@excitedjs/dreamux 0.26.0-beta.265 → 0.26.0

package/CHANGELOG.md

@@ -1,6 +1,76 @@
 # Change Log - @excitedjs/dreamux
 
-This log was last generated on Thu, 10 Sep 2026 04:59:50 GMT and should not be manually modified.
+This log was last generated on Fri, 09 Oct 2026 03:05:18 GMT and should not be manually modified.
+
+## 0.26.0
+Fri, 09 Oct 2026 03:05:18 GMT
+
+### Minor changes
+
+- The Dispatcher Agent has its own Commands. `dispatcher.submit` submits one turn to the addressed Dispatcher's own Agent and `dispatcher.interrupt` interrupts it; both address that Dispatcher through the caller context, like every other Command in the namespace, and both are reachable over `admin.sock` and a Channel's in-process port. `team.submit` and `team.interrupt` now require `team_name`: a Team Command names exactly one Team, and a call that omits the name is answered `BAD_REQUEST` by schema validation before any Agent is reached, instead of silently reaching the Dispatcher Agent. A caller that relied on the omission calls the Dispatcher Command instead. The two submit Commands share one reader for the Channel-facing payload (`service/channel-submission.ts`), which owns the attribute, text, reminder, and `source_id` rules once and fixes the `channel` provenance for both, and `DispatcherService.interrupt(teamId | null)` splits into `interruptAgent()` and `interruptTeamLeader(teamId)` to match.
+- Support ultrathink through native Codex effort parameters, restore ordinary effort on the next ordinary submission, and pass submission text through unchanged. Busy input follows native Codex timing.
+- BREAKING: `dispatchers[].cwd` is now required and must be a non-empty string on every Dispatcher entry, enabled or not; a config without it fails to load with an error naming the Dispatcher id. Rebuild: add "cwd": "<absolute dir>" to every dispatchers[] entry that lacks it.
+- Refuse new Workflow TeamMate construction after its Team or Dispatcher starts closing, before allocating a name, workspace, identity, or launch hooks; preserve already-admitted construction cleanup and lock finalization.
+- Default omitted dispatcher workspace policies and new onboarding to false; preserve explicit values. Repository-free work uses the dispatcher cwd unless isolation is enabled.
+- Load plugins from an optional top-level `plugins[]` in `config.json` (`builtin:<id>` or `npm:<package>[#export]` refs, each a string or `{ ref, config }`); existing configs load unchanged. Plugins can contribute providers addressed as `builtin:<name>`, append instructions and skill roots to Dispatcher and TeamLeader launches, and react to Team creation; a failing plugin hook is logged and skipped. `dreamux doctor` lists loaded plugins and plugin load failures. Ships the built-in, opt-in `builtin:bootstrap` plugin, which injects `.workspace/identity.md` and `user.md` from the Dispatcher cwd.
+- Redact tool call invocations and arguments in the conversation projection. Secret masking and workspace/home path renaming now apply to every displayed member of a tool call, and a call's structured payloads are redacted by walking the JSON value, so a secret written into a nested object or a multi-line .env is masked and the payload is still valid JSON. The redaction rules themselves moved to @excitedjs/dreamux-utils, where the host logger and config display now share one list of secret key names; the logger previously missed api_key, private_key, and client_secret.
+- Code organization refactor stage 6d: scheduler/service.ts renamed to index.ts and scheduler/mcp-delegate.ts to mcp.ts (matching the agent/team/workflow-service per-domain template); a new requests.ts holds the request readers and result projections previously split across types.ts and store.ts, which is now persistence-only; the dead dispatcherId option/parameter was dropped from CronJobStore and detectLegacyCronJobStore; the fire path was consolidated onto one store read per fire plus a pure advanceJob/impure rearm pair (a one-shot job whose dispatch throws is now disabled immediately instead of staying enabled with a stale next_run_at until the next start()); and SchedulerService now implements SchedulerCommands directly, with TeamService composing its own closing fence directly into the admit closure it passes at construction instead of wrapping the public command surface in a second, Team-scoped object.
+- Codex and Claude Code now load exactly like the built-in Feishu plugin: both are always-loaded plugins that contribute their Agent Runtime provider, instead of a core-side static builtin-provider registry pre-registering their descriptors ahead of the provider loader importing their package. No behavior change for a default install: both still register under builtin:codex / builtin:claude-code before agents[] is resolved, and a config naming an unmapped builtin:<ref> still fails loud with the same UnknownBuiltinProviderPackageError it always has. `dreamux uninstall`'s directory-safety guard also no longer hard-codes ~/.codex and ~/.claude: it now builds the same always-loaded plugin registry and asks each registered Agent Runtime provider for its own operatorStateRoot, so a provider added or removed by future plugin work is protected (or not) automatically. The protected paths for a default install are unchanged.
