@dmsdc-ai/aigentry-telepty 0.5.8 → 0.6.0

package/install.js

@@ -5,9 +5,6 @@ const os = require('os');
 const fs = require('fs');
 const path = require('path');
 const { cleanupDaemonProcesses } = require('./daemon-control');
-const { runInteractiveSkillInstaller } = require('./skill-installer');
-
-console.log("🚀 Installing @dmsdc-ai/aigentry-telepty...");
 
 function run(cmd) {
   try {
@@ -18,6 +15,10 @@ function run(cmd) {
   }
 }
 
+function shellQuote(value) {
+  return `'${String(value).replace(/'/g, "'\\''")}'`;
+}
+
 function resolveInstalledPackageRoot() {
   try {
     const globalRoot = execSync('npm root -g', { encoding: 'utf8' }).trim();
@@ -27,6 +28,15 @@ function resolveInstalledPackageRoot() {
   }
 }
 
+function resolveDaemonLaunchOptions(options = {}) {
+  const packageRoot = options.packageRoot || __dirname;
+  const nodeBin = options.nodeBin || process.execPath;
+  const cliJs = options.cliJs || path.join(packageRoot, 'cli.js');
+  const logDir = options.logDir || path.join(os.homedir(), '.telepty', 'logs');
+
+  return { nodeBin, cliJs, logDir };
+}
+
 function cleanupLocalDaemons() {
   console.log('🧹 Cleaning up existing telepty daemons...');
   const results = cleanupDaemonProcesses();
@@ -36,6 +46,261 @@ function cleanupLocalDaemons() {
   }
 }
 
