@delegance/claude-autopilot 6.2.2 → 7.2.0

package/dist/src/core/run-state/resolve-engine.js

@@ -1,50 +1,30 @@
 // src/core/run-state/resolve-engine.ts
 //
-// v6.0.1 — pure precedence resolver for whether the Run State Engine should
-// run for a given CLI invocation. Spec: docs/specs/v6-run-state-engine.md
-// "Migration path (v5.6 → v6) + precedence matrix" + docs/v6/migration-guide.md
-// "How to opt in".
+// v7.0 — engine-off path retired. The function is preserved for source
+// compatibility with callers that pass `cliEngine` / `envValue` /
+// `configEnabled`, but it now returns `enabled: true` unconditionally.
 //
-// v6.1 update — built-in default flipped from `false` → `true` per
-// docs/specs/v6.1-default-flip.md. Users who opt out explicitly via
-// `--no-engine`, `CLAUDE_AUTOPILOT_ENGINE=off|false|0|no`, or
-// `engine.enabled: false` in `guardrail.config.yaml` keep the legacy
-// (engine-off) behavior, but they now receive a deprecation warning —
-// the escape hatch goes away in v7. See `emitEngineOffDeprecationWarning`
-// below.
+// What changed in v7.0 vs v6.x:
+//   - `ENGINE_DEFAULT_V6_0` and `ENGINE_DEFAULT_V6_1` exports REMOVED.
+//     Direct importers must replace with literal `true` (see
+//     docs/v7/breaking-changes.md).
+//   - The deprecation warning helpers (`emitEngineOffDeprecationWarning`
+//     / `shouldWarnEngineOffDeprecation` / `ENGINE_OFF_DEPRECATION_MESSAGE`)
+//     are RETAINED as no-op stubs so call sites don't have to change in
+//     the same PR — they always return false / never fire.
+//   - `parseEngineEnvValue()` is RETAINED for back-compat with any
+//     out-of-tree callers; `resolveEngineEnabled()` ignores the env
+//     value entirely (the engine-off env path is gone).
 //
-// Precedence (highest wins):
-//   1. CLI flag         — `--engine` / `--no-engine`
-//   2. Env var          — `CLAUDE_AUTOPILOT_ENGINE=on|off|true|false|1|0|yes|no`
-//   3. Config           — `engine.enabled: true|false` in guardrail.config.yaml
-//   4. Built-in default — v6.1+: true (was false in v6.0)
-//
-// This module is intentionally pure and side-effect-free: it never reads from
-// the environment or the config file directly. Callers (the CLI dispatcher)
-// gather the inputs and pass them in — that keeps the function trivially
-// testable and lets the dispatcher own all I/O.
-//
-// Invalid env values do NOT throw. The contract from the spec / migration
-// guide is "treat as unset and emit a run.warning so observers can attribute
-// the fallthrough." This module returns metadata — the resolver caller
-// (cli/index.ts) is responsible for emitting the warning event.
-/** v6.1+ ships with the engine ON by default — flipped from the v6.0
- *  default (`false`) per `docs/specs/v6.1-default-flip.md`. Exported so
- *  tests / future releases can pin a known value. */
-export const ENGINE_DEFAULT_V6_1 = true;
-/** Historical v6.0 default. Preserved verbatim — its semantic meaning
- *  ("the v6.0 default was off") doesn't change just because the active
- *  default flipped. Out-of-tree consumers that pinned this constant get
- *  the value the name promises. Use `ENGINE_DEFAULT_V6_1` for the active
- *  default. Removed in v7.
- *  @deprecated Use `ENGINE_DEFAULT_V6_1` or omit `builtInDefault` to inherit
- *  the active default. */
-export const ENGINE_DEFAULT_V6_0 = false;
+// Why keep the stub function shape: the CLI dispatcher passes
+// `cliEngine` / `envEngine` / config to `runPhaseWithLifecycle`, which
+// in turn calls `resolveEngineEnabled()`. Those parameters become
+// effective no-ops in v7.0 — the values are observed (so a future PR
+// can re-enable the path or surface a deprecation event) but never
+// override the always-on result.
 /** Parse a stringly-typed env value into a tri-state boolean.