+- BREAKING: code organization refactor stage 8c, item 1: `DREAMUX_CONFIG_DIR` is deleted, and so is `dreamux onboard`'s `--config-dir` option; `dreamux uninstall --config-dir` is deleted too, by inference — it has nothing left to relocate once `config.json` is root-derived. `config.json` now always lives at `<DREAMUX_ROOT>/config.json` (default `~/.dreamux/config.json`, unchanged only for an install that set neither `DREAMUX_CONFIG_DIR` nor `DREAMUX_ROOT`); the managed-service unit now writes `DREAMUX_ROOT` instead of `DREAMUX_CONFIG_DIR`, taking the value from the environment of the process that runs `dreamux daemon install` or `dreamux onboard` (`~/.dreamux` when unset); `dreamux uninstall` now also removes the whole root directory itself, not just its contents. Before this change `DREAMUX_ROOT` relocated only state, run, cache and logs, `config.json` came from `DREAMUX_CONFIG_DIR` or `~/.dreamux`, and the managed-service unit that `dreamux daemon install` wrote carried no `DREAMUX_ROOT`, so a managed service ran with `.dreamux` under its `HOME` as its root unless its environment supplied a `DREAMUX_ROOT` by another route (a unit drop-in, an environment file, or the service manager's own environment). Scenario 1: an install that set `DREAMUX_CONFIG_DIR` to a path other than the root it ran with — after upgrade `DREAMUX_CONFIG_DIR` is silently ignored, so the daemon looks for `config.json` under the root instead of the operator's configured directory. If no `config.json` exists there, the daemon fails on an ordinary missing-file error that never mentions `DREAMUX_CONFIG_DIR` or what moved, and the unit's `Restart=on-failure` loops; if a `config.json` already exists there (for example from an earlier default-path `dreamux onboard`), the daemon starts silently against that unrelated file instead. Scenario 2: an operator who exports `DREAMUX_ROOT` in their shell (profile, direnv, a foreground `dreamux serve`) while `config.json` stayed in `DREAMUX_CONFIG_DIR` or `~/.dreamux` — `dreamux serve` and `dreamux daemon install` run from that shell now look for `config.json` under the exported root and fail on the same missing-file error (`dreamux doctor` reports it); and if the operator moves `config.json` there and re-runs `dreamux daemon install`, the shell's root is written into the unit, so the service moves to a root it never used: its durable state (dispatcher identities, Teams, Workflow runs, `access.json`) stays behind in the old root and the service comes up on a root that holds none of it. Rebuild: keep the root the old service actually used — do not assume it is the `DREAMUX_ROOT` your shell exports. (1) Find that root from the environment the old daemon actually ran with. For a managed service, read it from the running process (on Linux `tr '\0' '\n' < /proc/$(systemctl --user show -p MainPID --value dreamux)/environ | grep -E '^(DREAMUX_ROOT|HOME)='`) or, when it is not running, from everything that defines that environment: the installed unit and any drop-ins (`systemctl --user cat dreamux`), any `EnvironmentFile` they name, and the user manager's own environment (`systemctl --user show-environment`); on macOS, the plist `~/Library/LaunchAgents/dev.excited.dreamux.plist` and `launchctl print gui/$(id -u)/dev.excited.dreamux`. A unit written by an earlier build has no `DREAMUX_ROOT` entry of its own, so unless one of those sources supplies it the root is `.dreamux` under the service's `HOME` (normally `~/.dreamux`). A foreground `dreamux serve` used the `DREAMUX_ROOT` of the shell that started it, else `~/.dreamux`. Confirm the root by checking that `<root>/state/` holds your dispatcher directories. (2) Put `config.json` at `<that root>/config.json`: move it from the old service's `DREAMUX_CONFIG_DIR` path (found the same way) when that names another directory (keep mode 0600, create parent directories as needed); there is nothing to move when it already sits in that root. (3) Re-run `dreamux daemon install` (or `dreamux onboard` again) from a shell whose `DREAMUX_ROOT` is that same root — or unset, when the root is `~/.dreamux` — so the unit is rewritten with the right `DREAMUX_ROOT`, then run `dreamux daemon restart`. For a foreground `dreamux serve`, export the same root in the shell that starts it. Only a deliberate change of root moves durable state: with the service stopped, move the old root's `state/` to `<new root>/state/` (`run/` is volatile, `cache/` is rebuildable, and `logs/` is diagnostics, so none of them needs to move) and `config.json` to `<new root>/config.json`, then do step (3) with `DREAMUX_ROOT` set to the new root; without the `state/` move the service starts on empty state.
+- PR #455 review round: `plugin/loader.ts`'s `constructPlugin` now validates a factory-returned plugin `name` against a safe single-segment pattern (1-64 ASCII letters/digits/dot/underscore/dash, starting with a letter or digit) and fails loading with `PluginLoadError` otherwise. `pluginStateDir` now uses `name` verbatim as the `state/plugins/<name>` directory segment instead of running it through the lossy teammate-name sanitizer, which mapped both `@acme/tool` and the unrelated `_acme_tool` to `state/plugins/_acme_tool` and passed `.`/`..` through unchanged (resolving up out of `state/plugins/`). Every built-in plugin name already conforms; a third-party `npm:` plugin whose factory returns a name outside this pattern now fails `dreamux serve` at load instead of silently sharing or escaping another plugin's state directory.
+- PR #455 review round, two scheduler fixes. `CronJobStore.parseCronJob` no longer fails loud on a leftover `deliver` field on an old cron-jobs.json job row: like the existing `dispatcher_id` tolerance, it is now an ordinary unknown field under the persisted-shape policy, ignored on load and dropped the next time that job is rewritten; `dreamux doctor` no longer names a store file for carrying it. Separately, a missed cron fire's rearm write no longer derives its `{ enabled, next_run_at }` write from the in-memory job snapshot `SchedulerService` captured before the fire; `CronJobStore.applyMissed` now derives that write from the row as it stands at write time, inside the store's own serialized update, so a `cron.update` committed while a fire's submission was in flight can no longer be silently overwritten by a stale missed-outcome write.
+- Core no longer rejects an Agent Runtime activity record whose `occurredAt` timestamp string is longer than 64 characters. This was the last provider-output length cap left over from R28 ("Core no longer re-validates an Agent Runtime provider's activity page against a byte/char/cursor-length budget", refactor-code-org-s2a-04); the provider's own bounds are the only bound now.
+- A `plugins[]` object entry (`{ ref, config }`) now follows the same persisted-shape policy (R21) as the rest of config.json: an unrecognized key alongside `ref`/`config` is tolerated and ignored instead of refusing `dreamux serve`. A missing `ref` still fails loading.
+- `dreamux uninstall` follows the existing next behavior: dry-run checks existence and reports planned removal without enumerating root contents or writing files; actual uninstall recursively removes the entire DREAMUX_ROOT, including other files and directories inside it. The foreign-retention predictor is removed. Results report removed or missing; permission and other filesystem errors still propagate, including after a successful preview. Normalized removal paths inside or containing a provider-derived operator runtime home are refused before any service mutation. Physical symlink aliases are not resolved. Current root addressing and service removal order remain unchanged.
