@dylanpiercey/work 0.1.1 → 0.2.1

package/dist/{_Dzz52ZtI.js → _KRMk2duX.js}

@@ -182,7 +182,7 @@ try {
 * open terminal. */
 var TMUX_SOCKET = process.env.WORK_TMUX_SOCKET || "work";
 var execFileAsync = promisify(execFile);
-async function run$1(cmd, args, cwd, env, opts = {}) {
+async function run$2(cmd, args, cwd, env, opts = {}) {
 	const child = execFileAsync(cmd, args, {
 		cwd,
 		env,
@@ -230,7 +230,7 @@ var git = async (args, cwd) => {
 	const verb = args.find((a) => !a.startsWith("-")) ?? "";
 	const timeoutMs = GIT_NETWORK_MS[verb];
 	try {
-		return await run$1("git", args, cwd, gitEnv(), timeoutMs ? { timeoutMs } : void 0);
+		return await run$2("git", args, cwd, gitEnv(), timeoutMs ? { timeoutMs } : void 0);
 	} catch (err) {
 		if (timeoutMs && err.killed) throw new Error(`git ${verb} timed out after ${Math.round(timeoutMs / 1e3)}s`);
 		throw err;
@@ -248,7 +248,7 @@ var gh = async (args, host) => {
 	const verb = args[0] ?? "";
 	const timeoutMs = GH_MS[verb] ?? GH_DEFAULT_MS;
 	try {
-		return await run$1("gh", args, void 0, host ? {
+		return await run$2("gh", args, void 0, host ? {
 			...process.env,
 			GH_HOST: host
 		} : void 0, { timeoutMs });
@@ -257,7 +257,7 @@ var gh = async (args, host) => {
 		throw err;
 	}
 };
-var tmux = (args, env, opts) => run$1("tmux", [
+var tmux = (args, env, opts) => run$2("tmux", [
 	"-L",
 	TMUX_SOCKET,
 	...args
@@ -1078,6 +1078,330 @@ function readTailscale({ path, version: versionText, status, serve }, { port, al
 	};
 }
 //#endregion
+//#region lib/setup/firewall.mjs
+/** The name work's own rule goes by: a firewalld service, a ufw comment. */
+var RULE = "work";
+var SOCKETFILTERFW = "usr/libexec/ApplicationFirewall/socketfilterfw";
+var CODESIGN = "usr/bin/codesign";
+/**
+* The active host firewall and whether it admits UDP `rtcPort`, or null
+* when none is active (or direct connections are off, `rtc` = "off").
+* `appPort` joins the rule when `listen` is beyond this machine, since the
+* app's own TCP port then has to be reachable too. `node` is the program
+* macOS's firewall is asked about (this process's by default: the server
+* asking for itself). `root` is where /etc and /usr are read from, and
+* `platform` the system taken for this one (a test's stand-ins).
+*/
+async function firewallProbe({ rtcPort, appPort, listen = "127.0.0.1", rtc, node = process.execPath, root = "/", platform = process.platform } = {}) {
+	if (rtc === "off") return null;
+	const port = Number(rtcPort) || Number(appPort) || 7171;
+	const tcp = loopback(listen) ? null : Number(appPort) || port;
+	const at = (p) => path.join(root, p);
+	if (platform === "darwin") return macos(port, node, at);
+	return await firewalld(port, tcp, at) ?? ufw(port, tcp, at);
+}
+async function firewalld(port, tcp, at) {
+	const bin = findBin("firewall-cmd");
+	if (!bin) return null;
+	const active = await run$1(bin, ["--get-active-zones"]);
+	if (!active.ok || !active.stdout.trim()) return null;
+	const zones = active.stdout.split("\n").filter((line) => line && !/^\s/.test(line)).map((line) => line.trim().split(/\s+/)[0]);
+	const byDefault = /^(\S+)\s+\(default\)/m.exec(active.stdout)?.[1];
+	const zone = byDefault && zones.includes(byDefault) ? byDefault : zones[0];
+	const services = await run$1(bin, ["--get-services"]);
+	const ruled = services.ok && services.stdout.split(/\s+/).includes("work");
+	const changed = readXml(at(`etc/firewalld/zones/${zone}.xml`));
+	const def = changed ?? readXml(at(`usr/lib/firewalld/zones/${zone}.xml`));
+	const exact = changed !== null;
+	const admits = ruled || def !== null && zoneAdmits(def, port, at);
+	const likely = !admits;
+	const plan = [
