsPath = (home) => path8.join(hubDir(home), "autostart.vbs");
+    schtasksDeleteArgs = () => ["/Delete", "/TN", TASK_NAME, "/F"];
+    schtasksQueryArgs = () => ["/Query", "/TN", TASK_NAME];
+    xml = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+    plistPath = (home) => path8.join(home, "Library", "LaunchAgents", `${MAC_LABEL}.plist`);
+    desktopPath = (home) => path8.join(home, ".config", "autostart", `${TASK_NAME}.desktop`);
+    defaultRun = async (cmd, args) => {
+      const r2 = await run(cmd, args, { timeout: CMD_TIMEOUT_MS });
+      return { ok: r2.ok, code: r2.code };
+    };
+    kindOf = (p2) => p2 === "win32" ? "win" : p2 === "darwin" ? "mac" : "linux";
+  }
+});
+
+// src/hub/config.ts
+import { mkdirSync as mkdirSync4, readFileSync as readFileSync6, renameSync as renameSync2, unlinkSync, writeFileSync as writeFileSync3 } from "fs";
+import path9 from "path";
+import { randomBytes } from "crypto";
+function defaultConfig() {
+  return { schema: 1, port: DEFAULT_PORT, accounts: {}, pinned: [], hidden: [] };
+}
+function defaultRegistry() {
+  return { schema: 1, repos: [] };
+}
+function sleepSync(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+function renameWithRetry(from, to) {
+  const retryable = /* @__PURE__ */ new Set(["EPERM", "EBUSY", "EACCES"]);
+  const attempts = isWin() ? 6 : 1;
+  for (let i = 0; ; i++) {
+    try {
+      renameSync2(from, to);
+      return;
+    } catch (e2) {
+      const code = e2.code ?? "";
+      if (i + 1 >= attempts || !retryable.has(code)) throw e2;
+      sleepSync(15 * 2 ** i);
+    }
+  }
+}
+function writeJsonAtomic(file, data) {
+  mkdirSync4(path9.dirname(file), { recursive: true, mode: 448 });
+  const tmp = `${file}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`;
+  try {
+    writeFileSync3(tmp, JSON.stringify(data, null, 2) + "\n", { mode: 384 });
+    renameWithRetry(tmp, file);
+  } catch (e2) {
+    try {
+      unlinkSync(tmp);
+    } catch {
+    }
+    throw e2;
+  }
+}
+function readJson(file, normalize, fallback) {
+  let text;
+  try {
+    text = readFileSync6(file, "utf8");
+  } catch (e2) {
+    if (e2.code === "ENOENT") {
+      const good = lastGood.get(file);
+      return { value: good ?? fallback() };
+    }
+    return failure(file, fallback, `cannot read ${path9.basename(file)}: ${e2.message}`);
+  }
+  try {
+    const value = normalize(JSON.parse(text));
+    lastGood.set(file, value);
+    return { value };
+  } catch (e2) {
+    return failure(file, fallback, `corrupt ${path9.basename(file)}: ${e2.message}`);
+  }
+}
+function failure(file, fallback, error) {
+  return { value: lastGood.get(file) ?? fallback(), error };
+}
+function normalizeConfig(raw) {
+  if (!isObj(raw)) throw new Error("not a JSON object");
+  const d3 = defaultConfig();
+  const port = raw.port;
+  if (typeof port === "number" && Number.isFinite(port)) d3.port = port;
+  if (isObj(raw.accounts)) {
+    for (const [k3, v2] of Object.entries(raw.accounts)) if (typeof v2 === "string") d3.accounts[k3] = v2;
+  }
+  d3.pinned = strings(raw.pinned);
+  d3.hidden = strings(raw.hidden);
+  return d3;
+}
+function normalizeRegistry(raw) {
+  if (!isObj(raw)) throw new Error("not a JSON object");
+  const repos = [];
+  if (Array.isArray(raw.repos)) {
+    for (const r2 of raw.repos) {
+      if (isObj(r2) && typeof r2.path === "string" && typeof r2.added_at === "string") {
+        repos.push({ path: r2.path, added_at: r2.added_at });
+      }
+    }
+  }
+  return { schema: 1, repos };
+}
+function readConfig(home) {
+  return readJson(configPath(home), normalizeConfig, defaultConfig);
+}
+function readRegistry(home) {
+  return readJson(registryPath(home), normalizeRegistry, defaultRegistry);
+}
+function normalizeRepoPath(p2) {
+  const r2 = path9.resolve(p2);
+  const root = path9.parse(r2).root;
+  let out = r2;
+  while (out.length > root.length && /[\/]$/.test(out)) out = out.slice(0, -1);
+  return out;
+}
+function addRepos(paths, home) {
+  const cur = readRegistry(home);
+  if (cur.error) return cur;
+  const seen = new Set(cur.value.repos.map((r2) => repoKey(r2.path)));
+  const repos = [...cur.value.repos];
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  let changed = false;
+  for (const p2 of paths) {
+    const n = normalizeRepoPath(p2);
+    const k3 = repoKey(n);
+    if (seen.has(k3)) continue;
+    seen.add(k3);
+    repos.push({ path: n, added_at: now });
+    changed = true;
+  }
+  const value = { schema: 1, repos };
+  if (changed) {
+    writeJsonAtomic(registryPath(home), value);
+    lastGood.set(registryPath(home), value);
+  }
+  return { value };
+}
+var DEFAULT_PORT, isWin, lastGood, isObj, strings, repoKey;
+var init_config = __esm({
+  "src/hub/config.ts"() {
+    "use strict";
+    init_paths();
+    DEFAULT_PORT = 47821;
+    isWin = () => process.platform === "win32";
+    lastGood = /* @__PURE__ */ new Map();
+    isObj = (v2) => typeof v2 === "object" && v2 !== null && !Array.isArray(v2);
+    strings = (v2) => Array.isArray(v2) ? v2.filter((x2) => typeof x2 === "string") : [];
+    repoKey = (p2) => isWin() ? p2.toLowerCase() : p2;
+  }
+});
+
+// src/hub/keyfile.ts
+import { chmodSync as chmodSync2, linkSync, mkdirSync as mkdirSync5, readFileSync as readFileSync7, unlinkSync as unlinkSync2, writeFileSync as writeFileSync4 } from "fs";
+import { randomBytes as randomBytes2 } from "crypto";
+import path10 from "path";
+function windowsAccount(env = process.env) {
+  const user = env.USERNAME ?? "";
+  return env.USERDOMAIN ? `${env.USERDOMAIN}\\${user}` : user;
+}
+function icaclsArgs(file, account) {
+  return [file, "/inheritance:r", "/grant:r", `${account}:F`];
+}
+function removeQuiet(file) {
+  try {
+    unlinkSync2(file);
+  } catch {
+  }
+}
+function readKey(file, platform) {
+  let text;
+  try {
+    text = readFileSync7(file, "utf8").trim();
+  } catch (e2) {
+    if (e2.code === "ENOENT") return null;
+    throw e2;
+  }
+  if (!KEY_RE.test(text)) throw new Error(`the hub key file is corrupt: delete ${file} and start again`);
+  if (platform !== "win32") chmodSync2(file, 384);
+  return text;
+}
+async function ownerOnly(file, platform, deps) {
+  if (platform !== "win32") {
+    chmodSync2(file, 384);
+    return;
+  }
+  const account = deps.account ?? windowsAccount();
+  if (!account) throw new Error("icacls: cannot find the current user name (USERNAME is not set)");
+  const r2 = await (deps.runCmd ?? run)("icacls", icaclsArgs(file, account), { timeout: ICACLS_TIMEOUT_MS });
+  if (!r2.ok) throw new Error(`icacls could not set the owner-only ACL on the hub key file (exit ${r2.code})`);
+}
+async function ensureKey(deps = {}) {
+  const platform = deps.platform ?? process.platform;
+  const file = keyPath(deps.home);
+  const existing = readKey(file, platform);
+  if (existing) return existing;
+  mkdirSync5(path10.dirname(file), { recursive: true, mode: 448 });
+  const key = randomBytes2(32).toString("hex");
+  const tmp = `${file}.${process.pid}.${randomBytes2(4).toString("hex")}.tmp`;
+  try {
+    writeFileSync4(tmp, "", { mode: 384, flag: "wx" });
+    await (deps.setAcl ?? ((f) => ownerOnly(f, platform, deps)))(tmp);
+    writeFileSync4(tmp, key, { flag: "r+" });
+    try {
+      linkSync(tmp, file);
+    } catch (e2) {
+      if (e2.code !== "EEXIST") throw e2;
+    }
+  } finally {
+    removeQuiet(tmp);
+  }
+  const back = readKey(file, platform);
+  if (!back) throw new Error("the hub key file disappeared after create");
+  return back;
+}
+var KEY_RE, ICACLS_TIMEOUT_MS;
+var init_keyfile = __esm({
+  "src/hub/keyfile.ts"() {
+    "use strict";
+    init_paths();
+    init_exec();
+    KEY_RE = /^[0-9a-f]{64}$/;
+    ICACLS_TIMEOUT_MS = 15e3;
+  }
+});
+
+// src/hub/lock.ts
+import { closeSync, mkdirSync as mkdirSync6, openSync, readFileSync as readFileSync8, unlinkSync as unlinkSync3, writeSync } from "fs";
+import path11 from "path";
+function readLock(home) {
+  try {
+    const raw = JSON.parse(readFileSync8(lockPath(home), "utf8"));
+    const pid = raw.pid;
+    const port = raw.port;
+    if (typeof pid !== "number" || !Number.isInteger(pid) || pid <= 0) return null;
+    if (typeof port !== "number" || !Number.isInteger(port)) return null;
+    const started = typeof raw.started_at === "string" ? raw.started_at : "";
+    const info = { pid, started_at: started, port };
+    if (typeof raw.instance === "string" && /^[0-9a-f]{32}$/.test(raw.instance)) info.instance = raw.instance;
+    return info;
+  } catch {
+    return null;
+  }
+}
+function holderAlive(h2, home, alive) {
+  return h2.pid === process.pid ? held.has(lockPath(home)) : alive(h2.pid);
+}
+function removeFile(file) {
+  try {
+    unlinkSync3(file);
+  } catch (e2) {
+    if (e2.code !== "ENOENT") throw e2;
+  }
+}
+function acquireLock(info, home, alive = pidAlive) {
+  const file = lockPath(home);
+  const live = (h2) => h2 !== null && holderAlive(h2, home, alive);
+  mkdirSync6(path11.dirname(file), { recursive: true, mode: 448 });
+  for (let attempt = 0; attempt < 3; attempt++) {
+    let fd;
+    try {
+      fd = openSync(file, "wx", 384);
+    } catch (e2) {
+      if (e2.code !== "EEXIST") throw e2;
+      const holder2 = readLock(home);
+      if (live(holder2)) return { ok: false, holder: holder2 };
+      const again = readLock(home);
+      if (live(again)) return { ok: false, holder: again };
+      removeFile(file);
+      continue;
+    }
+    try {
+      writeSync(fd, JSON.stringify(info) + "\n");
+    } finally {
+      closeSync(fd);
+    }
+    if (info.pid === process.pid) held.add(file);
+    return { ok: true };
+  }
+  const holder = readLock(home);
+  if (holder) return { ok: false, holder };
+  throw new Error("could not take the hub lock");
+}
+function writeLock(info, home) {
+  writeJsonAtomic(lockPath(home), info);
+}
+function releaseLock(pid, home) {
+  const cur = readLock(home);
+  if (!cur || cur.pid !== pid) return;
+  if (pid === process.pid) held.delete(lockPath(home));
+  try {
+    removeFile(lockPath(home));
+  } catch {
+  }
+}
+function removeLockIf(expected, home) {
+  const cur = readLock(home);
+  if (cur && cur.pid === expected.pid && cur.instance === expected.instance && cur.started_at === expected.started_at) {
+    removeLock(home);
+  }
+}
+function removeLock(home) {
+  held.delete(lockPath(home));
+  try {
+    removeFile(lockPath(home));
+  } catch {
+  }
+}
+var held;
+var init_lock = __esm({
+  "src/hub/lock.ts"() {
+    "use strict";
+    init_config();
+    init_paths();
+    init_sessions();
+    held = /* @__PURE__ */ new Set();
+  }
+});
+
+// src/hub/restart.ts
+import { readFileSync as readFileSync9 } from "fs";
+import path12 from "path";
+function readInstalledVersion2(packageRoot) {
+  try {
+    const parsed = JSON.parse(readFileSync9(path12.join(packageRoot, "package.json"), "utf8"));
+    return typeof parsed.version === "string" && parsed.version ? parsed.version : null;
+  } catch {
+    return null;
+  }
+}
+function createRestarter(deps) {
+  const sleep2 = deps.sleep ?? ((ms) => new Promise((r2) => setTimeout(r2, ms)));
+  const now = deps.now ?? Date.now;
+  const waitMs = deps.waitMs ?? RESTART_WAIT_MS;
+  const failed = /* @__PURE__ */ new Set();
+  let busy = false;
+  let cancel = null;
+  async function handOver(version) {
+    deps.log(`caddis hub: version ${deps.currentVersion} -> ${version}; starting the new server`);
+    let child = null;
+    let error = "";
+    try {
+      await deps.closeServer();
