@decibelsystems/tools 3.0.0 → 3.1.0

package/dist/pty/launchProfile.js

@@ -0,0 +1,149 @@
+// ============================================================================
+// Launch profile — the flags every daemon spawn gets (decibel-hq ADR-0018 D3)
+// ============================================================================
+// ~/.decibel/launch.json, written by Ben, read by the daemon. Kept apart from
+// config.yaml and env so it holds no secrets and can be read and diffed freely.
+//
+// The schema is CLOSED: an unknown key, a mode Claude Code does not have, or a
+// channel that is not `server:<name>` makes the whole file invalid, and every
+// spawn then refuses with LAUNCH_PROFILE_INVALID rather than silently starting
+// claude without the flags Ben chose. HQ and the CLI never send argv or a
+// profile; caller-chosen flags plus `claude` is code execution.
+//
+// No file means today's behaviour: no extra flags.
+//
+// The `tmux` block configures the daemon's own tmux server, which starts with
+// -f /dev/null and so never reads ~/.tmux.conf. Mouse on lets the wheel scroll
+// a session attached from Ghostty; HQ's pane scrolls through its own frames
+// either way, and copies with Option-drag once tmux owns the mouse.
+// ============================================================================
+import { existsSync, readFileSync } from 'fs';
+import { homedir } from 'os';
+import { join } from 'path';
+import { SessionError } from './errors.js';
+/** `claude --permission-mode` choices, Claude Code 2.1.281. */
+export const PERMISSION_MODES = ['acceptEdits', 'auto', 'bypassPermissions', 'manual', 'dontAsk', 'plan'];
+const CHANNEL_RE = /^server:[a-z0-9-]+$/;
+const KEYS = new Set(['permission_mode', 'dev_channels', 'period_gap_hours', 'restore_on_start', 'tmux']);
+const TMUX_KEYS = new Set(['mouse', 'history_limit']);
+export const DEFAULT_PERIOD_GAP_HOURS = 4;
+/** Scrollback lines per pane. A pane's limit is fixed when it is created. */
+export const DEFAULT_HISTORY_LIMIT = 50_000;
+const MIN_HISTORY_LIMIT = 2_000;
+const MAX_HISTORY_LIMIT = 1_000_000;
+export function defaultProfile() {
+    return {
+        dev_channels: [],
+        period_gap_hours: DEFAULT_PERIOD_GAP_HOURS,
+        restore_on_start: false,
+        // Mouse on by default: Ben asked for wheel scrolling in Ghostty twice.
+        tmux: { mouse: true, history_limit: DEFAULT_HISTORY_LIMIT },
+    };
+}
+/** Resolved per call so tests (and a changed $HOME) are honoured. */
+export function launchProfilePath() {
+    return process.env.DECIBEL_LAUNCH_PATH || join(homedir(), '.decibel', 'launch.json');
+}
+/** Validate a parsed launch.json. Throws a message naming the first problem. */
+export function parseLaunchProfile(raw) {
+    if (!raw || typeof raw !== 'object' || Array.isArray(raw))
+        throw new Error('launch.json must be a JSON object');
+    const o = raw;
+    for (const k of Object.keys(o)) {
+        if (!KEYS.has(k))
+            throw new Error(`unknown key "${k}" (allowed: ${[...KEYS].join(', ')})`);
+    }
+    const p = defaultProfile();
+    if (o.permission_mode !== undefined) {
+        if (!PERMISSION_MODES.includes(o.permission_mode)) {
+            throw new Error(`permission_mode must be one of ${PERMISSION_MODES.join(', ')}`);
+        }
+        p.permission_mode = o.permission_mode;
+    }
+    if (o.dev_channels !== undefined) {
+        if (!Array.isArray(o.dev_channels) || !o.dev_channels.every((c) => typeof c === 'string' && CHANNEL_RE.test(c))) {
+            throw new Error('dev_channels must be a list of "server:<name>" entries ([a-z0-9-] names)');
+        }
+        p.dev_channels = [...new Set(o.dev_channels)];
+    }
+    if (o.period_gap_hours !== undefined) {
+        const h = o.period_gap_hours;
+        if (typeof h !== 'number' || !Number.isFinite(h) || h < 0.5 || h > 72) {
+            throw new Error('period_gap_hours must be a number between 0.5 and 72');
+        }
+        p.period_gap_hours = h;
+    }
+    if (o.restore_on_start !== undefined) {
+        if (typeof o.restore_on_start !== 'boolean')
+            throw new Error('restore_on_start must be true or false');
+        p.restore_on_start = o.restore_on_start;
+    }
+    if (o.tmux !== undefined) {
+        const t = o.tmux;
+        if (!t || typeof t !== 'object' || Array.isArray(t))
+            throw new Error('tmux must be an object');
+        const to = t;
+        for (const k of Object.keys(to)) {
+            if (!TMUX_KEYS.has(k))
+                throw new Error(`unknown key "tmux.${k}" (allowed: ${[...TMUX_KEYS].join(', ')})`);
+        }
+        if (to.mouse !== undefined) {
+            if (typeof to.mouse !== 'boolean')
+                throw new Error('tmux.mouse must be true or false');
+            p.tmux.mouse = to.mouse;
+        }
+        if (to.history_limit !== undefined) {
+            const n = to.history_limit;
+            if (typeof n !== 'number' || !Number.isInteger(n) || n < MIN_HISTORY_LIMIT || n > MAX_HISTORY_LIMIT) {
+                throw new Error(`tmux.history_limit must be a whole number from ${MIN_HISTORY_LIMIT} to ${MAX_HISTORY_LIMIT}`);
+            }
+            p.tmux.history_limit = n;
+        }
+    }
+    return p;
+}
+/**
+ * The profile, read per call (the file is tiny and spawns are rare, so an edit
+ * takes effect without a restart). Throws LAUNCH_PROFILE_INVALID when the file
+ * exists and is wrong.
+ */
+export function loadLaunchProfile() {
+    const path = launchProfilePath();
+    if (!existsSync(path))
+        return defaultProfile();
+    try {
+        return parseLaunchProfile(JSON.parse(readFileSync(path, 'utf-8')));
+    }
+    catch (err) {
+        throw new SessionError(500, 'LAUNCH_PROFILE_INVALID', `${path} is invalid: ${err instanceof Error ? err.message : String(err)}. Fix or remove it; no session starts until then.`);
+    }
+}
+/**
+ * claude flags for a profile. Each channel gets its own flag, placed last: the
+ * flag is undocumented, and repeating it is safe whether it takes one value or
+ * many, where a second bare value could otherwise be read as a prompt.
+ */
+export function profileArgs(p) {
+    const out = [];
+    if (p.permission_mode)
+        out.push('--permission-mode', p.permission_mode);
+    for (const c of p.dev_channels)
+        out.push('--dangerously-load-development-channels', c);
+    return out;
+}
+/**
+ * Lets tmux pass OSC 8 hyperlinks (which Claude Code emits) through to an
+ * xterm-family client, so links are clickable in Ghostty and HQ's pane. Always
+ * on; it costs nothing. A FIXED index, not `set -as`: this runs before every
+ * spawn, and appending would grow the array by one entry each time.
+ */
+export const HYPERLINKS_FEATURE_INDEX = 20;
+/** Options for the owned server, as one ';'-separated tmux invocation. */
+export function tmuxOptionArgs(t) {
+    return [
+        'set-option', '-g', 'history-limit', String(t.history_limit), ';',
+        'set-option', '-g', 'mouse', t.mouse ? 'on' : 'off', ';',
+        'set-option', '-s', `terminal-features[${HYPERLINKS_FEATURE_INDEX}]`, 'xterm*:hyperlinks',
+    ];
+}
+//# sourceMappingURL=launchProfile.js.map