+- `workflow_status` and `workflow_list` no longer serve a finished run's record from a stale in-memory cache for the rest of the dispatcher's process lifetime. The scope's `WorkflowRunStore` now releases a run's cached store once its owning run settles (or once a crash-recovery pass finds it already terminal), and reads finished records one-shot from disk afterward, so a hand edit to a finished run's record.json is now reflected.
+- A provider ref listed under the wrong kind in config.json (for example a `builtin:codex` agent-runtime provider referenced from a `channels[]` entry) now fails config validation with a `RuleViolation` naming the actual and expected kind, instead of the provider package loader's own contract error. This follows from built-in providers now registering their descriptor and implementation together as always-loaded plugins (R9): the mismatch is caught once, in config validation, for both built-in and `npm:` provider refs. No behavior change for a correctly configured install.
+- Code organization refactor stage 2a, item 3: cron jobs are no longer capped at 128 per dispatcher/Team owner. The cap had no named failure scenario. Old cron stores are unaffected.
+- Code organization refactor stage 2a, item 4: Core no longer re-validates an Agent Runtime provider's activity page against a byte/char/cursor-length budget, or a provider's declared capabilities against a tag-count/length or publicConfig size bound. The provider's own bounds are the only bound now.
+- Code organization refactor stage 2a, item 5: the `dispatcher.start` Command and the `dispatcher start` server-ctl CLI verb are removed. Every configured, enabled Dispatcher already starts automatically when the daemon starts; there was no supported way to stop one independently and restart it in-process to begin with.
+- Code organization refactor stage 2a, item 12 (R47): `dreamux serve` no longer runs its startup pre-flight that aggregated every dispatcher's pre-#233 leftover state and removed cron stores and aborted the whole process before the admin socket opened, and `dreamux doctor` no longer reports a dispatcher's leftover state as a row. A stale `channel-bindings.json`/`collaboration-spaces.json` at the dispatcher root, a pre-#233 flat `teammate/`/`team/` leaf (`records`, `turns`, `identities`, `history`, `sessions.jsonl`, `ledger`), or an agent identity record still carrying a removed field (`checkpoint`, `checkpoint_kind`, `session_ref`, `display_name`, `close_status`) are now silently ignored rather than triggering a fail-loud rebuild instruction. This is not `BREAKING:`: nothing an operator relied on to start stops working — the opposite failure mode (refusing to start) is what's removed. A cron store with an unrecognized version and an identity still keyed by the pre-#148 `provider_ref` format still raise a named error when actually read (a dispatcher's scheduler start, `dreamux doctor`'s unchanged cron rows), but that failure is no longer aggregated into a whole-process startup refusal — it now fails only the one dispatcher whose store or identity is affected, the same as any other per-dispatcher start failure.
+- Code organization refactor stage 4b item 1: moved AgentIdentityStore and AgentEntityCollectionStore onto TransactionalStore, deleted AgentRuntimeStateStore's own mutation tail in favor of the store's serialized update, and fixed four second-authority duplicate-reader sites (dispatcher-root identity shared between Dispatchers and DispatcherService, TeammateCollection.mustIdentity, reprepareDeletedManagedWorktree's nested-update pattern, and TeammateCollection.buildEntity minting a second, never-loaded AgentIdentityStore instead of reusing the one that created or read the entity). AgentIdentityStoreBinding no longer carries onPersisted; every create/update/upsert call now threads it explicitly. Named behavior change: a name lookup for a live TeamMate (mustIdentity) now answers from that TeamMate's own live identity instead of a fresh file read, so it can no longer race a runtime that just committed a status transition; record.json's shape is unchanged.
+- Code organization refactor stage 4b item 2: moved TeamStore onto a per-Team TransactionalStore, replacing its exclusive-write-plus-readback create path with a load-decide-write inside the store's own serialized queue and its manual write queue with the store's tail. TeamService now holds its Team's TransactionalStore handle directly instead of a caller-refreshed record field, and the Team read model answers leader_state from a live TeamService's own in-memory identity before falling back to a one-shot file read. record.json's shape, TeamStore's/TeamService's public methods, and Command/MCP-visible behavior are unchanged; only the anti-resurrection mechanism moved from 'merge against disk' to 'one in-memory owner per Team, merging against its committed value' (already an accepted operator ruling, 2026-09-19).
+- Code organization refactor stage 4b item 3: moved CronJobStore onto a single TransactionalStore<CronJobFile>, inlining the version-mismatch/missing-file-default check that JsonDocumentStore used to run. Dropped the operator-only nested `action` Command field from scheduler.cron.create/update. Its former `action.prompt` was consumed as the scheduled submission text; the Commands now take the same text as top-level `prompt`, while persisted jobs keep their internal `action.prompt` and stopped writing `dispatcher_id` in scheduler.cron.list/create/update/delete results, the cron_* MCP tool results, and newly written cron-jobs.json job rows; a leftover dispatcher_id on an old file now loads as an ordinary unknown field under the persisted-shape policy (tolerate unknown fields, reject only wrong types and missing fields) instead of being required and cross-checked against the store's own dispatcher id. Old cron-jobs.json files carrying either field still load. Named behavior change: deleting a Team's cron store file on dissolve now loads the file first (TransactionalStore.remove()'s own contract), so a cron-jobs.json that fails its version/shape check at that exact moment now fails the delete too, instead of always succeeding via a direct unlink(); this is one more of dissolve's ordinary collected cleanup-step failures, handled the same way as any other resource that would not close.
