@chrisjowen/wheelhouse 0.1.0 → 0.2.0

package/dist/cli.js

@@ -1,15 +1,19 @@
 #!/usr/bin/env node
 
 // cli/index.ts
-import { spawn as spawn2 } from "node:child_process";
+import { fork, spawn as spawn4 } from "node:child_process";
 import { existsSync as existsSync2 } from "node:fs";
 import { createServer } from "node:http";
-import path4 from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import { Command, InvalidArgumentError, Option } from "commander";
+import path13 from "node:path";
+import { fileURLToPath as fileURLToPath2, pathToFileURL } from "node:url";
+import { Command as Command4, InvalidArgumentError as InvalidArgumentError2, Option } from "commander";
 
 // package.json
-var version = "0.1.0";
+var version = "0.2.0";
+
+// src/lib/chat/attachments.ts
+var UPLOAD_MAX_BYTES = 25 * 1024 * 1024;
+var UNIT = { B: 1, KB: 1024, MB: 1024 * 1024 };
 
 // src/lib/server/firstmate/install.ts
 import { access, constants, open, stat } from "node:fs/promises";
@@ -291,13 +295,13 @@ async function checkScript(firstmateDir, s) {
   } catch {
     return { ...base, ok: false, problem: `${s.name} is not executable` };
   }
-  let text;
+  let text2;
   try {
-    text = await readHead(file);
+    text2 = await readHead(file);
   } catch (e) {
     return { ...base, ok: false, problem: `${s.name} could not be read: ${e.message}` };
   }
-  const missing = s.markers.filter((m) => !text.includes(m));
+  const missing = s.markers.filter((m) => !text2.includes(m));
   if (missing.length) {
     return {
       ...base,
@@ -315,10 +319,10 @@ async function firstmateVersion(firstmateDir) {
   );
   return r.ok ? r.stdout.trim() || null : null;
 }
-async function checkCompatibility(install) {
+async function checkCompatibility(install2) {
   const [scripts, version2] = await Promise.all([
-    Promise.all(SUPPORTED_SCRIPTS.map((s) => checkScript(install.firstmateDir, s))),
-    firstmateVersion(install.firstmateDir)
+    Promise.all(SUPPORTED_SCRIPTS.map((s) => checkScript(install2.firstmateDir, s))),
+    firstmateVersion(install2.firstmateDir)
   ]);
   const problems = scripts.flatMap((s) => s.problem ? [s.problem] : []);
   return {
@@ -331,6 +335,7 @@ async function checkCompatibility(install) {
 }
 
 // src/lib/server/plugins/config.ts
+import { mkdir, readFile, rename, stat as stat2, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import path2 from "node:path";
 function defaultConfigDir(env) {
@@ -338,60 +343,2105 @@ function defaultConfigDir(env) {
   if (env.XDG_CONFIG_HOME) return path2.join(env.XDG_CONFIG_HOME, "wheelhouse");
   return path2.join(homedir(), ".config", "wheelhouse");
 }
+var PLUGINS_FILE = "plugins.json";
+var isRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+function parsePluginConfig(text2) {
+  let raw;
+  try {
+    raw = JSON.parse(text2);
+  } catch (e) {
+    return { ok: false, error: `not valid JSON: ${e.message}` };
+  }
+  if (!isRecord(raw)) return { ok: false, error: "expected a JSON object" };
+  for (const k of Object.keys(raw)) {
+    if (k !== "plugins") return { ok: false, error: `unknown field "${k}"` };
+  }
+  const plugins = {};
+  if (raw.plugins !== void 0) {
+    if (!isRecord(raw.plugins)) return { ok: false, error: '"plugins" must be an object' };
+    for (const [id, s] of Object.entries(raw.plugins)) {
+      if (!isRecord(s)) return { ok: false, error: `plugins.${id} must be an object` };
+      const setting = {};
+      for (const [k, v] of Object.entries(s)) {
+        if (k === "enabled") {
+          if (typeof v !== "boolean") {
+            return { ok: false, error: `plugins.${id}.enabled must be true or false` };
+          }
+          setting.enabled = v;
+        } else if (k === "projects") {
+          if (!isRecord(v)) return { ok: false, error: `plugins.${id}.projects must be an object` };
+          for (const [p, on] of Object.entries(v)) {
+            if (typeof on !== "boolean") {
+              return { ok: false, error: `plugins.${id}.projects.${p} must be true or false` };
+            }
+          }
+          setting.projects = v;
+        } else if (k === "settings") {
+          if (!isRecord(v)) return { ok: false, error: `plugins.${id}.settings must be an object` };
+          setting.settings = v;
+        } else {
+          return { ok: false, error: `unknown field "plugins.${id}.${k}"` };
+        }
+      }
+      plugins[id] = setting;
+    }
+  }
+  return { ok: true, config: { plugins } };
+}
+async function readRaw(file) {
+  let text2;
+  try {
+    text2 = await readFile(file, "utf8");
+  } catch (e) {
+    if (e.code === "ENOENT") return { ok: true, raw: null };
+    return { ok: false, error: `could not read ${file}: ${e.message}` };
+  }
+  const parsed = parsePluginConfig(text2);
+  if (!parsed.ok) return { ok: false, error: `${file} is not valid: ${parsed.error}` };
+  return { ok: true, raw: JSON.parse(text2) };
+}
+async function readPluginSettings(dir, id) {
+  const r = await readRaw(path2.join(dir, PLUGINS_FILE));
+  if (!r.ok) return r;
+  const plugins = r.raw?.plugins ?? {};
+  return { ok: true, settings: { ...plugins[id]?.settings ?? {} } };
+}
+var editing = Promise.resolve();
+function editPlugin(dir, id, change) {
+  const run = editing.then(async () => {
+    const file = path2.join(dir, PLUGINS_FILE);
+    const r = await readRaw(file);
+    if (!r.ok) return r;
+    const raw = r.raw ?? {};
+    const plugins = isRecord(raw.plugins) ? raw.plugins : {};
+    const entry2 = isRecord(plugins[id]) ? { ...plugins[id] } : {};
+    change(entry2);
+    if (Object.keys(entry2).length) plugins[id] = entry2;
+    else delete plugins[id];
+    raw.plugins = plugins;
+    try {
+      await mkdir(dir, { recursive: true });
+      const tmp = `${file}.${process.pid}.tmp`;
+      await writeFile(tmp, `${JSON.stringify(raw, null, "	")}
+`);
+      await rename(tmp, file);
+    } catch (e) {
+      return { ok: false, error: `could not write ${file}: ${e.message}` };
+    }
+    return { ok: true };
+  });
+  editing = run.catch(() => {
+  });
+  return run;
+}
+function writePluginSettings(dir, id, settings2) {
+  return editPlugin(dir, id, (entry2) => {
+    entry2.settings = settings2;
+  });
+}
+
+// src/lib/server/plugins/installed.ts
+import { mkdir as mkdir2, readFile as readFile2, rename as rename2, writeFile as writeFile2 } from "node:fs/promises";
+import { homedir as homedir2 } from "node:os";
+import path3 from "node:path";
+var INSTALLED_FILE = "installed.json";
+var SCHEMA = "wheelhouse-installed-plugins.v1";
+var EMPTY_INSTALLED = () => ({ schema: SCHEMA, plugins: {} });
+function defaultPluginsDir(env) {
+  if (env.WHEELHOUSE_PLUGINS_DIR) return path3.resolve(env.WHEELHOUSE_PLUGINS_DIR);
+  return path3.join(homedir2(), ".wheelhouse", "plugins");
+}
+var isRecord2 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+function record(v) {
+  if (!isRecord2(v)) return null;
+  const { repository, ref, commit, version: version2, installedAt, enabled } = v;
+  if (typeof repository !== "string" || ref !== null && typeof ref !== "string" || typeof commit !== "string" || typeof version2 !== "string" || typeof installedAt !== "string" || typeof enabled !== "boolean") {
+    return null;
+  }
+  return { repository, ref, commit, version: version2, installedAt, enabled };
+}
+async function readInstalled(dir) {
+  const file = path3.join(dir, INSTALLED_FILE);
+  let text2;
+  try {
+    text2 = await readFile2(file, "utf8");
+  } catch (e) {
+    if (e.code === "ENOENT")
+      return { ok: true, installed: EMPTY_INSTALLED() };
+    return { ok: false, error: `could not read ${file}: ${e.message}` };
+  }
+  let raw;
+  try {
+    raw = JSON.parse(text2);
+  } catch (e) {
+    return { ok: false, error: `${file} is not valid JSON: ${e.message}` };
+  }
+  if (!isRecord2(raw) || raw.schema !== SCHEMA || !isRecord2(raw.plugins)) {
+    return { ok: false, error: `${file} is not a ${SCHEMA} record` };
+  }
+  const installed = EMPTY_INSTALLED();
+  for (const [id, v] of Object.entries(raw.plugins)) {
+    const r = record(v);
+    if (!r) return { ok: false, error: `${file}: the entry for "${id}" is not a valid record` };
+    installed.plugins[id] = r;
+  }
+  return { ok: true, installed };
+}
+async function writeInstalled(dir, installed) {
+  await mkdir2(dir, { recursive: true });
+  const file = path3.join(dir, INSTALLED_FILE);
+  const tmp = `${file}.${process.pid}.tmp`;
+  await writeFile2(tmp, `${JSON.stringify(installed, null, "	")}
+`);
+  await rename2(tmp, file);
+}
 
 // src/lib/server/store/store.ts
 import { realpathSync } from "node:fs";
-import path3 from "node:path";
+import path4 from "node:path";
+
+// src/lib/inbox.ts
+var SNOOZE_MS = 4 * 3600 * 1e3;
+
+// src/lib/server/store/store.ts
 function defaultStateDir(env) {
-  if (env.WHEELHOUSE_STATE_DIR) return path3.resolve(env.WHEELHOUSE_STATE_DIR);
-  if (env.XDG_STATE_HOME) return path3.join(path3.resolve(env.XDG_STATE_HOME), "wheelhouse");
-  return path3.join(env.HOME ?? "", ".local", "state", "wheelhouse");
+  if (env.WHEELHOUSE_STATE_DIR) return path4.resolve(env.WHEELHOUSE_STATE_DIR);
+  if (env.XDG_STATE_HOME) return path4.join(path4.resolve(env.XDG_STATE_HOME), "wheelhouse");
+  return path4.join(env.HOME ?? "", ".local", "state", "wheelhouse");
 }
 function real(p) {
-  const abs = path3.resolve(p);
+  const abs = path4.resolve(p);
   try {
     return realpathSync(abs);
   } catch {
-    const parent = path3.dirname(abs);
-    return parent === abs ? abs : path3.join(real(parent), path3.basename(abs));
+    const parent = path4.dirname(abs);
+    return parent === abs ? abs : path4.join(real(parent), path4.basename(abs));
   }
 }
 function isInside(p, dir) {
-  const rel = path3.relative(real(dir), real(p));
-  return rel === "" || !rel.startsWith("..") && !path3.isAbsolute(rel);
+  const rel = path4.relative(real(dir), real(p));
+  return rel === "" || !rel.startsWith("..") && !path4.isAbsolute(rel);
+}
+
+// src/lib/server/restart.ts
+var KEY = /* @__PURE__ */ Symbol.for("wheelhouse.restart");
+var g = globalThis;
+function setRestart(fn) {
+  g[KEY] = fn ?? void 0;
+}
+
+// cli/gateway.ts
+import path6 from "node:path";
+import { Argument, Command, InvalidArgumentError } from "commander";
+
+// src/lib/gateway.ts
+var GATEWAY_CHANNELS = [
+  { channel: "discord", label: "Discord" }
+];
+var DEFAULT_GATEWAY_ALERTS = ["question", "pr-green", "stuck"];
+var PAIRING_MS = 10 * 6e4;
+
+// src/lib/server/gateway/channels/discord.ts
+import WebSocket from "ws";
+var DISCORD_API = "https://discord.com/api/v10";
+var DISCORD_INTENTS = 1 << 12;
+var REQUEST_TIMEOUT_MS = 15e3;
+var wsTransport = {
+  fetch: (url, init) => fetch(url, init),
+  connect(url, on) {
+    const ws = new WebSocket(url);
+    ws.on("message", (data) => on.message(data.toString()));
+    ws.on("close", (code) => on.close(code));
+    ws.on("error", (e) => on.error(e));
+    return {
+      send: (data) => {
+        if (ws.readyState === WebSocket.OPEN) ws.send(data);
+      },
+      close: (code) => ws.close(code)
+    };
+  }
+};
+var DiscordError = class extends Error {
+  constructor(status, message) {
+    super(message);
+    this.status = status;
+    this.name = "DiscordError";
+  }
+  status;
+};
+var str = (v) => typeof v === "string" && v ? v : null;
+function sleep(ms, signal) {
+  return new Promise((resolve) => {
+    const t = setTimeout(done, ms);
+    function done() {
+      clearTimeout(t);
+      signal?.removeEventListener("abort", done);
+      resolve();
+    }
+    signal?.addEventListener("abort", done, { once: true });
+  });
+}
+async function call(transport, token, version2, method, route, what, body) {
+  const redact = (s) => s.split(token).join("[token]");
+  for (let attempt = 0; ; attempt++) {
+    let res;
+    try {
+      res = await transport.fetch(`${DISCORD_API}${route}`, {
+        method,
+        headers: {
+          authorization: `Bot ${token}`,
+          "content-type": "application/json",
+          "user-agent": `DiscordBot (https://github.com/chrisjowen/wheelhouse, ${version2})`
+        },
+        body: body === void 0 ? void 0 : JSON.stringify(body),
+        signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+      });
+    } catch (e) {
+      throw new DiscordError(
+        0,
+        redact(`Wheelhouse could not reach Discord to ${what}: ${e.message}`)
+      );
+    }
+    if (res.status === 429 && attempt < 2) {
+      const j = await res.json().catch(() => ({}));
+      await sleep(Math.min(10, Math.max(0.1, Number(j.retry_after) || 1)) * 1e3);
+      continue;
+    }
+    const text2 = await res.text().catch(() => "");
+    if (!res.ok) {
+      let said = "";
+      try {
+        said = str(JSON.parse(text2).message) ?? "";
+      } catch {
+      }
+      throw new DiscordError(
+        res.status,
+        redact(`Discord would not ${what} (${res.status}${said ? `: ${said}` : ""}).`)
+      );
+    }
+    return text2 ? JSON.parse(text2) : void 0;
+  }
+}
+async function checkDiscordToken(token, opts = {}) {
+  const transport = opts.transport ?? wsTransport;
+  const version2 = opts.version ?? "0";
+  try {
+    const me = await call(
+      transport,
+      token,
+      version2,
+      "GET",
+      "/users/@me",
+      "say who the bot is"
+    );
+    const id = str(me?.id);
+    if (!id) return { ok: false, error: "Discord did not say who the bot is." };
+    const app = await call(
+      transport,
+      token,
+      version2,
+      "GET",
+      "/applications/@me",
+      "describe the application"
+    ).catch(() => null);
+    return {
+      ok: true,
+      bot: { id, name: str(me.global_name) ?? str(me.username) ?? id },
+      appId: str(app?.id) ?? id,
+      publicBot: typeof app?.bot_public === "boolean" ? app.bot_public : null
+    };
+  } catch (e) {
+    const status = e instanceof DiscordError ? e.status : 0;
+    if (status === 401)
+      return {
+        ok: false,
+        error: "Discord refused this token: it is not a valid bot token, or it was reset."