+		...ruled ? [] : [sudo("firewall-cmd", "--permanent", `--new-service=${RULE}`), sudo("firewall-cmd", "--permanent", `--service=${RULE}`, `--set-short=${RULE}`)],
+		sudo("firewall-cmd", "--permanent", `--service=${RULE}`, `--add-port=${port}/udp`),
+		...tcp ? [sudo("firewall-cmd", "--permanent", `--service=${RULE}`, `--add-port=${tcp}/tcp`)] : [],
+		sudo("firewall-cmd", "--permanent", `--zone=${zone}`, `--add-service=${RULE}`),
+		sudo("firewall-cmd", "--reload")
+	];
+	return result({
+		kind: "firewalld",
+		what: `firewalld (zone ${zone})`,
+		zone,
+		port,
+		admits,
+		likely,
+		exact,
+		ruled,
+		why: admits || exact ? null : "by the zone's definition as shipped",
+		plan: admits ? [] : plan
+	});
+}
+function ufw(port, tcp, at) {
+	let conf = "";
+	try {
+		conf = fs.readFileSync(at("etc/ufw/ufw.conf"), "utf8");
+	} catch {
+		return null;
+	}
+	if (!/^\s*ENABLED\s*=\s*yes/m.test(conf)) return null;
+	let policy = "DROP";
+	try {
+		policy = /^\s*DEFAULT_INPUT_POLICY\s*=\s*"?(\w+)/m.exec(fs.readFileSync(at("etc/default/ufw"), "utf8"))?.[1] ?? policy;
+	} catch {}
+	let rules = null;
+	try {
+		rules = fs.readFileSync(at("etc/ufw/user.rules"), "utf8");
+	} catch {}
+	const ruled = !!rules && new RegExp(`### tuple ### allow udp ${port} \\S+ \\S+ \\S+ in\\b`).test(rules);
+	const admits = policy === "ACCEPT" || ruled;
+	const plan = [sudo("ufw", "allow", `${port}/udp`, "comment", RULE), ...tcp ? [sudo("ufw", "allow", `${tcp}/tcp`, "comment", RULE)] : []];
+	return result({
+		kind: "ufw",
+		what: "ufw",
+		port,
+		admits,
+		likely: !admits,
+		exact: rules !== null,
+		ruled,
+		why: admits || rules !== null ? null : `by its default input policy, ${policy}`,
+		plan: admits ? [] : plan
+	});
+}
+/** macOS's application firewall filters by program, not port: what counts
+* is whether the node the server runs (`node`) may take connections. All
+* of it reads without root — the switch, "Block all incoming
+* connections", whether signed software is let in by itself, node's own
+* entry, and node's signature — and each parser takes what it can
+* recognise and leaves the rest unknown (`macosVerdict`), since the
+* wording has changed across releases. */
+async function macos(port, node, at) {
+	const bin = at(SOCKETFILTERFW);
+	if (!fs.existsSync(bin)) return null;
+	const real = realpath(node);
+	const said = (r) => `${r.stdout}\n${r.stderr}`;
+	const [state, blockAll, signed, blocked, apps, sign] = await Promise.all([
+		["--getglobalstate"],
+		["--getblockall"],
+		["--getallowsigned"],
+		["--getappblocked", real],
+		["--listapps"]
+	].map((a) => run$1(bin, a).then(said)).concat(run$1(at(CODESIGN), ["-dv", real]).then(said)));
+	const v = macosVerdict({
+		state,
+		blockAll,
+		signed,
+		blocked,
+		apps,
+		sign,
+		paths: [.../* @__PURE__ */ new Set([node, real])]
+	});
+	if (!v) return null;
+	const sfw = (...a) => sudo(bin, ...a);
+	const plan = v.needs === "unblock" ? [sfw("--unblockapp", real)] : v.needs === "add" ? [sfw("--add", real), sfw("--unblockapp", real)] : [];
+	return result({
+		kind: "macos",
+		what: "the macOS firewall",
+		port,
+		admits: v.admits,
+		likely: !v.admits,
+		exact: v.exact,
+		ruled: false,
+		why: v.why,
+		node: real,
+		plan,
+		fix: v.needs === "blockall" ? BLOCK_ALL_FIX : void 0
+	});
+}
+var BLOCK_ALL_FIX = "turn off “Block all incoming connections” (System Settings → Network → Firewall → Options); no rule for one program opens anything while it is on";
+/**
+* The macOS firewall's verdict on node from what socketfilterfw and
+* codesign said (their stdout and stderr, as text): null when the firewall
+* is off or its state could not be read. `needs` names the fix: `blockall`
+* (a setting only the user should change), `unblock` (node is listed and
+* blocked), `add` (node is not listed).