+- Code organization refactor stage 4b item 4: moved WorkflowRunStore onto a per-run TransactionalStore<WorkflowRunRecord | null>, inlining the version-mismatch/missing-file-default check that JsonDocumentStore used to run, and moved WorkflowJournal.create onto dreamux-utils' publishFileExclusive. run.ts keeps mutating its working draft before each persistence point; the queue that used to serialize those writes is gone (each run's own TransactionalStore now serializes them), but the reclassification of a failed journal/store write into WorkflowPersistenceError (which executeAgent's catch depends on to tell a storage failure apart from an ordinary agent failure) is preserved under a renamed helper. Named behavior change: WorkflowRun.snapshot(), which backs workflow_status/workflow_list for a live run, now returns the run's last committed (written) value instead of the in-progress in-memory draft between a mutation and the write that persists it. Freshness here was already documented as unspecified, so this narrows rather than changes the contract, but it is a real, observable difference from today's snapshot timing. record.json's shape, the journal's shape, and every public method signature are unchanged. `this.record.x = …` in-place mutation and `AgentCall.record` as a live alias into `this.record.agents[]` were both kept as they were, rather than becoming a pure builder passed to `store.update()` and an index respectively; traced for data loss (each write clones at commit time and every store now serializes on its own `TransactionalStore` queue) and found none.
+- Code organization refactor stage 4b item 5: config.json now tolerates unknown top-level, dispatchers[], channels[], agents[], and dispatchers[].workspace keys instead of rejecting them; wrong types and missing required fields are still rejected. Per R21's tolerate-unknown-fields policy, this also removes every remaining named rejection of a retired config.json key: the top-level codex block, dispatchers[].runtime, the dispatchers[].feishu/.codex legacy-shape pre-check, and channels[].collaborationSpace are no longer special-cased and now load as ordinary tolerated unknown fields like any other retired key.
+- Code organization refactor stage 4c: added two Commands, config.agents.get and config.agents.replace, reachable through admin.sock and any Channel's in-process invoke port like every other Command. config.agents.get returns the current agents[] in file shape with every secret-named value emptied; config.agents.replace validates and writes a whole new agents[] array, matched to the existing one by id (submitting an empty secret-named value keeps the stored value). A replace takes effect for the next runtime launch only — a runtime already running keeps what it launched with. The first replace re-serializes config.json with two-space indentation and the submitted agent order; other values, and dispatchers[], are written unchanged. Neither Command is dispatcher-scoped, and dispatchers[] still has no Command. No persisted-format change.
+- team.history's grep filter now ignores leading/trailing whitespace in the search term, matching teammate.history's existing behavior.
+- Code organization refactor stage 6a item 2a: renamed the class service/agent/service.ts's TeammateService -> AgentService and service/agent/runtime-generation.ts's TeammateRuntimeOwner -> RuntimeGeneration (propagated to every consumer's type-only imports across the package, e.g. dispatcher-service/ and team-service/; service/agent/factory.ts is left on the old name, since converting it into the per-dispatcher AgentServiceFactory is stage 6a item 2b). This one class now serves three roles (the Dispatcher's own Agent, a Team's leader, and an ordinary TeamMate) but hardcoded 'TeamMate' in every thrown-error message regardless of which role it was closing, locking, or starting; a Team's leader.close() (dissolve) or a Dispatcher agent's runtime-generation failure produced a wrong 'TeamMate ...' message. Added agentRoleNoun(role, name) (service/agent/service-types.ts, to avoid a service.ts <-> runtime-generation.ts import cycle) and used it at every such error message in these two files, so a Dispatcher agent now reads 'the Dispatcher agent ...' and a Team's leader reads 'Team leader "<name>" ...'. Most of an ordinary TeamMate's own wording is unchanged (byte-identical, same JSON.stringify(name) quoting); four messages that previously named 'TeamMate' without the entity's name now include it for every role, including teammate, as a byproduct of routing through the one shared helper: the close-note validation message (this is also a real fix, not just wording -- close() runs on a Team's leader too on dissolve, per team-service/closing.ts, so the pre-existing text was already wrong there), the two closed-with-no-closed_at invariant-violation messages, and the stale-lock-token invariant-violation message. Also deleted two dead-by-construction fields: ownsWorktreeOnClose (its condition, restricted to the three real construction sites, was already exactly implied by identity.worktree.mode === 'managed' && identity.worktree.cleanup === 'delete-on-close' alone -- the Dispatcher agent and every Team leader are always worktree.mode 'reuse-cwd', and a Team-scoped TeamMate's spawn path always forces a reuse-cwd shared workspace, so the flag never disagreed with the identity's own facts since it was introduced) and assertIdentityScope plus runtime-id.ts's three assert*Scope helper functions (the identity was already read by a store scoped to the correct directory by the owner that materialized it, so re-checking scope on every ensureStarted() call had no failure scenario construction-time scoping doesn't already rule out). No persisted format, public API, or MCP/Command contract changed.
+- Code organization refactor stage 6a item 3: the completion notice the Dispatcher's own agent receives after one of its Team's leaders settles a team.create-with-prompt turn (R16, deliverCompletionToDispatcher) always read 'TeamMate <name> has finished its task,' misdescribing a Team leader as a TeamMate. Added role: TeammateRole to TeammateCompletionFact (service/completion-router/index.ts) and threaded the producing AgentService's own role (fixed for its lifetime, passed once into EntityTurnCoordinatorOptions at construction) through service/agent/turn.ts's fact construction. service/agent/completion-renderer.ts's teammateStatusLine now words the sentence by the producer's actual role: a Team leader completion reads 'Team leader <name> has finished its task.' (and failed/stopped variants); an ordinary TeamMate completion, the only other role a delivered completion is produced by today, is unchanged. The Dispatcher-role branch is exhaustive but currently unreached -- the Dispatcher's own agent never attaches a completion-delivery closure to its own turns today, so 'The Dispatcher agent has finished its task.' is not yet observable, but is now correctly worded for when it is. workflowStatusLine is untouched. No persisted format, public API, or MCP/Command contract changed.