+      };
+    return { ok: false, error: e.message };
+  }
+}
+var inviteUrl = (appId) => `https://discord.com/oauth2/authorize?client_id=${encodeURIComponent(appId)}&scope=bot&permissions=0`;
+
+// src/lib/server/gateway/keychain.ts
+import { spawn as spawn2 } from "node:child_process";
+var KEYCHAIN_SERVICE = "wheelhouse-gateway";
+var SECURITY = "/usr/bin/security";
+var NOT_FOUND = 44;
+function security(args, input = "") {
+  return new Promise((resolve, reject) => {
+    const child = spawn2(SECURITY, args, { stdio: ["pipe", "pipe", "ignore"] });
+    let stdout = "";
+    child.stdout.setEncoding("utf8").on("data", (d) => stdout += d);
+    child.on("error", reject);
+    child.on("close", (code) => resolve({ code: code ?? -1, stdout }));
+    child.stdin.on("error", () => {
+    });
+    child.stdin.end(input);
+  });
+}
+function macKeychain(service = KEYCHAIN_SERVICE) {
+  const failed = (what, code) => new Error(`the macOS Keychain could not ${what} (security exited ${code})`);
+  return {
+    where: `the macOS Keychain (${service})`,
+    async get(account) {
+      const r = await security(["find-generic-password", "-s", service, "-a", account, "-w"]);
+      if (r.code === NOT_FOUND) return null;
+      if (r.code !== 0) throw failed("read it", r.code);
+      return r.stdout.trim() || null;
+    },
+    async set(account, secret) {
+      if (!/^[A-Za-z0-9._-]+$/.test(secret))
+        throw new Error("not a secret the Keychain line can hold");
+      const r = await security(
+        ["-i"],
+        `add-generic-password -U -s ${service} -a ${account} -w ${secret}
+`
+      );
+      if (r.code !== 0) throw failed("keep it", r.code);
+    },
+    async remove(account) {
+      const r = await security(["delete-generic-password", "-s", service, "-a", account]);
+      if (r.code === NOT_FOUND) return false;
+      if (r.code !== 0) throw failed("remove it", r.code);
+      return true;
+    }
+  };
+}
+function defaultKeychain() {
+  return process.platform === "darwin" ? macKeychain() : null;
+}
+
+// src/lib/server/gateway/settings.ts
+import { createHash, randomBytes } from "node:crypto";
+import {
+  chmod,
+  lstat,
+  mkdir as mkdir3,
+  readFile as readFile3,
+  realpath,
+  rename as rename3,
+  rm,
+  stat as stat3,
+  writeFile as writeFile3
+} from "node:fs/promises";
+import path5 from "node:path";
+
+// src/lib/bell.ts
+var ALERT_KINDS = [
+  {
+    kind: "pr-green",
+    label: "PR green",
+    hint: "A pull request passed its checks and waits on you"
+  },
+  { kind: "question", label: "Question waiting", hint: "Firstmate needs your decision" },
+  { kind: "stuck", label: "Worker stuck", hint: "Blocked, failed, lost contact or gone quiet" },
+  { kind: "landed", label: "Merge landed", hint: "A pull request was merged" },
+  { kind: "issue", label: "New issue", hint: "A GitHub issue you watch, with the bell on" }
+];
+var QUIET_AFTER_MS = 20 * 6e4;
+
+// src/lib/server/gateway/settings.ts
+var GATEWAY_SETTINGS_SCHEMA = "wheelhouse-gateway-settings.v1";
+var SETTINGS_FILE = "settings.json";
+var gatewayDir = (configDir) => path5.join(configDir, "gateway");
+function defaultSettings() {
+  return Object.fromEntries(
+    GATEWAY_CHANNELS.map((c) => [
+      c.channel,
+      { enabled: true, paired: null, alerts: [...DEFAULT_GATEWAY_ALERTS], titlesOnly: false }
+    ])
+  );
+}
+function cleanToken(raw) {
+  const t = raw.trim().replace(/^Bot\s+/i, "");
+  if (t.length < 50 || t.length > 200) return null;
+  return /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(t) ? t : null;
+}
+var isObj = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+var str2 = (v) => typeof v === "string" && v ? v : null;
+var KINDS = new Set(ALERT_KINDS.map((k) => k.kind));
+function parsePeer(v) {
+  if (!isObj(v)) return null;
+  const id = str2(v.id);
+  if (!id || !/^\d{1,32}$/.test(id)) return null;
+  return { id, name: str2(v.name) ?? id, dm: str2(v.dm), at: str2(v.at) ?? (/* @__PURE__ */ new Date(0)).toISOString() };
+}
+function parseChannel(v, fallback) {
+  if (!isObj(v)) return fallback;
+  return {
+    enabled: typeof v.enabled === "boolean" ? v.enabled : fallback.enabled,
+    paired: parsePeer(v.paired),
+    alerts: Array.isArray(v.alerts) ? v.alerts.filter((k) => KINDS.has(k)) : fallback.alerts,
+    titlesOnly: typeof v.titlesOnly === "boolean" ? v.titlesOnly : fallback.titlesOnly
+  };
+}
+async function writeAtomic(file, text2) {
+  await mkdir3(path5.dirname(file), { recursive: true, mode: 448 });
+  const tmp = `${file}.tmp-${process.pid}-${randomBytes(4).toString("hex")}`;
+  try {
+    await writeFile3(tmp, text2, { mode: 384 });
+    await rename3(tmp, file);
+  } catch (e) {
+    await rm(tmp, { force: true });
+    throw e;
+  }
+}
+var GatewaySettings = class {
+  constructor(dir, keychain = null) {
+    this.dir = dir;
+    this.keychain = keychain;
+  }
+  dir;
+  keychain;
+  get file() {
+    return path5.join(this.dir, SETTINGS_FILE);
+  }
+  tokenFile(channel) {
+    return path5.join(this.dir, `${channel}.token`);
+  }
+  /** The settings, with defaults for anything missing; an unreadable file reads as the defaults, with why. */
+  async read() {
+    const settings2 = defaultSettings();
+    let text2;
+    try {
+      text2 = await readFile3(this.file, "utf8");
+    } catch (e) {
+      if (e.code === "ENOENT") return { settings: settings2, error: null };
+      return { settings: settings2, error: `${this.file} could not be read: ${e.message}` };
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(text2);
+    } catch {
+      return { settings: settings2, error: `${this.file} is not valid JSON.` };
+    }
+    if (!isObj(parsed) || parsed.schema !== GATEWAY_SETTINGS_SCHEMA) {
+      return { settings: settings2, error: `${this.file} is not a Wheelhouse gateway settings file.` };
+    }
+    for (const { channel } of GATEWAY_CHANNELS) {
+      settings2[channel] = parseChannel(parsed[channel], settings2[channel]);
+    }
+    return { settings: settings2, error: null };
+  }
+  /** Change the settings and write them; an unreadable file is replaced with the change applied to the defaults. */
+  async update(change) {
+    const { settings: settings2 } = await this.read();
+    change(settings2);
+    await writeAtomic(
+      this.file,
+      JSON.stringify({ schema: GATEWAY_SETTINGS_SCHEMA, ...settings2 }, null, "	") + "\n"
+    );
+    return settings2;
+  }
+  /**
+   * The channel's bot token and where it is kept, or null when none is set:
+   * the Keychain first, then the file. A token file that is not a plain file
+   * is ignored.
+   */
+  async find(channel) {
+    const kept = this.keychain ? await this.keychain.get(await this.keychainAccount(channel)).catch(() => null) : null;
+    const fromKeychain = kept ? cleanToken(kept) : null;
+    if (fromKeychain) return { token: fromKeychain, where: this.keychain.where };
+    const file = this.tokenFile(channel);
+    try {
+      const s = await lstat(file);
+      if (!s.isFile()) return null;
+      if ((s.mode & 63) !== 0) await chmod(file, 384);
+      const token = cleanToken(await readFile3(file, "utf8"));
+      return token ? { token, where: file } : null;
+    } catch {
+      return null;
+    }
+  }
+  async token(channel) {
+    return (await this.find(channel))?.token ?? null;
+  }
+  /**
+   * The Keychain account for the channel's token in this directory: the
+   * channel and a digest of the directory's real path, so each config
+   * directory has its own token.