+function escapeXml(value) {
+  return String(value)
+    .replace(/&/g, '&')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&apos;');
+}
+
+function uniquePathEntries(entries) {
+  const seen = new Set();
+  const result = [];
+
+  for (const entry of entries) {
+    if (!entry || seen.has(entry)) {
+      continue;
+    }
+    seen.add(entry);
+    result.push(entry);
+  }
+
+  return result;
+}
+
+function buildDaemonPath(nodeBin, baseEntries) {
+  return uniquePathEntries([path.dirname(nodeBin), ...baseEntries]).join(':');
+}
+
+function systemdExecArg(value) {
+  const text = String(value);
+  if (/^[A-Za-z0-9_@%+=:,./-]+$/.test(text)) {
+    return text;
+  }
+  return `"${text.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`;
+}
+
+function quoteWindowsArg(value) {
+  return `"${String(value).replace(/"/g, '\\"')}"`;
+}
+
+function buildLaunchdPlist(options = {}) {
+  const label = options.label || 'com.aigentry.telepty';
+  const nodeBin = options.nodeBin || process.execPath;
+  const cliJs = options.cliJs || path.join(__dirname, 'cli.js');
+  const logDir = options.logDir || path.join(os.homedir(), '.telepty', 'logs');
+  const command = options.command || 'daemon';
+  const daemonPath = buildDaemonPath(nodeBin, ['/usr/local/bin', '/usr/bin', '/bin', '/usr/sbin', '/sbin']);
+  const stdoutPath = path.join(logDir, 'launchd.out.log');
+  const stderrPath = path.join(logDir, 'launchd.err.log');
+  const envPairs = [['PATH', daemonPath], ...Object.entries(options.extraEnv || {})];
+  const envXml = envPairs
+    .map(([key, value]) => `        <key>${escapeXml(key)}</key>\n        <string>${escapeXml(value)}</string>`)
+    .join('\n');
+
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>Label</key>
+    <string>${escapeXml(label)}</string>
+    <key>ProgramArguments</key>
+    <array>
+        <string>${escapeXml(nodeBin)}</string>
+        <string>${escapeXml(cliJs)}</string>
+        <string>${escapeXml(command)}</string>
+    </array>
+    <key>EnvironmentVariables</key>
+    <dict>
+${envXml}
+    </dict>
+    <key>StandardOutPath</key>
+    <string>${escapeXml(stdoutPath)}</string>
+    <key>StandardErrorPath</key>
+    <string>${escapeXml(stderrPath)}</string>
+    <key>RunAtLoad</key>
+    <true/>
+    <key>KeepAlive</key>
+    <true/>
+</dict>
+</plist>`;
+}
+
+function systemdEnvLine(key, value) {
+  const escaped = String(value).replace(/\\/g, '\\\\').replace(/"/g, '\\"');
+  return `Environment="${key}=${escaped}"`;
+}
+
+function buildSystemdService(options = {}) {
+  const nodeBin = options.nodeBin || process.execPath;
+  const cliJs = options.cliJs || path.join(__dirname, 'cli.js');
+  const user = options.user;
+  const userLine = user ? `User=${user}\n` : '';
+  const daemonPath = buildDaemonPath(nodeBin, ['/usr/local/bin', '/usr/bin', '/bin']);
+  const wantedBy = options.wantedBy || 'multi-user.target';
+  const command = options.command || 'daemon';
+  const description = options.description || 'Telepty Daemon';
+  const extraEnvLines = Object.entries(options.extraEnv || {})
+    .map(([key, value]) => `${systemdEnvLine(key, value)}\n`)
+    .join('');
+
+  return `[Unit]
+Description=${description}
+After=network.target
+
+[Service]
+ExecStart=${systemdExecArg(nodeBin)} ${systemdExecArg(cliJs)} ${systemdExecArg(command)}
+Restart=always
+${userLine}Environment=PATH=${daemonPath}
+Environment=NODE_ENV=production
+${extraEnvLines}
+[Install]
+WantedBy=${wantedBy}`;
+}
+
+function buildWindowsAutostartCommand(options = {}) {
+  const nodeBin = options.nodeBin || process.execPath;
+  const cliJs = options.cliJs || path.join(__dirname, 'cli.js');
+  const taskName = options.taskName || 'telepty-daemon';
+  const command = options.command || 'daemon';
+  const taskCommand = `${quoteWindowsArg(nodeBin)} ${quoteWindowsArg(cliJs)} ${command}`;
+
+  return `schtasks /create /tn ${quoteWindowsArg(taskName)} /sc onlogon /rl LIMITED /f /tr ${quoteWindowsArg(taskCommand)}`;
+}
+
+function buildWindowsRunTaskCommand(options = {}) {
+  const taskName = options.taskName || 'telepty-daemon';
+  return `schtasks /run /tn ${quoteWindowsArg(taskName)}`;
+}
+
+function buildWindowsQueryTaskCommand(options = {}) {
+  const taskName = options.taskName || 'telepty-daemon';
+  return `schtasks /query /tn ${quoteWindowsArg(taskName)} /fo LIST`;
+}
+
+// --- Broker-host service variant (telepty #42 broker MVP — spec §6 + §2 H; reuses #41 hardening) ---