+*/
+function macosVerdict({ state, blockAll, signed, blocked, apps, sign, paths }) {
+	if (globalOn(state) !== true) return null;
+	if (blockAllOn(blockAll) ?? /State\s*=\s*2\b/.test(state)) return {
+		admits: false,
+		exact: true,
+		why: "“Block all incoming connections” is on",
+		needs: "blockall"
+	};
+	const entry = listedAs(apps, paths) ?? appBlocked(blocked);
+	if (entry === "block") return {
+		admits: false,
+		exact: true,
+		why: "node is blocked in it",
+		needs: "unblock"
+	};
+	if (entry === "allow") return {
+		admits: true,
+		exact: true,
+		why: "node is allowed in it",
+		needs: null
+	};
+	const signature = signatureOf(sign);
+	const auto = allowSigned(signed);
+	if (signature === "developer-id" && auto.downloaded || signature === "apple" && auto.builtIn) return {
+		admits: true,
+		exact: false,
+		why: `node is not listed, but it is ${signature === "apple" ? "Apple" : "Developer ID"}-signed and signed ${signature === "apple" ? "built-in" : "downloaded"} software is let in`,
+		needs: null
+	};
+	return {
+		admits: false,
+		exact: false,
+		why: `node is not listed, and ${signature === "developer-id" || signature === "apple" ? "signed software is not let in by itself" : signature === "adhoc" ? "an ad-hoc-signed program is not let in by itself" : signature === "unsigned" ? "an unsigned program is not let in by itself" : signature ? "a program not Developer ID-signed is not let in by itself" : "its signature could not be read"}, so its connections are dropped or asked about on the Mac's screen`,
+		needs: "add"
+	};
+}
+/** `--getglobalstate`: "Firewall is enabled. (State = 1)", "Firewall is
+* disabled. (State = 0)"; 2 is on with everything blocked. */
+function globalOn(text = "") {
+	const n = /State\s*=\s*(\d)/i.exec(text);
+	if (n) return n[1] !== "0";
+	if (/\bdisabled\b|\boff\b/i.test(text)) return false;
+	if (/\benabled\b|\bon\b/i.test(text)) return true;
+	return null;
+}
+/** `--getblockall`: "Block all ENABLED!" / "Block all DISABLED!", or
+* "Firewall has block all state set to enabled." / "… disabled." */
+function blockAllOn(text = "") {
+	if (!/block\s*all/i.test(text)) return null;
+	if (/\bdisabled\b|\boff\b/i.test(text)) return false;
+	if (/\benabled\b|\bon\b/i.test(text)) return true;
+	return null;
+}
+/** `--getallowsigned`: "Automatically allow built-in signed software
+* ENABLED." and "Automatically allow downloaded signed software
+* ENABLED." (older: "… allow signed built-in software …", or one "… allow
+* signed software …" switch for both). */
+function allowSigned(text = "") {
+	const out = {
+		builtIn: null,
+		downloaded: null
+	};
+	for (const line of text.split("\n")) {
+		if (!/signed/i.test(line)) continue;
+		const on = /\bdisabled\b|\boff\b/i.test(line) ? false : /\benabled\b|\bon\b/i.test(line) ? true : null;
+		if (on === null) continue;
+		if (/download/i.test(line)) out.downloaded = on;
+		else if (/built-?\s?in/i.test(line)) out.builtIn = on;
+		else out.builtIn = out.downloaded = on;
+	}
+	return out;
+}
+/** `--listapps`: "ALF: total number of apps = 2", then per app "1 :
+* /path" and, on its next line or after the path, "( Allow incoming
+* connections )" or "( Block incoming connections )". */
+function listedAs(text = "", paths = []) {
+	const lines = text.split("\n");
+	for (let i = 0; i < lines.length; i++) {
+		const m = /^\s*\d+\s*:\s*(.+?)\s*(?:\(([^)]*)\))?\s*$/.exec(lines[i]);
+		if (!m || !paths.includes(m[1].trim())) continue;
+		for (const said of [m[2] ?? "", ...lines.slice(i + 1, i + 4)]) {
+			if (/^\s*\d+\s*:/.test(said)) break;
+			if (/\bblock/i.test(said)) return "block";
+			if (/\b(allow|permit)/i.test(said)) return "allow";
+		}
+	}
+	return null;
+}