+   */
+  async keychainAccount(channel) {
+    const real2 = await realpath(this.dir).catch(() => path5.resolve(this.dir));
+    return `${channel}:${createHash("sha256").update(real2).digest("hex").slice(0, 16)}`;
+  }
+  /** Keep the token in the Keychain, else in its file, replacing the one before; returns where it went. */
+  async setToken(channel, token) {
+    await mkdir3(this.dir, { recursive: true, mode: 448 });
+    const keychain = this.keychain;
+    const account = await this.keychainAccount(channel);
+    const kept = keychain ? await keychain.set(account, token).then(
+      () => true,
+      () => false
+    ) : false;
+    if (kept) {
+      await rm(this.tokenFile(channel), { force: true });
+    } else {
+      await keychain?.remove(account).catch(() => false);
+      await writeAtomic(this.tokenFile(channel), `${token}
+`);
+      await chmod(this.dir, 448).catch(() => {
+      });
+    }
+    await this.update(() => {
+    });
+    return kept ? keychain.where : this.tokenFile(channel);
+  }
+  /** Changes whenever a file is written (setting a Keychain token rewrites the settings), so the server can pick up what the CLI changed. */
+  async stamp() {
+    const one = async (f) => {
+      try {
+        const s = await stat3(f);
+        return `${s.mtimeMs}:${s.size}:${s.ino}`;
+      } catch {
+        return "-";
+      }
+    };
+    const files = [this.file, ...GATEWAY_CHANNELS.map((c) => this.tokenFile(c.channel))];
+    return (await Promise.all(files.map(one))).join("|");
+  }
+};
+
+// cli/gateway.ts
+var CHANNELS = GATEWAY_CHANNELS.map((c) => c.channel);
+var labelOf = (c) => GATEWAY_CHANNELS.find((x) => x.channel === c).label;
+function parseChannel2(v) {
+  if (!CHANNELS.includes(v)) {
+    throw new InvalidArgumentError(`Channels: ${CHANNELS.join(", ")}.`);
+  }
+  return v;
+}
+function parsePort(value) {
+  const n = Number(value);
+  if (!Number.isInteger(n) || n < 1 || n > 65535) {
+    throw new InvalidArgumentError("Port must be a whole number from 1 to 65535.");
+  }
+  return n;
+}
+async function readSecret(question2) {
+  const input = process.stdin;
+  if (!input.isTTY) {
+    const chunks = [];
+    for await (const c of input) chunks.push(Buffer.from(c));
+    return Buffer.concat(chunks).toString("utf8");
+  }
+  process.stdout.write(question2);
+  input.setRawMode(true);
+  input.setEncoding("utf8");
+  input.resume();
+  return new Promise((resolve, reject) => {
+    let value = "";
+    const stop = () => {
+      input.off("data", onData);
+      input.setRawMode(false);
+      input.pause();
+      process.stdout.write("\n");
+    };
+    const onData = (s) => {
+      for (const ch of s) {
+        if (ch === "\r" || ch === "\n") {
+          stop();
+          return resolve(value);
+        }
+        if (ch === "" || ch === "") {
+          stop();
+          return reject(new Error("cancelled"));
+        }
+        if (ch === "\x7F" || ch === "\b") value = value.slice(0, -1);
+        else value += ch;
+      }
+    };
+    input.on("data", onData);
+  });
+}
+async function liveView(port) {
+  try {
+    const r = await fetch(`http://127.0.0.1:${port}/api/gateway`, {
+      signal: AbortSignal.timeout(1500)
+    });
+    return r.ok ? await r.json() : null;
+  } catch {
+    return null;
+  }
+}
+function gatewayCommand(over = {}) {
+  const deps = {
+    env: process.env,
+    readSecret,
+    check: (token) => checkDiscordToken(token, { version }),
+    keychain: defaultKeychain(),
+    live: liveView,
+    log: (line) => console.log(line),
+    error: (line) => console.error(line),
+    ...over
+  };
+  const cmd = new Command("gateway").description("Reach Firstmate from your phone: set up the chat channels (Discord).").option(
+    "--config-dir <dir>",
+    "the Wheelhouse config directory (default: $WHEELHOUSE_CONFIG_DIR, else $XDG_CONFIG_HOME/wheelhouse, else ~/.config/wheelhouse)"
+  );
+  const settingsFor = (c) => {
+    const dir = c.optsWithGlobals().configDir;
+    const configDir = dir ? path6.resolve(dir) : defaultConfigDir(deps.env);
+    const found = resolveInstall({ cwd: process.cwd(), env: deps.env });
+    if (found.ok && isInside(configDir, found.install.homeDir)) {
+      deps.error(
+        `wheelhouse: the config directory ${configDir} is inside the Firstmate home, where the crew can read it. Pass --config-dir <dir> outside it.`
+      );
+      process.exitCode = 1;
+      return null;
+    }
+    return new GatewaySettings(gatewayDir(configDir), deps.keychain);
+  };
+  const fail = (line) => {
+    deps.error(`wheelhouse: ${line}`);
+    process.exitCode = 1;
+  };
+  cmd.command("connect <channel>").description(
+    "Set the bot token for a channel (asked for here, never taken from the command line)."
+  ).action(async (channel, _o, c) => {
+    const ch = parseChannel2(channel);
+    const settings2 = settingsFor(c);
+    if (!settings2) return;
+    let raw;
+    try {
+      raw = await deps.readSecret(`${labelOf(ch)} bot token (input hidden): `);
+    } catch {
+      return fail("cancelled; nothing was changed.");
+    }
+    const token = cleanToken(raw);
+    if (!token) {
+      return fail(
+        "that does not look like a bot token. Copy it from the Bot page of your application in the Discord Developer Portal (Reset Token)."
+      );
+    }
+    const checked = await deps.check(token);
+    if (!checked.ok) return fail(`${checked.error} Nothing was changed.`);
+    const where = await settings2.setToken(ch, token);
+    deps.log(`Saved the ${labelOf(ch)} bot token in ${where} (readable by you only).`);
+    deps.log(`Bot: ${checked.bot.name} (id ${checked.bot.id}).`);
+    if (checked.publicBot) {
+      deps.log(
+        'Warning: "Public Bot" is on, so anyone with its link can add it to their server. Turn it off on the Bot page.'
+      );
+    }
+    deps.log(
+      `Add it to a private server you are in (it needs no permissions): ${inviteUrl(checked.appId)}`
+    );
+    deps.log("Next: in Wheelhouse, open Settings \u2192 Gateway and pair your account.");
+  });
+  for (const [name, on] of [
+    ["on", true],
+    ["off", false]
+  ]) {
+    cmd.command(`${name} [channel]`).description(
+      on ? "Turn a channel on (default: discord)." : "Turn a channel off: it neither reads nor sends (default: discord)."
+    ).action(async (channel, _o, c) => {
+      const ch = parseChannel2(channel ?? "discord");
+      const settings2 = settingsFor(c);
+      if (!settings2) return;
+      await settings2.update((s) => s[ch].enabled = on);
+      deps.log(`${labelOf(ch)} is turned ${name}.`);
+    });
+  }
+  cmd.command("unbind [channel]").description(
+    "Forget the paired account: no one\u2019s messages reach Firstmate until you pair again (default: discord)."
+  ).action(async (channel, _o, c) => {
+    const ch = parseChannel2(channel ?? "discord");
+    const settings2 = settingsFor(c);
+    if (!settings2) return;
+    const { settings: before } = await settings2.read();
+    await settings2.update((s) => s[ch].paired = null);
+    deps.log(
+      before[ch].paired ? `Unbound ${before[ch].paired.name} from ${labelOf(ch)}.` : `No account was bound to ${labelOf(ch)}.`
+    );
+  });
+  cmd.command("titles-only").addArgument(new Argument("<state>", "on or off").choices(["on", "off"])).argument("[channel]").description(
+    "Send alerts and decisions as their titles only, without their text, or in full again (default: discord)."
+  ).action(async (state, channel, _o, c) => {
+    const ch = parseChannel2(channel ?? "discord");
+    const settings2 = settingsFor(c);
+    if (!settings2) return;
+    await settings2.update((s) => s[ch].titlesOnly = state === "on");
+    deps.log(
+      state === "on" ? `${labelOf(ch)} sends alerts and decisions as titles only.` : `${labelOf(ch)} sends alerts and decisions in full.`
+    );
+  });
+  cmd.command("status").description(
+    "Show each channel: its token, whether it is on, who is paired, and the connection."
+  ).option("--port <n>", "the port the running Wheelhouse listens on", parsePort, 4310).action(async (o, c) => {
+    const settings2 = settingsFor(c);
+    if (!settings2) return;
+    const { settings: s, error } = await settings2.read();
+    if (error) deps.log(`Warning: ${error}`);
+    const live = await deps.live(o.port);
+    for (const { channel, label: label2 } of GATEWAY_CHANNELS) {
+      const cs = s[channel];
+      const token = await settings2.find(channel);
+      const lv = live?.channels.find((x) => x.channel === channel);
+      deps.log(label2);
+      deps.log(
+        `  Bot token:   ${token ? `set (${token.where})` : `not set (wheelhouse gateway connect ${channel})`}`
+      );
+      deps.log(`  Turned:      ${cs.enabled ? "on" : "off"}`);
+      deps.log(
+        `  Paired:      ${cs.paired ? `${cs.paired.name} (id ${cs.paired.id}), since ${cs.paired.at.slice(0, 10)}` : "no one (pair in Settings \u2192 Gateway)"}`
+      );
+      deps.log(`  Alerts:      ${cs.alerts.length ? cs.alerts.join(", ") : "none"}`);
+      deps.log(`  Titles only: ${cs.titlesOnly ? "on" : "off"}`);
+      deps.log(
+        `  Connection:  ${lv ? `${lv.state}${lv.bot && lv.state === "connected" ? ` as ${lv.bot.name}` : ""}${lv.reason ? ` (${lv.reason})` : ""}` : `no Wheelhouse answers on port ${o.port}; the gateway runs only while Wheelhouse does`}`
+      );
+    }
+  });
+  return cmd;
+}
+
+// cli/plugin.ts
+import { createInterface } from "node:readline/promises";
+import path10 from "node:path";
+import { Command as Command2 } from "commander";
+
+// src/lib/server/plugins/install.ts
+import { execFile } from "node:child_process";
+import { mkdir as mkdir4, mkdtemp, readFile as readFile4, realpath as realpath2, rename as rename4, rm as rm2, stat as stat4 } from "node:fs/promises";
+import path8 from "node:path";
+
+// src/lib/server/plugins/manifest.ts
+import path7 from "node:path";
+
+// src/lib/plugins/addresses.ts
+var TEMPLATE = /^[a-z0-9-]*\{port\}[a-z0-9-]*(?:\.[a-z0-9-]+)*\.localhost$/;
+function validHostTemplate(v) {
+  return typeof v === "string" && v.length <= 100 && TEMPLATE.test(v);
+}
+
+// src/lib/plugins/types.ts
+var SLOTS = [
+  "project.tab",
+  "harbour.card",
+  "task.section",
+  "step.evidence",
+  "bridge.card",
+  "home.card",
+  "header.indicator",
+  "nav.page"
+];
+
+// src/lib/server/plugins/types.ts
+var PLUGIN_API_VERSION = 1;
+var SUPPORTED_API_VERSIONS = [PLUGIN_API_VERSION, PLUGIN_API_VERSION - 1].filter(
+  (v) => v >= 1
+);
+
+// src/lib/server/plugins/manifest.ts
+var MANIFEST_DIR = ".wheelhouse-plugin";
+var MANIFEST_FILE = "plugin.json";
+var manifestPath = (pluginDir) => path7.join(pluginDir, MANIFEST_DIR, MANIFEST_FILE);
+var MANIFEST_FIELDS = [
+  "$schema",
+  "name",
+  "displayName",
+  "version",
+  "description",
+  "author",
+  "repository",
+  "homepage",
+  "license",
+  "keywords",
+  "wheelhouse"
+];
+var WHEELHOUSE_FIELDS = [
+  "apiVersion",
+  "server",
+  "ui",
+  "enabledByDefault",
+  "enabledWhenFile",
+  "enabledWhenHomeFile",
+  "contributions",
+  "services",
+  "settings",
+  "mcpServers",
+  "addressRewrites",
+  "hostRoutes"
+];
+var SETTING_FIELDS = [
+  "title",
+  "description",
+  "type",
+  "required",
+  "default",
+  "options"
+];
+var SETTING_TYPES = ["text", "number", "boolean", "list"];
+var ID = /^[a-z][a-z0-9-]{0,39}$/;
+var SETTING_KEY = /^[A-Za-z][A-Za-z0-9_]{0,39}$/;
+var MAX_SETTINGS = 20;
+var MAX_OPTIONS = 20;
+var MAX_LIST = 50;
+var SEMVER = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+var MAX_TEXT = 400;
+var isRecord3 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+function insidePath(f) {
+  return typeof f === "string" && f.length > 0 && !path7.isAbsolute(f) && !f.split(/[\\/]/).some((part) => part === ".." || part === "" || part === ".");
+}
+var Invalid = class extends Error {
+};
+function text(v, where, optional = false) {
+  if (v === void 0 && optional) return null;
+  if (typeof v !== "string" || !v.trim()) throw new Invalid(`${where} must be text`);
+  if (v.length > MAX_TEXT) throw new Invalid(`${where} is longer than ${MAX_TEXT} characters`);