+- Code organization refactor stage 6a item 4: deleted TeammateRuntimeOwnerCallbacks, the function-valued dependency bag RuntimeGeneration used to reach back into AgentService's private phase field via isActive()/markClosing(). RuntimeGeneration.ensureStarted() now takes no phase callback and simply resolves once the runtime is live or throws; it no longer self-aborts mid-launch. AgentService now owns the race check itself through one new private method, ensureRuntimeStarted(), used by every one of its three callers of runtimeGeneration.ensureStarted() (admitToRuntime, activate(), the locked Workflow submit path): it checks this.phase itself before calling ensureStarted() (replacing the old pre-lease isActive() check) and again immediately after ensureStarted() resolves, stopping the runtime and reporting not-active itself when a close raced and won the awaited start (replacing the old post-start isActive() self-abort). The one case that used to call markClosing() — startFromRecord's rollback branch where the rollback's own runtime.stop() also fails after a native start failure — now has RuntimeGeneration throw a new named error, RuntimeTerminationUnproven (an AggregateError subclass carrying the same start/stop failure pair), which ensureRuntimeStarted() catches to set AgentService's own phase to 'closing' before rethrowing; this is the mutation every caller previously got for free via the callback, so centralizing it is what keeps a runtime whose termination could not be proven from being handed out by a later ensureStarted() call, which treats any non-null runtime handle as already live and never re-examines it. Internal control-flow refactor moving which class owns a phase decision. One caller-visible admission-outcome shape changed for the narrow start-races-close window: a submission that used to reject with an 'is closing' Error now resolves as an ordinary {status:'stopped'} TurnAdmission (the same shape a submission to an already-stopped recipient always gets), so its display reason becomes 'the agent runtime is not running' instead of the old message text. The issue #63 non-blocking submit ordering (runtime.submit fires synchronously before being handed to the admission continuation queue) is untouched.
+- Code organization refactor stage 6b item 2 (R48): deleted the team.hooks.created plugin hook end-to-end, together with its background scheduling (fireCreated), its InFlightWork-backed in-flight tracking, and the Dispatcher shutdown drain that awaited it. A plugin that tapped this hook loses it; nothing in this tree taps it today, and Dispatcher shutdown no longer waits on it.
+- Fixed a bug: team.create with a prompt, called through admin.sock or a Channel's team.create Command, no longer pushes the leader's first-turn completion back to the Dispatcher Agent -- only the Dispatcher's own team MCP create tool call does now, matching the deliverCompletionToDispatcher contract team.submit has always had. DispatcherService.createTeam, TeamCollection.createFromRequest/createAtCandidate, and TeamService.createNew all take an explicit deliverCompletionToDispatcher boolean threaded the same way teamId/payloadHash already thread through; service/team/commands.ts's create.execute() passes false, service/team/mcp.ts's create() (the Dispatcher's own MCP call) passes true. initial-prompt.ts's submitInitialLeaderPrompt is folded into TeamService.createNew, which now calls submitToLeader(...) directly and checks the returned TurnAdmission itself, so the initial turn runs through the same admit-fenced submission path (and the same completion-initiator wiring) as every later turn; resolveTeamLeaderCompletionDelivery (completion-targets.ts) is deleted as the second initiator-to-delivery mapping it duplicated. TeamLeaderCompletionTargets itself, used for a Team's own members' completions reporting to the leader, is unrelated and unchanged.
+- Code organization refactor stage 6b item 6 (R10): rewrote TeamClosing's dissolve/close sequence. TeamClosingDeps drops the leader()/closeLeaderForDissolve() callback pair; dissolve(input, leader), abandonCreation(input, leader), and stopForHost(leader) now all take the TeamLeader as a plain AgentService | null value, read once by TeamService (its own leader_ field) at each call site instead of asked for through a callback. stopChildRuntimesForDissolve and the child-stopping half of stopRuntimesForDissolve are unified as stopChildrenForDissolve() and stopAllForDissolve(leader), both still built on the one shared, non-throwing stopChildRuntimes(failures) helper so a member-stop failure and a leader-stop failure still aggregate into one thrown error exactly as today; closeResources (now closeChildren) drops its own redundant repeat of workflows.closeAdmission()/stopAll() and scheduler.stop() -- both were already covered, idempotently, by stopAllForDissolve immediately before it, so the repeat inside closeResources answered nothing new. abandonCreation's adoptDurableLeader callback is removed: TeamService.createNew's own catch adopts an orphaned durable leader itself, before calling abandonCreation, and passes the result as the leader argument; a failure during that adoption attempt is now logged rather than folded into the thrown AggregateError alongside the original creation-failure cause. The number, order, and gating of every worktree assessment, the dissolve refusal contract, the dissolve receipt shape, and team.closed timing are unchanged. TeamService forgets this.leader_ (checked once, after closing.dissolve() settles) whenever the new AgentService.isSafeToForget() is true, not only once AgentService.isRetired() confirms the close's own durable write also landed: a leader whose close() fully released runtime authority (stopRuntime() succeeded) but whose identity write then failed is still forgotten and rebuilt fresh from disk on next use, matching the pre-refactor unconditional pre-close null. isSafeToForget() stays false for the different case of an unproven runtime termination (a failed start whose own rollback stop could not prove the native runtime dead), because that runtime might still be alive and must not be silently forgotten. A leader whose close was never reached at all (an earlier stop or assessment refused first) is left live and reusable exactly as before.
+- workflow.run and the workflow_run MCP tool now report BAD_REQUEST instead of INTERNAL for an empty resolved script, a scriptPath that is not a regular file, or a scriptPath over the read-size cap -- each is the caller's own mistake, not a server failure. Missing script/scriptPath and an out-of-range max_concurrency already reported BAD_REQUEST and are unaffected.