- *  Accepts (case-insensitive): on, off, true, false, 1, 0, yes, no.
- *  Returns undefined for any other input INCLUDING empty / whitespace-only
- *  strings — that signals the caller to fall through to the next precedence
- *  layer. */
+ *  Retained for back-compat with any out-of-tree callers; the v7
+ *  resolver does not consult env values. */
 export function parseEngineEnvValue(raw) {
     if (raw === undefined)
         return undefined;
@@ -66,125 +46,29 @@ export function parseEngineEnvValue(raw) {
             return undefined;
     }
 }
-/** Resolve whether the Run State Engine should run for this invocation.
- *  Pure function — does not touch process.env, fs, or anything I/O. */
-export function resolveEngineEnabled(opts = {}) {
-    const { cliEngine, envValue, configEnabled, builtInDefault } = opts;
-    const builtIn = builtInDefault ?? ENGINE_DEFAULT_V6_1;
-    // Layer 1 — CLI flag wins outright.
-    if (cliEngine === true) {
-        return { enabled: true, source: 'cli', reason: '--engine flag' };
-    }
-    if (cliEngine === false) {
-        return { enabled: false, source: 'cli', reason: '--no-engine flag' };
-    }
-    // Layer 2 — env var.
-    if (envValue !== undefined && envValue.trim() !== '') {
-        const parsed = parseEngineEnvValue(envValue);
-        if (parsed !== undefined) {
-            return {
-                enabled: parsed,
-                source: 'env',
-                reason: `CLAUDE_AUTOPILOT_ENGINE=${envValue}`,
-            };
-        }
-        // Invalid value — fall through, but record the raw value so the caller
-        // can emit a run.warning. Continue to config / default below.
-        // We bind it here so it survives the recursion-style fallthrough.
-        return resolveWithFallthrough({
-            configEnabled,
-            builtIn,
-            invalidEnvValue: envValue,
-        });
-    }
-    return resolveWithFallthrough({ configEnabled, builtIn });
-}
-/** Layers 3 + 4 — config, then built-in default. Factored out so the env
- *  invalid-value path can reach the same logic without recursing into
- *  resolveEngineEnabled (which would re-evaluate the env var and loop). */
-function resolveWithFallthrough(opts) {
-    const { configEnabled, builtIn, invalidEnvValue } = opts;
-    const invalidSuffix = invalidEnvValue !== undefined
-        ? `; invalid CLAUDE_AUTOPILOT_ENGINE=${JSON.stringify(invalidEnvValue)} ignored`
-        : '';
-    if (configEnabled === true) {
-        return {
-            enabled: true,
-            source: 'config',
-            reason: `engine.enabled: true in guardrail.config.yaml${invalidSuffix}`,
-            ...(invalidEnvValue !== undefined ? { invalidEnvValue } : {}),
-        };
-    }
-    if (configEnabled === false) {
-        return {
-            enabled: false,
-            source: 'config',
-            reason: `engine.enabled: false in guardrail.config.yaml${invalidSuffix}`,
-            ...(invalidEnvValue !== undefined ? { invalidEnvValue } : {}),
-        };
-    }
+/** v7.0+ — engine is always on. Pure function; ignores all inputs.
+ *  Source compatible with v6.x call sites. */
+export function resolveEngineEnabled(_opts = {}) {
     return {
-        enabled: builtIn,
+        enabled: true,
         source: 'default',
-        reason: `built-in default (engine ${builtIn ? 'on' : 'off'} in v6.1+)${invalidSuffix}`,
-        ...(invalidEnvValue !== undefined ? { invalidEnvValue } : {}),
+        reason: 'v7.0+ — engine always on (engine-off path removed)',
     };
 }
 // ---------------------------------------------------------------------------
-// v6.1 deprecation warning for explicit engine-off
+// v6.1 deprecation helpers — retained as no-op stubs for source compat.