+/** `--getappblocked <path>`: "… is permitted" / "… is blocked", or that it
+* is not part of the firewall (not listed). */
+function appBlocked(text = "") {
+	if (/not part of|isn['’]?t part|not (?:a )?(?:listed|found|in the)|no such|does not exist/i.test(text)) return null;
+	if (/\bpermitted\b|\ballowed\b|\bunblocked\b|\bnot blocked\b/i.test(text)) return "allow";
+	if (/\bblocked\b/i.test(text)) return "block";
+	return null;
+}
+/** `codesign -dv <path>` (on stderr): "Authority=Developer ID
+* Application: …", Apple's own ("Authority=Software Signing"),
+* "Signature=adhoc", or "code object is not signed at all". */
+function signatureOf(text = "") {
+	if (/not signed at all/i.test(text)) return "unsigned";
+	if (/^Authority=Developer ID Application\b/im.test(text)) return "developer-id";
+	if (/^Authority=(Software Signing|Apple Code Signing|Apple Mac OS Application Signing)\b/im.test(text)) return "apple";
+	if (/^Signature=adhoc\b|\badhoc\b/im.test(text)) return "adhoc";
+	if (/^Authority=/im.test(text)) return "other";
+	return null;
+}
+function result(r) {
+	return {
+		...r,
+		fix: r.fix ?? (r.plan.length ? r.plan.map(shell).join(" && ") : null)
+	};
+}
+/** Whether a firewalld zone definition lets UDP `port` in: by its target,
+* a port range of its own, or a service it names (a readable one). */
+function zoneAdmits(xml, port, at) {
+	if (/<zone[^>]*\btarget="ACCEPT"/.test(xml)) return true;
+	if (portsAdmit(xml, port)) return true;
+	for (const [, name] of xml.matchAll(/<service\s+name="([^"]+)"/g)) {
+		const svc = readXml(at(`etc/firewalld/services/${name}.xml`)) ?? readXml(at(`usr/lib/firewalld/services/${name}.xml`));
+		if (svc && portsAdmit(svc, port)) return true;
+	}
+	return false;
+}
+function portsAdmit(xml, port) {
+	for (const [tag] of xml.matchAll(/<port\b[^>]*>/g)) {
+		const proto = /protocol="(\w+)"/.exec(tag)?.[1];
+		const range = /port="(\d+)(?:-(\d+))?"/.exec(tag);
+		if (proto !== "udp" || !range) continue;
+		const lo = Number(range[1]);
+		const hi = Number(range[2] ?? range[1]);
+		if (port >= lo && port <= hi) return true;
+	}
+	return false;
+}
+function realpath(file) {
+	try {
+		return fs.realpathSync(file);
+	} catch {
+		return file;
+	}
+}
+function sudo(...args) {
+	return ["sudo", ...args];
+}
+function shell(argv) {
+	return argv.map((a) => /^[\w@%+=:,./-]+$/.test(a) ? a : `'${a.replace(/'/g, "'\\''")}'`).join(" ");
+}
+function loopback(listen) {
+	return !listen || listen === "::1" || /^127\./.test(listen) || listen === "localhost";
+}
+function readXml(file) {
+	try {
+		return fs.readFileSync(file, "utf8");
+	} catch {
+		return null;
+	}
+}
+/** A program on PATH, or in the sbin directories a user's PATH can leave
+* out. */
+function findBin(name) {
+	const dirs = [
+		...(process.env.PATH || "").split(path.delimiter),
+		"/usr/sbin",
+		"/sbin"
+	];
+	for (const dir of dirs) {
+		if (!dir) continue;
+		const full = path.join(dir, name);
+		try {
+			if (fs.statSync(full).isFile()) return full;
+		} catch {}
+	}
+	return null;
+}
+function run$1(cmd, args) {
+	return new Promise((resolve) => execFile(cmd, args, { timeout: 5e3 }, (err, stdout, stderr) => resolve({
+		ok: !err,
+		stdout: String(stdout || ""),
+		stderr: String(stderr || "")
+	})));
+}
+//#endregion
 //#region lib/setup/doctor.mjs
 var home = os.homedir();
 /** Agent CLI install dirs from meta (`~` → home). Same list the service and
@@ -1423,7 +1747,8 @@ async function tailscaleProbe({ port, allowedHosts } = {}) {
 * @param {{ hosts?: string[], port?: string, allowedHosts?: string }} [opts]
 *   configured GitHub hosts (settings); github.com and any host gh is
 *   already signed in to are always included. `port` and `allowedHosts`
-*   are the service's, for the Tailscale probe.