+  return v;
+}
+function only(o, where, keys) {
+  for (const k of Object.keys(o)) {
+    if (!keys.includes(k)) throw new Invalid(`unknown field "${where ? `${where}.` : ""}${k}"`);
+  }
+}
+function entry(v, where) {
+  if (!insidePath(v)) throw new Invalid(`${where} must be a plain path inside the plugin`);
+  if (!/\.m?js$/.test(v)) throw new Invalid(`${where} must be a JavaScript module (.js or .mjs)`);
+  return v;
+}
+function author(v) {
+  if (v === void 0) return null;
+  if (typeof v === "string") return { name: text(v, "author") };
+  if (!isRecord3(v)) throw new Invalid("author must be text or an object");
+  only(v, "author", ["name", "email", "url"]);
+  const a = { name: text(v.name, "author.name") };
+  const email = text(v.email, "author.email", true);
+  const url = text(v.url, "author.url", true);
+  if (email) a.email = email;
+  if (url) a.url = url;
+  return a;
+}
+function wheelhouse(v) {
+  if (!isRecord3(v)) throw new Invalid('"wheelhouse" must be an object');
+  only(v, "wheelhouse", WHEELHOUSE_FIELDS);
+  if (typeof v.apiVersion !== "number" || !Number.isInteger(v.apiVersion)) {
+    throw new Invalid("wheelhouse.apiVersion must be a whole number");
+  }
+  if (!SUPPORTED_API_VERSIONS.includes(v.apiVersion)) {
+    throw new Invalid(
+      `it was written for plugin contract ${v.apiVersion}; this Wheelhouse supports ${SUPPORTED_API_VERSIONS.join(" and ")}`
+    );
+  }
+  const w = {
+    apiVersion: v.apiVersion,
+    server: entry(v.server, "wheelhouse.server"),
+    ui: v.ui === void 0 ? null : entry(v.ui, "wheelhouse.ui"),
+    contributions: [],
+    services: [],
+    settings: settings(v.settings),
+    mcpServers: [],
+    addressRewrites: hosts(v.addressRewrites, "addressRewrites", "to"),
+    hostRoutes: hosts(v.hostRoutes, "hostRoutes", "host")
+  };
+  if (v.enabledByDefault !== void 0) {
+    if (typeof v.enabledByDefault !== "boolean") {
+      throw new Invalid("wheelhouse.enabledByDefault must be true or false");
+    }
+    w.enabledByDefault = v.enabledByDefault;
+  }
+  for (const k of ["enabledWhenFile", "enabledWhenHomeFile"]) {
+    if (v[k] === void 0) continue;
+    if (!insidePath(v[k])) throw new Invalid(`wheelhouse.${k} must be a plain relative path`);
+    w[k] = v[k];
+  }
+  if (!Array.isArray(v.contributions)) {
+    throw new Invalid("wheelhouse.contributions must be a list");
+  }
+  for (const [i, c] of v.contributions.entries()) {
+    const where = `wheelhouse.contributions[${i}]`;
+    if (!isRecord3(c)) throw new Invalid(`${where} must be an object`);
+    only(c, where, ["id", "slot"]);
+    if (typeof c.id !== "string" || !ID.test(c.id)) {
+      throw new Invalid(`${where}.id must be lower-case letters, digits and dashes`);
+    }
+    if (!SLOTS.includes(c.slot)) {
+      throw new Invalid(`${where}.slot must be one of ${SLOTS.join(", ")}`);
+    }
+    if (w.contributions.some((x) => x.id === c.id)) {
+      throw new Invalid(`it declares contribution "${c.id}" twice`);
+    }
+    w.contributions.push({ id: c.id, slot: c.slot });
+  }
+  if (v.services !== void 0) {
+    if (!Array.isArray(v.services)) throw new Invalid("wheelhouse.services must be a list");
+    for (const [i, s] of v.services.entries()) {
+      const where = `wheelhouse.services[${i}]`;
+      if (!isRecord3(s)) throw new Invalid(`${where} must be an object`);
+      only(s, where, ["id", "scope"]);
+      if (typeof s.id !== "string" || !ID.test(s.id)) {
+        throw new Invalid(`${where}.id must be lower-case letters, digits and dashes`);
+      }
+      if (s.scope !== "fleet" && s.scope !== "project") {
+        throw new Invalid(`${where}.scope must be "fleet" or "project"`);
+      }
+      if (w.services.some((x) => x.id === s.id)) {
+        throw new Invalid(`it declares service "${s.id}" twice`);
+      }
+      w.services.push({ id: s.id, scope: s.scope });
+    }
+  }
+  if (v.mcpServers !== void 0) {
+    if (!Array.isArray(v.mcpServers)) throw new Invalid("wheelhouse.mcpServers must be a list");
+    for (const [i, s] of v.mcpServers.entries()) {
+      const where = `wheelhouse.mcpServers[${i}]`;
+      if (!isRecord3(s)) throw new Invalid(`${where} must be an object`);
+      only(s, where, ["id", "service"]);
+      if (typeof s.id !== "string" || !ID.test(s.id)) {
+        throw new Invalid(`${where}.id must be lower-case letters, digits and dashes`);
+      }
+      if (typeof s.service !== "string" || !w.services.some((x) => x.id === s.service)) {
+        throw new Invalid(`${where}.service must be one of the services it declares`);
+      }
+      if (w.mcpServers.some((x) => x.id === s.id)) {
+        throw new Invalid(`it declares MCP server "${s.id}" twice`);
+      }
+      w.mcpServers.push({ id: s.id, service: s.service });
+    }
+  }
+  return w;
+}
+function hosts(v, field, key) {
+  if (v === void 0) return [];
+  if (!Array.isArray(v)) throw new Invalid(`wheelhouse.${field} must be a list`);
+  const out = [];
+  for (const [i, h] of v.entries()) {
+    const where = `wheelhouse.${field}[${i}]`;
+    if (!isRecord3(h)) throw new Invalid(`${where} must be an object`);
+    only(h, where, ["id", key]);
+    if (typeof h.id !== "string" || !ID.test(h.id)) {
+      throw new Invalid(`${where}.id must be lower-case letters, digits and dashes`);
+    }
+    if (!validHostTemplate(h[key])) {
+      throw new Invalid(
+        `${where}.${key} must be a host name ending in .localhost with {port} in its first label, such as {port}.localhost`
+      );
+    }
+    if (out.some((x) => x.id === h.id)) throw new Invalid(`it declares ${field} "${h.id}" twice`);
+    out.push({ id: h.id, [key]: h[key] });
+  }
+  return out;
+}
+function settings(v) {
+  if (v === void 0) return [];
+  if (!isRecord3(v)) throw new Invalid("wheelhouse.settings must be an object of settings by key");
+  const keys = Object.keys(v);
+  if (keys.length > MAX_SETTINGS) {
+    throw new Invalid(`wheelhouse.settings declares more than ${MAX_SETTINGS} settings`);
+  }
+  return keys.map((key) => {
+    const where = `wheelhouse.settings.${key}`;
+    if (!SETTING_KEY.test(key)) {
+      throw new Invalid(
+        `wheelhouse.settings key "${key}" must start with a letter and hold only letters, digits and underscores`
+      );
+    }
+    const s = v[key];
+    if (!isRecord3(s)) throw new Invalid(`${where} must be an object`);
+    only(s, where, SETTING_FIELDS);
+    const type = s.type === void 0 ? "text" : s.type;
+    if (!SETTING_TYPES.includes(type)) {
+      throw new Invalid(`${where}.type must be one of ${SETTING_TYPES.join(", ")}`);
+    }
+    if (s.required !== void 0 && typeof s.required !== "boolean") {
+      throw new Invalid(`${where}.required must be true or false`);
+    }
+    const spec = {
+      key,
+      title: text(s.title, `${where}.title`, true) ?? key,
+      description: text(s.description, `${where}.description`, true),
+      type,
+      required: s.required ?? false
+    };
+    if (s.options !== void 0) {
+      if (type !== "text") throw new Invalid(`${where}.options are for a text setting only`);
+      spec.options = options(s.options, `${where}.options`);
+    }
+    if (s.default !== void 0) {
+      const ok = type === "number" ? typeof s.default === "number" && Number.isFinite(s.default) : type === "boolean" ? typeof s.default === "boolean" : type === "list" ? Array.isArray(s.default) && s.default.length <= MAX_LIST && s.default.every((x) => typeof x === "string" && x.trim() && x.length <= MAX_TEXT) : typeof s.default === "string" && s.default.length <= MAX_TEXT && (!spec.options || spec.options.some((o) => o.value === s.default));
+      if (!ok) {
+        const want = {
+          text: spec.options ? "one of its options" : "text",
+          number: "a number",
+          boolean: "true or false",
+          list: "a list of texts"
+        }[type];
+        throw new Invalid(`${where}.default must be ${want}`);
+      }
+      spec.default = s.default;
+    }
+    return spec;
+  });
+}
+function options(v, where) {
+  if (!Array.isArray(v) || !v.length || v.length > MAX_OPTIONS) {
+    throw new Invalid(`${where} must be a list of 1 to ${MAX_OPTIONS} options`);
+  }
+  const seen = /* @__PURE__ */ new Set();
+  return v.map((o, i) => {
+    if (!isRecord3(o)) throw new Invalid(`${where}[${i}] must be an object`);
+    only(o, `${where}[${i}]`, ["value", "label"]);
+    const value = text(o.value, `${where}[${i}].value`);
+    if (seen.has(value)) throw new Invalid(`${where} has "${value}" twice`);
+    seen.add(value);
+    return { value, label: text(o.label, `${where}[${i}].label`, true) ?? value };
+  });
+}
+function parseManifest(text_) {
+  let raw;
+  try {
+    raw = JSON.parse(text_);
+  } catch (e) {
+    return { ok: false, error: `not valid JSON: ${e.message}` };
+  }
+  try {
+    if (!isRecord3(raw)) throw new Invalid("expected a JSON object");
+    only(raw, "", MANIFEST_FIELDS);
+    if (typeof raw.name !== "string" || !ID.test(raw.name)) {
+      throw new Invalid("name must be lower-case letters, digits and dashes (at most 40)");
+    }
+    if (typeof raw.version !== "string" || !SEMVER.test(raw.version)) {
+      throw new Invalid("version must be a semantic version, such as 0.1.0");
+    }
+    if (raw.wheelhouse === void 0) {
+      throw new Invalid('"wheelhouse" is missing, so this is not a Wheelhouse plugin');
+    }
+    const keywords = raw.keywords === void 0 ? [] : raw.keywords;
+    if (!Array.isArray(keywords) || keywords.some((k) => typeof k !== "string")) {
+      throw new Invalid("keywords must be a list of text");
+    }
+    return {
+      ok: true,
+      manifest: {
+        name: raw.name,
+        displayName: text(raw.displayName, "displayName", true) ?? raw.name,
+        version: raw.version,
+        description: text(raw.description, "description", true),
+        author: author(raw.author),
+        repository: text(raw.repository, "repository", true),
+        homepage: text(raw.homepage, "homepage", true),
+        license: text(raw.license, "license", true),
+        keywords,
+        wheelhouse: wheelhouse(raw.wheelhouse)
+      }
+    };
+  } catch (e) {
+    if (e instanceof Invalid) return { ok: false, error: e.message };
+    throw e;
+  }
+}
+
+// src/lib/server/plugins/settings.ts
+var ATTEMPTS = 3;
+var has = (o, k) => Object.prototype.hasOwnProperty.call(o, k);
+function parseGiven(pairs) {
+  const given2 = {};
+  for (const p of pairs) {
+    const at = p.indexOf("=");
+    if (at < 1) return { ok: false, error: `--setting "${p}" is not key=value` };
+    given2[p.slice(0, at).trim()] = p.slice(at + 1);
+  }
+  return { ok: true, given: given2 };
+}
+function parseValue(spec, text2) {
+  const t = text2.trim();
+  if (spec.type === "list") {
+    const items = [
+      ...new Set(
+        t.split(",").map((x) => x.trim()).filter(Boolean)
+      )
+    ];
+    return items.length || !spec.required ? { ok: true, value: items } : { ok: false, error: `${spec.title} needs at least one` };
+  }
+  if (spec.options) {
+    const o = spec.options.find((x) => x.value === t || x.label.toLowerCase() === t.toLowerCase());
+    return o ? { ok: true, value: o.value } : {
+      ok: false,
+      error: `${spec.title} must be one of ${spec.options.map((x) => x.label).join(", ")}`
+    };
+  }
+  if (spec.type === "number") {
+    const n = Number(t);
+    return t !== "" && Number.isFinite(n) ? { ok: true, value: n } : { ok: false, error: `${spec.title} must be a number` };
+  }
+  if (spec.type === "boolean") {
+    if (/^(y|yes|true|on)$/i.test(t)) return { ok: true, value: true };
+    if (/^(n|no|false|off)$/i.test(t)) return { ok: true, value: false };
+    return { ok: false, error: `${spec.title} must be yes or no` };
+  }
+  return t ? { ok: true, value: t } : { ok: false, error: `${spec.title} must not be empty` };
+}
+function showValue(spec, v) {
+  if (v === true) return "yes";
+  if (v === false) return "no";
+  if (Array.isArray(v)) return v.join(", ");