+// v7.0 removed the engine-off path entirely; no warning ever fires.
 // ---------------------------------------------------------------------------
-/** Stable copy emitted on stderr when a user explicitly opts out of the
- *  engine via `--no-engine`, `CLAUDE_AUTOPILOT_ENGINE=off`, or
- *  `engine.enabled: false`. v7 removes the escape hatch entirely.
- *
- *  Exported for tests + downstream consumers (e.g. CI parsers) that want to
- *  match against the exact string. Kept on a single line so terminals don't
- *  wrap mid-message. */
-export const ENGINE_OFF_DEPRECATION_MESSAGE = '[deprecation] --no-engine / engine.enabled: false will be removed in v7. Migrate to engine-on (default).';
-/** Decide whether v6.1's `--no-engine` deprecation warning applies for a
- *  given resolver result. Returns `true` ONLY when the user explicitly
- *  opted out (via CLI flag, env var, or config) — never on the v6.1 default
- *  (which is `enabled: true`, so it can't trigger here anyway) and never
- *  when the engine is actually on. Pure: takes the resolver result, returns
- *  a boolean.
- *
- *  Why this is a separate predicate (not collapsed into the warner): the
- *  CLI dispatcher wants to ALSO emit a typed `run.warning` event into a
- *  ledger when the engine ends up on but the resolver came from a layer
- *  that's about to be removed — except today, on v6.1, the only path that
- *  warns IS the "engine off, explicit opt-out" path. So the predicate
- *  collapses cleanly to that single condition. v7 removes both. */
-export function shouldWarnEngineOffDeprecation(resolved) {
-    if (resolved.enabled)
-        return false;
-    return (resolved.source === 'cli' ||
-        resolved.source === 'env' ||
-        resolved.source === 'config');
+/** v6.1-era stable deprecation banner. v7.0+ never emits this string —
+ *  the path is gone. Kept exported so out-of-tree consumers that imported
+ *  it still type-check. */
+export const ENGINE_OFF_DEPRECATION_MESSAGE = '[deprecation] --no-engine / engine.enabled: false were removed in v7.0. Migration: drop the flag/env/config.';
+/** v7.0+ no-op. Always returns false. */
+export function shouldWarnEngineOffDeprecation(_resolved) {
+    return false;
 }
-/** Emit the v6.1 `--no-engine` deprecation warning to stderr (or the
- *  supplied `warn` callback) when the resolver result indicates the user
- *  explicitly opted out of the engine. No-op when:
- *    - the engine is on (no opt-out happened);
- *    - the source is `'default'` (v6.1's flipped default = on, so a default
- *      result with `enabled: false` is impossible without a custom
- *      `builtInDefault` override — and even that path doesn't warn since
- *      it's not a user-driven opt-out).
- *
- *  Pure-ish: side-effect is captured behind the optional `warn` callback so
- *  tests can assert on the message without spawning a subprocess. The
- *  default warner writes to `process.stderr` with a trailing newline.
- *
- *  Returns `true` when the warning fired, `false` when it was a no-op. The
- *  return value is purely informational — callers can use it to decide
- *  whether to also append a `run.warning` event into a run ledger (only
- *  meaningful on the engine-on path; the v6.1 deprecation only fires on
- *  engine-off, where there's no run dir to write into). */
-export function emitEngineOffDeprecationWarning(resolved, warn = (msg) => {
-    process.stderr.write(`${msg}\n`);
-}) {
-    if (!shouldWarnEngineOffDeprecation(resolved))
-        return false;
-    warn(ENGINE_OFF_DEPRECATION_MESSAGE);
-    return true;
+/** v7.0+ no-op. Always returns false. */
+export function emitEngineOffDeprecationWarning(_resolved, _warn = () => { }) {
+    return false;
 }
 //# sourceMappingURL=resolve-engine.js.map