+*   are the service's, for the Tailscale probe; `firewall`, when given, is
+*   the service's own firewall reading (`serviceFirewall` in the CLI).
 */
 async function doctor(opts = {}) {
 	const hostSet = /* @__PURE__ */ new Set([
@@ -1431,13 +1756,19 @@ async function doctor(opts = {}) {
 		...opts.hosts || [],
 		...ghKnownHosts()
 	]);
-	const [versions, github, awake, extensions, helpers, tailscale] = await Promise.all([
+	const [versions, github, awake, extensions, helpers, tailscale, firewall] = await Promise.all([
 		miseVersions(),
 		Promise.all([...hostSet].map(githubHostStatus)),
 		canStayAwake(),
 		ghExtensions(),
 		staleGhHelpers(),
-		tailscaleProbe(opts)
+		tailscaleProbe(opts),
+		opts.firewall !== void 0 ? opts.firewall : firewallProbe({
+			rtcPort: opts.rtcPort ?? process.env.WORK_RTC_PORT,
+			appPort: opts.port || process.env.PORT || process.env.WORK_APP_PORT || "7171",
+			listen: opts.listen ?? process.env.WORK_LISTEN,
+			rtc: opts.rtc ?? process.env.WORK_RTC
+		})
 	]);
 	const tools = TOOLS.map((t) => {
 		if (t.ghExtension) {
@@ -1480,7 +1811,8 @@ async function doctor(opts = {}) {
 		github,
 		awake,
 		staleGhHelpers: helpers,
-		tailscale
+		tailscale,
+		firewall
 	};
 }
 //#endregion
@@ -7745,7 +8077,7 @@ function publishChange(sessionId) {
 	const row = get("SELECT workspace_id FROM sessions WHERE id = ?", sessionId);
 	if (row?.workspace_id) {
 		const workspaceId = row.workspace_id;
-		import("./_HbAW5Cbt.js").then((m) => m.notifySessionsChanged(workspaceId));
+		import("./_ZwD1NY8D.js").then((m) => m.notifySessionsChanged(workspaceId));
 		return;
 	}
 	publish("sessions.changed");
@@ -8688,7 +9020,7 @@ async function token() {
 	const fromHosts = hostsToken();
 	if (fromHosts) return fromHosts;
 	try {
-		return await run$1("gh", ["auth", "token"]) || null;
+		return await run$2("gh", ["auth", "token"]) || null;
 	} catch {
 		return null;
 	}
@@ -9800,6 +10132,40 @@ function tmuxWasStarted(id) {
 function clearTmuxStarted(id) {
 	tmuxStarted.delete(id);
 }
+/** How long an attach waits for another's session creation to show before
+* it takes the session for gone. tmux makes the session as it starts, far
+* inside this; the wait ends early once it exists or its creator gives up. */
+var CREATE_WAIT_MS = 3e3;
+var creating = /* @__PURE__ */ new Map();
+/** An attach is creating `id`'s tmux session: its `new-session -A` takes a
+* few milliseconds to exist, and an attach arriving meanwhile finds it
+* started but missing — what an agent that exited leaves. Such an attach
+* waits on this (`creationOf`) and looks again. The returned function ends
+* the wait early, for a creator that gave up before spawning. */
+function beginCreation(id, name) {
+	let gaveUp = false;
+	const done = (async () => {
+		const until = Date.now() + CREATE_WAIT_MS;
+		while (!gaveUp && Date.now() < until) {
+			if (await tmux([
+				"has-session",
+				"-t",
+				name
+			]).then(() => true, () => false)) return;
+			await sleep(20);
+		}
+	})().finally(() => {
+		if (creating.get(id) === done) creating.delete(id);
+	});
+	creating.set(id, done);
+	return () => {
+		gaveUp = true;
+	};
+}
+/** The creation of `id`'s session under way (`beginCreation`), if any. */
+function creationOf(id) {
+	return creating.get(id);
+}
 /** Events-bus payload: session rows + live tmux/hook state so clients
 * don't refetch. Coalesced per workspace: a turn boundary lands as a burst