+  return spec.options?.find((o) => o.value === v)?.label ?? String(v);
+}
+function question(spec, offered) {
+  const optional = spec.required ? "" : " (optional)";
+  const kind = spec.type === "boolean" ? " (y/n)" : spec.type === "list" ? " (separate with commas)" : spec.options ? ` (${spec.options.map((o) => o.label).join(" / ")})` : "";
+  const def = offered === void 0 ? "" : ` [${showValue(spec, offered)}]`;
+  return `${spec.title}${optional}${kind}${def}: `;
+}
+async function gatherSettings(id, specs, o) {
+  for (const k of Object.keys(o.given)) {
+    if (!specs.some((s) => s.key === k)) {
+      return { ok: false, error: `${id} has no setting "${k}"` };
+    }
+  }
+  const settings2 = { ...o.current };
+  let introduced = false;
+  for (const spec of specs) {
+    if (has(o.given, spec.key)) {
+      const v = parseValue(spec, o.given[spec.key]);
+      if (!v.ok) return { ok: false, error: `--setting ${spec.key}: ${v.error}` };
+      settings2[spec.key] = v.value;
+      continue;
+    }
+    if (has(o.current, spec.key)) continue;
+    const offered = spec.default;
+    if (!o.ask) {
+      if (offered !== void 0) settings2[spec.key] = offered;
+      else if (spec.required) {
+        return {
+          ok: false,
+          error: `${id} needs ${spec.title}; pass --setting ${spec.key}=<value>`
+        };
+      }
+      continue;
+    }
+    if (!introduced) {
+      o.log(o.intro);
+      introduced = true;
+    }
+    if (spec.description) o.log(`  ${spec.description}`);
+    let answered = false;
+    for (let i = 0; i < ATTEMPTS && !answered; i++) {
+      const a = await o.ask(question(spec, offered));
+      if (a === null) return { ok: false, error: `stopped before ${spec.title} was answered` };
+      if (!a.trim()) {
+        if (offered !== void 0) {
+          settings2[spec.key] = offered;
+          answered = true;
+        } else if (!spec.required) answered = true;
+        else o.log(`  ${spec.title} is needed.`);
+        continue;
+      }
+      const v = parseValue(spec, a);
+      if (v.ok) {
+        settings2[spec.key] = v.value;
+        answered = true;
+      } else o.log(`  ${v.error}.`);
+    }
+    if (!answered) return { ok: false, error: `${id} needs ${spec.title}` };
+  }
+  return { ok: true, settings: settings2 };
+}
+
+// src/lib/server/plugins/install.ts
+var ID2 = /^[a-z][a-z0-9-]{0,39}$/;
+var NAME = /^[A-Za-z0-9_.-]+$/;
+var SHA = /^[0-9a-f]{7,40}$/;
+function parseSource(spec) {
+  const m = /^([^/@\s]+)\/([^/@\s]+?)(?:\.git)?(?:@(\S+))?$/.exec(spec.trim());
+  if (!m || !NAME.test(m[1]) || !NAME.test(m[2]) || m[1].startsWith("-") || m[2].startsWith(".")) {
+    return null;
+  }
+  const ref = m[3] ?? null;
+  if (ref !== null && (ref.startsWith("-") || !/^[A-Za-z0-9_./-]+$/.test(ref))) return null;
+  return { org: m[1], repo: m[2], ref };
+}
+var runGit = (args, cwd) => new Promise((resolve) => {
+  execFile(
+    "git",
+    args,
+    {
+      cwd,
+      env: { ...process.env, GIT_TERMINAL_PROMPT: "0" },
+      maxBuffer: 4 * 1024 * 1024
+    },
+    (err, stdout, stderr) => resolve({
+      code: err ? typeof err.code === "number" ? err.code : 1 : 0,
+      stdout: String(stdout),
+      stderr: String(stderr)
+    })
+  );
+});
+var githubUrl = (s) => `https://github.com/${s.org}/${s.repo}.git`;
+var short = (commit) => commit.slice(0, 12);
+var label = (r) => `${r.repository}${r.ref ? `@${r.ref}` : ""}`;
+var Refused = class extends Error {
+};
+async function fetchSource(source, into, deps) {
+  const git = deps.git ?? runGit;
+  const url = (deps.gitUrl ?? githubUrl)(source);
+  const step = async (args) => {
+    const r = await git(args, into);
+    if (r.code !== 0)
+      throw new Refused(r.stderr.trim().split("\n").pop() || `git ${args[0]} failed`);
+    return r.stdout.trim();
+  };
+  await step(["init", "-q"]);
+  const want = source.ref ?? "HEAD";
+  const shallow = await git(["fetch", "-q", "--depth", "1", url, want], into);
+  if (shallow.code !== 0) {
+    if (!source.ref || !SHA.test(source.ref)) {
+      throw new Refused(
+        `could not fetch ${source.org}/${source.repo}${source.ref ? ` at ${source.ref}` : ""}: ${shallow.stderr.trim().split("\n").pop() ?? ""}`
+      );
+    }
+    await step(["fetch", "-q", url]);
+    await step(["checkout", "-q", "--detach", source.ref]);
+  } else {
+    await step(["checkout", "-q", "--detach", "FETCH_HEAD"]);
+  }
+  const commit = await step(["rev-parse", "HEAD"]);
+  await rm2(path8.join(into, ".git"), { recursive: true, force: true });
+  return commit;
+}
+async function checkCopy(dir) {
+  let text2;
+  try {
+    text2 = await readFile4(manifestPath(dir), "utf8");
+  } catch {
+    throw new Refused("it has no .wheelhouse-plugin/plugin.json, so it is not a Wheelhouse plugin");
+  }
+  const parsed = parseManifest(text2);
+  if (!parsed.ok) throw new Refused(`its manifest is not valid: ${parsed.error}`);
+  const m = parsed.manifest;
+  const base = await realpath2(dir);
+  for (const [what, rel] of [
+    ["server entry", m.wheelhouse.server],
+    ["ui bundle", m.wheelhouse.ui]
+  ]) {
+    if (!rel) continue;
+    let file;
+    try {
+      file = await realpath2(path8.join(base, rel));
+      if (!(await stat4(file)).isFile()) throw new Error();
+    } catch {
+      throw new Refused(`its ${what} ${rel} is missing`);
+    }
+    if (!file.startsWith(base + path8.sep))
+      throw new Refused(`its ${what} leads outside the plugin`);
+  }
+  return m;
+}
+function enabledText(m) {
+  const w = m.wheelhouse;
+  return w.enabledWhenHomeFile ? `while the Firstmate home has ${w.enabledWhenHomeFile}` : w.enabledWhenFile ? `for projects whose clone has ${w.enabledWhenFile}` : w.enabledByDefault ? "for every project" : "only where your plugins file turns it on";
+}
+function describeManifest(m, from, commit) {
+  const w = m.wheelhouse;
+  const enabled = enabledText(m);
+  return [
+    `${m.displayName} (${m.name}) ${m.version}`,
+    ...m.description ? [`  ${m.description}`] : [],
+    `  From:      ${from}`,
+    `  Commit:    ${commit}`,
+    ...m.author ? [`  Author:    ${m.author.name}${m.author.url ? ` <${m.author.url}>` : ""}`] : [],
+    ...m.repository ? [`  Homepage:  ${m.repository}`] : [],
+    `  Contract:  plugin API ${w.apiVersion}`,
+    `  Slots:     ${w.contributions.map((c) => `${c.slot} (${c.id})`).join(", ") || "none"}`,
+    `  Services:  ${w.services.map((s) => `${s.id} (${s.scope})`).join(", ") || "none"}`,
+    `  Settings:  ${w.settings.map((s) => `${s.key}${s.required ? " (required)" : ""}`).join(", ") || "none"}`,
+    ...w.mcpServers.length ? [
+      `  MCP apps:  ${w.mcpServers.map((s) => `${s.id} (on ${s.service})`).join(", ")}, drawn in a sandboxed frame`
+    ] : [],
+    ...w.hostRoutes.length ? [
+      `  Answers:   ${w.hostRoutes.map((r) => r.host).join(", ")} on Wheelhouse\u2019s port, with its own code`
+    ] : [],
+    ...w.addressRewrites.length ? [
+      `  Addresses: opens addresses on this computer at ${w.addressRewrites.map((r) => r.to).join(", ")}`
+    ] : [],
+    `  UI bundle: ${w.ui ?? "none"}`,
+    `  On:        ${enabled}`,
+    "",
+    "Its code runs with your permissions: its server entry inside Wheelhouse, and",
+    "its UI bundle in Wheelhouse\u2019s pages. Wheelhouse gives it read-only helpers, but",
+    "does not sandbox it. Install only plugins you trust."
+  ];
+}
+async function withStaging(dir, work) {
+  await mkdir4(dir, { recursive: true });
+  const staging = await mkdtemp(path8.join(dir, ".staging-"));
+  try {
+    return await work(staging);
+  } finally {
+    await rm2(staging, { recursive: true, force: true });
+  }
+}
+async function guarded(work) {
+  try {
+    return await work();
+  } catch (e) {
+    if (e instanceof Refused) return { ok: false, error: e.message };
+    throw e;
+  }
+}
+function given(pairs) {
+  const g2 = parseGiven(pairs ?? []);
+  if (!g2.ok) throw new Refused(g2.error);
+  return g2.given;
+}
+async function settle(m, deps, o) {
+  if (!m.wheelhouse.settings.length && !Object.keys(o.given).length) return null;
+  const current = await readPluginSettings(deps.configDir, m.name);
+  if (!current.ok) throw new Refused(current.error);
+  const r = await gatherSettings(m.name, m.wheelhouse.settings, {
+    current: current.settings,
+    given: o.given,
+    ask: o.yes ? null : deps.ask ?? null,
+    intro: `${m.displayName} needs some settings (Enter keeps the one in brackets):`,
+    log: deps.log
+  });
+  if (!r.ok) throw new Refused(r.error);
+  return r.settings;
+}
+async function keepSettings(id, settings2, deps) {
+  const w = await writePluginSettings(deps.configDir, id, settings2);
+  if (!w.ok) throw new Refused(`could not keep ${id}'s settings: ${w.error}`);
+  deps.log(`Kept ${id}'s settings in ${path8.join(deps.configDir, PLUGINS_FILE)}.`);
+}
+async function reload(deps, what, yes) {
+  const r = await deps.restart(async (url, busy) => {
+    deps.log(`Restarting Wheelhouse at ${url} stops what it is running:`);
+    for (const b of busy) deps.log(`  - ${b}`);
+    return yes || deps.confirm("Restart it now?");
+  });
+  for (const url of r.restarted) deps.log(`Restarting Wheelhouse at ${url} to ${what}.`);
+  for (const url of r.kept) deps.log(`Left Wheelhouse at ${url} running; restart it to ${what}.`);
+  for (const f of r.failed) {
+    deps.log(`Could not restart Wheelhouse at ${f.url} (${f.reason}); restart it to ${what}.`);
+  }
+  if (!r.restarted.length && !r.kept.length && !r.failed.length) {
+    deps.log(`Wheelhouse is not running; it will ${what} when it next starts.`);
+  }
+}
+async function record2(deps) {
+  const r = await readInstalled(deps.dir);
+  if (!r.ok) throw new Refused(r.error);
+  return r.installed;
+}
+function expected(commit, expect, repository) {
+  if (expect !== void 0 && commit !== expect) {
+    throw new Refused(
+      `${repository} is at ${short(commit)} now, not ${short(expect)} as when you looked; look it up again`
+    );
+  }
+}
+function install(spec, deps, o = {}) {
+  return guarded(async () => {
+    const source = parseSource(spec);
+    if (!source) throw new Refused(`"${spec}" is not org/repo or org/repo@ref`);
+    const answers = given(o.settings);
+    const installed = await record2(deps);
+    const repository = `${source.org}/${source.repo}`;
+    return withStaging(deps.dir, async (staging) => {
+      deps.log(`Fetching ${repository}${source.ref ? ` at ${source.ref}` : ""}\u2026`);
+      const commit = await fetchSource(source, staging, deps);
+      expected(commit, o.expect, repository);
+      const m = await checkCopy(staging);
+      const target = path8.join(deps.dir, m.name);
+      if (installed.plugins[m.name]) {
+        throw new Refused(
+          `${m.name} is already installed from ${label(installed.plugins[m.name])}; use \`wheelhouse plugin update ${m.name}\``
+        );
+      }
+      if (await exists(target)) {
+        throw new Refused(`${target} already exists; remove it first`);
+      }
+      for (const line of describeManifest(
+        m,
+        `${repository}${source.ref ? ` (${source.ref})` : ""}`,
+        commit
+      ))
+        deps.log(line);
+      if (!o.yes && !await deps.confirm(`Install ${m.name}?`)) {
+        throw new Refused("not installed");
+      }
+      const settings2 = await settle(m, deps, { yes: o.yes, given: answers });
+      if (settings2) await keepSettings(m.name, settings2, deps);
+      await rename4(staging, target);
+      installed.plugins[m.name] = {
+        repository,
+        ref: source.ref,
+        commit,
+        version: m.version,
+        installedAt: (deps.now?.() ?? /* @__PURE__ */ new Date()).toISOString(),
+        enabled: true
+      };
+      await writeInstalled(deps.dir, installed);
+      deps.log(`Installed ${m.name} ${m.version} at ${short(commit)}.`);
+      await reload(deps, `load ${m.name}`, o.yes);
+      return { ok: true };
+    });
+  });
+}
+function update(id, deps, o = {}) {
+  return guarded(async () => {
+    const answers = given(o.settings);
+    const installed = await record2(deps);