package/dist/src/core/run-state/run-phase-with-lifecycle.d.ts

@@ -28,15 +28,11 @@ export interface RunPhaseWithLifecycleOpts<I, O> {
      *  unset. The helper passes this through to `resolveEngineEnabled` —
      *  invalid values fall through with a `run.warning` recorded automatically. */
     envEngine: string | undefined;
-    /** Engine-off escape hatch — what to return when `resolveEngineEnabled`
-     *  decides the engine should NOT run. Most callers pass an async function
-     *  that runs the legacy code path (typically the same `phase.run` body
-     *  invoked without the lifecycle wrapper). The helper does not invoke
-     *  `phase.run` for engine-off so the caller has full control over the
-     *  legacy path's behavior — keeps engine-off byte-for-byte identical to
-     *  pre-v6 behavior even when the phase body's signature would otherwise
-     *  pin the call shape. */
-    runEngineOff: () => Promise<O>;
+    /** v6.x escape hatch — invoked when the engine was disabled. Retained
+     *  in the v7.0 type for source compatibility with existing callers,
+     *  but the helper NEVER calls it in v7.0+ (engine-off path was
+     *  removed). Optional in v7.0; can be omitted from new call sites. */
+    runEngineOff?: () => Promise<O>;
 }
 /** What the helper hands back. `runId` and `runDir` are null on the
  *  engine-off path so callers can branch on whether engine artifacts exist

package/dist/src/core/run-state/run-phase-with-lifecycle.js

@@ -39,7 +39,7 @@ import { createRun } from "./runs.js";
 import { runPhase } from "./phase-runner.js";
 import { appendEvent, replayState } from "./events.js";
 import { writeStateSnapshot } from "./state.js";
-import { resolveEngineEnabled, emitEngineOffDeprecationWarning, } from "./resolve-engine.js";
+import { resolveEngineEnabled, } from "./resolve-engine.js";
 // Inline ANSI codes — same shape every wrapped verb uses. Kept here so the
 // helper doesn't depend on a verb-local `fmt`. The error message format
 // (`[<phase>] engine: phase failed — <msg>` + dim inspect hint) is
@@ -69,12 +69,12 @@ const ANSI_RED = '\x1b[31m';
  *  catch block does not need to release the lock itself — `finally` covers
  *  both the success and failure exit paths. */
 export async function runPhaseWithLifecycle(opts) {
-    const { cwd, phase, input, config, cliEngine, envEngine, runEngineOff } = opts;
-    // Resolve engine via the canonical precedence (CLI > env > config >
-    // built-in default). The resolver is pure — same inputs always produce
-    // the same decision. We DO consult the loaded config's `engine.enabled`
-    // here so the helper's caller doesn't have to repeat the conditional
-    // spread that every wrapped verb wrote inline.
+    const { cwd, phase, input, config, cliEngine, envEngine } = opts;
+    // v7.0 — engine is always on. resolveEngineEnabled() returns
+    // { enabled: true, source: 'default' } unconditionally. We still
+    // pass the v6-era inputs through so any future re-introduction of
+    // observability (a run.warning when a user passes the removed flags
+    // via env vars in CI) is a one-line change.
     const engineResolved = resolveEngineEnabled({
         ...(cliEngine !== undefined ? { cliEngine } : {}),
         ...(envEngine !== undefined ? { envValue: envEngine } : {}),
@@ -82,18 +82,6 @@ export async function runPhaseWithLifecycle(opts) {
             ? { configEnabled: config.engine.enabled }
             : {}),
     });
-    if (!engineResolved.enabled) {
-        // Engine off — call the caller's legacy path. No run dir, no events,
-        // no lifecycle work. Behavior is byte-for-byte identical to pre-engine
-        // versions of the verb. v6.1+ emits a one-line stderr deprecation
-        // notice when the user explicitly opted out (CLI / env / config); the
-        // v6.1 default is `enabled: true`, so a `'default'` source can't reach
-        // this branch and the deprecation helper no-ops on the `enabled: true`
-        // path. v7 removes the opt-out entirely.
-        emitEngineOffDeprecationWarning(engineResolved);
-        const output = await runEngineOff();
-        return { output, runId: null, runDir: null };
-    }
     // Engine on — full lifecycle. Mirrors the pre-v6.0.6 inline shape that
     // every wrapped verb duplicated.
     const created = await createRun({
@@ -115,6 +103,25 @@ export async function runPhaseWithLifecycle(opts) {
             details: { resolution: engineResolved },
         }, { writerId: created.lock.writerId, runId: created.runId });
     }
+    // v7.0 — emit `engine_off_removed` warning when CLAUDE_AUTOPILOT_ENGINE
+    // is set to an off-style value. The env value is otherwise ignored
+    // (engine remains on). Softer than --no-engine (which exits 1) because
+    // env vars in CI are sticky and silently breaking every v6.x → v7
+    // upgrade in CI on day one would burn user trust. See spec test #1(c).
+    if (envEngine !== undefined) {
+        const normalized = envEngine.trim().toLowerCase();
+        if (normalized === 'off' || normalized === 'false' || normalized === '0' || normalized === 'no') {
+            appendEvent(created.runDir, {
+                event: 'run.warning',
+                message: 'engine_off_removed',
+                details: {
+                    code: 'engine_off_removed',
+                    envValue: envEngine,
+                    note: 'CLAUDE_AUTOPILOT_ENGINE=off has no effect in v7.0+; engine remains on.',
+                },
+            }, { writerId: created.lock.writerId, runId: created.runId });
+        }
+    }
     const runStartedAt = Date.now();
     try {
         const output = await runPhase(phase, input, {