+// The broker runs the SAME hardened service definition as the daemon, but executes
+// `<node> <cli.js> broker` (spec §5/§6) and carries the broker host env (TLS + JWT/enroll
+// secrets, spec §6). Selected via `telepty install --broker` or env TELEPTY_BROKER_MODE.
+const BROKER_LAUNCHD_LABEL = 'com.aigentry.telepty-broker';
+const BROKER_SYSTEMD_SERVICE = 'telepty-broker';
+const BROKER_WINDOWS_TASK = 'telepty-broker';
+
+// Pass-through env keys for the broker host service (spec §5/§6). Secrets are NEVER
+// hardcoded — they are read from the install-time environment and forwarded into the
+// generated service definition so the always-on broker host loads them on start.
+const BROKER_ENV_KEYS = [
+  'TELEPTY_JWT_SECRET',
+  'TELEPTY_ENROLL_SECRET',
+  'TELEPTY_TLS_CERT',
+  'TELEPTY_TLS_KEY',
+  'TELEPTY_BROKER_ACL',
+  'TELEPTY_ENROLL_MAX_NODES',
+  'PORT',
+];
+
+function collectBrokerServiceEnv(env = process.env) {
+  const result = { TELEPTY_BROKER_MODE: '1' };
+  for (const key of BROKER_ENV_KEYS) {
+    const value = env[key];
+    if (value !== undefined && value !== '') {
+      result[key] = String(value);
+    }
+  }
+  return result;
+}
+
+function buildBrokerLaunchdPlist(options = {}) {
+  return buildLaunchdPlist({
+    ...options,
+    label: options.label || BROKER_LAUNCHD_LABEL,
+    command: 'broker',
+    extraEnv: { ...collectBrokerServiceEnv(options.env), ...(options.extraEnv || {}) },
+  });
+}
+
+function buildBrokerSystemdService(options = {}) {
+  return buildSystemdService({
+    ...options,
+    command: 'broker',
+    description: options.description || 'Telepty Broker',
+    extraEnv: { ...collectBrokerServiceEnv(options.env), ...(options.extraEnv || {}) },
+  });
+}
+
+function buildBrokerWindowsAutostartCommand(options = {}) {
+  return buildWindowsAutostartCommand({
+    ...options,
+    taskName: options.taskName || BROKER_WINDOWS_TASK,
+    command: 'broker',
+  });
+}
+
+// Resolve the active service profile (daemon vs broker) so main() can install either
+// variant from one code path. The daemon profile reproduces the exact pre-#42 values
+// (no behavior change for existing installs); the broker profile selects distinct
+// label/service/task names, the `broker` command, and the broker host env.
+function resolveServiceProfile(options = {}) {
+  if (options.broker) {
+    return {
+      command: 'broker',
+      launchdLabel: BROKER_LAUNCHD_LABEL,
+      launchdPlistName: `${BROKER_LAUNCHD_LABEL}.plist`,
+      systemdService: BROKER_SYSTEMD_SERVICE,
+      windowsTask: BROKER_WINDOWS_TASK,
+      description: 'Telepty Broker',
+      extraEnv: collectBrokerServiceEnv(options.env),
+    };
+  }
+  return {
+    command: 'daemon',
+    launchdLabel: 'com.aigentry.telepty',
+    launchdPlistName: 'com.aigentry.telepty.plist',
+    systemdService: 'telepty',
+    windowsTask: 'telepty-daemon',
+    description: 'Telepty Daemon',
+    extraEnv: {},
+  };
+}
+
+function assertLaunchdServiceLive(label = 'com.aigentry.telepty') {
+  let output = '';
+  try {
+    output = execSync(`launchctl list ${shellQuote(label)}`, { encoding: 'utf8' });
+  } catch (e) {
+    throw new Error(`launchd service ${label} was not found after load`);
+  }
+
+  const pidMatch = output.match(/"PID"\s*=\s*([0-9]+)/);
+  if (!pidMatch || Number(pidMatch[1]) <= 0) {
+    throw new Error(`launchd service ${label} loaded but has no live PID. launchctl output:\n${output}`);
+  }
+}
+
+function assertSystemdServiceLive(serviceName = 'telepty', options = {}) {
+  const scope = options.user ? '--user ' : '';
+  try {
+    execSync(`systemctl ${scope}is-active --quiet ${serviceName}`, { stdio: 'ignore' });
+  } catch (e) {
+    throw new Error(`systemd service ${serviceName} is not active after start`);
+  }
+}
+
+function assertWindowsTaskRunning(taskName = 'telepty-daemon') {
+  let output = '';
+  try {
+    output = execSync(buildWindowsQueryTaskCommand({ taskName }), { encoding: 'utf8' });
+  } catch (e) {
+    throw new Error(`Windows scheduled task ${taskName} was not found after creation`);
+  }
+
+  if (!/^Status:\s*Running$/im.test(output)) {
+    throw new Error(`Windows scheduled task ${taskName} started but is not running. schtasks output:\n${output}`);
+  }
+}
+
 async function installSkills() {
   if (!process.stdin.isTTY || !process.stdout.isTTY) {
     console.log('⏭️  Skipping interactive skill installation (no TTY).');
@@ -46,6 +311,7 @@ async function installSkills() {
   console.log('\n📋 Telepty skill installation');
 