package/dist/pty/launchProfile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"launchProfile.js","sourceRoot":"","sources":["../../src/pty/launchProfile.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,8EAA8E;AAC9E,+EAA+E;AAC/E,8EAA8E;AAC9E,gFAAgF;AAChF,EAAE;AACF,+EAA+E;AAC/E,8EAA8E;AAC9E,+EAA+E;AAC/E,0EAA0E;AAC1E,gEAAgE;AAChE,EAAE;AACF,mDAAmD;AACnD,EAAE;AACF,8EAA8E;AAC9E,+EAA+E;AAC/E,4EAA4E;AAC5E,oEAAoE;AACpE,+EAA+E;AAE/E,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,+DAA+D;AAC/D,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,aAAa,EAAE,MAAM,EAAE,mBAAmB,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAU,CAAC;AAGnH,MAAM,UAAU,GAAG,qBAAqB,CAAC;AACzC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,iBAAiB,EAAE,cAAc,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,CAAC,CAAC,CAAC;AAC1G,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC,CAAC;AAgBtD,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC;AAC1C,6EAA6E;AAC7E,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAC5C,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAChC,MAAM,iBAAiB,GAAG,SAAS,CAAC;AAEpC,MAAM,UAAU,cAAc;IAC5B,OAAO;QACL,YAAY,EAAE,EAAE;QAChB,gBAAgB,EAAE,wBAAwB;QAC1C,gBAAgB,EAAE,KAAK;QACvB,uEAAuE;QACvE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,qBAAqB,EAAE;KAC5D,CAAC;AACJ,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,iBAAiB;IAC/B,OAAO,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;AACvF,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAC7C,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAChH,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,eAAe,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,CAAC,GAAG,cAAc,EAAE,CAAC;IAC3B,IAAI,CAAC,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QACpC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAiC,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,KAAK,CAAC,kCAAkC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,CAAC,CAAC,eAAe,GAAG,CAAC,CAAC,eAAiC,CAAC;IAC1D,CAAC;IACD,IAAI,CAAC,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAChH,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;QAC9F,CAAC;QACD,CAAC,CAAC,YAAY,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,YAAwB,CAAC,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,CAAC,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,CAAC,CAAC,gBAAgB,CAAC;QAC7B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACtE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QACD,CAAC,CAAC,gBAAgB,GAAG,CAAC,CAAC;IACzB,CAAC;IACD,IAAI,CAAC,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACrC,IAAI,OAAO,CAAC,CAAC,gBAAgB,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QACvG,CAAC,CAAC,gBAAgB,GAAG,CAAC,CAAC,gBAAgB,CAAC;IAC1C,CAAC;IACD,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;QACjB,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC/F,MAAM,EAAE,GAAG,CAA4B,CAAC;QACxC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YAChC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,eAAe,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5G,CAAC;QACD,IAAI,EAAE,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,OAAO,EAAE,CAAC,KAAK,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;YACvF,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC;QAC1B,CAAC;QACD,IAAI,EAAE,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC;YAC3B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,iBAAiB,IAAI,CAAC,GAAG,iBAAiB,EAAE,CAAC;gBACpG,MAAM,IAAI,KAAK,CAAC,kDAAkD,iBAAiB,OAAO,iBAAiB,EAAE,CAAC,CAAC;YACjH,CAAC;YACD,CAAC,CAAC,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,IAAI,GAAG,iBAAiB,EAAE,CAAC;IACjC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,cAAc,EAAE,CAAC;IAC/C,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IACrE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,YAAY,CACpB,GAAG,EACH,wBAAwB,EACxB,GAAG,IAAI,gBAAgB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,mDAAmD,CAC3H,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,CAAgB;IAC1C,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,CAAC,CAAC,eAAe;QAAE,GAAG,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC;IACxE,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY;QAAE,GAAG,CAAC,IAAI,CAAC,yCAAyC,EAAE,CAAC,CAAC,CAAC;IACvF,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,CAAC;AAE3C,0EAA0E;AAC1E,MAAM,UAAU,cAAc,CAAC,CAAc;IAC3C,OAAO;QACL,YAAY,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,GAAG;QACjE,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG;QACxD,YAAY,EAAE,IAAI,EAAE,qBAAqB,wBAAwB,GAAG,EAAE,mBAAmB;KAC1F,CAAC;AACJ,CAAC"}