package/dist/src/core/run-state/state.d.ts

@@ -5,7 +5,7 @@ export declare const RUN_STATE_MIN_SUPPORTED_SCHEMA_VERSION: 1;
 /** Highest `schema_version` value this binary can replay. Always equal to
  *  the writer's `RUN_STATE_SCHEMA_VERSION` — the writer never produces a
  *  newer shape than the reader on the same binary. */
-export declare const RUN_STATE_MAX_SUPPORTED_SCHEMA_VERSION: 1;
+export declare const RUN_STATE_MAX_SUPPORTED_SCHEMA_VERSION: 2;
 export declare function statePath(runDir: string): string;
 /** Write the snapshot atomically. Sequence:
  *    open(tmp, 'w') → write → fsync(fd) → close → rename → fsync(dirfd).

package/dist/src/core/run-state/types.d.ts

@@ -1,6 +1,12 @@
 /** Schema version for everything written by this engine. Bump on breaking
- *  changes to RunState / RunEvent / PhaseSnapshot shape. */
-export declare const RUN_STATE_SCHEMA_VERSION: 1;
+ *  changes to RunState / RunEvent / PhaseSnapshot shape.
+ *
+ *  v7.0 — bumped from 1 to 2 to signal the v7 cycle on every newly-written
+ *  state.json. v6.x runs (schema_version=1) remain readable by v7 binaries
+ *  because `RUN_STATE_MIN_SUPPORTED_SCHEMA_VERSION` stays at 1. v6 binaries
+ *  cannot read v7-written runs; the corrupted_state error includes a
+ *  "downgrade resume is not supported" hint so operators know why. */
+export declare const RUN_STATE_SCHEMA_VERSION: 2;
 export type SchemaVersion = typeof RUN_STATE_SCHEMA_VERSION;
 /** Identifies a single OS-level writer. PID + a hash of the hostname (we
  *  don't persist the raw hostname to the lock metadata so co-tenant signal

package/dist/src/core/run-state/types.js

@@ -8,6 +8,12 @@
 // Spec: docs/specs/v6-run-state-engine.md ("State on disk", "Run lifecycle",
 // "Idempotency rules + external operation ledger", "Persistence protocol").
 /** Schema version for everything written by this engine. Bump on breaking
- *  changes to RunState / RunEvent / PhaseSnapshot shape. */
-export const RUN_STATE_SCHEMA_VERSION = 1;
+ *  changes to RunState / RunEvent / PhaseSnapshot shape.
+ *
+ *  v7.0 — bumped from 1 to 2 to signal the v7 cycle on every newly-written
+ *  state.json. v6.x runs (schema_version=1) remain readable by v7 binaries
+ *  because `RUN_STATE_MIN_SUPPORTED_SCHEMA_VERSION` stays at 1. v6 binaries
+ *  cannot read v7-written runs; the corrupted_state error includes a
+ *  "downgrade resume is not supported" hint so operators know why. */
+export const RUN_STATE_SCHEMA_VERSION = 2;
 //# sourceMappingURL=types.js.map