+- dispatcher.submit and team.submit now report SUBMIT_FAILED / SUBMIT_AMBIGUOUS instead of TEAM_SUBMIT_FAILED / TEAM_SUBMIT_AMBIGUOUS for a failed or ambiguous submission. The shared submit receipt covers both callers, and a Dispatcher's own Agent submission has no Team involved, so the wire code no longer names Team.
+- A dispatcher's own admission gate and its workflow-run admission check now report SERVER_SHUTTING_DOWN instead of INTERNAL when they refuse a request, matching the code the process-wide shutdown fence and a dispatcher's Channel port already reported for their own closed-scope refusals.
+- ChannelService.closeAll() now collects and reports every channel session's close failure instead of logging and swallowing it. A Dispatcher's own close already wraps this call in its aggregate shutdown-failure collector, so a channel provider's close() throwing during a dispatcher stop or the daemon's graceful shutdown now surfaces as a shutdown failure where it was previously silent.
+- dispatcher.status's status field and each dispatcher.list entry's status field now always report the runtime vocabulary (declared/starting/ready/degraded/stopping/stopped). Previously dispatcher.list reported the identity vocabulary (starting/running/degraded/closed/stopped) for both a live and a cold dispatcher, and dispatcher.status mixed the two: the runtime vocabulary while live, the identity vocabulary while cold. A caller branching on 'running' or 'closed' needs to branch on 'ready' or 'stopped' instead. Two cases that previously reported 'stopped' now report 'declared': a dispatcher with no persisted identity yet, and a materialized dispatcher whose agent is built but has never activated its runtime in this process (previously this fell back to the persisted identity's status, which could be stale after a crash).
+- team.status already refused during a dispatcher stop; team.history and team.list now refuse the same way (SERVER_SHUTTING_DOWN) instead of answering from a Team's stale records. All three are per-Team operational reads and are now gated uniformly; dispatcher.list, dispatcher.status, and channel.list are unaffected and remain observable through a stop.
+- TeammateCollection now takes its admission fence at construction and gates every TeammateOps verb (spawn/send/close/list/status/history/last/getCapabilities) internally, uniformly, instead of wrapping only the three mutating verbs at the dispatcher-service boundary. A dispatcher-root teammate.list/.status/.history/.last call now refuses with SERVER_SHUTTING_DOWN during a Dispatcher stop instead of answering from stale records; a Team-scoped one now refuses with TEAM_CLOSED during that Team's dissolve, and with SERVER_SHUTTING_DOWN during a Dispatcher stop, instead of always answering. dispatcher-service/teammate-ops.ts is deleted; DispatcherService.teammates returns the collection directly.
+- The `dreamux dispatcher start` CLI verb is removed (R11: no in-process restart after a dispatcher has closed). It never reached a working code path (no `'start'` case existed on the server-side dispatcher-control method resolver), but its removal is a CLI surface change an operator's script could still reference. `dreamux dispatcher status`/`list` are unaffected.
+- A dispatcher's shutdown stops Workflows, each Team, each materialized TeamMate runtime, and the dispatcher's own Agent runtime, joins every already-admitted operation, then repeats that same runtime sweep once more before closing Channels last. The sweep runs before the admitted-work join as well as after: an admitted call can itself be starting a runtime with no timeout of its own, so joining first would wait on exactly the runtime the sweep exists to stop, and stopping it first is what makes that runtime's own teardown unblock the join. The second, post-join pass catches a pre-fence admission that only starts - or, since a runtime stop fences an entity's admission for its own convergence only and never durably closes it, revives - a runtime after the first pass already read past that entity. Separately, TeammateCollection's and TeamCollection's own entity-construction paths check the dispatcher's closing fact the instant they register a brand-new entity and self-close its runtime immediately, preempting a spawned TeamMate's first submission outright (a Team's leader can already have taken its first prompt by the time the collection notices, so it only stops that runtime as soon as it can) - a different race, from a new entity's own construction, than the two-pass sweep covers.
+- Code organization refactor stage 6f, item 2 (R48): wired the new Dispatcher.hooks.teammateLaunch hook through TeammateCollection.buildEntity (the one construction path behind spawn, createLocked, and reopen), the dispatcher-root and Team-scoped TeammateCollections, and the TeamMate system prompt, so a plugin can now append instructions and skill sources to every ordinary TeamMate's launch the same way it already can for the Dispatcher and a TeamLeader.
+- Code organization refactor stage 6f, item 3 (R48): wired the new Dispatcher.hooks.createTeam hook into TeamCollection.createFromRequest, which now runs it on a non-replay team.create request's own wire-shaped params before doing the repo/skill-source translation admin.sock and the Team MCP delegate used to each do for themselves; both callers now build one TeamCreateCommand and forward it unchanged.
+- Code organization refactor stage 6f, item 4 (R50): added platform/paths.ts's pluginStateDir(name), a host-owned per-plugin durable state directory under state/plugins/<name>/, and wired it into every plugin's server(host) call as ServerHost.stateDir. Purely additive; no existing path moves or changes shape.
+- Code organization refactor stage 6f, item 1 (R52): renamed the Dispatcher hook object's beforeLaunch key to launch and the Team hook object's beforeTeamLeaderLaunch key to leaderLaunch, following the matching dreamux-types rename. Internal wiring (DispatcherAgentOptions, TeamLeaderForTeamDeps, tapable debug-name labels) renamed to match; no ownership or firing-site change.