package/dist/pty/openTerminal.d.ts

@@ -0,0 +1,48 @@
+import { type HostedSession } from './sessions.js';
+export declare const MAX_OPEN = 12;
+export declare const GHOSTTY_APP = "/Applications/Ghostty.app";
+export declare const GHOSTTY_TERM = "xterm-ghostty";
+export type OpenStatus = 'opened' | 'already_open' | 'failed';
+export type OpenCode = 'NOT_LIVE' | 'NOT_OWNED' | 'GHOSTTY_NOT_INSTALLED' | 'AUTOMATION_DENIED' | 'OSASCRIPT_FAILED' | 'BAD_PATH';
+export interface OpenRow {
+    session_key: string;
+    status: OpenStatus;
+    code?: OpenCode;
+    error?: string;
+}
+export interface RunResult {
+    code: number;
+    stderr: string;
+}
+export interface OpenDeps {
+    sessions?: () => Promise<HostedSession[]>;
+    /** Session names that already have a Ghostty client on the owned server. */
+    ghosttyAttached?: () => Promise<Set<string>>;
+    ghosttyInstalled?: () => boolean;
+    /** Runs an AppleScript (tabs). */
+    osascript?: (script: string) => Promise<RunResult>;
+    /** Runs `open` with these args (windows). */
+    open?: (args: string[]) => Promise<RunResult>;
+    ensureTitles?: () => Promise<void>;
+    sleep?: (ms: number) => Promise<void>;
+}
+/** Global on the owned server, so sessions spawned before this also get titles. */
+export declare function ensureTitles(): Promise<void>;
+/** One shell word. Ghostty runs `command` through a shell. */
+export declare function shellWord(s: string): string;
+/**
+ * An AppleScript string literal. AppleScript has no \u escape, so JSON-style
+ * quoting breaks on anything it would escape that way; only backslash and the
+ * double quote are escaped, and control characters are refused outright.
+ */
+export declare function appleString(s: string): string;
+export declare function tabScript(command: string, cwd: string): string;
+export declare function windowArgs(argv: string[], cwd: string): string[];
+export declare function validateOpen(body: unknown): {
+    keys: string[];
+    layout: 'tabs' | 'windows';
+};
+export declare function openTerminal(body: unknown, deps?: OpenDeps): Promise<{
+    results: OpenRow[];
+}>;
+//# sourceMappingURL=openTerminal.d.ts.map

package/dist/pty/openTerminal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openTerminal.d.ts","sourceRoot":"","sources":["../../src/pty/openTerminal.ts"],"names":[],"mappings":"AA4BA,OAAO,EAAsB,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AAEvE,eAAO,MAAM,QAAQ,KAAK,CAAC;AAC3B,eAAO,MAAM,WAAW,8BAA8B,CAAC;AACvD,eAAO,MAAM,YAAY,kBAAkB,CAAC;AAG5C,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,cAAc,GAAG,QAAQ,CAAC;AAC9D,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,WAAW,GAAG,uBAAuB,GAAG,mBAAmB,GAAG,kBAAkB,GAAG,UAAU,CAAC;AAElI,MAAM,WAAW,OAAO;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,UAAU,CAAC;IACnB,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,EAAE,MAAM,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1C,4EAA4E;IAC5E,eAAe,CAAC,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7C,gBAAgB,CAAC,EAAE,MAAM,OAAO,CAAC;IACjC,kCAAkC;IAClC,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;IACnD,6CAA6C;IAC7C,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;IAC9C,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAMD,mFAAmF;AACnF,wBAAsB,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAGlD;AAMD,8DAA8D;AAC9D,wBAAgB,SAAS,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAE3C;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAG7C;AAED,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAc9D;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAEhE;AAiCD,wBAAgB,YAAY,CAAC,IAAI,EAAE,OAAO,GAAG;IAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAc1F;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,GAAE,QAAa,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,EAAE,CAAA;CAAE,CAAC,CA6DtG"}