   try {
+    const { runInteractiveSkillInstaller } = require('./skill-installer');
     await runInteractiveSkillInstaller({
       packageRoot: resolveInstalledPackageRoot(),
       cwd: process.cwd()
@@ -55,7 +321,19 @@ async function installSkills() {
   }
 }
 
-(async () => {
+async function main() {
+  console.log("🚀 Installing @dmsdc-ai/aigentry-telepty...");
+
+  // Broker-host variant (telepty #42): `telepty install --broker` or env TELEPTY_BROKER_MODE
+  // installs the SAME hardened service running `telepty broker` instead of `telepty daemon`.
+  // Default-OFF — existing daemon installs are entirely unaffected (additive).
+  const wantsBroker = process.argv.slice(2).includes('--broker')
+    || process.env.TELEPTY_BROKER_MODE === '1';
+  const profile = resolveServiceProfile({ broker: wantsBroker });
+  if (wantsBroker) {
+    console.log(`🛰️  Broker-host mode: installing service '${profile.launchdLabel}' (runs 'telepty broker').`);
+  }
+
   // 1. Install globally via npm
   console.log("📦 Installing package globally...");
   run("npm install -g @dmsdc-ai/aigentry-telepty");
@@ -63,12 +341,10 @@ async function installSkills() {
   // 2. Install telepty skills for supported clients
   await installSkills();
 
-  // 3. Find executable
-  let teleptyPath = '';
-  try {
-    teleptyPath = execSync(os.platform() === 'win32' ? 'where telepty' : 'which telepty', { encoding: 'utf8' }).split('\n')[0].trim();
-  } catch (e) {
-    teleptyPath = 'telepty'; // fallback
+  // 3. Resolve daemon entrypoint without relying on service-manager PATH.
+  const launchOptions = resolveDaemonLaunchOptions({ packageRoot: resolveInstalledPackageRoot() });
+  if (!fs.existsSync(launchOptions.cliJs)) {
+    throw new Error(`Cannot find daemon entrypoint: ${launchOptions.cliJs}`);
   }
 
   // 4. Setup OS-specific autostart or background daemon
@@ -76,86 +352,115 @@ async function installSkills() {
 
   if (platform === 'win32') {
     cleanupLocalDaemons();
-    console.log("⚙️ Setting up Windows background process...");
-    const subprocess = spawn(teleptyPath, ['daemon'], {
-      detached: true,
-      stdio: 'ignore',
-      windowsHide: true
-    });
-    subprocess.unref();
-    console.log("✅ Windows daemon started in background.");
+    console.log("⚙️ Setting up Windows scheduled task...");
+    run(buildWindowsAutostartCommand({ ...launchOptions, taskName: profile.windowsTask, command: profile.command }));
+    run(buildWindowsRunTaskCommand({ taskName: profile.windowsTask }));
+    assertWindowsTaskRunning(profile.windowsTask);
+    console.log("✅ Windows scheduled task installed and started.");
 
   } else if (platform === 'darwin') {
     console.log("⚙️ Setting up macOS launchd service...");
-    const plistPath = path.join(os.homedir(), 'Library', 'LaunchAgents', 'com.aigentry.telepty.plist');
+    const plistPath = path.join(os.homedir(), 'Library', 'LaunchAgents', profile.launchdPlistName);
     fs.mkdirSync(path.dirname(plistPath), { recursive: true });
-    try { execSync(`launchctl unload "${plistPath}" 2>/dev/null`); } catch(e){}
+    fs.mkdirSync(launchOptions.logDir, { recursive: true });
+    try { execSync(`launchctl unload ${shellQuote(plistPath)} 2>/dev/null`); } catch(e){}
     cleanupLocalDaemons();
 