package/dist/src/dashboard/auto-upload.d.ts

@@ -0,0 +1,26 @@
+export interface AutoUploadOptions {
+    /** Caller's explicit opt-out (e.g. CLI --no-upload). */
+    disabled?: boolean;
+    /** Test seam — substitute fetch impl. */
+    fetchImpl?: typeof fetch;
+    /** Test seam — silence stdout. */
+    silent?: boolean;
+}
+export interface AutoUploadResult {
+    attempted: boolean;
+    ok: boolean;
+    url: string | null;
+    skipped: boolean;
+    reason?: 'opt-out-flag' | 'env-off' | 'not-logged-in' | 'no-events' | 'aborted' | 'error' | 'limit-reached';
+}
+export declare function shouldAutoUpload(options?: AutoUploadOptions): {
+    ok: boolean;
+    reason?: AutoUploadResult['reason'];
+};
+/**
+ * Run an auto-upload for the given runId. Wraps the foreground uploader
+ * in a SIGINT/SIGTERM handler so Ctrl-C is clean. Always returns a result
+ * — never throws. Caller preserves the run's original exit code.
+ */
+export declare function autoUploadAtComplete(runId: string, runDir: string, options?: AutoUploadOptions): Promise<AutoUploadResult>;
+//# sourceMappingURL=auto-upload.d.ts.map

package/dist/src/dashboard/auto-upload.js

@@ -0,0 +1,107 @@
+// Auto-upload at run.complete — non-fatal hosted-product hook.
+//
+// Contract (per spec): never fails the run. Always preserves the original
+// exit code. Failure prints a resume command. Empty events.ndjson skips
+// upload cleanly (Phase 2.2's POST /api/upload-session 422s expectedChunkCount=0).
+//
+// Opt-outs:
+//   - explicit `--no-upload` flag → caller passes options.disabled=true
+//   - env CLAUDE_AUTOPILOT_UPLOAD=off
+//   - not logged in (no config)
+//   - events.ndjson missing or 0 bytes
+import { promises as fs } from 'node:fs';
+import * as path from 'node:path';
+import { readConfig } from "./config.js";
+import { uploadRun, UploadLimitError } from "./upload/uploader.js";
+export function shouldAutoUpload(options = {}) {
+    if (options.disabled)
+        return { ok: false, reason: 'opt-out-flag' };
+    const env = process.env.CLAUDE_AUTOPILOT_UPLOAD;
+    if (env && /^(off|false|0|no)$/i.test(env))
+        return { ok: false, reason: 'env-off' };
+    return { ok: true };
+}
+async function fileExistsNonEmpty(p) {
+    try {
+        const stat = await fs.stat(p);
+        return stat.isFile() && stat.size > 0;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Run an auto-upload for the given runId. Wraps the foreground uploader
+ * in a SIGINT/SIGTERM handler so Ctrl-C is clean. Always returns a result
+ * — never throws. Caller preserves the run's original exit code.
+ */
+export async function autoUploadAtComplete(runId, runDir, options = {}) {
+    const gate = shouldAutoUpload(options);
+    if (!gate.ok) {
+        return { attempted: false, ok: true, url: null, skipped: true, reason: gate.reason ?? 'opt-out-flag' };
+    }
+    const cfg = await readConfig();
+    if (!cfg) {
+        return { attempted: false, ok: true, url: null, skipped: true, reason: 'not-logged-in' };
+    }
+    const eventsPath = path.join(runDir, 'events.ndjson');
+    const hasEvents = await fileExistsNonEmpty(eventsPath);
+    if (!hasEvents) {
+        return { attempted: false, ok: true, url: null, skipped: true, reason: 'no-events' };
+    }
+    const ac = new AbortController();
+    const sigintHandler = () => ac.abort();
+    process.on('SIGINT', sigintHandler);
+    process.on('SIGTERM', sigintHandler);
+    try {
+        const result = await uploadRun(runId, runDir, {
+            apiKey: cfg.apiKey,
+            signal: ac.signal,
+            ...(options.fetchImpl !== undefined ? { fetchImpl: options.fetchImpl } : {}),
+        });
+        if (result.ok && result.url) {
+            if (!options.silent)
+                process.stdout.write(`[autopilot] uploaded to ${result.url}\n`);
+            return { attempted: true, ok: true, url: result.url, skipped: false };
+        }
+        if (result.ok && result.skipped) {
+            if (!options.silent)
+                process.stdout.write(`[autopilot] skipping upload — events.ndjson is empty\n`);
+            return { attempted: true, ok: true, url: null, skipped: true, reason: 'no-events' };
+        }
+        if (!options.silent) {
+            process.stderr.write(`[autopilot] upload failed: ${result.error}\n`);
+            process.stderr.write(`            Resume with: claude-autopilot dashboard upload ${runId}\n`);
+        }
+        return { attempted: true, ok: false, url: null, skipped: false, reason: 'error' };
+    }
+    catch (err) {
+        if (ac.signal.aborted) {
+            if (!options.silent) {
+                process.stderr.write(`\n[autopilot] upload interrupted. Run is saved locally.\n`);
+                process.stderr.write(`            Resume with: claude-autopilot dashboard upload ${runId}\n`);
+            }
+            return { attempted: true, ok: false, url: null, skipped: false, reason: 'aborted' };
+        }
+        // Phase 3 — runs/storage cap reached. Print a friendly message but
+        // do NOT print the resume hint (resume would just hit 402 again until
+        // the user upgrades) and do NOT bubble the error so the run's exit
+        // code is preserved.
+        if (err instanceof UploadLimitError) {
+            if (!options.silent) {
+                process.stderr.write(`[autopilot] ${err.message}\n`);
+            }
+            return { attempted: true, ok: false, url: null, skipped: false, reason: 'limit-reached' };
+        }
+        if (!options.silent) {
+            process.stderr.write(`[autopilot] upload error: ${err.message}\n`);
+            process.stderr.write(`            Resume with: claude-autopilot dashboard upload ${runId}\n`);
+        }
+        return { attempted: true, ok: false, url: null, skipped: false, reason: 'error' };
+    }
+    finally {
+        process.off('SIGINT', sigintHandler);
+        process.off('SIGTERM', sigintHandler);
+    }
+}
+//# sourceMappingURL=auto-upload.js.map