package/dist/pty/openTerminal.js

@@ -0,0 +1,185 @@
+// ============================================================================
+// POST /sessions/open-terminal: open hosted sessions in desktop Ghostty
+// ============================================================================
+// decibel-hq ADR-0018 D5, amended 2026-10-14 (tools ISS-0210). A browser
+// cannot run AppleScript, so HQ asks the daemon to open a Ghostty tab or
+// window attached to a live session the daemon itself spawned.
+//
+// What the caller controls is only WHICH sessions and the layout. The command
+// is always the daemon's own attach argv and the cwd the daemon recorded, so
+// no request text reaches a shell. Titles are not in the command either: the
+// owned tmux server runs with set-titles on (see ensureTitles), so tmux titles
+// every client itself, including tabs that were already open.
+//
+//   tabs     AppleScript: new tab in the front window, or a new window if
+//            none is open. Needs a macOS Automation (TCC) grant for whatever
+//            process macOS holds responsible: under launchd, node.
+//   windows  `open -na Ghostty.app --args ...`: LaunchServices, not Apple
+//            Events, so no Automation grant. One window per session.
+//
+// After one AUTOMATION_DENIED, the rest of the batch is not attempted: every
+// further try would raise the same macOS prompt or fail the same way.
+// ============================================================================
+import { execFile } from 'child_process';
+import { existsSync } from 'fs';
+import { log } from '../config.js';
+import { SessionError } from './errors.js';
+import { tmux, TITLE_FORMAT } from './tmux.js';
+import { listHostedSessions } from './sessions.js';
+export const MAX_OPEN = 12;
+export const GHOSTTY_APP = '/Applications/Ghostty.app';
+export const GHOSTTY_TERM = 'xterm-ghostty';
+const STAGGER_MS = 300;
+// ----------------------------------------------------------------------------
+// Titles: tmux sends OSC 2 to every client on the owned server
+// ----------------------------------------------------------------------------
+/** Global on the owned server, so sessions spawned before this also get titles. */
+export async function ensureTitles() {
+    const r = await tmux('owned', ['set-option', '-g', 'set-titles', 'on', ';', 'set-option', '-g', 'set-titles-string', TITLE_FORMAT]);
+    if (!r.ok)
+        log(`Sessions: could not turn on tmux titles: ${r.stderr.trim()}`);
+}
+// ----------------------------------------------------------------------------
+// Quoting
+// ----------------------------------------------------------------------------
+/** One shell word. Ghostty runs `command` through a shell. */
+export function shellWord(s) {
+    return `'${s.replace(/'/g, `'\\''`)}'`;
+}
+/**
+ * An AppleScript string literal. AppleScript has no \u escape, so JSON-style
+ * quoting breaks on anything it would escape that way; only backslash and the
+ * double quote are escaped, and control characters are refused outright.
+ */
+export function appleString(s) {
+    if (/[\u0000-\u001f\u007f]/.test(s))
+        throw new Error('control character in AppleScript string');
+    return `"${s.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`;
+}
+export function tabScript(command, cwd) {
+    return [
+        'tell application "Ghostty"',
+        '  set cfg to new surface configuration',
+        `  set command of cfg to ${appleString(command)}`,
+        `  set initial working directory of cfg to ${appleString(cwd)}`,
+        '  if (count of windows) = 0 then',
+        '    new window with configuration cfg',
+        '  else',
+        '    new tab in front window with configuration cfg',
+        '  end if',
+        'end tell',
+        '',
+    ].join('\n');
+}
+export function windowArgs(argv, cwd) {
+    return ['-na', GHOSTTY_APP, '--args', `--working-directory=${cwd}`, `--command=${argv.map(shellWord).join(' ')}`];
+}
+// ----------------------------------------------------------------------------
+// Default deps
+// ----------------------------------------------------------------------------
+function run(bin, args, input) {
+    return new Promise((resolve) => {
+        const child = execFile(bin, args, { timeout: 30_000 }, (err, _stdout, stderr) => {
+            // On a non-zero exit, execFile's error carries the exit code as `code`.
+            const exit = err?.code;
+            const code = !err ? 0 : typeof exit === 'number' ? exit : 1;