 * of phase transitions (hook, then scrape), and each one cost a list-panes
@@ -9982,7 +10348,7 @@ async function listPanesNow() {
 * (tmux exits when its last session closes). */
 async function ensureTmuxServer() {
 	if (await tmux(["has-session"]).then(() => true, () => false)) return;
-	await run$1("systemd-run", [
+	await run$2("systemd-run", [
 		"--user",
 		`--unit=${TMUX_SOCKET === "work" ? "work-tmux" : `work-tmux-${TMUX_SOCKET.replace(/[^\w.:-]/g, "_")}`}`,
 		"--service-type=forking",
@@ -10254,4 +10620,4 @@ function sleep(ms) {
 	return new Promise((resolve) => setTimeout(resolve, ms));
 }
 //#endregion
-export { saveSubscription as $, swr as $t, clearAgentPhase as A, TOOLS as At, agentBadge as B, readBody as Bt, readHookPayload as C, miseVersions as Ct, realInsideSync as D, which as Dt, realInside as E, tilde as Et, onPhaseChange as F, applyPrefChange as Ft, ACCENT_RE as G, TMUX_SOCKET as Gt, agentFromCommand as H, db as Ht, setAgentPhase as I, FRAME_ANCESTORS as It, manifest as J, gitEnv as Jt, getInstance as K, gh as Kt, setScrapedPhase as L, FRAME_HEADERS as Lt, hookReportedAt as M, agentLabel$1 as Mt, noteBackground as N, catalogPin as Nt, blankRow as O, DEFAULT_GITHUB_HOST as Ot, noteUserAnswered as P, toolById as Pt, pushPublicKey as Q, shared as Qt, setSessionViewers as R, checked as Rt, AGENTS as S, miseInstalls as St, inside as T, stableGh as Tt, agentLabel as U, get as Ut, agentFamily as V, all as Vt, agentMeta as W, workspacePath as Wt, setInstance as X, tmux as Xt, normalizeAccent as Y, run$1 as Yt, deleteSubscription as Z, config as Zt, renameSession as _, setPref as _t, ensureTmuxServer as a, subscriberCount as at, tmuxName as b, doctor as bt, killSession as c, agentChoices as ct, listPanesWithin as d, deleteWorkspacePrefs as dt, withLock as en, sendPush as et, listSessions as f, disabledAgents as ft, panePids as g, setDisabledAgents as gt, notifySessionsChanged as h, preferredAgent as ht, disposeSessions as i, subscribe as it, hookPhase as j, agentById as jt, agentPhase as k, PROJECT_TOOLS as kt, killWorkspaceSessions as l, allPrefs as lt, newSessionArgs as m, getSetting as mt, clearTmuxStarted as n, publish as nt, forgetPanes as o, PREF_MAX as ot, markTmuxStarted as p, enabledAgents as pt, iconSvg as q, git as qt, createSession as r, publishJson as rt, getSession as s, WORKSPACE_PREFS as st, cleanEnv as t, validSubscription as tt, listPanes as u, changePref as ut, sendToSession as v, setSetting as vt, reportsWorking as w, setupPath as wt, tmuxWasStarted as x, ghKnownHosts as xt, sessionStates as y, discoverAgents as yt, settleQuietWorking as z, httpError as zt };
+export { deleteSubscription as $, tmux as $t, blankRow as A, firewallProbe as At, setSessionViewers as B, FRAME_HEADERS as Bt, tmuxWasStarted as C, ghKnownHosts as Ct, inside as D, stableGh as Dt, reportsWorking as E, setupPath as Et, noteBackground as F, agentLabel$1 as Ft, agentLabel as G, db as Gt, agentBadge as H, httpError as Ht, noteUserAnswered as I, catalogPin as It, getInstance as J, TMUX_SOCKET as Jt, agentMeta as K, get as Kt, onPhaseChange as L, toolById as Lt, clearAgentPhase as M, PROJECT_TOOLS as Mt, hookPhase as N, TOOLS as Nt, realInside as O, tilde as Ot, hookReportedAt as P, agentById as Pt, setInstance as Q, run$2 as Qt, setAgentPhase as R, applyPrefChange as Rt, tmuxName as S, doctor as St, readHookPayload as T, miseVersions as