-    const plistContent = `<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-    <key>Label</key>
-    <string>com.aigentry.telepty</string>
-    <key>ProgramArguments</key>
-    <array>
-        <string>${teleptyPath}</string>
-        <string>daemon</string>
-    </array>
-    <key>RunAtLoad</key>
-    <true/>
-    <key>KeepAlive</key>
-    <true/>
-</dict>
-</plist>`;
+    const plistContent = buildLaunchdPlist({
+      ...launchOptions,
+      label: profile.launchdLabel,
+      command: profile.command,
+      extraEnv: profile.extraEnv,
+    });
 
     fs.writeFileSync(plistPath, plistContent);
-    run(`launchctl load "${plistPath}"`);
+    run(`launchctl load ${shellQuote(plistPath)}`);
+    assertLaunchdServiceLive(profile.launchdLabel);
     console.log("✅ macOS LaunchAgent installed and started.");
 
   } else {
     // Linux
+    let hasSystemd = false;
     try {
       execSync('systemctl --version', { stdio: 'ignore' });
+      hasSystemd = true;
+    } catch(e) {}
+
+    if (hasSystemd) {
       if (process.getuid && process.getuid() === 0) {
         console.log("⚙️ Setting up systemd service for Linux...");
-        try { execSync('systemctl stop telepty', { stdio: 'ignore' }); } catch(e) {}
+        try { execSync(`systemctl stop ${profile.systemdService}`, { stdio: 'ignore' }); } catch(e) {}
         cleanupLocalDaemons();
-        const serviceContent = `[Unit]
-Description=Telepty Daemon
-After=network.target
-
-[Service]
-ExecStart=${teleptyPath} daemon
-Restart=always
-User=${process.env.SUDO_USER || process.env.USER || 'root'}
-Environment=PATH=/usr/bin:/usr/local/bin:$PATH
-Environment=NODE_ENV=production
-
-[Install]
-WantedBy=multi-user.target`;
+        const serviceContent = buildSystemdService({
+          ...launchOptions,
+          user: process.env.SUDO_USER || process.env.USER || 'root',
+          command: profile.command,
+          description: profile.description,
+          extraEnv: profile.extraEnv,
+        });
 
-        fs.writeFileSync('/etc/systemd/system/telepty.service', serviceContent);
+        fs.writeFileSync(`/etc/systemd/system/${profile.systemdService}.service`, serviceContent);
         run('systemctl daemon-reload');
-        run('systemctl enable telepty');
-        run('systemctl start telepty');
+        run(`systemctl enable ${profile.systemdService}`);
+        run(`systemctl start ${profile.systemdService}`);
+        assertSystemdServiceLive(profile.systemdService);
         console.log("✅ Systemd service installed and started.");
         process.exit(0);
       }
-    } catch(e) {}
 
-    // Fallback for Linux without systemd or non-root
-    console.log("⚠️ Skipping systemd (no root or no systemd). Starting in background...");
+      console.log("⚙️ Setting up user systemd service for Linux...");
+      const userServicePath = path.join(os.homedir(), '.config', 'systemd', 'user', `${profile.systemdService}.service`);
+      fs.mkdirSync(path.dirname(userServicePath), { recursive: true });
+      cleanupLocalDaemons();
+      fs.writeFileSync(userServicePath, buildSystemdService({
+        ...launchOptions,
+        wantedBy: 'default.target',
+        command: profile.command,
+        description: profile.description,
+        extraEnv: profile.extraEnv,
+      }));
+      run('systemctl --user daemon-reload');
+      run(`systemctl --user enable ${profile.systemdService}`);
+      run(`systemctl --user start ${profile.systemdService}`);
+      assertSystemdServiceLive(profile.systemdService, { user: true });
+      console.log("✅ User systemd service installed and started.");
+      process.exit(0);
+    }
+
+    // Fallback for Linux without systemd
+    console.log("⚠️ Skipping persistent systemd setup. Starting daemon for this session only...");
     cleanupLocalDaemons();
-    const subprocess = spawn(teleptyPath, ['daemon'], {
+    const subprocess = spawn(launchOptions.nodeBin, [launchOptions.cliJs, profile.command], {
       detached: true,
-      stdio: 'ignore'
+      stdio: 'ignore',
+      env: { ...process.env, ...profile.extraEnv }
     });
     subprocess.unref();
-    console.log("✅ Linux daemon started in background using nohup equivalent.");
+    console.log("✅ Linux daemon started in background for the current session.");
   }
 