package/dist/src/dashboard/config.d.ts

@@ -0,0 +1,22 @@
+export interface DashboardConfig {
+    schemaVersion: 1;
+    apiKey: string;
+    fingerprint: string;
+    accountEmail: string;
+    loggedInAt: string;
+    lastUploadAt: string | null;
+}
+export declare function getConfigDir(): string;
+export declare function getConfigPath(): string;
+export declare function readConfig(): Promise<DashboardConfig | null>;
+export declare function writeConfig(config: DashboardConfig): Promise<void>;
+export declare function deleteConfig(): Promise<void>;
+export declare function getAutopilotBaseUrl(): string;
+export declare function _resetAutopilotBaseUrlWarning(): void;
+/**
+ * Returns a warning string if the config file is group/world-readable on
+ * a POSIX filesystem; null otherwise (or on Windows, where mode bits
+ * don't apply meaningfully).
+ */
+export declare function warnIfPermissive(): Promise<string | null>;
+//# sourceMappingURL=config.d.ts.map

package/dist/src/dashboard/config.js

@@ -0,0 +1,109 @@
+// CLI dashboard config — atomic read/write of ~/.claude-autopilot/dashboard.json.
+//
+// Codex plan-pass WARNING: respect CLAUDE_AUTOPILOT_HOME env override so
+// tests + experimentation never touch the developer's real home dir.
+import { promises as fs } from 'node:fs';
+import * as path from 'node:path';
+import * as os from 'node:os';
+const KEY_RE = /^clp_[0-9a-f]{64}$/;
+function resolveHome() {
+    return process.env.CLAUDE_AUTOPILOT_HOME ?? path.join(os.homedir(), '.claude-autopilot');
+}
+export function getConfigDir() {
+    return resolveHome();
+}
+export function getConfigPath() {
+    return path.join(resolveHome(), 'dashboard.json');
+}
+export async function readConfig() {
+    try {
+        const raw = await fs.readFile(getConfigPath(), 'utf-8');
+        const parsed = JSON.parse(raw);
+        if (parsed.schemaVersion !== 1)
+            return null;
+        if (!KEY_RE.test(parsed.apiKey))
+            return null;
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+export async function writeConfig(config) {
+    if (!KEY_RE.test(config.apiKey)) {
+        throw new Error('writeConfig: invalid apiKey shape');
+    }
+    const dir = getConfigDir();
+    const file = getConfigPath();
+    await fs.mkdir(dir, { recursive: true, mode: 0o700 });
+    // Try to tighten dir mode even if it already existed.
+    try {
+        await fs.chmod(dir, 0o700);
+    }
+    catch { /* best effort */ }
+    // Atomic write: temp-file + rename.
+    const tmp = `${file}.tmp.${process.pid}.${Date.now()}`;
+    const payload = JSON.stringify(config, null, 2);
+    await fs.writeFile(tmp, payload, { mode: 0o600 });
+    await fs.chmod(tmp, 0o600);
+    await fs.rename(tmp, file);
+}
+export async function deleteConfig() {
+    try {
+        await fs.unlink(getConfigPath());
+    }
+    catch {
+        /* idempotent */