+            resolve({ code, stderr: String(stderr ?? '') || (err ? err.message : '') });
+        });
+        if (input !== undefined)
+            child.stdin?.end(input);
+    });
+}
+async function ghosttyAttachedDefault() {
+    const r = await tmux('owned', ['list-clients', '-F', '#{client_session}\t#{client_termname}']);
+    const out = new Set();
+    if (!r.ok)
+        return out;
+    for (const line of r.stdout.split('\n')) {
+        const [session, term] = line.split('\t');
+        if (session && term === GHOSTTY_TERM)
+            out.add(session);
+    }
+    return out;
+}
+// ----------------------------------------------------------------------------
+// The route
+// ----------------------------------------------------------------------------
+export function validateOpen(body) {
+    const b = (body ?? {});
+    const layout = b.layout === undefined ? 'tabs' : b.layout;
+    if (layout !== 'tabs' && layout !== 'windows') {
+        throw new SessionError(400, 'BAD_REQUEST', 'layout must be "tabs" or "windows".');
+    }
+    if (!Array.isArray(b.session_keys) || b.session_keys.length === 0 || !b.session_keys.every((k) => typeof k === 'string' && k)) {
+        throw new SessionError(400, 'BAD_REQUEST', 'session_keys must be a non-empty array of session keys.');
+    }
+    const keys = [...new Set(b.session_keys)];
+    if (keys.length > MAX_OPEN) {
+        throw new SessionError(400, 'BAD_REQUEST', `At most ${MAX_OPEN} sessions per call.`);
+    }
+    return { keys, layout };
+}
+export async function openTerminal(body, deps = {}) {
+    const { keys, layout } = validateOpen(body);
+    const installed = (deps.ghosttyInstalled ?? (() => existsSync(GHOSTTY_APP)))();
+    if (!installed) {
+        return { results: keys.map((k) => ({ session_key: k, status: 'failed', code: 'GHOSTTY_NOT_INSTALLED', error: `${GHOSTTY_APP} not found.` })) };
+    }
+    await (deps.ensureTitles ?? ensureTitles)();
+    const [rows, attached] = await Promise.all([
+        (deps.sessions ?? (() => listHostedSessions()))(),
+        (deps.ghosttyAttached ?? ghosttyAttachedDefault)(),
+    ]);
+    const byKey = new Map(rows.map((r) => [r.session_key, r]));
+    const osascript = deps.osascript ?? ((script) => run('osascript', ['-'], script));
+    const open = deps.open ?? ((args) => run('open', args));
+    const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    const results = [];
+    let denied = false;
+    let opened = 0;
+    for (const key of keys) {
+        const row = byKey.get(key);
+        if (!row || row.state !== 'live') {
+            results.push({ session_key: key, status: 'failed', code: 'NOT_LIVE', error: 'Not a live session.' });
+            continue;
+        }
+        if (row.origin !== 'spawned' || !row.attach_argv || !row.cwd) {
+            results.push({ session_key: key, status: 'failed', code: 'NOT_OWNED', error: 'Only sessions the daemon spawned can be opened.' });
+            continue;
+        }
+        if (attached.has(key)) {
+            results.push({ session_key: key, status: 'already_open' });
+            continue;
+        }
+        if (denied) {
+            results.push({ session_key: key, status: 'failed', code: 'AUTOMATION_DENIED', error: 'macOS denied control of Ghostty.' });
+            continue;
+        }
+        if (opened > 0)
+            await sleep(STAGGER_MS);
+        let r;
+        try {
+            r = layout === 'tabs'
+                ? await osascript(tabScript(row.attach_argv.map(shellWord).join(' '), row.cwd))
+                : await open(windowArgs(row.attach_argv, row.cwd));
+        }
+        catch (err) {
+            results.push({ session_key: key, status: 'failed', code: 'BAD_PATH', error: err instanceof Error ? err.message : String(err) });
+            continue;
+        }
+        if (r.code === 0) {
+            opened++;
+            results.push({ session_key: key, status: 'opened' });
+        }
+        else if (/-1743/.test(r.stderr)) {
+            denied = true;
+            results.push({ session_key: key, status: 'failed', code: 'AUTOMATION_DENIED', error: 'macOS denied control of Ghostty.' });
+        }
+        else {
+            results.push({ session_key: key, status: 'failed', code: 'OSASCRIPT_FAILED', error: r.stderr.trim().slice(0, 300) || `exit ${r.code}` });
+        }
+    }
+    log(`Sessions: open-terminal (${layout}) ${results.map((r) => `${r.session_key}=${r.status}`).join(' ')}`);
+    return { results };
+}
+//# sourceMappingURL=openTerminal.js.map