+- Code organization refactor stage 7, item 9: `dreamux serve` now runs `cli/server.ts`'s `runServe()` in-process instead of spawning `dist/cli/server.js` as a child process, and `dreamux status` / `dreamux dispatcher list` / `dreamux dispatcher status` now call the admin socket in-process through `admin/client.ts`'s `adminJsonInvoker` instead of spawning the deleted `server-ctl` entry; `cli/server-ctl.ts` is removed. Two small, verified output differences on failure paths: (1) when the admin socket is absent or refuses the connection, the status/dispatcher commands now report `TRANSPORT_ERROR` carrying Node's own socket error (e.g. `dreamux: admin socket connection to <path> failed - connect ENOENT <path>`) instead of the old bespoke `dreamux: cannot reach admin socket at <path> — is the server running?` sentence, matching the TRANSPORT_ERROR behavior the 0.24.0 CHANGELOG already documents for every other admin caller; a Command-level failure (the server ran and refused the request) still prints the unchanged `error: [code] message` line, and the exit code (1) is unchanged in both cases. These two commands are also now subject to the shared 10-second admin-socket request timeout instead of waiting indefinitely. (2) A `dreamux serve` startup failure now prints `dreamux: <message>` through the CLI's own top-level error handler instead of the old child process's `[server] fatal: <error with stack>` line, no stack included; verified for a missing/invalid config.json (rejects with `Error`/`RuleViolation`) and a failing plugin `server` hook (wrapped as `PluginLoadError`, also an `Error`), both of which keep exit code 1 unchanged, matching every other Dreamux failure's `Error`-subclass contract. `dreamux serve --help`'s old usage text (config path, `DREAMUX_CONFIG_DIR`, run/state/logs roots, plugin ref grammar) is dropped rather than carried into the new implementation: it was already unreachable through the `dreamux` CLI, which answers `--help` before ever invoking a serve handler, and that content already lives in `.agents/domains/state-config-and-files.md` and the `dreamux-maintenance` skill's `config-envelope.md` reference.
+- Code organization refactor stage 7, item 7 (R14): the teammate.spawn and teammate.submit Commands now reject an empty prompt, a blank agent_runtime, or a blank intent with BAD_REQUEST, matching what the equivalent TeamMate MCP tools already reject. The MCP tools' own behavior is unchanged.
+- Code organization refactor stage 7, item 5 (R20): the teammate.spawn and team.create Commands no longer accept repo.slug (already true of the equivalent MCP tools since 0.25.0). The worktree directory and default branch already derive from the allocated entity name; existing worktrees and persisted state are unchanged.
+- Move identity notifications, completion recipients, admission, role tools and command addressing to their actual owners. Remove dormant loader import, chmod, executable-directory probe, name/id, clock and Workflow runner construction overrides. Preserve real CLI logger/sweep extensions, channel-log creation timing and leader-tool refusal order; persisted formats and config require no migration.
+- Plugin hook review fixes: a plugin's own interceptor added with `hook.intercept` — on `call`, `tap`, `loop`, `result`, `done`, `error`, or `register` — is guarded the same way a tap is, attributed to the plugin that registered it: on `dispatcher`, `team`, and a launch hook a throw is logged and skipped, and on `hooks.plugin.for(name)` a throw fails plugin loading with a clear error, so neither crashes `dreamux serve` or `dreamux doctor` — including a `done`/`error` interceptor on an async hook, which tapable invokes from a continuation an ordinary try/catch around the hook cannot see. Interceptor methods must be synchronous: an `async` one's rejection is logged at runtime and fails plugin loading on `hooks.plugin.for(name)` with an error naming the interceptor, and an `async` `register` leaves the tap unchanged. A launch-hook interceptor sees only an opaque, disconnected handle, never the internal launch draft, so it cannot add a skill root that skips the skill fence. An async plugin tap on the sync `dispatcher`/`team` hooks is logged and skipped, with no unhandled rejection risk. An async `server()` or `contribute()` fails loading with a clear error naming the plugin, so a tap registered after its first `await` is never silently lost. A `plugins[]` entry's `config` block for a plugin with no `config.read` is ignored, so `dreamux serve` starts.
+- Revert #408 and restore the previous workspace and Team creation behavior.
+- Project RuntimeActivity without reshaping, redacting text and structured JSON payloads while retaining native ids, timestamps, result and error separately. Publish and validate the four Core events with camelCase members and remove unused redacted flags.
+- Project the new token.usage activity through the conversation projection as numeric counters with nothing to redact.
+
+### Patches
+
+- Release fully retired Team stores and read historical records from disk while preserving live owners, queued writes and cleanup. Keep an admitted leader dissolve on that captured owner through its asynchronous precheck and detached cleanup, even when initial construction fails. Restore non-blocking Codex inbound and final-parent behavioral coverage with explicit native-model opt-in and separate auth-free protocol checks. Retain revocable event sources and skip display DTO production without an audience while preserving durable observations. Restore actual ESLint code-line limits and public package boundary assertions. Ignore non-Team inventory names without reading or altering their contents, and keep one construction record acquisition through workspace preparation and publication. Pure retained-record reads return the committed snapshot without waiting for unrelated queued writes; writer releases still drain their captured queues.
+- `dreamux serve` now always exits on SIGTERM or SIGINT: a shutdown that fails is logged and the process exits with status 1, and a shutdown that has not settled by a fixed deadline is cut off and the process exits with status 1, where a failed shutdown used to leave the process running. Under systemd (`Restart=on-failure`), a failed or cut-off shutdown that was not requested through `systemctl stop` therefore restarts the service, and a runtime child process can outlive a daemon cut off this way, as after a manager kill. A value refused by config validation in an online config replace is now reported as a bad request rather than an internal failure. An unknown `builtin:` provider ref in a replace payload is classified the same way, and its message no longer reads as an external-provider load failure; `serve`, `doctor` and `onboard` print the same reworded message for such a ref. The `repo` input of Dispatcher `spawn` and Team `create` carries its field descriptions and length bounds, defined once beside the repo request reader; because the canonical `spawn` and `team.create` commands validate against that same schema, an empty or over-long repo path, base ref or branch is now rejected as a bad request over the admin socket and the Channel port as well. `last` on a running agent, including a TeamMate a `send` is still reopening, reads the provider, config and session of the runtime that is running instead of the current config. Two lifecycle fixes: a Workflow handle lock taken while an agent is created is released when that agent closes before the handle is handed over, and looking up an absent Team no longer leaves a store cached for that id.