+      child = await deps.spawnNew();
+      let exited = false;
+      void child.exited.then(() => {
+        exited = true;
+      });
+      const deadline = now() + waitMs;
+      while (now() < deadline) {
+        await Promise.resolve();
+        if (exited) {
+          error = "the new server exited before it answered";
+          break;
+        }
+        if (await deps.probe(child) === version) {
+          deps.exit(0);
+          return;
+        }
+        await sleep2(POLL_MS);
+      }
+      if (!error) error = `the new server did not answer with version ${version} in ${Math.round(waitMs / 1e3)} s`;
+    } catch (e2) {
+      error = e2 instanceof Error ? e2.message : String(e2);
+    }
+    failed.add(version);
+    deps.log(`caddis hub: restart to ${version} failed (${error}); keeping version ${deps.currentVersion}`);
+    if (child && deps.killChild) {
+      try {
+        await deps.killChild(child);
+      } catch {
+      }
+    }
+    try {
+      await deps.restartOwn();
+    } catch (e2) {
+      deps.log(`caddis hub: could not restart the old server: ${e2 instanceof Error ? e2.message : String(e2)}`);
+      deps.exit(1);
+    }
+  }
+  async function tick() {
+    if (busy) return;
+    busy = true;
+    try {
+      const v2 = deps.readVersion();
+      if (v2 === null || v2 === deps.currentVersion || failed.has(v2)) return;
+      await handOver(v2);
+    } catch (e2) {
+      try {
+        deps.log(`caddis hub: restart check failed: ${e2 instanceof Error ? e2.message : String(e2)}`);
+      } catch {
+      }
+    } finally {
+      busy = false;
+    }
+  }
+  return {
+    start: () => {
+      cancel ??= deps.every(() => void tick(), RESTART_CHECK_MS);
+    },
+    stop: () => {
+      cancel?.();
+      cancel = null;
+    },
+    tick
+  };
+}
+var RESTART_CHECK_MS, RESTART_WAIT_MS, POLL_MS;
+var init_restart = __esm({
+  "src/hub/restart.ts"() {
+    "use strict";
+    RESTART_CHECK_MS = 6e4;
+    RESTART_WAIT_MS = 2e4;
+    POLL_MS = 250;
+  }
+});
+
+// src/hub/auth.ts
+import { createHash, randomBytes as randomBytes3, timingSafeEqual } from "crypto";
+function randomToken() {
+  return randomBytes3(32).toString("base64url");
+}
+function safeEqual(a, b3) {
+  const ha = createHash("sha256").update(a, "utf8").digest();
+  const hb = createHash("sha256").update(b3, "utf8").digest();
+  return timingSafeEqual(ha, hb) && a.length === b3.length;
+}
+function hostAllowed(host, port) {
+  if (!host) return false;
+  const h2 = host.toLowerCase();
+  return h2 === `127.0.0.1:${port}` || h2 === `localhost:${port}`;
+}
+function originAllowed(origin, port) {
+  if (!origin) return false;
+  return origin === `http://127.0.0.1:${port}` || origin === `http://localhost:${port}`;
+}
+function parseCookies(header) {
+  const out = {};
+  if (!header) return out;
+  for (const part of header.split(";")) {
+    const i = part.indexOf("=");
+    if (i < 1) continue;
+    const name = part.slice(0, i).trim();
+    if (name && !(name in out)) out[name] = part.slice(i + 1).trim();
+  }
+  return out;
+}
+var CODE_TTL_MS, MAX_CODES, MAX_SESSIONS, SESSION_IDLE_MS, SESSION_MAX_MS, AuthStore;
+var init_auth = __esm({
+  "src/hub/auth.ts"() {
+    "use strict";
+    CODE_TTL_MS = 6e4;
+    MAX_CODES = 20;
+    MAX_SESSIONS = 20;
+    SESSION_IDLE_MS = 12 * 60 * 60 * 1e3;
+    SESSION_MAX_MS = 24 * 60 * 60 * 1e3;
+    AuthStore = class {
+      constructor(now = Date.now) {
+        this.now = now;
+      }
+      now;
+      codes = [];
+      sessions = [];
+      /** Mint a single-use code. Expired codes are dropped first; then the oldest goes past the cap. */
+      mintCode() {
+        const t = this.now();
+        this.codes = this.codes.filter((c) => t - c.mintedAt < CODE_TTL_MS);
+        const value = randomToken();
+        this.codes.push({ value, mintedAt: t });
+        while (this.codes.length > MAX_CODES) this.codes.shift();
+        return value;
+      }
+      /** Expiry time of a code minted now, as UTC ISO 8601. */
+      codeExpiresAt() {
+        return new Date(this.now() + CODE_TTL_MS).toISOString();
+      }
+      /**
+       * Swap a code for a new session id. The code is removed before the age check,
+       * so a code is consumed even when this call fails. Returns null on failure.
+       */
+      redeemCode(code) {
+        if (!code) return null;
+        let found;
+        for (const c of this.codes) if (safeEqual(c.value, code)) found = c;
+        if (!found) return null;
+        this.codes = this.codes.filter((c) => c !== found);
+        const age = this.now() - found.mintedAt;
+        if (age < 0 || age >= CODE_TTL_MS) return null;
+        const t = this.now();
+        const s = { id: randomToken(), csrf: randomToken(), tab: randomToken(), createdAt: t, lastSeenAt: t };
+        this.sessions.push(s);
+        while (this.sessions.length > MAX_SESSIONS) this.sessions.shift();
+        return s.id;
+      }
+      /** Remove a code without making a session (a refused /login still uses up its code). */
+      discardCode(code) {
+        if (!code) return;
+        this.codes = this.codes.filter((c) => !safeEqual(c.value, code));
+      }
+      /**
+       * Find a live session and mark it used. A session past the idle TTL or the absolute TTL
+       * is removed and the call returns null.
+       */
+      getSession(id) {
+        return this.findSession(id, null);
+      }
+      /**
+       * As getSession, but the session's tab token must match too (constant time). A wrong or missing token
+       * returns null and does not mark the session used.
+       */
+      getTabSession(id, tab) {
+        return this.findSession(id, tab ?? "");
+      }
+      findSession(id, tab) {
+        if (!id) return null;
+        let found = null;
+        for (const s of this.sessions) if (safeEqual(s.id, id)) found = s;
+        if (!found) return null;
+        if (tab !== null && !safeEqual(found.tab, tab)) return null;
+        const t = this.now();
+        if (t - found.lastSeenAt >= SESSION_IDLE_MS || t - found.createdAt >= SESSION_MAX_MS) {
+          this.sessions = this.sessions.filter((x2) => x2 !== found);
+          return null;
+        }
+        found.lastSeenAt = t;
+        return found;
+      }
+      deleteSession(id) {
+        const s = this.getSession(id);
+        if (s) this.sessions = this.sessions.filter((x2) => x2 !== s);
+      }
+      codeCount() {
+        return this.codes.length;
+      }
+      sessionCount() {
+        return this.sessions.length;
+      }
+    };
+  }
+});
+
+// src/hub/server.ts
+import http from "http";
+function send(res, status5, body, extra = {}) {
+  const text = JSON.stringify(body);
+  res.writeHead(status5, {
+    "Content-Type": "application/json; charset=utf-8",
+    "Content-Length": Buffer.byteLength(text),
+    ...extra
+  });
+  res.end(text);
+}
+function readBody(req) {
+  return new Promise((resolve, reject) => {
+    const declared = Number(req.headers["content-length"] ?? 0);
+    if (declared > MAX_BODY_BYTES) {
+      reject(new BodyTooLarge());
+      return;
+    }
+    const chunks = [];
+    let size = 0;
+    let done = false;
+    req.on("data", (c) => {
+      if (done) return;
+      size += c.length;
+      if (size > MAX_BODY_BYTES) {
+        done = true;
+        reject(new BodyTooLarge());
+        return;
+      }
+      chunks.push(c);
+    });
+    req.on("end", () => {
+      if (!done) resolve(Buffer.concat(chunks));
+    });
+    req.on("error", (e2) => {
+      if (!done) reject(e2);
+    });
+  });
+}
+function tooLarge(req, res) {
+  res.on("finish", () => req.socket.destroy());
+  fail(res, 413, "body_too_large");
+}
+function keyOk(req, key) {
+  const v2 = req.headers[KEY_HEADER];
+  return typeof v2 === "string" && safeEqual(v2, key);
+}
+async function startServer(opts) {
+  const host = opts.host ?? "127.0.0.1";
+  if (host !== "127.0.0.1") throw new Error("the hub server binds 127.0.0.1 only");
+  if (typeof opts.key !== "string" || Buffer.byteLength(opts.key, "utf8") < MIN_KEY_BYTES) {
+    throw new Error(`the hub server key must be at least ${MIN_KEY_BYTES} bytes`);
+  }
+  const auth = new AuthStore(opts.now ?? Date.now);
+  const { key, versions } = opts;
+  let port = opts.port;
+  const sessionOf = (req) => auth.getSession(parseCookies(req.headers.cookie)[SESSION_COOKIE]);
+  const tabSessionOf = (req) => {
+    const tab = req.headers[TAB_HEADER];
+    return auth.getTabSession(parseCookies(req.headers.cookie)[SESSION_COOKIE], typeof tab === "string" ? tab : "");
+  };
+  async function handle(req, res) {
+    res.setHeader("Content-Security-Policy", CSP);
+    res.setHeader("X-Content-Type-Options", "nosniff");
+    res.setHeader("Referrer-Policy", "no-referrer");
+    let url;
+    try {
+      url = new URL(req.url ?? "/", "http://127.0.0.1");
+    } catch {
+      fail(res, 400, "bad_url");
+      return;
+    }
+    const path19 = url.pathname;
+    const method = req.method ?? "GET";
+    if (path19.startsWith("/api/") || path19 === "/login") res.setHeader("Cache-Control", "no-store");
+    if (!hostAllowed(req.headers.host, port)) {
+      if (path19 === "/login") auth.discardCode(url.searchParams.get("code") ?? "");
+      fail(res, 403, "bad_host");
+      return;
+    }
+    if (path19 === "/api/hub/whoami" && method === "GET") {
+      if (!opts.instance) return fail(res, 404, "not_found");
+      return send(res, 200, { instance: opts.instance });
+    }
+    if (path19 === "/api/health" && method === "GET") {
+      if (!keyOk(req, key)) return fail(res, 401, "unauthorized");
+      return send(res, 200, { schema: 1, ok: true, versions });
+    }
+    if (path19 === "/api/hub/code" && method === "POST") {
+      if (!keyOk(req, key)) return fail(res, 401, "unauthorized");
+      try {
+        await readBody(req);
+      } catch (e2) {
+        if (e2 instanceof BodyTooLarge) return tooLarge(req, res);
+        throw e2;
+      }
+      const code = auth.mintCode();
+      return send(res, 200, { schema: 1, code, expires_at: auth.codeExpiresAt() });
+    }
+    if (path19 === "/api/hub/stop" && method === "POST") {
+      if (!keyOk(req, key)) return fail(res, 401, "unauthorized");
+      try {
+        await readBody(req);
+      } catch (e2) {
+        if (e2 instanceof BodyTooLarge) return tooLarge(req, res);
+        throw e2;
+      }
+      res.on("finish", () => opts.onStop?.());
+      return send(res, 200, { schema: 1, ok: true });
+    }
+    if (method !== "GET") {
+      const origin = req.headers.origin;
+      if (!originAllowed(typeof origin === "string" ? origin : void 0, port)) return fail(res, 403, "bad_origin");
+      const session = sessionOf(req);
+      if (!session) return fail(res, 401, "unauthorized");
+      const token = req.headers[CSRF_HEADER];
+      if (typeof token !== "string" || !safeEqual(token, session.csrf)) return fail(res, 403, "bad_csrf");
+      try {
+        await readBody(req);
+      } catch (e2) {
+        if (e2 instanceof BodyTooLarge) return tooLarge(req, res);
+        throw e2;
+      }
+      if (path19 === "/api/logout" && method === "POST") {
+        auth.deleteSession(session.id);
+        return send(res, 200, { schema: 1, ok: true }, {
+          "Set-Cookie": `${SESSION_COOKIE}=; HttpOnly; SameSite=Strict; Path=/; Max-Age=0`
+        });
+      }
+      return fail(res, 404, "not_found");
+    }
+    if (path19 === "/") {
+      res.writeHead(200, {
+        "Content-Type": "text/html; charset=utf-8",