package/dist/pty/openTerminal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openTerminal.js","sourceRoot":"","sources":["../../src/pty/openTerminal.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,wEAAwE;AACxE,+EAA+E;AAC/E,yEAAyE;AACzE,yEAAyE;AACzE,+DAA+D;AAC/D,EAAE;AACF,8EAA8E;AAC9E,6EAA6E;AAC7E,6EAA6E;AAC7E,+EAA+E;AAC/E,8DAA8D;AAC9D,EAAE;AACF,0EAA0E;AAC1E,6EAA6E;AAC7E,mEAAmE;AACnE,0EAA0E;AAC1E,qEAAqE;AACrE,EAAE;AACF,6EAA6E;AAC7E,sEAAsE;AACtE,+EAA+E;AAE/E,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAChC,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAsB,MAAM,eAAe,CAAC;AAEvE,MAAM,CAAC,MAAM,QAAQ,GAAG,EAAE,CAAC;AAC3B,MAAM,CAAC,MAAM,WAAW,GAAG,2BAA2B,CAAC;AACvD,MAAM,CAAC,MAAM,YAAY,GAAG,eAAe,CAAC;AAC5C,MAAM,UAAU,GAAG,GAAG,CAAC;AA8BvB,+EAA+E;AAC/E,+DAA+D;AAC/D,+EAA+E;AAE/E,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,mBAAmB,EAAE,YAAY,CAAC,CAAC,CAAC;IACpI,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,GAAG,CAAC,4CAA4C,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AAChF,CAAC;AAED,+EAA+E;AAC/E,UAAU;AACV,+EAA+E;AAE/E,8DAA8D;AAC9D,MAAM,UAAU,SAAS,CAAC,CAAS;IACjC,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,CAAS;IACnC,IAAI,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAChG,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,OAAe,EAAE,GAAW;IACpD,OAAO;QACL,4BAA4B;QAC5B,wCAAwC;QACxC,2BAA2B,WAAW,CAAC,OAAO,CAAC,EAAE;QACjD,6CAA6C,WAAW,CAAC,GAAG,CAAC,EAAE;QAC/D,kCAAkC;QAClC,uCAAuC;QACvC,QAAQ;QACR,oDAAoD;QACpD,UAAU;QACV,UAAU;QACV,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAc,EAAE,GAAW;IACpD,OAAO,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,uBAAuB,GAAG,EAAE,EAAE,aAAa,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AACpH,CAAC;AAED,+EAA+E;AAC/E,eAAe;AACf,+EAA+E;AAE/E,SAAS,GAAG,CAAC,GAAW,EAAE,IAAc,EAAE,KAAc;IACtD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE;YAC9E,wEAAwE;YACxE,MAAM,IAAI,GAAI,GAAiC,EAAE,IAAI,CAAC;YACtD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5D,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9E,CAAC,CAAC,CAAC;QACH,IAAI,KAAK,KAAK,SAAS;YAAE,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,sBAAsB;IACnC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,cAAc,EAAE,IAAI,EAAE,uCAAuC,CAAC,CAAC,CAAC;IAC/F,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,GAAG,CAAC;IACtB,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,OAAO,IAAI,IAAI,KAAK,YAAY;YAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,+EAA+E;AAC/E,YAAY;AACZ,+EAA+E;AAE/E,MAAM,UAAU,YAAY,CAAC,IAAa;IACxC,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAiD,CAAC;IACvE,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC1D,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAC9C,MAAM,IAAI,YAAY,CAAC,GAAG,EAAE,aAAa,EAAE,qCAAqC,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,EAAE,CAAC;QAC9H,MAAM,IAAI,YAAY,CAAC,GAAG,EAAE,aAAa,EAAE,yDAAyD,CAAC,CAAC;IACxG,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,YAAwB,CAAC,CAAC,CAAC;IACtD,IAAI,IAAI,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,YAAY,CAAC,GAAG,EAAE,aAAa,EAAE,WAAW,QAAQ,qBAAqB,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAa,EAAE,OAAiB,EAAE;IACnE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,uBAAuB,EAAE,KAAK,EAAE,GAAG,WAAW,aAAa,EAAE,CAAC,CAAC,EAAE,CAAC;IACjJ,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,YAAY,CAAC,EAAE,CAAC;IAC5C,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACzC,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,GAAG,EAAE,CAAC,kBAAkB,EAAE,CAAC,CAAC,EAAE;QACjD,CAAC,IAAI,CAAC,eAAe,IAAI,sBAAsB,CAAC,EAAE;KACnD,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,MAAc,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1F,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,IAAc,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAE1F,MAAM,OAAO,GAAc,EAAE,CAAC;IAC9B,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;YACjC,OAAO,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;YACrG,SAAS;QACX,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;YAC7D,OAAO,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,iDAAiD,EAAE,CAAC,CAAC;YAClI,SAAS;QACX,CAAC;QACD,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;YAC3D,SAAS;QACX,CAAC;QACD,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC,CAAC;YAC3H,SAAS;QACX,CAAC;QAED,IAAI,MAAM,GAAG,CAAC;YAAE,MAAM,KAAK,CAAC,UAAU,CAAC,CAAC;QACxC,IAAI,CAAY,CAAC;QACjB,IAAI,CAAC;YACH,CAAC,GAAG,MAAM,KAAK,MAAM;gBACnB,CAAC,CAAC,MAAM,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;gBAC/E,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChI,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACjB,MAAM,EAAE,CAAC;YACT,OAAO,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QACvD,CAAC;aAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YAClC,MAAM,GAAG,IAAI,CAAC;YACd,OAAO,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC,CAAC;QAC7H,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC3I,CAAC;IACH,CAAC;IACD,GAAG,CAAC,4BAA4B,MAAM,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC3G,OAAO,EAAE,OAAO,EAAE,CAAC;AACrB,CAAC"}