+    const was = installed.plugins[id];
+    if (!was) throw new Refused(`${id} is not installed`);
+    const [org, repo] = was.repository.split("/");
+    const source = { org, repo, ref: o.ref ?? was.ref };
+    if (!parseSource(`${org}/${repo}${source.ref ? `@${source.ref}` : ""}`)) {
+      throw new Refused(`"${source.ref}" is not a ref`);
+    }
+    return withStaging(deps.dir, async (staging) => {
+      deps.log(`Fetching ${was.repository}${source.ref ? ` at ${source.ref}` : ""}\u2026`);
+      const commit = await fetchSource(source, staging, deps);
+      expected(commit, o.expect, was.repository);
+      if (commit === was.commit) {
+        if (source.ref !== was.ref) {
+          installed.plugins[id] = { ...was, ref: source.ref };
+          await writeInstalled(deps.dir, installed);
+        }
+        deps.log(`${id} is already at ${short(commit)}.`);
+        return { ok: true };
+      }
+      const m = await checkCopy(staging);
+      if (m.name !== id) {
+        throw new Refused(`${was.repository} now names its plugin "${m.name}", not "${id}"`);
+      }
+      deps.log(
+        `Update ${id} from ${was.version} (${short(was.commit)}) to ${m.version} (${short(commit)}):`
+      );
+      for (const line of describeManifest(
+        m,
+        `${was.repository}${source.ref ? ` (${source.ref})` : ""}`,
+        commit
+      ))
+        deps.log(line);
+      if (!o.yes && !await deps.confirm(`Update ${id}?`)) throw new Refused("not updated");
+      const settings2 = await settle(m, deps, { yes: o.yes, given: answers });
+      if (settings2) await keepSettings(id, settings2, deps);
+      const target = path8.join(deps.dir, id);
+      const old = await mkdtemp(path8.join(deps.dir, ".old-"));
+      const parked = path8.join(old, id);
+      if (await exists(target)) await rename4(target, parked);
+      try {
+        await rename4(staging, target);
+      } catch (e) {
+        if (await exists(parked)) await rename4(parked, target);
+        throw e;
+      } finally {
+        await rm2(old, { recursive: true, force: true });
+      }
+      installed.plugins[id] = {
+        ...was,
+        ref: source.ref,
+        commit,
+        version: m.version,
+        installedAt: (deps.now?.() ?? /* @__PURE__ */ new Date()).toISOString()
+      };
+      await writeInstalled(deps.dir, installed);
+      deps.log(`Updated ${id} to ${m.version} at ${short(commit)}.`);
+      await reload(deps, `load ${id} ${m.version}`, o.yes);
+      return { ok: true };
+    });
+  });
+}
+function remove(id, deps, o = {}) {
+  return guarded(async () => {
+    if (!ID2.test(id)) throw new Refused(`"${id}" is not a plugin id`);
+    const installed = await record2(deps);
+    if (!installed.plugins[id]) throw new Refused(`${id} is not installed`);
+    await rm2(path8.join(deps.dir, id), { recursive: true, force: true });
+    delete installed.plugins[id];
+    await writeInstalled(deps.dir, installed);
+    deps.log(`Removed ${id}.`);
+    await reload(deps, `unload ${id}`, o.yes);
+    return { ok: true };
+  });
+}
+function setEnabled(id, enabled, deps, o = {}) {
+  return guarded(async () => {
+    const installed = await record2(deps);
+    const r = installed.plugins[id];
+    if (!r) throw new Refused(`${id} is not installed`);
+    installed.plugins[id] = { ...r, enabled };
+    await writeInstalled(deps.dir, installed);
+    deps.log(`${id} is ${enabled ? "on" : "off"}.`);
+    await reload(deps, `${enabled ? "load" : "unload"} ${id}`, o.yes);
+    return { ok: true };
+  });
+}
+function list(deps) {
+  return guarded(async () => {
+    const installed = await record2(deps);
+    const rows = Object.entries(installed.plugins).sort(([a], [b]) => a.localeCompare(b));
+    if (!rows.length) {
+      deps.log(`No plugins installed in ${deps.dir}.`);
+      return { ok: true };
+    }
+    const width = Math.max(...rows.map(([id]) => id.length));
+    for (const [id, r] of rows) deps.log(row(id, r, width));
+    return { ok: true };
+  });
+}
+function row(id, r, width) {
+  return `${id.padEnd(width)}  ${r.version.padEnd(8)}  ${r.enabled ? "on " : "off"}  ${short(r.commit)}  ${label(r)}`;
+}
+async function exists(p) {
+  try {
+    await stat4(p);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// cli/running.ts
+import { randomBytes as randomBytes2, timingSafeEqual } from "node:crypto";
+import { mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { readdir, readFile as readFile5, rm as rm3 } from "node:fs/promises";
+import path9 from "node:path";
+var RESTART_EXIT = 75;
+var RESTART_PATH = "/api/wheelhouse/restart";
+var RUNNING_DIR = ".running";
+var TIMEOUT_MS = 3e3;
+var newToken = () => randomBytes2(24).toString("hex");
+function writeRunning(pluginsDir, r) {
+  const dir = path9.join(pluginsDir, RUNNING_DIR);
+  mkdirSync(dir, { recursive: true, mode: 448 });
+  const file = path9.join(dir, `${r.pid}.json`);
+  writeFileSync(file, `${JSON.stringify(r)}
+`, { mode: 384 });
+  return file;
+}
+function removeRunning(file) {
+  rmSync(file, { force: true });
+}
+var sameToken = (got, want) => {
+  const a = Buffer.from(got);
+  const b = Buffer.from(want);
+  return a.length === b.length && timingSafeEqual(a, b);
+};
+function restartHandler(token, restart, busy) {
+  return (req, res) => {
+    if (req.url !== RESTART_PATH) return false;
+    const auth = /^Bearer (\S+)$/.exec(req.headers.authorization ?? "")?.[1] ?? "";
+    if (req.method !== "GET" && req.method !== "POST") {
+      res.writeHead(405, { allow: "GET, POST" }).end();
+    } else if (!sameToken(auth, token)) {
+      res.writeHead(403).end();
+    } else if (req.method === "GET") {
+      busy().then(
+        (work) => res.writeHead(200, { "content-type": "application/json" }).end(JSON.stringify({ busy: work })),
+        () => res.writeHead(500).end()
+      );
+    } else {
+      res.once("finish", restart);
+      res.writeHead(202, { "content-type": "text/plain" }).end("restarting\n");
+    }
+    return true;
+  };
+}
+var alive = (pid) => {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (e) {
+    return e.code === "EPERM";
+  }
+};
+var refused = (e) => e.cause?.code === "ECONNREFUSED";
+async function requestRestart(pluginsDir, proceed) {
+  const dir = path9.join(pluginsDir, RUNNING_DIR);
+  const out = { restarted: [], failed: [], kept: [] };
+  let names;
+  try {
+    names = (await readdir(dir)).filter((n) => /^\d+\.json$/.test(n)).sort();
+  } catch {
+    return out;
+  }
+  for (const name of names) {
+    const file = path9.join(dir, name);
+    let r;
+    try {
+      r = JSON.parse(await readFile5(file, "utf8"));
+      if (typeof r.url !== "string" || typeof r.token !== "string") throw new Error();
+    } catch {
+      await rm3(file, { force: true });
+      continue;
+    }
+    if (typeof r.pid === "number" && !alive(r.pid)) {
+      await rm3(file, { force: true });
+      continue;
+    }
+    const headers = { authorization: `Bearer ${r.token}` };
+    try {
+      const at = new URL(RESTART_PATH, r.url);
+      const asked = await fetch(at, { headers, signal: AbortSignal.timeout(TIMEOUT_MS) });
+      if (asked.status !== 200) {
+        out.failed.push({ url: r.url, reason: `it answered ${asked.status}` });
+        continue;
+      }
+      const { busy } = await asked.json();
+      if (busy.length && !await proceed(r.url, busy)) {
+        out.kept.push(r.url);
+        continue;
+      }
+      const res = await fetch(at, {
+        method: "POST",
+        headers,
+        signal: AbortSignal.timeout(TIMEOUT_MS)
+      });
+      if (res.status === 202) out.restarted.push(r.url);
+      else out.failed.push({ url: r.url, reason: `it answered ${res.status}` });
+    } catch (e) {
+      if (refused(e)) await rm3(file, { force: true });
+      else out.failed.push({ url: r.url, reason: e.message });
+    }
+  }
+  return out;
+}
+
+// cli/plugin.ts
+async function askTerminal(question2) {
+  if (!process.stdin.isTTY) {
+    console.error("wheelhouse: no terminal to ask on; pass --yes to agree without asking.");
+    return false;
+  }
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    return /^y(es)?$/i.test((await rl.question(`${question2} [y/N] `)).trim());
+  } finally {
+    rl.close();
+  }
+}
+async function askLine(question2) {
+  if (!process.stdin.isTTY) return null;
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    return await new Promise((resolve) => {
+      rl.once("close", () => resolve(null));
+      rl.once("SIGINT", () => rl.close());
+      rl.question(question2).then(resolve, () => resolve(null));
+    });
+  } finally {
+    rl.close();
+  }
+}
+var collect = (v, all = []) => [...all, v];
+function pluginCommand(over = {}) {
+  const env = over.env ?? process.env;
+  const cmd = new Command2("plugin").description("Install and manage plugins from GitHub repositories.").option(
+    "--plugins-dir <dir>",
+    "where installed plugins live (default: $WHEELHOUSE_PLUGINS_DIR, else ~/.wheelhouse/plugins)"
+  ).option(
+    "--config-dir <dir>",
+    "the Wheelhouse config whose plugins.json keeps plugin settings (default: $WHEELHOUSE_CONFIG_DIR, else $XDG_CONFIG_HOME/wheelhouse, else ~/.config/wheelhouse)"
+  );
+  const deps = (c) => {
+    const g2 = c.optsWithGlobals();
+    const dir = g2.pluginsDir ? path10.resolve(g2.pluginsDir) : defaultPluginsDir(env);
+    return {
+      dir,
+      configDir: g2.configDir ? path10.resolve(g2.configDir) : defaultConfigDir(env),
+      confirm: askTerminal,
+      ask: askLine,
+      restart: (proceed) => requestRestart(dir, proceed),
+      log: (line) => console.log(line),
+      ...over
+    };
+  };
+  const run = async (c, work) => {
+    const o = await work(deps(c));
+    if (!o.ok) {
+      (over.log ?? console.error)(`wheelhouse: ${o.error}.`);
+      process.exitCode = 1;
+    }
+  };
+  cmd.command("install <repo>").description("Install a plugin from org/repo, or org/repo@<tag, branch or commit>.").option("-y, --yes", "install without asking; settings take their defaults (for scripts)").option("-s, --setting <key=value>", "answer one of its settings (repeatable)", collect).action(
+    (repo, o, c) => run(c, (d) => install(repo, d, { yes: o.yes, settings: o.setting }))
+  );
+  cmd.command("list").description("List installed plugins, their versions and pinned commits.").action((_o, c) => run(c, list));
+  cmd.command("update <id>").description("Fetch the ref the plugin was installed from again (or --ref), and replace it.").option("--ref <ref>", "a tag, branch or commit to move to").option("-y, --yes", "update without asking; new settings take their defaults (for scripts)").option("-s, --setting <key=value>", "answer one of its settings (repeatable)", collect).action(
+    (id, o, c) => run(c, (d) => update(id, d, { yes: o.yes, ref: o.ref, settings: o.setting }))
+  );
+  cmd.command("remove <id>").description("Delete an installed plugin.").option("-y, --yes", "restart a running Wheelhouse without asking, even mid-work").action(
+    (id, o, c) => run(c, (d) => remove(id, d, { yes: o.yes }))
+  );
+  cmd.command("enable <id>").description("Turn an installed plugin on.").option("-y, --yes", "restart a running Wheelhouse without asking, even mid-work").action(
+    (id, o, c) => run(c, (d) => setEnabled(id, true, d, { yes: o.yes }))
+  );
+  cmd.command("disable <id>").description("Turn an installed plugin off without removing it.").option("-y, --yes", "restart a running Wheelhouse without asking, even mid-work").action(
+    (id, o, c) => run(c, (d) => setEnabled(id, false, d, { yes: o.yes }))
+  );
+  return cmd;
+}
+
+// cli/supervise.ts
+var MAX_RESTARTS = 5;
+var RESTART_WINDOW_MS = 6e4;
+var backoff = (n) => Math.min(500 * 2 ** (n - 1), 8e3);
+function isReady(msg) {
+  return typeof msg === "object" && msg !== null && msg.type === "ready" && typeof msg.port === "number";
+}
+function supervise(opts) {
+  const maxRestarts = opts.maxRestarts ?? MAX_RESTARTS;
+  const windowMs = opts.windowMs ?? RESTART_WINDOW_MS;
+  const wait = opts.backoffMs ?? backoff;