+        "Content-Length": Buffer.byteLength(PLACEHOLDER_HTML)
+      });
+      res.end(PLACEHOLDER_HTML);
+      return;
+    }
+    if (path19 === "/login") {
+      const id = auth.redeemCode(url.searchParams.get("code") ?? "");
+      const session = id ? auth.getSession(id) : null;
+      if (!id || !session) return fail(res, 401, "bad_code");
+      res.writeHead(303, {
+        Location: `/#tab=${session.tab}`,
+        "Set-Cookie": `${SESSION_COOKIE}=${id}; HttpOnly; SameSite=Strict; Path=/`,
+        "Content-Length": 0
+      });
+      res.end();
+      return;
+    }
+    if (path19 === "/api/session") {
+      const session = tabSessionOf(req);
+      if (!session) return fail(res, 401, "unauthorized");
+      return send(res, 200, { schema: 1, csrf_token: session.csrf, versions });
+    }
+    if (path19 === "/api/state") {
+      if (!tabSessionOf(req)) return fail(res, 401, "unauthorized");
+      let state;
+      try {
+        state = await opts.getState();
+      } catch {
+        return fail(res, 500, "state_failed");
+      }
+      return send(res, 200, state);
+    }
+    return fail(res, 404, "not_found");
+  }
+  const server = http.createServer((req, res) => {
+    handle(req, res).catch(() => {
+      if (!res.headersSent) fail(res, 500, "internal");
+      else res.destroy();
+    });
+  });
+  server.headersTimeout = 1e4;
+  server.requestTimeout = 15e3;
+  await new Promise((resolve, reject) => {
+    const onError = (e2) => reject(e2);
+    server.once("error", onError);
+    server.listen(opts.port, host, () => {
+      server.off("error", onError);
+      resolve();
+    });
+  });
+  const addr = server.address();
+  port = addr.port;
+  return {
+    port,
+    address: addr.address,
+    close: () => new Promise((resolve) => {
+      server.close(() => resolve());
+      server.closeAllConnections();
+    })
+  };
+}
+var SESSION_COOKIE, KEY_HEADER, CSRF_HEADER, TAB_HEADER, MAX_BODY_BYTES, MIN_KEY_BYTES, CSP, PLACEHOLDER_HTML, BodyTooLarge, fail;
+var init_server = __esm({
+  "src/hub/server.ts"() {
+    "use strict";
+    init_auth();
+    SESSION_COOKIE = "caddis_hub_session";
+    KEY_HEADER = "x-caddis-hub-key";
+    CSRF_HEADER = "x-csrf-token";
+    TAB_HEADER = "x-caddis-hub-tab";
+    MAX_BODY_BYTES = 16 * 1024;
+    MIN_KEY_BYTES = 32;
+    CSP = "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; connect-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'self'";
+    PLACEHOLDER_HTML = '<!doctype html>\n<html lang="en">\n<head>\n<meta charset="utf-8">\n<title>caddis hub</title>\n</head>\n<body>\n<h1>caddis hub</h1>\n<p>UI arrives in H2.</p>\n</body>\n</html>\n';
+    BodyTooLarge = class extends Error {
+    };
+    fail = (res, status5, error) => send(res, status5, { schema: 1, error });
+  }
+});
+
+// src/hub/bounded.ts
+function withTimeout(work, ms, what) {
+  let timer;
+  const limit = new Promise((_resolve, reject) => {
+    timer = setTimeout(() => reject(new Error(`${what} did not finish in ${Math.round(ms / 1e3)} s`)), ms);
+    timer.unref();
+  });
+  return Promise.race([work, limit]).finally(() => clearTimeout(timer));
+}
+var init_bounded = __esm({
+  "src/hub/bounded.ts"() {
+    "use strict";
+  }
+});
+
+// src/hub/spawn.ts
+import { spawn } from "child_process";
+function killTree(pid) {
+  if (process.platform === "win32") {
+    try {
+      spawn("taskkill", ["/T", "/F", "/PID", String(pid)], {
+        windowsHide: true,
+        shell: false,
+        stdio: "ignore"
+      }).on("error", () => {
+      });
+    } catch {
+    }
+    return;
+  }
+  try {
+    process.kill(-pid, "SIGKILL");
+  } catch {
+    try {
+      process.kill(pid, "SIGKILL");
+    } catch {
+    }
+  }
+}
+function wrapWindowsShim(cmd, args) {
+  if (process.platform !== "win32" || !/\.(cmd|bat)$/i.test(cmd)) return null;
+  if (UNSAFE_PATH.test(cmd)) return { error: `refused: the command path contains an unsafe character: ${cmd}` };
+  for (const a of args) {
+    if (!SAFE_ARG.test(a)) return { error: `refused argument for a .cmd shim: ${JSON.stringify(a)}` };
+  }
+  return { cmd: process.env.ComSpec || "cmd.exe", args: ["/d", "/s", "/c", `""${cmd}"${args.map((a) => ` ${a}`).join("")}"`] };
+}
+var DEFAULT_MAX_BYTES, SAFE_ARG, UNSAFE_PATH, spawnBounded;
+var init_spawn = __esm({
+  "src/hub/spawn.ts"() {
+    "use strict";
+    DEFAULT_MAX_BYTES = 16 * 1024 * 1024;
+    SAFE_ARG = /^[A-Za-z0-9._:/@=-]+$/;
+    UNSAFE_PATH = /["&|<>^%!\r\n]/;
+    spawnBounded = (cmd, args, opts) => new Promise((resolve) => {
+      let verbatim = false;
+      const wrapped = wrapWindowsShim(cmd, args);
+      if (wrapped && "error" in wrapped) {
+        resolve({ ok: false, code: null, stdout: "", stderr: wrapped.error, timedOut: false });
+        return;
+      }
+      if (wrapped) {
+        verbatim = true;
+        cmd = wrapped.cmd;
+        args = wrapped.args;
+      }
+      const cap = opts.maxBytes ?? DEFAULT_MAX_BYTES;
+      let stdout = "";
+      let stderr = "";
+      let timedOut = false;
+      let settled = false;
+      const finish2 = (code, extraErr = "") => {
+        if (settled) return;
+        settled = true;
+        clearTimeout(timer);
+        resolve({
+          ok: code === 0 && !timedOut,
+          code,
+          stdout,
+          stderr: extraErr ? `${stderr}${stderr ? "\n" : ""}${extraErr}` : stderr,
+          timedOut
+        });
+      };
+      let child;
+      try {
+        child = spawn(cmd, args, {
+          cwd: opts.cwd,
+          env: opts.env ? { ...process.env, ...opts.env } : process.env,
+          windowsHide: true,
+          shell: false,
+          // The wrapped command line is already quoted for cmd.exe. Node must not quote it again.
+          windowsVerbatimArguments: verbatim,
+          detached: process.platform !== "win32",
+          stdio: ["ignore", "pipe", "pipe"]
+        });
+      } catch (error) {
+        resolve({
+          ok: false,
+          code: null,
+          stdout: "",
+          stderr: error instanceof Error ? error.message : String(error),
+          timedOut: false
+        });
+        return;
+      }
+      const timer = setTimeout(() => {
+        timedOut = true;
+        if (child.pid !== void 0) killTree(child.pid);
+        setTimeout(() => finish2(null), 2e3).unref();
+      }, opts.timeoutMs);
+      const append = (current, chunk) => {
+        if (current.length >= cap) return current;
+        return (current + chunk.toString("utf8")).slice(0, cap);
+      };
+      child.stdout?.on("data", (c) => {
+        stdout = append(stdout, c);
+      });
+      child.stderr?.on("data", (c) => {
+        stderr = append(stderr, c);
+      });
+      child.on("error", (error) => finish2(null, error.message));
+      child.on("close", (code) => finish2(code));
+    });
+  }
+});
+
+// src/hub/sources/agents.ts
+import { existsSync as existsSync7, readFileSync as readFileSync10, statSync } from "fs";
+import path13 from "path";
+function classifyWaiting(waitingFor) {
+  const w2 = (waitingFor ?? "").toLowerCase();
+  if (w2 === "permission prompt" || w2 === "input needed" || w2.includes("question")) return "owner";
+  return "peer";
+}
+function repoPathFor(cwd) {
+  if (!cwd) return null;
+  let dir = path13.resolve(cwd);
+  for (; ; ) {
+    const dotGit = path13.join(dir, ".git");
+    if (existsSync7(dotGit)) {
+      if (isDir(dotGit)) return normalizeRepoPath(dir);
+      if (isFile(dotGit)) return commonRoot(dir, dotGit);
+      return null;
+    }
+    const parent = path13.dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+function commonRoot(dir, dotGitFile) {
+  try {
+    const m2 = /^gitdir:\s*(.+?)\s*$/m.exec(readFileSync10(dotGitFile, "utf8"));
+    if (!m2) return null;
+    const gitdir = path13.resolve(dir, m2[1] ?? "");
+    let common;
+    try {
+      const rel = readFileSync10(path13.join(gitdir, "commondir"), "utf8").trim();
+      if (!rel) return normalizeRepoPath(dir);
+      common = path13.resolve(gitdir, rel);
+    } catch {
+      return normalizeRepoPath(dir);
+    }
+    return normalizeRepoPath(path13.dirname(common));
+  } catch {
+    return null;
+  }
+}
+function createAgentsSource(opts = {}) {
+  const now = opts.now ?? Date.now;
+  const spawn2 = opts.spawn ?? spawnBounded;
+  const find2 = opts.findClaude ?? (() => findBin("claude"));
+  const waitingSince = /* @__PURE__ */ new Map();
+  let sessions = null;
+  let lastOkAt = null;
+  let lastError = null;
+  let lastRunOk = false;
+  let running = null;
+  const fail2 = (message3) => {
+    lastError = message3;
+    lastRunOk = false;
+  };
+  const ingest = (parsed) => {
+    if (!Array.isArray(parsed)) return fail2("claude agents output is not a JSON array");
+    const t = now();
+    const byId = /* @__PURE__ */ new Map();
+    const seenWaiting = /* @__PURE__ */ new Set();
+    for (const raw of parsed) {
+      if (!raw || typeof raw !== "object") continue;
+      const e2 = raw;
+      const sessionId = str(e2.sessionId);
+      if (!sessionId) continue;
+      const kind = str(e2.kind) ?? "interactive";
+      const status5 = str(e2.status) ?? str(e2.state) ?? "unknown";
+      if (kind === "background" && status5 === "done") continue;
+      const prior = byId.get(sessionId);
+      if (prior) {
+        prior.copies += 1;
+        continue;
+      }
+      const pid = typeof e2.pid === "number" ? e2.pid : null;
+      const cwd = str(e2.cwd);
+      const isWaiting = status5 === "waiting";
+      const waitingFor = isWaiting ? str(e2.waitingFor) : null;
+      const key = `${pid ?? str(e2.id) ?? kind}:${sessionId}`;
+      let since = null;
+      if (isWaiting) {
+        seenWaiting.add(key);
+        since = waitingSince.get(key) ?? t;
+        waitingSince.set(key, since);
+      }
+      const confirmed = isWaiting && t - (since ?? t) >= WAIT_DEBOUNCE_MS;
+      byId.set(sessionId, {
+        key,
+        pid,
+        session_id: sessionId,
+        name: str(e2.name),
+        kind,
+        cwd,
+        repo_path: repoPathFor(cwd),
+        status: status5,
+        waiting_for: waitingFor,
+        waiting_class: confirmed ? classifyWaiting(waitingFor) : null,
+        waiting_since: since === null ? null : new Date(since).toISOString(),
+        copies: 1
+      });
+    }
+    for (const k3 of [...waitingSince.keys()]) if (!seenWaiting.has(k3)) waitingSince.delete(k3);
+    sessions = [...byId.values()];
+    lastOkAt = t;
+    lastError = null;
+    lastRunOk = true;
+  };
+  const run2 = async () => {
+    const bin = await withTimeout(find2(), FIND_TIMEOUT_MS, "finding claude");
+    if (!bin) return fail2("claude was not found on PATH");
+    const result = await spawn2(bin, ["agents", "--json"], { timeoutMs: RUN_TIMEOUT_MS });
+    if (result.timedOut) return fail2(`claude agents timed out after ${RUN_TIMEOUT_MS / 1e3} s`);
+    if (!result.ok) {
+      const detail2 = (result.stderr || result.stdout).trim().slice(0, 500);
+      return fail2(`claude agents failed (exit ${result.code ?? "none"})${detail2 ? `: ${detail2}` : ""}`);
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(result.stdout);
+    } catch (error) {
+      return fail2(`claude agents output is not valid JSON: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    ingest(parsed);
+  };
+  return {
+    refresh() {
+      if (!running) {
+        running = run2().catch((error) => fail2(error instanceof Error ? error.message : String(error))).finally(() => {