   console.log("\n🎉 Installation complete! Telepty daemon is running.");
   console.log("👉 Try running: telepty attach\n");
-})();
+}
+
+if (require.main === module) {
+  main().catch((e) => {
+    console.error('❌ Installation failed:', e.message);
+    process.exit(1);
+  });
+}
+
+module.exports = {
+  buildLaunchdPlist,
+  buildSystemdService,
+  buildWindowsAutostartCommand,
+  resolveDaemonLaunchOptions,
+  buildBrokerLaunchdPlist,
+  buildBrokerSystemdService,
+  buildBrokerWindowsAutostartCommand,
+  collectBrokerServiceEnv,
+  resolveServiceProfile,
+  BROKER_LAUNCHD_LABEL,
+  BROKER_SYSTEMD_SERVICE,
+  BROKER_WINDOWS_TASK,
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dmsdc-ai/aigentry-telepty",
-  "version": "0.5.8",
+  "version": "0.6.0",
   "main": "daemon.js",
   "bin": {
     "aigentry-telepty": "install.js",
@@ -35,9 +35,9 @@
   ],
   "scripts": {
     "postinstall": "node scripts/postinstall.js",
-    "test": "node --require ./test-support/setup-env.js --test test/auth.test.js test/http-auth.test.js test/daemon.test.js test/daemon-singleton.test.js test/integration/daemon-launch.test.js test/cli.test.js test/telepty-kill.test.js test/idle-ttl.test.js test/telepty-clean-older-than.test.js test/lifecycle-transport-agnostic.test.js test/skill-installer.test.js test/interactive-terminal.test.js test/runtime-info.test.js test/session-routing.test.js test/session-state.test.js test/session-store-persistence.test.js test/mailbox-lock.test.js test/report-enforcement.test.js test/enforce-report.test.js test/peer-inject-validator.test.js test/enforce-submit-gate.test.js test/submit-gate.test.js test/submit-via-pty.test.js test/prompt-symbol-registry.test.js test/inject-submit-flags.test.js test/inject-submit-force-env.test.js test/host-spec.test.js test/cross-host-inject.test.js test/cross-machine-ssh-routing.test.js test/init.test.js test/win-resolve-executable.test.js test/version-handshake.test.js test/win-kill-process.test.js test/daemon-control-port-owner.test.js test/banner-stderr-jq-safety.test.js test/bridge-supervisor-ipc.test.js test/bridge-j3-shim.test.js test/bridge-e2e.test.js test/release-0.4.5-bugfixes.test.js && git diff --exit-code tests/snippet-protocol/v1/",
-    "test:watch": "node --require ./test-support/setup-env.js --test --watch test/auth.test.js test/http-auth.test.js test/daemon.test.js test/daemon-singleton.test.js test/integration/daemon-launch.test.js test/cli.test.js test/telepty-kill.test.js test/idle-ttl.test.js test/telepty-clean-older-than.test.js test/lifecycle-transport-agnostic.test.js test/skill-installer.test.js test/interactive-terminal.test.js test/runtime-info.test.js test/session-routing.test.js test/session-state.test.js test/session-store-persistence.test.js test/mailbox-lock.test.js test/report-enforcement.test.js test/enforce-report.test.js test/peer-inject-validator.test.js test/enforce-submit-gate.test.js test/submit-gate.test.js test/submit-via-pty.test.js test/prompt-symbol-registry.test.js test/inject-submit-flags.test.js test/inject-submit-force-env.test.js test/host-spec.test.js test/cross-host-inject.test.js test/cross-machine-ssh-routing.test.js test/init.test.js test/win-resolve-executable.test.js test/version-handshake.test.js test/win-kill-process.test.js test/daemon-control-port-owner.test.js test/banner-stderr-jq-safety.test.js test/bridge-supervisor-ipc.test.js test/bridge-j3-shim.test.js test/bridge-e2e.test.js test/release-0.4.5-bugfixes.test.js",