+  let port = opts.port;
+  let everReady = false;
+  let stopping = false;
+  let child = null;
+  let pending = null;
+  let killer = null;
+  let restarts = [];
+  let finish = () => {
+  };
+  const done = new Promise((resolve) => {
+    finish = (code) => {
+      if (pending) clearTimeout(pending);
+      if (killer) clearTimeout(killer);
+      pending = killer = null;
+      resolve(code);
+    };
+  });
+  const launch = (restart) => {
+    pending = null;
+    const c = opts.start(port, restart);
+    child = c;
+    c.on("message", (msg) => {
+      if (!isReady(msg)) return;
+      port = msg.port;
+      if (!everReady) {
+        everReady = true;
+        opts.onReady(msg.port);
+      } else {
+        opts.log(`Wheelhouse's server is back on http://127.0.0.1:${msg.port}/.`);
+      }
+    });
+    c.on("exit", (code, signal) => {
+      if (child === c) child = null;
+      if (stopping || code === 0) return finish(0);
+      if (code === RESTART_EXIT && everReady) {
+        opts.log("Restarting Wheelhouse\u2026");
+        return launch(true);
+      }
+      if (!everReady) return finish(code ?? 1);
+      const how = signal ? `was stopped by ${signal}` : `exited with code ${code}`;
+      const now = Date.now();
+      restarts = [...restarts.filter((t) => now - t < windowMs), now];
+      if (restarts.length > maxRestarts) {
+        opts.log(
+          `Wheelhouse's server ${how} and has failed ${restarts.length} times within a minute, so Wheelhouse is closing. Firstmate and its crew are still running.`
+        );
+        return finish(1);
+      }
+      const ms = wait(restarts.length);
+      opts.log(
+        `Wheelhouse's server ${how}; restarting it in ${Math.round(ms / 100) / 10} s. Firstmate and its crew are untouched.`
+      );
+      pending = setTimeout(() => launch(true), ms);
+    });
+  };
+  launch(false);
+  return {
+    done,
+    stop: () => {
+      if (stopping) return;
+      stopping = true;
+      if (!child) return finish(0);
+      child.kill("SIGTERM");
+      const c = child;
+      killer = setTimeout(() => c.kill("SIGKILL"), opts.killAfterMs ?? 5e3);
+      killer.unref?.();
+    }
+  };
+}
+
+// cli/upgrade.ts
+import { spawn as spawn3 } from "node:child_process";
+import path12 from "node:path";
+import { fileURLToPath } from "node:url";
+import { Command as Command3 } from "commander";
+
+// src/lib/server/upgrade/clone.ts
+import { execFile as execFile2 } from "node:child_process";
+import { readFile as readFile6, realpath as realpath3 } from "node:fs/promises";
+import path11 from "node:path";
+var COMMITS_SHOWN = 20;
+var OUTPUT_KEPT = 6e4;
+var runCommand = (cmd, args, cwd) => new Promise((resolve) => {
+  execFile2(cmd, args, { cwd, maxBuffer: 64 * 1024 * 1024 }, (err, stdout, stderr) => {
+    const output = `${String(stdout)}${String(stderr)}`;
+    resolve({
+      code: err ? typeof err.code === "number" ? err.code : 1 : 0,
+      output: output.slice(-OUTPUT_KEPT)
+    });
+  });
+});
+function githubRepository(url) {
+  const m = /^(?:https?:\/\/(?:[^@/]+@)?github\.com\/|(?:ssh:\/\/)?git@github\.com[:/])([^/]+)\/([^/]+?)(?:\.git)?\/?$/.exec(
+    url.trim()
+  );
+  return m ? `${m[1]}/${m[2]}` : null;
+}
+function packageVersion(text2) {
+  if (text2 === null) return null;
+  try {
+    const v = JSON.parse(text2).version;
+    return typeof v === "string" ? v : null;
+  } catch {
+    return null;
+  }
+}
+var lastLine = (s) => s.trim().split("\n").pop() ?? "";
+async function checkClone(deps) {
+  const git = deps.git ?? runGit;
+  const g2 = async (...args) => git(args, deps.dir);
+  const out = {
+    schema: "wheelhouse-update.v1",
+    checkedAt: (deps.now?.() ?? /* @__PURE__ */ new Date()).toISOString(),
+    state: "unsupported",
+    reason: null,
+    dir: deps.dir,
+    repository: null,
+    branch: null,
+    current: { commit: null, version: null },
+    latest: null,
+    commits: [],
+    behind: 0,
+    changes: []
+  };
+  out.current.version = packageVersion(
+    await readFile6(path11.join(deps.dir, "package.json"), "utf8").catch(() => null)
+  );
+  const top = await g2("rev-parse", "--show-toplevel");
+  const here = await realpath3(deps.dir).catch(() => deps.dir);
+  if (top.code !== 0 || await realpath3(top.stdout.trim()).catch(() => "") !== here) {
+    out.reason = `${deps.dir} is not a git clone, so Wheelhouse cannot upgrade it; update it the way it was installed (for npm, \`npm install -g @chrisjowen/wheelhouse\`)`;
+    return out;
+  }
+  const head = await g2("rev-parse", "HEAD");
+  out.current.commit = head.code === 0 ? head.stdout.trim() : null;
+  const origin = await g2("remote", "get-url", "origin");
+  if (origin.code !== 0) {
+    out.reason = `${deps.dir} has no origin remote to upgrade from`;
+    return out;
+  }
+  out.repository = githubRepository(origin.stdout);
+  const symref = await g2("ls-remote", "--symref", "origin", "HEAD");
+  const branch = /^ref: refs\/heads\/(\S+)\s+HEAD$/m.exec(symref.stdout)?.[1] ?? null;
+  if (symref.code !== 0 || !branch) {
+    out.state = "error";
+    out.reason = `could not reach origin: ${lastLine(symref.stderr) || "it named no default branch"}`;
+    return out;
+  }
+  out.branch = branch;
+  const fetched = await g2("fetch", "--quiet", "--no-tags", "origin", `refs/heads/${branch}`);
+  if (fetched.code !== 0) {
+    out.state = "error";
+    out.reason = `could not fetch ${branch}: ${lastLine(fetched.stderr)}`;
+    return out;
+  }
+  const latest = (await g2("rev-parse", "FETCH_HEAD")).stdout.trim();
+  const remotePkg = await g2("show", `${latest}:package.json`);
+  out.latest = {
+    commit: latest,
+    version: packageVersion(remotePkg.code === 0 ? remotePkg.stdout : null)
+  };
+  const counts = (await g2("rev-list", "--left-right", "--count", `HEAD...${latest}`)).stdout.trim().split(/\s+/).map(Number);
+  const ahead = counts[0] || 0;
+  out.behind = counts[1] || 0;
+  if (out.behind === 0) {
+    out.state = "current";
+    return out;
+  }
+  const log = await g2("log", "--format=%H%x1f%s%x1f%cI", `-n${COMMITS_SHOWN}`, `HEAD..${latest}`);
+  out.commits = log.stdout.split("\n").filter(Boolean).map((l) => {
+    const [sha, subject, date] = l.split("");
+    return { sha, subject, date };
+  });
+  const on = await g2("symbolic-ref", "--quiet", "--short", "HEAD");
+  const status = await g2("status", "--porcelain", "--untracked-files=no");
+  const changes = status.stdout.split("\n").filter((l) => l.trim());
+  out.state = "refused";
+  if (on.code !== 0) {
+    out.reason = `${deps.dir} is not on a branch (detached HEAD), so it cannot fast-forward to ${branch}`;
+  } else if (on.stdout.trim() !== branch) {
+    out.reason = `${deps.dir} is on ${on.stdout.trim()}, not ${branch}, so it cannot fast-forward`;
+  } else if (changes.length) {
+    out.reason = `${deps.dir} has local changes; commit or discard them, then check again`;
+    out.changes = changes;
+  } else if (ahead > 0) {
+    out.reason = `${deps.dir} has ${ahead} commit${ahead === 1 ? "" : "s"} that ${branch} does not, so it cannot fast-forward`;
+  } else {
+    out.state = "available";
+  }
+  return out;
+}
+async function upgradeClone(deps, onStep = () => {
+}) {
+  const git = deps.git ?? runGit;
+  const run = deps.run ?? runCommand;
+  onStep("fetch");
+  const check = await checkClone(deps);
+  if (check.state !== "available" || !check.latest) {
+    const error = check.state === "current" ? `Wheelhouse is already up to date with ${check.branch}` : check.reason ?? "there is nothing to upgrade to";
+    return { ok: false, step: "fetch", error, output: "", check };
+  }
+  onStep("fast-forward");
+  const ff = await git(["merge", "--ff-only", "--quiet", check.latest.commit], deps.dir);
+  if (ff.code !== 0) {
+    return {
+      ok: false,
+      step: "fast-forward",
+      error: `could not fast-forward: ${lastLine(ff.stderr)}`,
+      output: ff.stderr,
+      check
+    };
+  }
+  for (const [step, args] of [
+    ["install", ["ci"]],
+    ["build", ["run", "build"]]
+  ]) {
+    onStep(step);
+    const r = await run("npm", [...args], deps.dir);
+    if (r.code !== 0) {
+      return {
+        ok: false,
+        step,
+        error: `npm ${args.join(" ")} failed (exit ${r.code}); the clone is at ${check.latest.commit.slice(0, 7)} but its build is incomplete, so rebuild it (npm ci && npm run build) before Wheelhouse restarts`,
+        output: r.output,
+        check
+      };
+    }
+  }
+  return { ok: true, check, from: check.current.commit, to: check.latest.commit };
+}
+
+// src/lib/updates.ts
+var UPGRADE_STEPS = [
+  { step: "fetch", label: "Fetch from GitHub" },
+  { step: "fast-forward", label: "Fast-forward the clone" },
+  { step: "install", label: "Install packages (npm ci)" },
+  { step: "build", label: "Build" },
+  { step: "restart", label: "Restart Wheelhouse" }
+];
+
+// cli/upgrade.ts
+function installDir() {
+  return path12.resolve(path12.dirname(fileURLToPath(import.meta.url)), "..");
+}
+var runInherit = (cmd, args, cwd) => new Promise((resolve) => {
+  const child = spawn3(cmd, args, { cwd, stdio: "inherit" });
+  child.on("error", (e) => resolve({ code: 1, output: e.message }));
+  child.on("exit", (code) => resolve({ code: code ?? 1, output: "" }));
+});
+var short2 = (c) => c ? c.slice(0, 7) : "unknown";
+var versionOf = (v) => v ? `${v.version ?? "?"} (${short2(v.commit)})` : "unknown";
+function describe(c, log) {
+  const from = c.repository ?? "origin";
+  if (c.state === "current") {
+    log(`Wheelhouse ${versionOf(c.current)} is up to date with ${from} ${c.branch}.`);
+    return;
+  }
+  if (c.state === "unsupported" || c.state === "error") return;
+  log(
+    `${from} ${c.branch} has ${c.behind} new commit${c.behind === 1 ? "" : "s"}: Wheelhouse ${versionOf(c.current)} \u2192 ${versionOf(c.latest)}`
+  );
+  for (const x of c.commits) log(`  ${short2(x.sha)}  ${x.subject}`);
+  if (c.behind > c.commits.length) log(`  \u2026 and ${c.behind - c.commits.length} more`);
+}
+async function upgrade(deps, o = {}) {
+  const cloneDeps = { dir: deps.dir, git: deps.git, run: deps.run ?? runInherit };
+  deps.log(`Checking ${deps.dir} for a newer Wheelhouse\u2026`);
+  const c = await checkClone(cloneDeps);
+  describe(c, deps.log);
+  if (c.state === "current") return true;
+  if (c.state !== "available") {
+    deps.log(`wheelhouse: ${c.reason}.`);
+    for (const ch of c.changes) deps.log(`  ${ch}`);
+    if (c.state === "refused") deps.log("Nothing was changed.");
+    return false;
+  }
+  if (o.check) return true;
+  if (!o.yes && !await deps.confirm("Upgrade Wheelhouse now?")) {
+    deps.log("Not upgraded.");
+    return false;
+  }
+  const label2 = Object.fromEntries(UPGRADE_STEPS.map((s) => [s.step, s.label]));
+  const r = await upgradeClone(cloneDeps, (step) => deps.log(`${label2[step]}\u2026`));
+  if (!r.ok) {
+    deps.log(`wheelhouse: ${r.error}.`);
+    return false;
+  }
+  deps.log(`Upgraded Wheelhouse to ${versionOf(r.check.latest)}.`);
+  const restarted = await deps.restart(async (url, busy) => {
+    deps.log(`Restarting Wheelhouse at ${url} stops what it is running:`);
+    for (const b of busy) deps.log(`  - ${b}`);
+    return o.yes || deps.confirm("Restart it now?");
+  });
+  for (const url of restarted.restarted) deps.log(`Restarting Wheelhouse at ${url}.`);
+  for (const url of restarted.kept) {
+    deps.log(`Left Wheelhouse at ${url} running the old version; restart it to use the new one.`);
+  }
+  for (const f of restarted.failed) {
+    deps.log(
+      `Could not restart Wheelhouse at ${f.url} (${f.reason}); restart it to use the new one.`
+    );
+  }
+  if (!restarted.restarted.length && !restarted.kept.length && !restarted.failed.length) {
+    deps.log("Wheelhouse is not running; the new version starts with `wheelhouse open`.");
+  }
+  return true;
+}
+function upgradeCommand(over = {}) {
+  const env = over.env ?? process.env;
+  return new Command3("upgrade").description(
+    "Fast-forward this Wheelhouse clone to the newest commit on GitHub, rebuild it and restart Wheelhouse."