Tt, agentFamily as U, readBody as Ut, settleQuietWorking as V, checked as Vt, agentFromCommand as W, all as Wt, manifest as X, git as Xt, iconSvg as Y, gh as Yt, normalizeAccent as Z, gitEnv as Zt, notifySessionsChanged as _, preferredAgent as _t, creationOf as a, publishJson as at, sendToSession as b, setSetting as bt, forgetPanes as c, PREF_MAX as ct, killWorkspaceSessions as d, allPrefs as dt, config as en, pushPublicKey as et, listPanes as f, changePref as ft, newSessionArgs as g, getSetting as gt, markTmuxStarted as h, enabledAgents as ht, createSession as i, publish as it, agentPhase as j, DEFAULT_GITHUB_HOST as jt, realInsideSync as k, which as kt, getSession as l, WORKSPACE_PREFS as lt, listSessions as m, disabledAgents as mt, cleanEnv as n, swr as nn, sendPush as nt, disposeSessions as o, subscribe as ot, listPanesWithin as p, deleteWorkspacePrefs as pt, ACCENT_RE as q, workspacePath as qt, clearTmuxStarted as r, withLock as rn, validSubscription as rt, ensureTmuxServer as s, subscriberCount as st, beginCreation as t, shared as tn, saveSubscription as tt, killSession as u, agentChoices as ut, panePids as v, setDisabledAgents as vt, AGENTS as w, miseInstalls as wt, sessionStates as x, discoverAgents as xt, renameSession as y, setPref as yt, setScrapedPhase as z, FRAME_ANCESTORS as zt };

package/dist/_ZwD1NY8D.js

@@ -0,0 +1,2 @@
+import { _ as notifySessionsChanged } from "./_KRMk2duX.js";
+export { notifySessionsChanged };

package/dist/_h48l7A55.js

@@ -0,0 +1,169 @@
+var glyphBadgeNum = "_y _x";
+var usageInk = {
+	ok: "_z",
+	mid: "_A",
+	warm: "_B",
+	hot: "_C"
+};
+var usageFill = {
+	ok: "_D",
+	mid: "_E",
+	warm: "_F",
+	hot: "_G"
+};
+var prTone = {
+	open: "_H",
+	draft: "_I",
+	merged: "_J",
+	closed: "_K"
+};
+var phaseIcon = {
+	working: "_X _W",
+	waiting: "_Y _W",
+	idle: "_Z _W",
+	off: "_0 _W"
+};
+var btnSm = "_7 _r";
+var btnLg = "_8 _r";
+var tone = {
+	accent: "_bb",
+	ok: "_bc",
+	warn: "_bd",
+	danger: "_be",
+	merged: "_bf",
+	closed: "_bg"
+};
+var inputLg = "_bk _bj";
+var iconBtnXs = "_bo _m";
+var iconBtnRow = "_bp _m";
+var iconBtnLg = "_bq _m";
+var chipBtn = "_br _m";
+var tocDot = "_dc _U";
+//#endregion
+//#region src/styles/tokens.css.ts
+var color = {
+	ok: "light-dark(#1a7f37, #57d364)",
+	okStrong: "light-dark(#116329, #7ee787)",
+	warn: "light-dark(#bf8700, #d4a72c)",
+	warnStrong: "light-dark(#8a5a00, #f0b84a)",
+	merged: "light-dark(#8250df, #a371f7)",
+	closed: "light-dark(#cf222e, #f85149)",
+	onAccent: "#fff",
+	onDanger: "#fff",
+	accentDefault: "light-dark(#4f5bd5, #6470e6)",
+	bg: "var(--bg)",
+	panel: "var(--panel)",
+	border: "var(--border)",
+	text: "var(--text)",
+	dim: "var(--dim)",
+	accent: "var(--accent)",
+	accentFill: "var(--accent-fill)",
+	accentText: "var(--accent-text)",
+	danger: "var(--danger)",
+	fieldBorder: "var(--field-border)",
+	raised: "color-mix(in srgb, var(--panel) 94%, var(--text))",
+	raisedHover: "color-mix(in srgb, var(--panel) 90%, var(--text))",
+	onScrim: "#fff"
+};
+var sans = "Inter, ui-sans-serif, system-ui, -apple-system, \"Segoe UI\", sans-serif";
+var iconSize = {
+	sm: 12,
+	md: 14,
+	lg: 16,
+	xl: 18
+};
+var toastKind = {
+	error: "_b4",
+	warn: "_b5",
+	info: "_b6"
+};
+var toastTitle = {
+	error: "_b7",
+	warn: "_b8",
+	info: "_b9"
+};
+//#endregion
+//#region src/tags/settings-agents.css.ts
+var agentRow = "_e1 _dO";
+var list$3 = "_dS _du _dN _dQ";
+var metaChip = "_d6 _bi _bh";