+          running = null;
+        });
+      }
+      return running;
+    },
+    get() {
+      return {
+        ok: lastRunOk,
+        last_ok_at: lastOkAt === null ? null : new Date(lastOkAt).toISOString(),
+        last_error: lastError,
+        stale: lastOkAt === null || now() - lastOkAt > STALE_AFTER_MS2,
+        data: sessions
+      };
+    }
+  };
+}
+var STALE_AFTER_MS2, WAIT_DEBOUNCE_MS, RUN_TIMEOUT_MS, FIND_TIMEOUT_MS, isFile, isDir, str;
+var init_agents = __esm({
+  "src/hub/sources/agents.ts"() {
+    "use strict";
+    init_which();
+    init_bounded();
+    init_spawn();
+    init_config();
+    STALE_AFTER_MS2 = 3 * 6e4;
+    WAIT_DEBOUNCE_MS = 45e3;
+    RUN_TIMEOUT_MS = 1e4;
+    FIND_TIMEOUT_MS = 1e4;
+    isFile = (p2) => {
+      try {
+        return statSync(p2).isFile();
+      } catch {
+        return false;
+      }
+    };
+    isDir = (p2) => {
+      try {
+        return statSync(p2).isDirectory();
+      } catch {
+        return false;
+      }
+    };
+    str = (v2) => typeof v2 === "string" && v2 ? v2 : null;
+  }
+});
+
+// src/hub/sources/collector.ts
+import { existsSync as existsSync8 } from "fs";
+import os5 from "os";
+import path14 from "path";
+function defaultScriptPath() {
+  const name = "caddis_hub_collect.py";
+  const bundle = bundlePath("antigravity-plugin", { requireManifest: false });
+  if (bundle) {
+    const shipped = path14.join(bundle, "scripts", name);
+    if (existsSync8(shipped)) return shipped;
+  }
+  return path14.join(packageInfo().root, "..", "scripts", name);
+}
+async function resolvePython() {
+  const py = await find("python");
+  if (py) return { cmd: py, pre: [] };
+  if (process.platform === "win32") {
+    const launcher = await find("py");
+    if (launcher) return { cmd: launcher, pre: ["-3"] };
+    return null;
+  }
+  const py3 = await find("python3");
+  return py3 ? { cmd: py3, pre: [] } : null;
+}
+function createCollectorSource(opts) {
+  const now = opts.now ?? Date.now;
+  const spawn2 = opts.spawn ?? spawnBounded;
+  const cache = /* @__PURE__ */ new Map();
+  let spend = null;
+  let guide = null;
+  let schema = COLLECTOR_SCHEMA;
+  let generatedAt = "";
+  let lastOkAt = null;
+  let lastError = null;
+  let updateNeeded = false;
+  let lastRunOk = false;
+  let running = null;
+  const fail2 = (message3) => {
+    lastError = message3;
+    lastRunOk = false;
+  };
+  const ingest = (parsed, wanted) => {
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return fail2("collector output is not a JSON object");
+    const out = parsed;
+    const version = out.schema;
+    if (typeof version !== "number" || !Number.isInteger(version) || version < COLLECTOR_SCHEMA - 1) {
+      return fail2(`collector output has an unusable schema: ${String(version)}`);
+    }
+    if (version > COLLECTOR_SCHEMA) {
+      updateNeeded = true;
+      return fail2(`collector schema ${version} is newer than this hub (${COLLECTOR_SCHEMA}): update the hub`);
+    }
+    if (!Array.isArray(out.repos)) return fail2("collector output has no repos list");
+    updateNeeded = false;
+    schema = version;
+    generatedAt = typeof out.generated_at === "string" ? out.generated_at : "";
+    const keep = new Set(wanted);
+    for (const key of [...cache.keys()]) if (!keep.has(key)) cache.delete(key);
+    for (const entry of out.repos) {
+      if (!entry || typeof entry.path !== "string" || !keep.has(entry.path)) continue;
+      const old = cache.get(entry.path);
+      if (entry.error !== void 0 || entry.fingerprint === void 0) {
+        if (!old || old.error !== void 0) cache.set(entry.path, entry);
+        continue;
+      }
+      if (!old || old.error !== void 0 || old.fingerprint !== entry.fingerprint) cache.set(entry.path, entry);
+    }
+    const keepOrError = (next, old) => {
+      if (!next || typeof next !== "object") return old;
+      const slot = next;
+      if ("error" in slot && old && !("error" in old)) return old;
+      return slot;
+    };
+    spend = keepOrError(out.spend, spend);
+    guide = keepOrError(out.guide, guide);
+    lastOkAt = now();
+    lastError = null;
+    lastRunOk = true;
+  };
+  const run2 = async () => {
+    const repos = opts.repos();
+    let cmd = opts.python;
+    let pre = [];
+    if (!cmd) {
+      const found = await resolvePython();
+      if (!found) return fail2("python was not found (tried python, then py -3)");
+      cmd = found.cmd;
+      pre = found.pre;
+    }
+    const script = opts.scriptPath ?? defaultScriptPath();
+    const args = repos.length ? [...pre, script, "--repos", ...repos, "--json"] : [...pre, script, "--repos", path14.join(os5.tmpdir(), "caddis-hub-no-repos"), "--only", "spend,guide", "--json"];
+    const result = await spawn2(cmd, args, { timeoutMs: RUN_TIMEOUT_MS2 });
+    if (result.timedOut) return fail2(`collector timed out after ${RUN_TIMEOUT_MS2 / 1e3} s`);
+    if (!result.ok) {
+      const detail2 = (result.stderr || result.stdout).trim().slice(0, 500);
+      return fail2(`collector failed (exit ${result.code ?? "none"})${detail2 ? `: ${detail2}` : ""}`);
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(result.stdout);
+    } catch (error) {
+      return fail2(`collector output is not valid JSON: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    ingest(parsed, repos);
+  };
+  return {
+    refresh() {
+      if (!running) {
+        running = run2().catch((error) => fail2(error instanceof Error ? error.message : String(error))).finally(() => {
+          running = null;
+        });
+      }
+      return running;
+    },
+    get() {
+      const hasData = lastOkAt !== null;
+      return {
+        ok: lastRunOk,
+        last_ok_at: lastOkAt === null ? null : new Date(lastOkAt).toISOString(),
+        last_error: lastError,
+        stale: lastOkAt === null || now() - lastOkAt > STALE_AFTER_MS3,
+        update_needed: updateNeeded,
+        data: hasData ? { schema, generated_at: generatedAt, repos: [...cache.values()], spend: spend ?? {}, guide: guide ?? {} } : null
+      };
+    }
+  };
+}
+var COLLECTOR_SCHEMA, STALE_AFTER_MS3, RUN_TIMEOUT_MS2, FIND_TIMEOUT_MS2, find;
+var init_collector = __esm({
+  "src/hub/sources/collector.ts"() {
+    "use strict";
+    init_pkg();
+    init_which();
+    init_bounded();
+    init_spawn();
+    COLLECTOR_SCHEMA = 1;
+    STALE_AFTER_MS3 = 3 * 6e4;
+    RUN_TIMEOUT_MS2 = 6e4;
+    FIND_TIMEOUT_MS2 = 1e4;
+    find = (name) => withTimeout(findBin(name), FIND_TIMEOUT_MS2, `finding ${name}`);
+  }
+});
+
+// src/hub/sources/coordinator.ts
+import { readdirSync as readdirSync3, readFileSync as readFileSync11 } from "fs";
+import path15 from "path";
+function stub(repoId, schema) {
+  return {
+    repo_id: repoId,
+    schema,
+    coordinator_session: null,
+    heartbeat_at: null,
+    queue: [],
+    merging_now: null,
+    deploy_checks: [],
+    ledger: [],
+    processed_requests: []
+  };
+}
+function parse3(repoId, text) {
+  let raw;
+  try {
+    raw = JSON.parse(text);
+  } catch (e2) {
+    return { error: `corrupt coordinator.json: ${e2.message}` };
+  }
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return { error: "coordinator.json is not a JSON object" };
+  const o2 = raw;
+  const schema = o2.schema;
+  if (typeof schema !== "number" || !Number.isInteger(schema) || schema < COORDINATOR_SCHEMA - 1) {
+    return { error: `coordinator.json has an unusable schema: ${String(schema)}` };
+  }
+  if (schema > COORDINATOR_SCHEMA) {
+    return {
+      newer: stub(repoId, schema),
+      error: `coordinator schema ${schema} is newer than this hub (${COORDINATOR_SCHEMA}): update the hub`
+    };
+  }
+  return {
+    good: {
+      repo_id: repoId,
+      schema,
+      coordinator_session: o2.coordinator_session ?? null,
+      heartbeat_at: typeof o2.heartbeat_at === "string" ? o2.heartbeat_at : null,
+      queue: arr(o2.queue),
+      merging_now: o2.merging_now ?? null,
+      deploy_checks: arr(o2.deploy_checks).slice(-5),
+      ledger: arr(o2.ledger).slice(-20),
+      processed_requests: arr(o2.processed_requests).slice(-20)
+    }
+  };
+}
+function hubHome(home) {
+  const override = process.env.CADDIS_HUB_HOME;
+  return override ? override : hubDir(home);
+}
+function createCoordinatorSource(opts = {}) {
+  const now = opts.now ?? Date.now;
+  const lastGood2 = /* @__PURE__ */ new Map();
+  const errors = /* @__PURE__ */ new Map();
+  return {
+    refresh() {
+      const root = path15.join(hubHome(opts.home), "repos");
+      let ids = [];
+      try {
+        ids = readdirSync3(root, { withFileTypes: true }).filter((d3) => d3.isDirectory()).map((d3) => d3.name);
+      } catch {
+      }
+      const seen = new Set(ids);
+      for (const id of [...lastGood2.keys()]) if (!seen.has(id)) lastGood2.delete(id);
+      for (const id of [...errors.keys()]) if (!seen.has(id)) errors.delete(id);
+      for (const id of ids) {
+        let text;
+        try {
+          text = readFileSync11(path15.join(root, id, "coordinator.json"), "utf8");
+        } catch (e2) {
+          if (e2.code === "ENOENT") {
+            lastGood2.delete(id);
+            errors.delete(id);
+          } else {
+            if (!lastGood2.has(id)) lastGood2.set(id, stub(id, null));
+            errors.set(id, { error: `cannot read coordinator.json: ${e2.message}`, updateNeeded: false });
+          }
+          continue;
+        }
+        const r2 = parse3(id, text);
+        if (r2.good) {
+          lastGood2.set(id, r2.good);
+          errors.delete(id);
+          continue;
+        }
+        if (!lastGood2.has(id)) lastGood2.set(id, r2.newer ?? stub(id, null));
+        errors.set(id, { error: r2.error ?? "unreadable", updateNeeded: r2.newer !== void 0 });
+      }
+    },
+    get() {
+      const t = now();
+      const out = [];
+      for (const [id, good] of lastGood2) {
+        const ms = good.heartbeat_at ? Date.parse(good.heartbeat_at) : NaN;
+        const age = Number.isNaN(ms) ? null : Math.max(0, Math.floor((t - ms) / 1e3));
+        const err = errors.get(id);
+        out.push({
+          ...good,
+          heartbeat_age_s: age,
+          responding: age !== null && age < RESPONDING_WITHIN_S,
+          error: err?.error ?? null,
+          update_needed: err?.updateNeeded ?? false
+        });
+      }
+      return out.sort((a, b3) => a.repo_id.localeCompare(b3.repo_id));
+    }
+  };
+}
+var COORDINATOR_SCHEMA, RESPONDING_WITHIN_S, arr;
+var init_coordinator = __esm({
+  "src/hub/sources/coordinator.ts"() {
+    "use strict";
+    init_paths();
+    COORDINATOR_SCHEMA = 1;
+    RESPONDING_WITHIN_S = 180;
+    arr = (v2) => Array.isArray(v2) ? v2 : [];
+  }
+});
+
+// src/hub/sources/github.ts
+import { readFileSync as readFileSync12 } from "fs";
+import path16 from "path";
+function parseGithubRemote(url) {
+  const m2 = /^(?:https?:\/\/(?:[^@/]+@)?|ssh:\/\/git@|git@)github\.com[/:]([^/\s]+)\/([^/\s]+?)(?:\.git)?\/?$/i.exec(url.trim());
+  return m2 ? `${m2[1]}/${m2[2]}` : null;
+}
+function readOriginUrl(repoDir) {
+  const root = repoPathFor(repoDir);
+  if (!root) return null;
+  let text;
+  try {
+    text = readFileSync12(path16.join(root, ".git", "config"), "utf8");
+  } catch {
+    return null;
+  }
+  let inOrigin = false;
+  for (const line2 of text.split(/\r?\n/)) {
+    const section = /^\s*\[(.+)\]\s*$/.exec(line2);
+    if (section) {
+      inOrigin = /^remote\s+"origin"$/.test(section[1] ?? "");
+      continue;
+    }