package/dist/pty/pairDialog.d.ts

@@ -0,0 +1,16 @@
+export type DialogAnswer = 'allow' | 'deny' | 'timeout' | 'error';
+export interface DialogDeps {
+    /** Runs the AppleScript; resolves with what the user did. */
+    run?: (script: string, timeoutSec: number) => Promise<DialogAnswer>;
+    platform?: string;
+    enabled?: boolean;
+}
+/** For tests. */
+export declare function _resetPairDialog(): void;
+export declare function dialogScript(origin: string, label: string, code: string, timeoutSec: number): string;
+/**
+ * Ask the user on this Mac. Fire and forget from the /pair/request route: the
+ * HTTP response never waits on the dialog, and nothing here throws.
+ */
+export declare function confirmPairingLocally(pairingId: string, deps?: DialogDeps): Promise<DialogAnswer | 'skipped'>;
+//# sourceMappingURL=pairDialog.d.ts.map

package/dist/pty/pairDialog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pairDialog.d.ts","sourceRoot":"","sources":["../../src/pty/pairDialog.ts"],"names":[],"mappings":"AA2BA,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC;AAElE,MAAM,WAAW,UAAU;IACzB,6DAA6D;IAC7D,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;IACpE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAID,iBAAiB;AACjB,wBAAgB,gBAAgB,IAAI,IAAI,CAEvC;AAOD,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAkBpG;AAmBD;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,GAAE,UAAe,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAqCvH"}

package/dist/pty/pairDialog.js

@@ -0,0 +1,121 @@
+// ============================================================================
+// Native pairing approval on macOS (ADR-0012 amendment, tools ISS-0228)
+// ============================================================================
+// ADR-0012's gate is that NO HTTP ROUTE APPROVES A PAIRING: a compromised HQ
+// page can ask to pair, but it cannot say yes. Until now the yes was
+// `decibel-tools pair approve <code>`, a developer command. On macOS the
+// daemon now shows a native dialog on the user's own screen instead:
+//
+//   "HQ (https://hq.example) wants to connect to Decibel on this Mac.
+//    Code 123456. Allow only if HQ shows the same code."   [Deny] [Allow]
+//
+// The gate is unchanged. The request arrives over HTTP, but the approval is a
+// local click in a window HQ cannot see or drive. Allow approves only the
+// exact pending request that was shown, by id AND code, so a request replaced
+// while the dialog was open is not approved by it. Deny removes the request.
+// No answer within the pending window (10 min) leaves it to expire.
+//
+// One dialog at a time; while one is open, further requests still work through
+// the CLI. Linux and Windows keep the CLI until each gets a native prompt.
+// DECIBEL_PAIR_DIALOG=0 turns the dialog off.
+// ============================================================================
+import { execFile } from 'child_process';
+import { log } from '../config.js';
+import { appleString } from './openTerminal.js';
+import { approvePendingLocally, revokePairing, listPairings, PENDING_TTL_MS } from './pairing.js';
+let open = false;
+/** For tests. */
+export function _resetPairDialog() {
+    open = false;
+}
+/** Strip anything that could not, or should not, be shown in a dialog. */
+function shown(s, max) {
+    return s.replace(/[\u0000-\u001f\u007f]/g, ' ').trim().slice(0, max);
+}
+export function dialogScript(origin, label, code, timeoutSec) {
+    const who = label && label !== 'HQ' ? `${shown(label, 60)} (${shown(origin, 200)})` : `HQ (${shown(origin, 200)})`;
+    const lines = [
+        `${who} wants to connect to Decibel on this Mac.`,
+        '',
+        `Code: ${code}`,
+        '',
+        "Allow only if HQ shows exactly this code. If you didn't just ask to connect, choose Deny.",
+    ];
+    // Lines joined in AppleScript itself: appleString escapes backslashes, so a
+    // "\n" inside the literal would show as text, not a line break.
+    const body = lines.map((l) => appleString(l)).join(' & linefeed & ');
+    return [
+        `display dialog (${body}) ` +
+            `with title "Decibel" buttons {"Deny", "Allow"} default button "Deny" cancel button "Deny" ` +
+            `with icon caution giving up after ${timeoutSec}`,
+        '',
+    ].join('\n');
+}
+function runDefault(script, timeoutSec) {
+    return new Promise((resolve) => {
+        const child = execFile('osascript', ['-'], { timeout: (timeoutSec + 30) * 1000 }, (err, stdout, stderr) => {
+            if (err) {
+                // The cancel button ("Deny") ends osascript with error -128.
+                resolve(/-128/.test(String(stderr)) ? 'deny' : 'error');
+                return;
+            }
+            const out = String(stdout);
+            if (/gave up:true/.test(out))
+                resolve('timeout');
+            else if (/button returned:Allow/.test(out))
+                resolve('allow');
+            else
+                resolve('deny');
+        });
+        child.stdin?.end(script);
+    });
+}
+/**
+ * Ask the user on this Mac. Fire and forget from the /pair/request route: the
+ * HTTP response never waits on the dialog, and nothing here throws.
+ */
+export async function confirmPairingLocally(pairingId, deps = {}) {
+    const platform = deps.platform ?? process.platform;
+    const enabled = deps.enabled ?? process.env.DECIBEL_PAIR_DIALOG !== '0';
+    if (platform !== 'darwin' || !enabled || open)
+        return 'skipped';
+    const p = listPairings().find((x) => x.id === pairingId && x.status === 'pending');
+    if (!p || !p.code)
+        return 'skipped';
+    open = true;
+    try {
+        const timeoutSec = Math.floor(PENDING_TTL_MS / 1000);
+        let script;
+        try {
+            script = dialogScript(p.origin, p.label, p.code, timeoutSec);
+        }
+        catch (err) {
+            log(`Pairing: dialog not shown: ${err instanceof Error ? err.message : String(err)}`);
+            return 'error';
+        }
+        const answer = await (deps.run ?? runDefault)(script, timeoutSec);
+        if (answer === 'allow') {
+            try {
+                await approvePendingLocally(p.id, p.code);
+                log(`Pairing: ${p.origin} approved in the native dialog`);
+            }
+            catch (err) {
+                log(`Pairing: dialog approval not applied: ${err instanceof Error ? err.message : String(err)}`);
+                return 'error';
+            }
+        }
+        else if (answer === 'deny') {
+            await revokePairing(p.id);
+            log(`Pairing: ${p.origin} denied in the native dialog`);
+        }
+        return answer;
+    }
+    catch (err) {
+        log(`Pairing: dialog failed: ${err instanceof Error ? err.message : String(err)}`);
+        return 'error';
+    }
+    finally {
+        open = false;
+    }
+}
+//# sourceMappingURL=pairDialog.js.map