+  ).option("--check", "only say whether there is a newer version").option("-y, --yes", "upgrade (and restart, even mid-work) without asking").option(
+    "--plugins-dir <dir>",
+    "the plugins directory the running Wheelhouse loads from, to find it (default: $WHEELHOUSE_PLUGINS_DIR, else ~/.wheelhouse/plugins)"
+  ).action(async (o) => {
+    const pluginsDir = o.pluginsDir ? path12.resolve(o.pluginsDir) : defaultPluginsDir(env);
+    const ok = await upgrade(
+      {
+        dir: installDir(),
+        confirm: askTerminal,
+        restart: (proceed) => requestRestart(pluginsDir, proceed),
+        log: (line) => console.log(line),
+        ...over
+      },
+      o
+    );
+    if (!ok) process.exitCode = 1;
+  });
 }
 
 // cli/index.ts
 var DEFAULT_PORT = 4310;
 var HOST = "127.0.0.1";
 var runtimeHolder = () => globalThis[/* @__PURE__ */ Symbol.for("wheelhouse.runtime")];
-function parsePort(value) {
+function parsePort2(value) {
   const n = Number(value);
   if (!Number.isInteger(n) || n < 0 || n > 65535) {
-    throw new InvalidArgumentError("Port must be a whole number from 0 to 65535.");
+    throw new InvalidArgumentError2("Port must be a whole number from 0 to 65535.");
   }
   return n;
 }
 function handlerPath() {
-  const here = path4.dirname(fileURLToPath(import.meta.url));
-  return path4.resolve(here, "..", "build", "handler.js");
+  const here = path13.dirname(fileURLToPath2(import.meta.url));
+  return path13.resolve(here, "..", "build", "handler.js");
 }
 function openBrowser(url) {
   const [cmd, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["cmd", ["/c", "start", '""', url]] : ["xdg-open", [url]];
   try {
-    const child = spawn2(cmd, args, { detached: true, stdio: "ignore" });
+    const child = spawn4(cmd, args, { detached: true, stdio: "ignore" });
     child.on("error", () => console.log(`Open ${url} in your browser.`));
     child.unref();
   } catch {
     console.log(`Open ${url} in your browser.`);
   }
 }
-function parseEffort(v) {
-  if (!["low", "medium", "high"].includes(v)) {
-    throw new InvalidArgumentError("Use low, medium or high.");
-  }
-  return v;
-}
 async function open2(opts) {
   const resolved = resolveInstall({
     firstmate: opts.firstmate,
@@ -403,11 +2453,11 @@ async function open2(opts) {
     console.error(`wheelhouse: ${resolved.error}`);
     process.exit(1);
   }
-  const { install, notes } = resolved;
+  const { install: install2, notes } = resolved;
   for (const n of notes) console.log(n);
-  console.log(`Firstmate:  ${install.firstmateDir}`);
-  console.log(`Home:       ${install.homeDir}`);
-  const compat = await checkCompatibility(install);
+  console.log(`Firstmate:  ${install2.firstmateDir}`);
+  console.log(`Home:       ${install2.homeDir}`);
+  const compat = await checkCompatibility(install2);
   if (compat.compatible) {
     console.log(
       `Scripts:    compatible${compat.firstmateVersion ? ` (Firstmate ${compat.firstmateVersion})` : ""}`
@@ -417,16 +2467,16 @@ async function open2(opts) {
     for (const p of compat.problems) console.warn(`  - ${p}`);
     console.warn("Wheelhouse will start and show what it can; see /api/health.");
   }
-  const stateDir = opts.stateDir ? path4.resolve(opts.stateDir) : defaultStateDir(process.env);
-  if (isInside(stateDir, install.homeDir)) {
+  const stateDir = opts.stateDir ? path13.resolve(opts.stateDir) : defaultStateDir(process.env);
+  if (isInside(stateDir, install2.homeDir)) {
     console.error(
       `wheelhouse: the state directory ${stateDir} is inside the Firstmate home. Wheelhouse never writes there; pass --state-dir <dir> outside it.`
     );
     process.exit(1);
   }
   console.log(`State:      ${stateDir}`);
-  const configDir = opts.configDir ? path4.resolve(opts.configDir) : defaultConfigDir(process.env);
-  if (isInside(configDir, install.homeDir)) {
+  const configDir = opts.configDir ? path13.resolve(opts.configDir) : defaultConfigDir(process.env);
+  if (isInside(configDir, install2.homeDir)) {
     console.error(
       `wheelhouse: the config directory ${configDir} is inside the Firstmate home. Wheelhouse never reads its own config from there; pass --config-dir <dir> outside it.`
     );
@@ -440,18 +2490,52 @@ async function open2(opts) {
     );
     process.exit(1);
   }
-  process.env.WHEELHOUSE_FIRSTMATE_DIR = install.firstmateDir;
-  process.env.WHEELHOUSE_HOME = install.homeDir;
+  process.env.WHEELHOUSE_FIRSTMATE_DIR = install2.firstmateDir;
+  process.env.WHEELHOUSE_HOME = install2.homeDir;
   process.env.WHEELHOUSE_STATE_DIR = stateDir;
   process.env.WHEELHOUSE_CONFIG_DIR = configDir;
+  if (opts.pluginsDir) process.env.WHEELHOUSE_PLUGINS_DIR = path13.resolve(opts.pluginsDir);
+  process.env.WHEELHOUSE_BUNDLED_PLUGINS_DIR = path13.resolve(path13.dirname(file), "..", "plugins");
+  process.env.WHEELHOUSE_INSTALL_DIR = path13.resolve(path13.dirname(file), "..");
   if (opts.tmuxSocket) process.env.WHEELHOUSE_TMUX_SOCKET = opts.tmuxSocket;
   process.env.WHEELHOUSE_SKIP_PERMISSIONS = opts.skipPermissions ? "1" : "0";
-  if (opts.specModel) process.env.WHEELHOUSE_SPEC_MODEL = opts.specModel;
-  if (opts.specEffort) process.env.WHEELHOUSE_SPEC_EFFORT = opts.specEffort;
   if (opts.reviewModel) process.env.WHEELHOUSE_REVIEW_MODEL = opts.reviewModel;
   if (opts.reviewEffort) process.env.WHEELHOUSE_REVIEW_EFFORT = opts.reviewEffort;
-  const { handler } = await import(pathToFileURL(file).href);
-  const server = createServer((req, res) => handler(req, res));
+  const cli = fileURLToPath2(import.meta.url);
+  const watcher = supervise({
+    port: opts.port,
+    start: (port, restart) => fork(cli, ["__server", "--port", String(port)], {
+      env: { ...process.env, WHEELHOUSE_RESTARTED: restart ? "1" : "0" },
+      stdio: ["ignore", "inherit", "inherit", "ipc"]
+    }),
+    onReady: (port) => {
+      const url = `http://${HOST}:${port}/`;
+      console.log(`Wheelhouse is listening on ${url}`);
+      console.log("Press Ctrl+C to close Wheelhouse. Firstmate and its crew keep running.");
+      if (opts.browser) openBrowser(url);
+    },
+    log: (line) => console.warn(line)
+  });
+  process.on("SIGINT", watcher.stop);
+  process.on("SIGTERM", watcher.stop);
+  process.exit(await watcher.done);
+}
+async function serve(opts) {
+  process.env.WHEELHOUSE_URL = `http://${HOST}:${opts.port}`;
+  process.env.BODY_SIZE_LIMIT ??= String(UPLOAD_MAX_BYTES + 64 * 1024);
+  const { handler } = await import(pathToFileURL(handlerPath()).href);
+  const token = newToken();
+  let close = (_code) => {
+  };
+  const restart = restartHandler(
+    token,
+    () => close(RESTART_EXIT),
+    async () => await runtimeHolder()?.busy?.() ?? []
+  );
+  const server = createServer((req, res) => {
+    if (!restart(req, res) && !runtimeHolder()?.request?.(req, res)) handler(req, res);
+  });
+  setRestart(() => close(RESTART_EXIT));
   server.on("upgrade", (req, socket, head) => {
     if (runtimeHolder()?.upgrade?.(req, socket, head)) return;
     socket.end("HTTP/1.1 404 Not Found\r\nConnection: close\r\nContent-Length: 0\r\n\r\n");
@@ -472,32 +2556,42 @@ async function open2(opts) {
   const address = server.address();
   const port = typeof address === "object" && address ? address.port : opts.port;
   const url = `http://${HOST}:${port}/`;
-  console.log(`Wheelhouse is listening on ${url}`);
-  console.log("Press Ctrl+C to close Wheelhouse. Firstmate and its crew keep running.");
-  if (opts.browser) openBrowser(url);
+  let running2 = null;
+  try {
+    running2 = writeRunning(defaultPluginsDir(process.env), { pid: process.pid, url, token });
+  } catch (e) {
+    console.warn(
+      `Warning: plugin changes will not restart Wheelhouse by themselves: ${e.message}`
+    );
+  }
+  process.send?.({ type: "ready", port });
   let closing = false;
-  const close = () => {
+  close = (code) => {
     if (closing) return;
     closing = true;
+    if (running2) removeRunning(running2);
     runtimeHolder()?.shutdown?.();
     server.close(() => {
-      console.log("Wheelhouse closed. Firstmate and its crew are still running.");
-      process.exit(0);
+      if (code !== RESTART_EXIT) {
+        console.log("Wheelhouse closed. Firstmate and its crew are still running.");
+      }
+      process.exit(code);
     });
     server.closeAllConnections();
-    setTimeout(() => process.exit(0), 3e3).unref();
+    setTimeout(() => process.exit(code), 3e3).unref();
   };
-  process.on("SIGINT", close);
-  process.on("SIGTERM", close);
+  process.on("SIGINT", () => close(0));
+  process.on("SIGTERM", () => close(0));
+  process.on("disconnect", () => close(0));
 }
 function program() {
-  const cli = new Command("wheelhouse").description("A local companion to Firstmate: watch the crew at work from a web UI.").version(version);
+  const cli = new Command4("wheelhouse").description("A local companion to Firstmate: watch the crew at work from a web UI.").version(version);
   cli.command("open", { isDefault: true }).description(
     "Start Wheelhouse, start (or show) the Firstmate session, and open it in the browser."
   ).option("--firstmate <dir>", "Firstmate code directory (default: the checkout you are in)").option(
     "--home <dir>",
     "Firstmate operational home (default: $FM_HOME, else the code directory)"
-  ).option("--port <n>", "port to listen on (127.0.0.1 only)", parsePort, DEFAULT_PORT).option(
+  ).option("--port <n>", "port to listen on (127.0.0.1 only)", parsePort2, DEFAULT_PORT).option(
     "--state-dir <dir>",
     "where Wheelhouse keeps its own records (default: $WHEELHOUSE_STATE_DIR, else $XDG_STATE_HOME/wheelhouse, else ~/.local/state/wheelhouse)"
   ).option(
@@ -507,12 +2601,8 @@ function program() {
     "--config-dir <dir>",
     "the captain-owned Wheelhouse config, with per-project passage files in projects/<id>.yaml (default: $WHEELHOUSE_CONFIG_DIR, else $XDG_CONFIG_HOME/wheelhouse, else ~/.config/wheelhouse)"
   ).option(
-    "--spec-model <model>",
-    "the Claude model the Spec tab's interviewer uses (default: $WHEELHOUSE_SPEC_MODEL, else sonnet)"
-  ).option(
-    "--spec-effort <level>",
-    "how hard the Spec tab's interviewer thinks: low, medium or high (default: $WHEELHOUSE_SPEC_EFFORT, else low)",
-    parseEffort
+    "--plugins-dir <dir>",
+    "where installed plugins live (default: $WHEELHOUSE_PLUGINS_DIR, else ~/.wheelhouse/plugins)"
   ).option("--no-browser", "do not open the browser").option(
     "--no-skip-permissions",
     "start Firstmate without --dangerously-skip-permissions, so Claude Code asks before tools run (answer in the terminal drawer)"
@@ -525,6 +2615,10 @@ function program() {
       "how hard the PR review agent thinks (default: $WHEELHOUSE_REVIEW_EFFORT, else low)"
     ).choices(["low", "medium", "high", "xhigh", "max"])
   ).action((opts) => open2(opts));
+  cli.command("__server", { hidden: true }).description("Wheelhouse's server, as `open` starts it under its watcher.").option("--port <n>", "port to listen on (127.0.0.1 only)", parsePort2, DEFAULT_PORT).action((opts) => serve(opts));
+  cli.addCommand(pluginCommand());
+  cli.addCommand(upgradeCommand());
+  cli.addCommand(gatewayCommand());
   return cli;
 }
 await program().parseAsync(process.argv);