+    const kv = inOrigin ? /^\s*url\s*=\s*(.+?)\s*$/.exec(line2) : null;
+    if (kv) return kv[1] ?? null;
+  }
+  return null;
+}
+function readRequiredChecks(repoDir) {
+  try {
+    const text = readFileSync12(path16.join(repoDir, ".caddis", "coordinator.md"), "utf8");
+    const m2 = /```json[^\S\r\n]*\r?\n([\s\S]*?)\r?\n[^\S\r\n]*```/.exec(text);
+    if (!m2) return null;
+    const parsed = JSON.parse(m2[1] ?? "");
+    if (!parsed || typeof parsed !== "object") return null;
+    const req = parsed.required_checks;
+    if (!Array.isArray(req) || !req.every((x2) => typeof x2 === "string")) return null;
+    return req;
+  } catch {
+    return null;
+  }
+}
+function requiredState(checks, required) {
+  if (required === null) return "unknown";
+  let pending = false;
+  for (const name of required) {
+    const c = checks.find((x2) => x2.name === name);
+    if (!c || c.status !== "completed") pending = true;
+    else if (c.conclusion && FAILED.has(c.conclusion)) return "fail";
+    else if (!c.conclusion || !PASSED.has(c.conclusion)) pending = true;
+  }
+  return pending ? "pending" : "pass";
+}
+async function defaultToken(spawn2, account) {
+  const gh = await findGh();
+  if (!gh) return null;
+  const r2 = await spawn2(gh, ["auth", "token", "-u", account], { timeoutMs: TOKEN_TIMEOUT_MS });
+  const token = r2.stdout.trim();
+  return r2.ok && token ? token : null;
+}
+function parseAuthStatus(text) {
+  const accounts = [];
+  let active = null;
+  let current = null;
+  for (const line2 of text.split(/\r?\n/)) {
+    const m2 = /Logged in to (\S+) (?:account|as) (\S+)/.exec(line2);
+    if (m2) {
+      current = m2[1] === "github.com" ? m2[2] ?? null : null;
+      if (current && !accounts.includes(current)) accounts.push(current);
+      continue;
+    }
+    if (current && /Active account:\s*true/i.test(line2)) active = current;
+  }
+  if (!active && accounts.length === 1) active = accounts[0] ?? null;
+  return { active, accounts };
+}
+async function defaultAuthStatus(spawn2) {
+  const gh = await findGh();
+  if (!gh) return null;
+  const r2 = await spawn2(gh, ["auth", "status", "-h", "github.com"], { timeoutMs: TOKEN_TIMEOUT_MS });
+  if (r2.timedOut) return null;
+  const status5 = parseAuthStatus(`${r2.stdout}
+${r2.stderr}`);
+  return status5.accounts.length || r2.ok ? status5 : null;
+}
+function accountCandidates(owner, status5, known) {
+  if (!status5) return [known ?? owner];
+  const out = [];
+  const add = (a) => {
+    if (a && !out.includes(a)) out.push(a);
+  };
+  if (known && status5.accounts.includes(known)) add(known);
+  add(status5.accounts.find((a) => a.toLowerCase() === owner.toLowerCase()));
+  add(status5.active);
+  status5.accounts.forEach(add);
+  return out;
+}
+function accessError(owner, tried) {
+  const set = `set "accounts": {"${owner}": "<gh user>"} in ~/.caddis/hub/config.json`;
+  if (!tried.length) return `no gh account is logged in: run gh auth login -h github.com, then ${set}`;
+  return `no access with account ${tried.join(", ")}: run gh auth login -h github.com, or ${set}`;
+}
+function createGithubSource(opts) {
+  const now = opts.now ?? Date.now;
+  const doFetch = opts.fetch ?? ((url, init2) => fetch(url, init2));
+  const spawn2 = opts.spawn ?? spawnBounded;
+  const getToken = opts.getToken ?? ((account) => defaultToken(spawn2, account));
+  const authStatus = opts.authStatus ?? (opts.getToken ? async () => null : () => defaultAuthStatus(spawn2));
+  const ownerAccount = /* @__PURE__ */ new Map();
+  let etags = /* @__PURE__ */ new Map();
+  let seen = /* @__PURE__ */ new Set();
+  const slots = /* @__PURE__ */ new Map();
+  const rate = /* @__PURE__ */ new Map();
+  let lastOkAt = null;
+  let lastError = null;
+  let lastRunOk = false;
+  let running = null;
+  const noteRate = (account, res) => {
+    const left = res.headers.get("x-ratelimit-remaining");
+    const remaining = Number(left);
+    if (left === null || !Number.isFinite(remaining)) return;
+    const reset = Number(res.headers.get("x-ratelimit-reset"));
+    rate.set(account, {
+      remaining,
+      reset_at: Number.isFinite(reset) && reset > 0 ? new Date(reset * 1e3).toISOString() : null
+    });
+  };
+  const getJson = async (account, token, pathAndQuery) => {
+    const url = `${API}${pathAndQuery}`;
+    const key = `${account}
+${url}`;
+    seen.add(key);
+    const cached2 = etags.get(key);
+    const headers = {
+      Authorization: `Bearer ${token}`,
+      Accept: "application/vnd.github+json",
+      "X-GitHub-Api-Version": "2022-11-28",
+      "User-Agent": "caddis-hub"
+    };
+    if (cached2) headers["If-None-Match"] = cached2.etag;
+    const signal = AbortSignal.timeout(FETCH_TIMEOUT_MS);
+    const res = await withTimeout(doFetch(url, { headers, signal }), FETCH_TIMEOUT_MS + 1e3, "GitHub request");
+    noteRate(account, res);
+    if (res.status === 304) {
+      if (cached2) return cached2.body;
+      throw new HttpError(304, false, "GitHub answered 304 with no cached copy");
+    }
+    if (!res.ok) {
+      const limited = (res.status === 403 || res.status === 429) && (res.headers.get("x-ratelimit-remaining") === "0" || res.headers.get("retry-after") !== null);
+      throw new HttpError(res.status, limited, limited ? "GitHub rate limit reached" : `GitHub answered ${res.status}`);
+    }
+    const body = await withTimeout(res.json(), FETCH_TIMEOUT_MS + 1e3, "GitHub response");
+    const etag = res.headers.get("etag");
+    if (etag) etags.set(key, { etag, body });
+    return body;
+  };
+  const loadRepo = async (repoPath, repo, account, token) => {
+    const required = readRequiredChecks(repoPath);
+    let first;
+    try {
+      first = await getJson(account, token, `/repos/${repo}/pulls?state=open&per_page=50`);
+    } catch (error) {
+      if (error instanceof HttpError && error.status === 404) throw new HttpError(404, false, error.message, true);
+      throw error;
+    }
+    const pulls = list(first);
+    const prs = [];
+    for (const p2 of pulls) {
+      const head = str2(rec(p2.head).sha) ?? "";
+      const byName = /* @__PURE__ */ new Map();
+      if (head) {
+        const body = rec(await getJson(account, token, `/repos/${repo}/commits/${head}/check-runs?per_page=100`));
+        for (const c of list(body.check_runs)) {
+          const name = str2(c.name);
+          if (!name) continue;
+          byName.set(name, {
+            name,
+            status: str2(c.status) ?? "unknown",
+            conclusion: str2(c.conclusion),
+            required: required === null ? null : required.includes(name)
+          });
+        }
+      }
+      const checks = [...byName.values()];
+      prs.push({
+        number: Number(p2.number),
+        title: str2(p2.title) ?? "",
+        head_sha: head,
+        author: str2(rec(p2.user).login),
+        draft: p2.draft === true,
+        updated_at: str2(p2.updated_at),
+        url: str2(p2.html_url) ?? "",
+        checks,
+        required_state: requiredState(checks, required)
+      });
+    }
+    const closed = list(
+      await getJson(account, token, `/repos/${repo}/pulls?state=closed&sort=updated&direction=desc&per_page=20`)
+    );
+    const merged = closed.filter((p2) => str2(p2.merged_at) && str2(p2.merge_commit_sha)).sort((a, b3) => String(b3.merged_at).localeCompare(String(a.merged_at))).slice(0, MERGES_SHOWN);
+    const merges = [];
+    for (const p2 of merged) {
+      const sha = str2(p2.merge_commit_sha) ?? "";
+      const body = rec(await getJson(account, token, `/repos/${repo}/actions/runs?head_sha=${sha}&per_page=10`));
+      merges.push({
+        number: Number(p2.number),
+        title: str2(p2.title) ?? "",
+        merge_sha: sha,
+        merged_at: str2(p2.merged_at) ?? "",
+        runs: list(body.workflow_runs).map((r2) => ({
+          name: str2(r2.name) ?? "",
+          status: str2(r2.status) ?? "unknown",
+          conclusion: str2(r2.conclusion),
+          url: str2(r2.html_url) ?? ""
+        }))
+      });
+    }
+    return { path: repoPath, repo, account, prs, merges };
+  };
+  const run2 = async () => {
+    seen = /* @__PURE__ */ new Set();
+    const limitedAccounts = /* @__PURE__ */ new Set();
+    try {
+      await runRepos(limitedAccounts);
+    } finally {
+      const kept = /* @__PURE__ */ new Map();
+      for (const key of seen) {
+        const entry = etags.get(key);
+        if (entry) kept.set(key, entry);
+      }
+      etags = kept;
+    }
+  };
+  const runRepos = async (limitedAccounts) => {
+    const accounts = opts.accounts();
+    const wanted = opts.repos();
+    const tokens = /* @__PURE__ */ new Map();
+    const errors = [];
+    let loaded = false;
+    let status5;
+    const tokenFor = async (account) => {
+      if (!tokens.has(account)) {
+        tokens.set(account, await withTimeout(getToken(account), TOKEN_TIMEOUT_MS + 5e3, "gh auth token"));
+      }
+      return tokens.get(account) ?? null;
+    };
+    for (const key of [...slots.keys()]) if (!wanted.includes(key)) slots.delete(key);
+    for (const repoPath of wanted) {
+      const url = readOriginUrl(repoPath);
+      const repo = url ? parseGithubRemote(url) : null;
+      if (!repo) {
+        slots.set(repoPath, { path: repoPath, reason: "no github remote" });
+        continue;
+      }
+      const owner = repo.split("/")[0] ?? "";
+      const override = accounts[repo] ?? accounts[owner];
+      let candidates;
+      if (override) {
+        candidates = [override];
+      } else {
+        if (status5 === void 0) {
+          status5 = await withTimeout(authStatus(), TOKEN_TIMEOUT_MS + 5e3, "gh auth status").catch(() => null);
+        }
+        candidates = accountCandidates(owner, status5, ownerAccount.get(owner));
+      }
+      const old = slots.get(repoPath);
+      const tried = [];
+      let settled = false;
+      for (const account of candidates) {
+        if (limitedAccounts.has(account)) {
+          settled = true;
+          break;
+        }
+        tried.push(account);
+        try {
+          const token = await tokenFor(account);
+          if (!token) continue;
+          const slot = await loadRepo(repoPath, repo, account, token);
+          slots.set(repoPath, { ...slot, last_ok_at: new Date(now()).toISOString() });
+          if (!override) ownerAccount.set(owner, account);
+          loaded = true;
+          settled = true;
+          break;
+        } catch (error) {
+          if (error instanceof HttpError && error.access && !error.rateLimited) continue;
+          if (error instanceof HttpError && error.rateLimited) limitedAccounts.add(account);
+          const message3 = error instanceof Error ? error.message : String(error);
+          errors.push(`${repo}: ${message3}`);
+          if (old?.prs !== void 0) {
+            if (!(error instanceof HttpError && error.rateLimited)) slots.set(repoPath, { ...old, error: message3 });
+          } else {
+            slots.set(repoPath, { path: repoPath, repo, account, error: message3 });
+          }
+          settled = true;
+          break;
+        }
+      }
+      if (!settled) {
+        if (!override && ownerAccount.get(owner) !== void 0) ownerAccount.delete(owner);
+        const slot = { path: repoPath, repo, error: accessError(owner, tried) };
+        if (tried[0]) slot.account = tried[0];
+        if (old?.last_ok_at) slot.last_ok_at = old.last_ok_at;
+        slots.set(repoPath, slot);
+      }
+    }
+    lastRunOk = errors.length === 0;