package/dist/pty/pairDialog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pairDialog.js","sourceRoot":"","sources":["../../src/pty/pairDialog.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,wEAAwE;AACxE,+EAA+E;AAC/E,6EAA6E;AAC7E,qEAAqE;AACrE,yEAAyE;AACzE,qEAAqE;AACrE,EAAE;AACF,sEAAsE;AACtE,0EAA0E;AAC1E,EAAE;AACF,8EAA8E;AAC9E,0EAA0E;AAC1E,8EAA8E;AAC9E,6EAA6E;AAC7E,oEAAoE;AACpE,EAAE;AACF,+EAA+E;AAC/E,2EAA2E;AAC3E,8CAA8C;AAC9C,+EAA+E;AAE/E,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,qBAAqB,EAAE,aAAa,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAWlG,IAAI,IAAI,GAAG,KAAK,CAAC;AAEjB,iBAAiB;AACjB,MAAM,UAAU,gBAAgB;IAC9B,IAAI,GAAG,KAAK,CAAC;AACf,CAAC;AAED,0EAA0E;AAC1E,SAAS,KAAK,CAAC,CAAS,EAAE,GAAW;IACnC,OAAO,CAAC,CAAC,OAAO,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,KAAa,EAAE,IAAY,EAAE,UAAkB;IAC1F,MAAM,GAAG,GAAG,KAAK,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC;IACnH,MAAM,KAAK,GAAG;QACZ,GAAG,GAAG,2CAA2C;QACjD,EAAE;QACF,SAAS,IAAI,EAAE;QACf,EAAE;QACF,2FAA2F;KAC5F,CAAC;IACF,4EAA4E;IAC5E,gEAAgE;IAChE,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACrE,OAAO;QACL,mBAAmB,IAAI,IAAI;YACzB,4FAA4F;YAC5F,qCAAqC,UAAU,EAAE;QACnD,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,MAAc,EAAE,UAAkB;IACpD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,UAAU,GAAG,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YACxG,IAAI,GAAG,EAAE,CAAC;gBACR,6DAA6D;gBAC7D,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;gBACxD,OAAO;YACT,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;YAC3B,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,OAAO,CAAC,SAAS,CAAC,CAAC;iBAC5C,IAAI,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,OAAO,CAAC,OAAO,CAAC,CAAC;;gBACxD,OAAO,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,SAAiB,EAAE,OAAmB,EAAE;IAClF,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACnD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,GAAG,CAAC;IACxE,IAAI,QAAQ,KAAK,QAAQ,IAAI,CAAC,OAAO,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC;IAChE,MAAM,CAAC,GAAG,YAAY,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;IACnF,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAEpC,IAAI,GAAG,IAAI,CAAC;IACZ,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;QACrD,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,8BAA8B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACtF,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,UAAU,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAClE,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YACvB,IAAI,CAAC;gBACH,MAAM,qBAAqB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC1C,GAAG,CAAC,YAAY,CAAC,CAAC,MAAM,gCAAgC,CAAC,CAAC;YAC5D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,yCAAyC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACjG,OAAO,OAAO,CAAC;YACjB,CAAC;QACH,CAAC;aAAM,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YAC7B,MAAM,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC1B,GAAG,CAAC,YAAY,CAAC,CAAC,MAAM,8BAA8B,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,2BAA2B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACnF,OAAO,OAAO,CAAC;IACjB,CAAC;YAAS,CAAC;QACT,IAAI,GAAG,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}