-    "test:ci": "node --require ./test-support/setup-env.js --test --test-reporter=spec test/auth.test.js test/http-auth.test.js test/daemon.test.js test/daemon-singleton.test.js test/integration/daemon-launch.test.js test/cli.test.js test/telepty-kill.test.js test/idle-ttl.test.js test/telepty-clean-older-than.test.js test/lifecycle-transport-agnostic.test.js test/skill-installer.test.js test/interactive-terminal.test.js test/runtime-info.test.js test/session-routing.test.js test/session-state.test.js test/session-store-persistence.test.js test/mailbox-lock.test.js test/report-enforcement.test.js test/enforce-report.test.js test/peer-inject-validator.test.js test/enforce-submit-gate.test.js test/submit-gate.test.js test/submit-via-pty.test.js test/prompt-symbol-registry.test.js test/inject-submit-flags.test.js test/inject-submit-force-env.test.js test/host-spec.test.js test/cross-host-inject.test.js test/cross-machine-ssh-routing.test.js test/init.test.js test/win-resolve-executable.test.js test/version-handshake.test.js test/win-kill-process.test.js test/daemon-control-port-owner.test.js test/banner-stderr-jq-safety.test.js test/bridge-supervisor-ipc.test.js test/bridge-j3-shim.test.js test/bridge-e2e.test.js test/release-0.4.5-bugfixes.test.js && git diff --exit-code tests/snippet-protocol/v1/",
+    "test": "node --require ./test-support/setup-env.js --test test/auth.test.js test/http-auth.test.js test/broker-protocol.test.js test/broker-auth.test.js test/broker-server.test.js test/broker-client.test.js test/daemon-broker-wiring.test.js test/broker-cli.test.js test/broker-integration.test.js test/daemon.test.js test/daemon-singleton.test.js test/integration/daemon-launch.test.js test/cli.test.js test/telepty-kill.test.js test/idle-ttl.test.js test/telepty-clean-older-than.test.js test/lifecycle-transport-agnostic.test.js test/skill-installer.test.js test/interactive-terminal.test.js test/runtime-info.test.js test/session-routing.test.js test/session-state.test.js test/session-store-persistence.test.js test/mailbox-lock.test.js test/report-enforcement.test.js test/enforce-report.test.js test/peer-inject-validator.test.js test/enforce-submit-gate.test.js test/submit-gate.test.js test/submit-via-pty.test.js test/submit-render-gate.test.js test/prompt-symbol-registry.test.js test/inject-submit-flags.test.js test/inject-submit-force-env.test.js test/host-spec.test.js test/cross-host-inject.test.js test/cross-machine-ssh-routing.test.js test/init.test.js test/install-service-generation.test.js test/install-broker-service.test.js test/win-resolve-executable.test.js test/version-handshake.test.js test/ensure-daemon-running.test.js test/win-kill-process.test.js test/daemon-control-port-owner.test.js test/banner-stderr-jq-safety.test.js test/bridge-supervisor-ipc.test.js test/bridge-j3-shim.test.js test/bridge-e2e.test.js test/release-0.4.5-bugfixes.test.js test/inject-audit-log.test.js test/inject-audit-daemon.test.js test/inject-audit-cli.test.js && git diff --exit-code tests/snippet-protocol/v1/",