+    lastError = errors.length ? errors.join("; ") : null;
+    if (lastRunOk || loaded) lastOkAt = now();
+  };
+  return {
+    refresh() {
+      if (!running) {
+        running = run2().catch((error) => {
+          lastError = error instanceof Error ? error.message : String(error);
+          lastRunOk = false;
+        }).finally(() => {
+          running = null;
+        });
+      }
+      return running;
+    },
+    get() {
+      return {
+        ok: lastRunOk,
+        last_ok_at: lastOkAt === null ? null : new Date(lastOkAt).toISOString(),
+        last_error: lastError,
+        stale: lastOkAt === null || now() - lastOkAt > STALE_AFTER_MS4,
+        data: lastOkAt === null && slots.size === 0 ? null : { repos: [...slots.values()], rate: Object.fromEntries(rate) }
+      };
+    },
+    nextDelayMs() {
+      for (const r2 of rate.values()) if (r2.remaining < RATE_RESERVE) return SLOW_POLL_MS;
+      return POLL_MS2;
+    }
+  };
+}
+var STALE_AFTER_MS4, POLL_MS2, SLOW_POLL_MS, RATE_RESERVE, API, TOKEN_TIMEOUT_MS, FIND_TIMEOUT_MS3, FETCH_TIMEOUT_MS, MERGES_SHOWN, FAILED, PASSED, HttpError, str2, rec, list, findGh;
+var init_github = __esm({
+  "src/hub/sources/github.ts"() {
+    "use strict";
+    init_which();
+    init_bounded();
+    init_spawn();
+    init_agents();
+    STALE_AFTER_MS4 = 3 * 6e4;
+    POLL_MS2 = 6e4;
+    SLOW_POLL_MS = 5 * 6e4;
+    RATE_RESERVE = 500;
+    API = "https://api.github.com";
+    TOKEN_TIMEOUT_MS = 1e4;
+    FIND_TIMEOUT_MS3 = 1e4;
+    FETCH_TIMEOUT_MS = 15e3;
+    MERGES_SHOWN = 5;
+    FAILED = /* @__PURE__ */ new Set(["failure", "cancelled", "timed_out", "action_required", "startup_failure", "stale"]);
+    PASSED = /* @__PURE__ */ new Set(["success", "neutral", "skipped"]);
+    HttpError = class extends Error {
+      constructor(status5, rateLimited, message3, access = false) {
+        super(message3);
+        this.status = status5;
+        this.rateLimited = rateLimited;
+        this.access = access || status5 === 401 || status5 === 403 && !rateLimited;
+      }
+      status;
+      rateLimited;
+      /** This token cannot see the repo: try the next account. */
+      access;
+    };
+    str2 = (v2) => typeof v2 === "string" && v2 ? v2 : null;
+    rec = (v2) => v2 && typeof v2 === "object" ? v2 : {};
+    list = (v2) => Array.isArray(v2) ? v2.map(rec) : [];
+    findGh = () => withTimeout(findBin("gh"), FIND_TIMEOUT_MS3, "finding gh");
+  }
+});
+
+// src/hub/state.ts
+import { createHash as createHash2 } from "crypto";
+import { readFileSync as readFileSync13 } from "fs";
+import path17 from "path";
+function repoIdFor(nameWithOwner) {
+  return nameWithOwner.trim().toLowerCase().replace(/\//g, "__");
+}
+function localRepoId(repoPath) {
+  const norm = process.platform === "win32" ? repoPath.toLowerCase().replace(/\//g, "\\") : repoPath;
+  const digest = createHash2("sha256").update(norm, "utf8").digest("hex").slice(0, 6);
+  return `local__${path17.basename(repoPath)}__${digest}`;
+}
+function readPluginVersion(home) {
+  try {
+    const file = path17.join(home, ".claude", "plugins", "installed_plugins.json");
+    const parsed = JSON.parse(readFileSync13(file, "utf8"));
+    for (const [key, entries] of Object.entries(parsed.plugins ?? {})) {
+      if (!key.startsWith("caddis@") || !Array.isArray(entries)) continue;
+      for (const e2 of entries) {
+        const v2 = e2?.version;
+        if (typeof v2 === "string" && v2) return v2;
+      }
+    }
+  } catch {
+  }
+  return null;
+}
+function defaultVersions(home) {
+  const pool = bundleManifest().poolVersion;
+  return { hub: packageInfo().version, pool: pool === "unknown" ? null : pool, plugin: readPluginVersion(home) };
+}
+function createHub(opts = {}) {
+  const home = opts.home ?? caddisHome();
+  const now = opts.now ?? Date.now;
+  const repoPaths = () => {
+    const cfg = readConfig(home).value;
+    const hidden = new Set(cfg.hidden.map((p2) => repoKey(normalizeRepoPath(p2))));
+    const seen = /* @__PURE__ */ new Set();
+    const out = [];
+    const add = (p2) => {
+      const n = normalizeRepoPath(p2);
+      const k3 = repoKey(n);
+      if (hidden.has(k3) || seen.has(k3)) return;
+      seen.add(k3);
+      out.push(n);
+    };
+    cfg.pinned.forEach(add);
+    readRegistry(home).value.repos.forEach((r2) => add(r2.path));
+    return out;
+  };
+  const collector = opts.collector ?? createCollectorSource({ repos: repoPaths, now });
+  const agents = opts.agents ?? createAgentsSource({ now });
+  const github = opts.github ?? createGithubSource({ repos: repoPaths, accounts: () => readConfig(home).value.accounts, now });
+  const coordinator = opts.coordinator ?? createCoordinatorSource({ home, now });
+  let versionsCache = null;
+  const versions = () => {
+    if (opts.versions) return opts.versions();
+    if (!versionsCache || now() - versionsCache.at > VERSIONS_TTL_MS) {
+      versionsCache = { at: now(), value: defaultVersions(home) };
+    }
+    return versionsCache.value;
+  };
+  const thrown = /* @__PURE__ */ new Map();
+  let coordinatorOkAt = null;
+  const guarded = async (name, run2) => {
+    try {
+      await withTimeout(Promise.resolve().then(run2), REFRESH_CEILING_MS[name], "refresh");
+      thrown.delete(name);
+      if (name === "coordinator") coordinatorOkAt = now();
+    } catch (e2) {
+      thrown.set(name, message(e2));
+    }
+  };
+  const registerSessionRepos = () => {
+    const sessions = agents.get().data ?? [];
+    const paths = sessions.map((s) => s.repo_path).filter((p2) => typeof p2 === "string" && p2 !== "");
+    if (!paths.length) return;
+    try {
+      addRepos(paths, home);
+    } catch {
+    }
+  };
+  const refreshers = {
+    agents: () => guarded("agents", async () => {
+      await agents.refresh();
+      registerSessionRepos();
+    }),
+    collector: () => guarded("collector", () => collector.refresh()),
+    github: () => guarded("github", () => github.refresh()),
+    coordinator: () => guarded("coordinator", () => coordinator.refresh())
+  };
+  const delays = {
+    agents: () => AGENTS_EVERY_MS,
+    collector: () => COLLECTOR_EVERY_MS,
+    github: () => github.nextDelayMs(),
+    coordinator: () => COORDINATOR_EVERY_MS
+  };
+  let running = false;
+  const timers = /* @__PURE__ */ new Map();
+  const schedule = (name, delay) => {
+    if (!running) return;
+    const timer = setTimeout(() => {
+      timers.delete(name);
+      void refreshers[name]().finally(() => {
+        let next = AGENTS_EVERY_MS;
+        try {
+          next = delays[name]();
+        } catch {
+        }
+        schedule(name, next);
+      });
+    }, delay);
+    timer.unref();
+    timers.set(name, timer);
+  };
+  const status5 = (name, s) => {
+    const err = thrown.get(name);
+    const okAt = s.last_ok_at === null ? null : Date.parse(s.last_ok_at);
+    return {
+      ok: s.ok && err === void 0,
+      last_ok_at: s.last_ok_at,
+      last_error: err ?? s.last_error,
+      stale: okAt === null || Number.isNaN(okAt) || now() - okAt > STALE_AFTER_MS5
+    };
+  };
+  const getState = () => {
+    const col = collector.get();
+    const ag = agents.get();
+    const gh = github.get();
+    const coord = coordinator.get();
+    const pinned = new Set(readConfig(home).value.pinned.map((p2) => repoKey(normalizeRepoPath(p2))));
+    const colByPath = new Map((col.data?.repos ?? []).map((r2) => [repoKey(r2.path), r2]));
+    const ghByPath = new Map((gh.data?.repos ?? []).map((r2) => [repoKey(r2.path), r2]));
+    const coordById = new Map(coord.map((c) => [c.repo_id, c]));
+    const repos = repoPaths().map((p2) => {
+      const k3 = repoKey(p2);
+      const c = colByPath.get(k3);
+      const g2 = ghByPath.get(k3) ?? null;
+      const repoId = g2?.repo ? repoIdFor(g2.repo) : g2?.reason === "no github remote" ? localRepoId(p2) : void 0;
+      const out = {
+        path: p2,
+        name: path17.basename(p2),
+        pinned: pinned.has(k3),
+        roadmaps: c?.roadmaps ?? null,
+        plans: c?.plans ?? null,
+        relays: c?.relays ?? null,
+        github: g2,
+        coordinator: repoId ? coordById.get(repoId) ?? null : null
+      };
+      if (repoId) out.repo_id = repoId;
+      if (c?.error !== void 0) out.error = c.error;
+      return out;
+    });
+    const coordOkAt = coordinatorOkAt === null ? null : new Date(coordinatorOkAt).toISOString();
+    return {
+      schema: STATE_SCHEMA,
+      generated_at: new Date(now()).toISOString(),
+      versions: versions(),
+      sources: {
+        collector: status5("collector", col),
+        agents: status5("agents", ag),
+        github: status5("github", gh),
+        coordinator: status5("coordinator", { ok: coordOkAt !== null, last_ok_at: coordOkAt, last_error: null })
+      },
+      update_needed: col.update_needed || coord.some((c) => c.update_needed),
+      repos,
+      sessions: ag.data ?? [],
+      spend: col.data?.spend ?? null,
+      guide: col.data?.guide ?? null
+    };
+  };
+  return {
+    start() {
+      if (running) return;
+      running = true;
+      schedule("coordinator", 0);
+      const first = setTimeout(() => {
+        timers.delete("agents");
+        void refreshers.agents().finally(() => {
+          schedule("agents", AGENTS_EVERY_MS);
+          schedule("collector", 0);
+          schedule("github", 0);
+        });
+      }, 0);
+      first.unref();
+      timers.set("agents", first);
+    },
+    stop() {
+      running = false;
+      for (const timer of timers.values()) clearTimeout(timer);
+      timers.clear();
+    },
+    getState,
+    async refreshAll() {
+      await refreshers.agents();
+      await refreshers.coordinator();
+      await refreshers.collector();
+      await refreshers.github();
+    },
+    repoPaths
+  };
+}
+var STATE_SCHEMA, STALE_AFTER_MS5, COLLECTOR_EVERY_MS, AGENTS_EVERY_MS, COORDINATOR_EVERY_MS, VERSIONS_TTL_MS, REFRESH_CEILING_MS, message;
+var init_state = __esm({
+  "src/hub/state.ts"() {
+    "use strict";
+    init_config();
+    init_agents();
+    init_collector();
+    init_coordinator();
+    init_github();
+    init_bounded();
+    init_pkg();
+    init_sessions();
+    STATE_SCHEMA = 1;
+    STALE_AFTER_MS5 = 3 * 6e4;
+    COLLECTOR_EVERY_MS = 6e4;
+    AGENTS_EVERY_MS = 3e4;
+    COORDINATOR_EVERY_MS = 3e4;
+    VERSIONS_TTL_MS = 6e4;
+    REFRESH_CEILING_MS = {
+      collector: 9e4,
+      agents: 9e4,
+      github: 3e5,
+      coordinator: 9e4
+    };
+    message = (e2) => e2 instanceof Error ? e2.message : String(e2);
+  }
+});
+
+// src/commands/hub.ts
+var hub_exports = {};
+__export(hub_exports, {
+  SPAWN_OPTIONS: () => SPAWN_OPTIONS,
+  START_WAIT_MS: () => START_WAIT_MS,
+  hubAutostart: () => hubAutostart,
+  hubOpen: () => hubOpen,
+  hubServe: () => hubServe,
+  hubStart: () => hubStart,
+  hubStatus: () => hubStatus,
+  hubStop: () => hubStop,
+  isNodeProcess: () => isNodeProcess,
+  killTree: () => killTree2,
+  processStartMs: () => processStartMs,
+  startHub: () => startHub
+});
+import http2 from "http";
+import path18 from "path";
+import { mkdirSync as mkdirSync7, readFileSync as readFileSync14 } from "fs";
+import { randomBytes as randomBytes4 } from "crypto";
+function defaultVersions2() {
+  return { cli: packageInfo().version, caddis: bundleManifest().poolVersion };
+}
+function resolvePort(deps) {
+  if (deps.port !== void 0) return deps.port;
+  const cfg = readConfig(deps.home);
+  if (cfg.error) errorLine(`${cfg.error}; using the last good config`);