+var sectionCount = "_dr _9 __";
+var usageNote = "_jG _bh";
+var pop$2 = "_gU _bw";
+var spinner = "_gX _bm _2";
+var toolLead = "_gF _d1";
+var name$4 = "_gz _d1";
+var desc$1 = "_gA _d2";
+//#endregion
+//#region src/tags/lsp-add-dialog.css.ts
+var addDlg = "_kl _bG";
+var key$1 = "_k2 _k0";
+var addTile = "_k4 _k0";
+var field$2 = "_le _bj";
+var keyField = "_lf _le _bj";
+var labelField = "_lg _le _bj";
+var detailsToggle = "_gm _P";
+var themeSeg = "_ft _bA";
+var checkList = "_hi _ds";
+//#endregion
+//#region src/tags/prompt-dialog.css.ts
+var promptDlg = "_bK _bG";
+var item$1 = "_bP _m";
+var glance = "_dE _m";
+//#endregion
+//#region src/tags/side-nav.css.ts
+var iconBtn = "_bS _m";
+var settingsDot = "_bT _bz";
+var notifyBtn = "_bY _m";
+//#endregion
+//#region src/styles/session-pop.css.ts
+var sessionPop = "_cp _bw";
+var sessionPopBtn = "_cq _4";
+var wsBtn = "_ep _4";
+var rowIcon = "_er _bo _m";
+var prChip = "_lQ _v _lK";
+var readyChip = "_lR _v";
+var prDot = "_lT _lS";
+//#endregion
+//#region src/tags/port-chip.css.ts
+var port = "_no _v _lK";
+var open = "_j4 _4";
+var action = "_j8 _br _m";
+var toggle = "_ea _P";
+var fold = "_eb _dP";
+var item = "_ki _4";
+var menu = "_lB _cp _bw";
+var menuItem = "_lD _4";
+var findBtn$1 = "_iX _h_ _bp _m";
+var tool = "_h_ _bp _m";
+var pop$1 = "_kE _cp _bw";
+var fileFilter = "_nn _o";
+var findInput = "_eG _o";
+var keybarIconBtn = "_eP _br _m";
+var repoTitle = "_mi _L";
+var input = "_ct _o";
+var group = "_cw _P";
+var hint$1 = "_mf _9 _M";
+var sheetDir = "_mI _by";
+var upBtn = "_ir _bp _m";
+var findBtn = "_iv _h_ _bp _m";
+var goBtn = "_iw _h_ _bp _m";
+var note = "_kA _bh";
+//#endregion
+//#region src/tags/manage-workspace.css.ts
+var procCmd = "_hY _d1";
+var factCopy = "_h5 _br _m";
+var resultRow = "_kJ _4";
+var resultBranch = "_kK _d6 _bi _bh _bo _m";
+var urlAction = "_kL _d6 _bi _bh _d7";
+var curRow = "_g6 _dV";
+//#endregion
+//#region src/tags/join-dialog.css.ts
+var dlg = "_kq _bG";
+var hint = "_kr _bh";
+var kbtn = "_cP _bq _m";
+var repeat = "_cS _cR";
+var dpadUser = "_cV _cR";
+var dpadEsc = "_cW _cR";
+//#endregion
+export { field$2 as $, item as A, tone as At, wsBtn as B, keybarIconBtn as C, glyphBadgeNum as Ct, findBtn$1 as D, inputLg as Dt, tool as E, iconBtnXs as Et, port as F, settingsDot as G, sessionPopBtn as H, prChip as I, promptDlg as J, glance as K, prDot as L, toggle as M, usageInk as Mt, action as N, menu as O, phaseIcon as Ot, open as P, addTile as Q, readyChip as R, findInput as S, chipBtn as St, pop$1 as T, iconBtnRow as Tt, iconBtn as U, sessionPop as V, notifyBtn as W, themeSeg as X, checkList as Y, detailsToggle as Z, sheetDir as _, iconSize as _t, dlg as a, name$4 as at, input as b, btnLg as bt, resultBranch as c, spinner as ct, factCopy as d, list$3 as dt, key$1 as et, procCmd as f, metaChip as ft, upBtn as g, color as gt, goBtn as h, toastTitle as ht, repeat as i, desc$1 as it, fold as j, usageFill as jt, menuItem as k, prTone as kt, resultRow as l, usageNote as lt, findBtn as m, toastKind as mt, dpadUser as n, labelField as nt, hint as o, toolLead as ot, note as p, agentRow as pt, item$1 as q, kbtn as r, addDlg as rt, curRow as s, pop$2 as st, dpadEsc as t, keyField as tt, urlAction as u, sectionCount as ut, hint$1 as v, sans as vt, fileFilter as w, iconBtnLg as wt, repoTitle as x, btnSm as xt, group as y, tocDot as yt, rowIcon as z };