+    "test:watch": "node --require ./test-support/setup-env.js --test --watch test/auth.test.js test/http-auth.test.js test/broker-protocol.test.js test/broker-auth.test.js test/broker-server.test.js test/broker-client.test.js test/daemon-broker-wiring.test.js test/broker-cli.test.js test/broker-integration.test.js test/daemon.test.js test/daemon-singleton.test.js test/integration/daemon-launch.test.js test/cli.test.js test/telepty-kill.test.js test/idle-ttl.test.js test/telepty-clean-older-than.test.js test/lifecycle-transport-agnostic.test.js test/skill-installer.test.js test/interactive-terminal.test.js test/runtime-info.test.js test/session-routing.test.js test/session-state.test.js test/session-store-persistence.test.js test/mailbox-lock.test.js test/report-enforcement.test.js test/enforce-report.test.js test/peer-inject-validator.test.js test/enforce-submit-gate.test.js test/submit-gate.test.js test/submit-via-pty.test.js test/submit-render-gate.test.js test/prompt-symbol-registry.test.js test/inject-submit-flags.test.js test/inject-submit-force-env.test.js test/host-spec.test.js test/cross-host-inject.test.js test/cross-machine-ssh-routing.test.js test/init.test.js test/install-service-generation.test.js test/install-broker-service.test.js test/win-resolve-executable.test.js test/version-handshake.test.js test/ensure-daemon-running.test.js test/win-kill-process.test.js test/daemon-control-port-owner.test.js test/banner-stderr-jq-safety.test.js test/bridge-supervisor-ipc.test.js test/bridge-j3-shim.test.js test/bridge-e2e.test.js test/release-0.4.5-bugfixes.test.js test/inject-audit-log.test.js test/inject-audit-daemon.test.js test/inject-audit-cli.test.js",
+    "test:ci": "node --require ./test-support/setup-env.js --test --test-reporter=spec test/auth.test.js test/http-auth.test.js test/broker-protocol.test.js test/broker-auth.test.js test/broker-server.test.js test/broker-client.test.js test/daemon-broker-wiring.test.js test/broker-cli.test.js test/broker-integration.test.js test/daemon.test.js test/daemon-singleton.test.js test/integration/daemon-launch.test.js test/cli.test.js test/telepty-kill.test.js test/idle-ttl.test.js test/telepty-clean-older-than.test.js test/lifecycle-transport-agnostic.test.js test/skill-installer.test.js test/interactive-terminal.test.js test/runtime-info.test.js test/session-routing.test.js test/session-state.test.js test/session-store-persistence.test.js test/mailbox-lock.test.js test/report-enforcement.test.js test/enforce-report.test.js test/peer-inject-validator.test.js test/enforce-submit-gate.test.js test/submit-gate.test.js test/submit-via-pty.test.js test/submit-render-gate.test.js test/prompt-symbol-registry.test.js test/inject-submit-flags.test.js test/inject-submit-force-env.test.js test/host-spec.test.js test/cross-host-inject.test.js test/cross-machine-ssh-routing.test.js test/init.test.js test/install-service-generation.test.js test/install-broker-service.test.js test/win-resolve-executable.test.js test/version-handshake.test.js test/ensure-daemon-running.test.js test/win-kill-process.test.js test/daemon-control-port-owner.test.js test/banner-stderr-jq-safety.test.js test/bridge-supervisor-ipc.test.js test/bridge-j3-shim.test.js test/bridge-e2e.test.js test/release-0.4.5-bugfixes.test.js test/inject-audit-log.test.js test/inject-audit-daemon.test.js test/inject-audit-cli.test.js && git diff --exit-code tests/snippet-protocol/v1/",
     "typecheck": "tsc --noEmit",
     "regen-fixtures": "node scripts/regen-snippet-fixtures.js"
   },
@@ -59,7 +59,7 @@
   ],
   "author": "dmsdc-ai",
   "license": "ISC",
-  "description": "Universal terminal session bridge — connect any terminal to any terminal, any machine",
+  "description": "Universal terminal session bridge \u2014 connect any terminal to any terminal, any machine",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/dmsdc-ai/aigentry-telepty.git"