+  const p2 = cfg.value.port;
+  if (!Number.isInteger(p2) || p2 < 1 || p2 > 65535) {
+    throw new HubError(`config.json port ${p2} is not valid: use a whole number in 1-65535`);
+  }
+  return p2;
+}
+function readKeyQuiet(home) {
+  try {
+    const k3 = readFileSync14(keyPath(home), "utf8").trim();
+    return /^[0-9a-f]{64}$/.test(k3) ? k3 : null;
+  } catch {
+    return null;
+  }
+}
+function hubRequest(method, port, p2, key, timeoutMs) {
+  return new Promise((resolve) => {
+    const req = http2.request(
+      {
+        host: "127.0.0.1",
+        port,
+        method,
+        path: p2,
+        headers: { host: `127.0.0.1:${port}`, "content-length": 0, ...key ? { [KEY_HEADER]: key } : {} },
+        agent: false,
+        timeout: timeoutMs
+      },
+      (res) => {
+        const chunks = [];
+        res.on("data", (c) => chunks.push(c));
+        res.on("end", () => {
+          let body = {};
+          try {
+            body = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+          } catch {
+          }
+          resolve({ status: res.statusCode ?? 0, body });
+        });
+        res.on("error", () => resolve(null));
+      }
+    );
+    req.on("timeout", () => req.destroy());
+    req.on("error", () => resolve(null));
+    req.end();
+  });
+}
+async function defaultSpawn(cmd, args, opts = {}) {
+  const { execa } = await import("execa");
+  const child = execa(cmd, args, { ...SPAWN_OPTIONS, cwd: opts.cwd });
+  child.unref();
+  return {
+    pid: child.pid,
+    exited: child.then(
+      (r2) => r2.exitCode ?? null,
+      () => null
+    )
+  };
+}
+async function killTree2(pid) {
+  if (process.platform === "win32") {
+    await run("taskkill", ["/T", "/F", "/PID", String(pid)], { timeout: TOOL_TIMEOUT_MS });
+    return;
+  }
+  try {
+    process.kill(-pid, "SIGTERM");
+  } catch {
+    try {
+      process.kill(pid, "SIGTERM");
+    } catch {
+    }
+  }
+}
+async function isNodeProcess(pid) {
+  const r2 = process.platform === "win32" ? await run("tasklist", ["/FI", `PID eq ${pid}`, "/FO", "CSV", "/NH"], { timeout: TOOL_TIMEOUT_MS }) : await run("ps", ["-p", String(pid), "-o", "comm="], { timeout: TOOL_TIMEOUT_MS });
+  if (!r2.ok) return false;
+  const name = (r2.stdout.split(/\r?\n/)[0] ?? "").replace(/^"([^"]*)".*$/, "$1").trim().toLowerCase();
+  if (!name) return false;
+  const runtime = path18.basename(process.execPath).toLowerCase().replace(/\.exe$/, "");
+  return name.includes("node") || name.includes(runtime);
+}
+async function defaultOpener(url) {
+  const r2 = process.platform === "win32" ? await run("cmd", ["/c", "start", "", url], { timeout: TOOL_TIMEOUT_MS }) : process.platform === "darwin" ? await run("open", [url], { timeout: TOOL_TIMEOUT_MS }) : await run("xdg-open", [url], { timeout: TOOL_TIMEOUT_MS });
+  return r2.ok;
+}
+async function processStartMs(pid) {
+  if (!Number.isInteger(pid) || pid <= 0) return null;
+  const r2 = process.platform === "win32" ? await run(
+    "powershell",
+    ["-NoProfile", "-NonInteractive", "-Command", `(Get-Process -Id ${pid}).StartTime.ToUniversalTime().ToString('o')`],
+    { timeout: TOOL_TIMEOUT_MS }
+  ) : await run("ps", ["-o", "lstart=", "-p", String(pid)], { timeout: TOOL_TIMEOUT_MS, env: { LC_ALL: "C" } });
+  if (!r2.ok) return null;
+  const text = r2.stdout.trim().replace(/(\.\d{3})\d+/, "$1");
+  const t = Date.parse(text);
+  return Number.isNaN(t) ? null : t;
+}
+async function whoami(port) {
+  const r2 = await hubRequest("GET", port, "/api/hub/whoami", null, WHOAMI_TIMEOUT_MS);
+  const id = r2?.status === 200 ? r2.body.instance : void 0;
+  return typeof id === "string" ? id : null;
+}
+async function sameProcess(lock, deps) {
+  const home = deps.home ?? caddisHome();
+  if (lock.pid === process.pid) return holderAlive(lock, home, () => false) ? "same" : "other";
+  const started = Date.parse(lock.started_at);
+  if (Number.isNaN(started)) return "other";
+  const t = await (deps.processStart ?? processStartMs)(lock.pid);
+  if (t === null) return "unknown";
+  return t <= started ? "same" : "other";
+}
+async function inspect(deps, lock = readLock(deps.home ?? caddisHome())) {
+  const home = deps.home ?? caddisHome();
+  if (!lock) return { kind: "none" };
+  if (!holderAlive(lock, home, deps.alive ?? pidAlive)) return { kind: "stale", lock };
+  if (lock.instance && lock.port > 0 && await whoami(lock.port) === lock.instance) return { kind: "running", lock };
+  if (await sameProcess(lock, deps) === "other") return { kind: "stale", lock };
+  const started = Date.parse(lock.started_at);
+  const young = !Number.isNaN(started) && (deps.now ?? Date.now)() - started < START_WAIT_MS;
+  return young ? { kind: "starting", lock } : { kind: "unresponsive", lock };
+}
+async function startHub(deps = {}) {
+  const home = deps.home ?? caddisHome();
+  const now = deps.now ?? Date.now;
+  const port = resolvePort(deps);
+  const info = {
+    pid: process.pid,
+    started_at: new Date(now()).toISOString(),
+    port,
+    instance: randomBytes4(16).toString("hex")
+  };
+  let got = acquireLock(info, home, deps.alive ?? pidAlive);
+  if (!got.ok) {
+    const st = await inspect(deps, got.holder);
+    if (st.kind === "running" || st.kind === "starting" || st.kind === "unresponsive") throw new HubError(refusal(st));
+    removeLockIf(got.holder, home);
+    got = acquireLock(info, home, deps.alive ?? pidAlive);
+    if (!got.ok) throw new HubError(alreadyRunning(got.holder));
+  }
+  let server;
+  const state = deps.state ?? createHub({ home, now });
+  let stopping = null;
+  let resolveDone;
+  const done = new Promise((r2) => resolveDone = r2);
+  const stop = () => {
+    stopping ??= (async () => {
+      try {
+        state.stop();
+        await server.close();
+      } finally {
+        releaseLock(process.pid, home);
+        resolveDone();
+      }
+    })();
+    return stopping;
+  };
+  try {
+    const key = await ensureKey({ home, runCmd: deps.runCmd });
+    server = await startServer({
+      host: "127.0.0.1",
+      port,
+      key,
+      getState: () => state.getState(),
+      versions: deps.versions ?? defaultVersions2(),
+      now,
+      instance: info.instance,
+      onStop: () => void stop()
+    });
+  } catch (e2) {
+    releaseLock(process.pid, home);
+    if (e2.code === "EADDRINUSE") {
+      throw new HubError(`port ${port} is in use by another program: free it or set "port" in the hub config.json`);
+    }
+    throw e2;
+  }
+  writeLock({ ...info, port: server.port }, home);
+  state.start();
+  return { port: server.port, stop, done };
+}
+async function killChild(child, deps) {
+  if (child.pid && (deps.alive ?? pidAlive)(child.pid)) await (deps.kill ?? killTree2)(child.pid);
+}
+async function hubServe(deps = {}) {
+  const home = deps.home ?? caddisHome();
+  let hub2;
+  try {
+    hub2 = await startHub(deps);
+  } catch (e2) {
+    errorLine(message2(e2));
+    return 1;
+  }
+  let restarting = false;
+  let exitCode = 0;
+  let resolveFinished;
+  const finished = new Promise((r2) => resolveFinished = r2);
+  const watch = (h2) => {
+    void h2.done.then(() => {
+      if (!restarting) resolveFinished();
+    });
+  };
+  watch(hub2);
+  const onSignal = () => void hub2.stop();
+  const onExit = () => releaseLock(process.pid, home);
+  process.once("SIGINT", onSignal);
+  process.once("SIGTERM", onSignal);
+  process.once("exit", onExit);
+  line(`caddis hub serving on ${hubUrl(hub2.port)} (pid ${process.pid}); stop it with: caddis hub stop`);
+  const pkgRoot = packageInfo().root;
+  const newEntry = path18.join(pkgRoot, "dist", "cli.js");
+  const runningVersion = (deps.versions ?? defaultVersions2()).cli ?? packageInfo().version;
+  const restarter = createRestarter({
+    currentVersion: runningVersion,
+    readVersion: () => readInstalledVersion2(pkgRoot),
+    closeServer: async () => {
+      restarting = true;
+      await hub2.stop();
+    },
+    spawnNew: () => (deps.spawn ?? defaultSpawn)(process.execPath, [newEntry, "hub", "serve"], { cwd: hubDir(home) }),
+    probe: async (child) => {
+      const lock = readLock(home);
+      const key = readKeyQuiet(home);
+      if (!lock || !key || lock.pid !== child.pid || lock.port <= 0 || !lock.instance) return null;
+      if (await whoami(lock.port) !== lock.instance) return null;
+      const h2 = await hubRequest("GET", lock.port, "/api/health", key, 1e3);
+      const v2 = h2?.body.versions?.cli;
+      return h2?.status === 200 && typeof v2 === "string" ? v2 : null;
+    },
+    restartOwn: async () => {
+      try {
+        hub2 = await startHub({ ...deps, port: hub2.port });
+        watch(hub2);
+      } finally {
+        restarting = false;
+      }
+    },
+    killChild: (child) => killChild(child, deps),
+    exit: (code) => {
+      exitCode = code;
+      resolveFinished();
+    },
+    log: errorLine,
+    every: (fn, ms) => {
+      const t = setInterval(fn, ms);
+      t.unref();
+      return () => clearInterval(t);
+    },
+    ...deps.restart
+  });
+  restarter.start();
+  await finished;
+  restarter.stop();
+  process.off("SIGINT", onSignal);
+  process.off("SIGTERM", onSignal);
+  process.off("exit", onExit);
+  return exitCode;
+}
+async function hubStart(deps = {}) {
+  const home = deps.home ?? caddisHome();
+  const alive = deps.alive ?? pidAlive;
+  try {
+    resolvePort(deps);
+  } catch (e2) {
+    errorLine(message2(e2));
+    return 1;
+  }
+  const st = await inspect(deps);
+  if (st.kind === "running" || st.kind === "starting" || st.kind === "unresponsive") {
+    errorLine(refusal(st));
+    return 1;
+  }
+  if (st.kind === "stale") removeLockIf(st.lock, home);
+  let key;
+  try {
+    key = await ensureKey({ home, runCmd: deps.runCmd });
+  } catch (e2) {
+    errorLine(message2(e2));
+    return 1;
+  }
+  const entry = deps.entry ?? process.argv[1];
+  if (!entry) {
+    errorLine("cannot find the caddis CLI entry script to start the hub");
+    return 1;
+  }
+  const cwd = hubDir(home);
+  mkdirSync7(cwd, { recursive: true });
+  const child = await (deps.spawn ?? defaultSpawn)(process.execPath, [entry, "hub", "serve"], { cwd });
+  let exited = false;
+  let exitCode = null;
+  void child.exited.then((c) => {
+    exited = true;
+    exitCode = c;
+  });
+  const waitMs = deps.startWaitMs ?? START_WAIT_MS;
+  const deadline = Date.now() + waitMs;
+  while (Date.now() < deadline) {
+    if (exited) {
+      errorLine(`caddis hub serve exited (code ${exitCode}) before it answered; run "caddis hub serve" to see the error`);
+      return 1;
+    }
+    const lock = readLock(home);
+    if (lock && lock.pid === child.pid && lock.port > 0 && lock.instance && await whoami(lock.port) === lock.instance) {
+      const h2 = await hubRequest("GET", lock.port, "/api/health", key, 1e3);
+      if (h2?.status === 200) {
+        line(`caddis hub running on ${hubUrl(lock.port)}`);
+        line("open it with: caddis hub open");
+        return 0;
+      }
+    }
+    await sleep(100);
+  }
+  if (child.pid && alive(child.pid)) await (deps.kill ?? killTree2)(child.pid);
+  errorLine(
+    `caddis hub did not answer within ${Math.round(waitMs / 1e3)} s; run "caddis hub serve" to see the error`
+  );
+  return 1;
+}
+async function runningHub(deps) {
+  const home = deps.home ?? caddisHome();
+  const st = await inspect(deps);
+  if (st.kind !== "running") return null;
+  const key = readKeyQuiet(home);
+  if (!key) return null;