+    }
+}
+/**
+ * Phase 4 — resolve the dashboard / public base URL from env, with
+ * AUTOPILOT_PUBLIC_BASE_URL preferred and AUTOPILOT_DASHBOARD_BASE_URL
+ * accepted as a deprecated alias. Logs a one-time deprecation warning
+ * when only the older variable is set.
+ *
+ * Defaults to https://autopilot.dev when neither is present.
+ */
+let _deprecationWarned = false;
+export function getAutopilotBaseUrl() {
+    const canonical = process.env.AUTOPILOT_PUBLIC_BASE_URL;
+    const legacy = process.env.AUTOPILOT_DASHBOARD_BASE_URL;
+    if (canonical)
+        return canonical;
+    if (legacy) {
+        if (!_deprecationWarned) {
+            _deprecationWarned = true;
+            // eslint-disable-next-line no-console
+            console.warn('[autopilot] AUTOPILOT_DASHBOARD_BASE_URL is deprecated; ' +
+                'use AUTOPILOT_PUBLIC_BASE_URL instead. Both are accepted for now.');
+        }
+        return legacy;
+    }
+    return 'https://autopilot.dev';
+}
+// Test seam — reset the one-shot warning flag.
+export function _resetAutopilotBaseUrlWarning() {
+    _deprecationWarned = false;
+}
+/**
+ * Returns a warning string if the config file is group/world-readable on
+ * a POSIX filesystem; null otherwise (or on Windows, where mode bits
+ * don't apply meaningfully).
+ */
+export async function warnIfPermissive() {
+    if (process.platform === 'win32')
+        return null;
+    const file = getConfigPath();
+    try {
+        const stat = await fs.stat(file);
+        const mode = stat.mode & 0o777;
+        if ((mode & 0o077) !== 0) {
+            return `Warning: ${file} mode is ${mode.toString(8)} (group/world readable). Run: chmod 600 ${file}`;
+        }
+    }
+    catch {
+        /* file doesn't exist, no warning */
+    }
+    return null;
+}
+//# sourceMappingURL=config.js.map

package/dist/src/dashboard/upload/canonical.d.ts

@@ -0,0 +1,3 @@
+export declare function canonicalJsonBytes(value: unknown): Buffer;
+export declare function sha256OfCanonical(value: unknown): string;
+//# sourceMappingURL=canonical.d.ts.map

package/dist/src/dashboard/upload/canonical.js

@@ -0,0 +1,16 @@
+// Parity copy of apps/web/lib/upload/canonical.ts (RFC 8785 / JCS).
+// CLI ↔ web byte-equality asserted in tests/dashboard/parity.test.ts.
+import canonicalize from 'canonicalize';
+import { createHash } from 'node:crypto';
+export function canonicalJsonBytes(value) {
+    // canonicalize implements RFC 8785 (JCS). Returns undefined only for
+    // inputs JSON cannot represent at the root; coerce to '' so callers
+    // always get a Buffer.
+    const str = canonicalize(value) ?? '';
+    return Buffer.from(str, 'utf-8');
+}
+export function sha256OfCanonical(value) {
+    const bytes = canonicalJsonBytes(value);
+    return createHash('sha256').update(bytes).digest('hex');
+}
+//# sourceMappingURL=canonical.js.map