+  const h2 = await hubRequest("GET", st.lock.port, "/api/health", key, HEALTH_TIMEOUT_MS);
+  return h2?.status === 200 ? { lock: st.lock, key, body: h2.body } : null;
+}
+function formatUptime(ms) {
+  let s = Math.max(0, Math.floor(ms / 1e3));
+  const d3 = Math.floor(s / 86400);
+  s -= d3 * 86400;
+  const h2 = Math.floor(s / 3600);
+  s -= h2 * 3600;
+  const m2 = Math.floor(s / 60);
+  s -= m2 * 60;
+  const parts = [];
+  if (d3) parts.push(`${d3}d`);
+  if (d3 || h2) parts.push(`${h2}h`);
+  if (d3 || h2 || m2) parts.push(`${m2}m`);
+  parts.push(`${s}s`);
+  return parts.join(" ");
+}
+async function hubStatus(opts = {}) {
+  const now = opts.now ?? Date.now;
+  const hub2 = await runningHub(opts);
+  if (!hub2) {
+    if (opts.json) line(JSON.stringify({ schema: 1, running: false, port: null, pid: null, versions: null }));
+    else line("caddis hub is not running; start it with: caddis hub start");
+    return 1;
+  }
+  const versions = hub2.body.versions ?? {};
+  if (opts.json) {
+    line(JSON.stringify({ schema: 1, running: true, port: hub2.lock.port, pid: hub2.lock.pid, versions }));
+    return 0;
+  }
+  const started = Date.parse(hub2.lock.started_at);
+  line(`caddis hub running on ${hubUrl(hub2.lock.port)}`);
+  line(`  pid ${hub2.lock.pid}, uptime ${Number.isNaN(started) ? "unknown" : formatUptime(now() - started)}`);
+  line(`  versions: ${Object.entries(versions).map(([k3, v2]) => `${k3} ${v2}`).join(", ")}`);
+  return 0;
+}
+async function hubStop(deps = {}) {
+  const home = deps.home ?? caddisHome();
+  const alive = deps.alive ?? pidAlive;
+  const waitMs = deps.stopWaitMs ?? STOP_WAIT_MS;
+  const st = await inspect(deps);
+  if (st.kind === "none") {
+    line("caddis hub is not running");
+    return 0;
+  }
+  const lock = st.lock;
+  if (st.kind === "running") {
+    const key = readKeyQuiet(home);
+    const r2 = key ? await hubRequest("POST", lock.port, "/api/hub/stop", key, waitMs) : null;
+    if (r2?.status === 200) {
+      const deadline2 = Date.now() + waitMs;
+      while (Date.now() < deadline2) {
+        const cur = readLock(home);
+        if (!cur || cur.instance !== lock.instance || !holderAlive(cur, home, alive)) {
+          line("caddis hub stopped");
+          return 0;
+        }
+        await sleep(50);
+      }
+    }
+  }
+  if (!holderAlive(lock, home, alive)) {
+    removeLockIf(lock, home);
+    line("caddis hub is not running (removed a stale lock)");
+    return 0;
+  }
+  const same = await sameProcess(lock, deps);
+  if (same === "unknown") {
+    errorLine(`caddis hub pid ${lock.pid} does not answer and its start time cannot be read; lock kept. Retry, or end that pid by hand`);
+    return 1;
+  }
+  const ours = same === "same" && await (deps.isHubPid ?? isNodeProcess)(lock.pid);
+  if (!ours) {
+    removeLockIf(lock, home);
+    line(`caddis hub is not running (removed a stale lock; pid ${lock.pid} is another program, not killed)`);
+    return 0;
+  }
+  await (deps.kill ?? killTree2)(lock.pid);
+  const deadline = Date.now() + waitMs;
+  while (alive(lock.pid) && Date.now() < deadline) await sleep(50);
+  if (alive(lock.pid)) {
+    errorLine(`could not stop caddis hub (pid ${lock.pid})`);
+    return 1;
+  }
+  removeLockIf(lock, home);
+  line(`caddis hub stopped (killed pid ${lock.pid})`);
+  return 0;
+}
+async function hubOpen(deps = {}) {
+  const now = deps.now ?? Date.now;
+  const hub2 = await runningHub(deps);
+  if (!hub2) {
+    errorLine("caddis hub is not running; start it with: caddis hub start");
+    return 1;
+  }
+  const r2 = await hubRequest("POST", hub2.lock.port, "/api/hub/code", hub2.key, HEALTH_TIMEOUT_MS);
+  const code = r2?.status === 200 ? r2.body.code : void 0;
+  if (typeof code !== "string" || !CODE_RE.test(code)) {
+    errorLine(`caddis hub did not give a valid login code (HTTP ${r2?.status ?? "no answer"})`);
+    return 1;
+  }
+  const url = `${hubUrl(hub2.lock.port)}login?code=${code}`;
+  const expires = Date.parse(String(r2?.body.expires_at ?? ""));
+  const secs = Number.isNaN(expires) ? 60 : Math.round((expires - now()) / 1e3);
+  line(url);
+  line(`the code works once, for ${secs} s`);
+  let opened = false;
+  try {
+    opened = await (deps.opener ?? defaultOpener)(url);
+  } catch {
+    opened = false;
+  }
+  if (!opened) line("no browser opened: open this URL in your browser");
+  return 0;
+}
+async function hubAutostart(action, deps = {}) {
+  try {
+    const r2 = action === "enable" ? await enableAutostart(deps) : action === "disable" ? await disableAutostart(deps) : action === "status" ? await autostartStatus(deps) : null;
+    if (!r2) {
+      errorLine(`unknown action "${action}": use enable, disable or status`);
+      return 1;
+    }
+    (r2.ok || action === "status" ? line : errorLine)(r2.message);
+    return r2.ok ? 0 : 1;
+  } catch (e2) {
+    errorLine(message2(e2));
+    return 1;
+  }
+}
+var SPAWN_OPTIONS, START_WAIT_MS, WHOAMI_TIMEOUT_MS, CODE_RE, STOP_WAIT_MS, HEALTH_TIMEOUT_MS, TOOL_TIMEOUT_MS, HubError, sleep, hubUrl, message2, alreadyRunning, unresponsive, refusal;
+var init_hub = __esm({
+  "src/commands/hub.ts"() {
+    "use strict";
+    init_autostart();
+    init_config();
+    init_keyfile();
+    init_lock();
+    init_paths();
+    init_restart();
+    init_server();
+    init_state();
+    init_exec();
+    init_log();
+    init_pkg();
+    init_sessions();
+    SPAWN_OPTIONS = {
+      detached: true,
+      stdio: "ignore",
+      windowsHide: true,
+      shell: false,
+      cleanup: false,
+      reject: false
+    };
+    START_WAIT_MS = 2e4;
+    WHOAMI_TIMEOUT_MS = 1500;
+    CODE_RE = /^[A-Za-z0-9_-]+$/;
+    STOP_WAIT_MS = 5e3;
+    HEALTH_TIMEOUT_MS = 3e3;
+    TOOL_TIMEOUT_MS = 15e3;
+    HubError = class extends Error {
+    };
+    sleep = (ms) => new Promise((r2) => setTimeout(r2, ms));
+    hubUrl = (port) => `http://127.0.0.1:${port}/`;
+    message2 = (e2) => e2 instanceof Error ? e2.message : String(e2);
+    alreadyRunning = (l2) => `caddis hub is already running (pid ${l2.pid}, port ${l2.port})`;
+    unresponsive = (l2) => `caddis hub pid ${l2.pid} holds the lock but does not answer: run caddis hub stop`;
+    refusal = (st) => st.kind === "unresponsive" ? unresponsive(st.lock) : alreadyRunning(st.lock);
+  }
+});
+
 // node_modules/commander/esm.mjs
 var import_index = __toESM(require_commander(), 1);
 var {
@@ -5762,14 +8324,14 @@ function* pluginBlocks(stdout) {
   if (current) yield current;
 }
 async function detect() {
-  const path7 = await findBin(BIN);
-  if (!path7) {
+  const path19 = await findBin(BIN);
+  if (!path19) {
     return { present: false, note: "no `claude` binary on PATH" };
   }
   const version = await run(BIN, ["--version"], { timeout: 2e4 });
   return {
     present: true,
-    path: path7,
+    path: path19,
     agentVersion: version.ok ? version.stdout.trim().split(/\s+/)[0] || void 0 : void 0,
     note: version.ok ? void 0 : "binary found but `claude --version` failed"
   };
@@ -5946,8 +8508,8 @@ function errorText(error) {
   if (!(error instanceof Error)) return String(error);
   const code = error.code;
   const kind = code ?? error.constructor.name;
-  const message = code && error.message.startsWith(`${code}: `) ? error.message.slice(code.length + 2) : error.message;
-  return `${kind}: ${message}`;
+  const message3 = code && error.message.startsWith(`${code}: `) ? error.message.slice(code.length + 2) : error.message;
+  return `${kind}: ${message3}`;
 }
 function stampMs(stamp) {
   const n = Number(stamp);
@@ -6212,8 +8774,8 @@ async function drive2(_action, options) {
         if (missing.length > 0) {
           let outcome = "there was nothing to restore";
           if (backup) {
-            const failure = backup.restore();
-            outcome = failure === null ? "the previous plugin was restored" : `the restore FAILED (${failure}); the old plugin is kept at ${backup.location}`;
+            const failure2 = backup.restore();
+            outcome = failure2 === null ? "the previous plugin was restored" : `the restore FAILED (${failure2}); the old plugin is kept at ${backup.location}`;
           }
           steps3.push({ command, ok: false, code: result.code, output: `missing after the install: ${missing.join(", ")}` });
           return {
@@ -6430,8 +8992,8 @@ ${result.stderr}`;
       rmSync2(legacyDir, { recursive: true, force: true });
       results.push({ command: removalCommand, ok: true, code: 0 });
     } catch (error) {
-      const message = error instanceof Error ? error.message : String(error);
-      results.push({ command: removalCommand, ok: false, code: null, output: message });
+      const message3 = error instanceof Error ? error.message : String(error);
+      results.push({ command: removalCommand, ok: false, code: null, output: message3 });
     }
   }
   const notes = [];
@@ -6476,8 +9038,8 @@ function createStubAdapter(spec) {
       const found = await findBin(bin);
       if (found) return { present: true, path: found, note: NOT_YET_SUPPORTED };
     }
-    for (const configPath of spec.configPaths) {
-      if (existsSync4(configPath)) return { present: true, path: configPath, note: NOT_YET_SUPPORTED };
+    for (const configPath2 of spec.configPaths) {
+      if (existsSync4(configPath2)) return { present: true, path: configPath2, note: NOT_YET_SUPPORTED };
     }
     return { present: false, note: `no ${spec.bins.map((b3) => `\`${b3}\``).join(" / ")} binary or config found` };
   }
@@ -6594,6 +9156,31 @@ withGlobalFlags(program2.command("status")).description("compact table: cli vers
   const { status: status5 } = await Promise.resolve().then(() => (init_status(), status_exports));
   finish(await status5({ adapters: resolveAdapters(flags), json: options.json }));
 });
+var hub = program2.command("hub").description("the local caddis hub web server (127.0.0.1 only)");
+hub.command("start").description("start the hub in the background (hidden)").action(async () => {
+  const { hubStart: hubStart2 } = await Promise.resolve().then(() => (init_hub(), hub_exports));
+  finish(await hubStart2());
+});
+hub.command("stop").description("stop the running hub").action(async () => {
+  const { hubStop: hubStop2 } = await Promise.resolve().then(() => (init_hub(), hub_exports));
+  finish(await hubStop2());
+});
+hub.command("status").description("is the hub running: port, pid, versions, uptime (exit 1 when down)").option("--json", "machine-readable output", false).action(async (options) => {
+  const { hubStatus: hubStatus2 } = await Promise.resolve().then(() => (init_hub(), hub_exports));
+  finish(await hubStatus2({ json: options.json === true }));
+});
+hub.command("open").description("open the hub in your browser with a one-time login code").action(async () => {
+  const { hubOpen: hubOpen2 } = await Promise.resolve().then(() => (init_hub(), hub_exports));
+  finish(await hubOpen2());
+});
+hub.command("serve").description("run the hub in the foreground (used by start and the logon task)").action(async () => {
+  const { hubServe: hubServe2 } = await Promise.resolve().then(() => (init_hub(), hub_exports));
+  finish(await hubServe2());
+});
+hub.command("autostart <action>").description("start the hub at logon: enable, disable or status (per user, opt-in)").action(async (action) => {
+  const { hubAutostart: hubAutostart2 } = await Promise.resolve().then(() => (init_hub(), hub_exports));
+  finish(await hubAutostart2(action));
+});
 program2.addHelpText(
   "after",
   `