+- Preserve existing taps when a plugin register interceptor omits its result. Reject asynchronous plugin factories and config readers with attributed load errors while observing their rejections. Reject simultaneously loaded plugin names that differ only by ASCII case; preserve the spelling of individual names, API keys, and state paths.
+- Bind fixed runtime context once and return persistence and cleanup operations to their owning services.
+- Team dissolve now writes the record closed immediately after its worktree precheck passes, then destroys every child service (Workflows, scheduler, members, leader) and reclaims the worktree as best-effort steps behind that commit, instead of stopping and closing children first and writing closed last. A member that dirties the managed worktree after the precheck no longer refuses the dissolve: the Team still closes, and a non-forced cleanup then only keeps the directory instead of removing it. A process that dies after the closed record lands now leaves the Team durably closed with whatever children the destroy pass had not yet reached, rather than reopening it. Persisted record shapes are unchanged.
+- A workflow status/list read or a cron list made while its dispatcher is stopping or its Team is dissolving is now refused instead of answered: WorkflowService and SchedulerService fence those reads behind the same admission gate their mutations already crossed. A leader-scoped mutation racing both a dispatcher stop and a Team dissolve at the same time now reports TeamClosedError instead of ServerShuttingDownError, now that the TeamLeader handle is assembled from surfaces that already fence themselves instead of forwarding through 12 hand-written closures. Internally, several resources a parent used to build and hand down (the Workflow journal, the Agent admission ledger, the per-Team record handle) are now built by the module that owns them instead; persisted record and config shapes are unchanged.
 
 ## 0.25.0
 Thu, 10 Sep 2026 04:59:50 GMT

package/README.md

@@ -274,12 +274,7 @@ default used to initialize a missing `~/.dreamux/state/<id>/access.json` is:
     "require_mention": true
   },
   "allow_users": [],
-  "pending": {},
-  "observed_chats": [],
-  "warnings": [],
-  "last_gate": {
-    "at": 0
-  }
+  "pending": {}
 }
 ```
 
@@ -287,10 +282,9 @@ default used to initialize a missing `~/.dreamux/state/<id>/access.json` is:
 `dm_policy`, `group.policy`, `group.allow_chats`, and
 `group.require_mention` are operator policy. `allow_users` is shared authority:
 live pairing/Owner approval may append it, and a quiesced operator may maintain
-it. `pending`, `observed_chats`, `warnings`, and `last_gate` are Channel-owned
-runtime ledger fields. Add real chat or sender ids only through the quiesced
-field-specific maintenance workflow below; the secure default grants neither
-chat nor sender authority.
+it. `pending` is a Channel-owned runtime ledger field. Add real chat or sender
+ids only through the quiesced field-specific maintenance workflow below; the
+secure default grants neither chat nor sender authority.
 
 For human group messages, `group.require_mention` runs first and `block` drops
 all human traffic. Under `allowlist`, an unlisted chat drops and a listed chat
@@ -307,12 +301,16 @@ Before deploying, review every non-empty `allow_chats` entry under both
 be trusted and whose passive known-bot observation should remain enabled.
 
 The access path is always `~/.dreamux/state/<id>/access.json`;
-`DREAMUX_CONFIG_DIR` and `dreamux config path` affect `config.json` only. For a
-manual access edit, fully stop the owning Dispatcher, confirm it stopped,
+`DREAMUX_ROOT` is the one relocation variable for both `config.json` and
+`access.json`; `dreamux config path` still names `config.json` only. For a
+manual access edit, stop the daemon, confirm the process exited,
 re-read after stop, apply only the requested policy/shared-authority fields via
 an owner-only sibling temporary file and atomic replacement at mode `0600`,
 validate the complete current V3 shape without printing values, and then start
-the Dispatcher. Preserve `version` and all Channel-owned ledger fields exactly.
+the daemon. Preserve `version` and the `pending` ledger field exactly. Never
+edit the file while the daemon runs: the running Channel holds the file in
+memory and its next write (a pairing request or an owner approval, for example)
+replaces the whole file, discarding the edit.
 A missing file after confirmed stop is valid current state: start from the full
 secure V3 default shown above, create a missing state directory at `0700`, and
 atomically create the first `0600` file. This is initialization, not a rebuild.
@@ -418,29 +416,44 @@ their own config and visible-reply tools.
 node common/scripts/install-run-rush.js test
 ```
 
-- `tests/smoke.test.ts` — fake-Codex dispatcher behavior: access gate,
-  per-message turn/start inbound submission, process-local dedupe, MCP
-  reply-only outbound, thread resume, app-server restart behavior, and
-  approval fail-fast.
+- `tests/channel-service.test.ts`, `tests/channel-input-format.test.ts` and
+  `tests/entity-turn-owner.test.ts` — Channel lifecycle, neutral inbound
+  rendering and turn ownership with controlled provider fixtures.
 - `tests/bin-launcher.test.ts` — real launcher behavior from arbitrary cwd and
   through symlinks.
-- `tests/doctor.test.ts` — standalone doctor checks for config, Codex home,
-  services, provider-owned runtime binaries, and dispatcher workspace skill
-  state.
-- `tests/agent-runtime-provider.test.ts`, `tests/channel-provider.test.ts`,
-  `tests/registry.test.ts`, and `tests/provider-ref.test.ts` — provider ref,
-  registry, Channel provider, and Agent Runtime provider coverage.
-- `tests/teammate-ledger.test.ts`, `tests/teammate-delivery.test.ts`, and
-  `tests/teammate-mcp.test.ts` — server-hosted TeamMate state, delivery, retry,
-  and retrieval coverage.
-- `tests/codex-live.test.ts` — real Codex app-server compatibility checks,
-  plus the issue #63 mid-turn model gate. Set `DREAMUX_SKIP_LIVE_CODEX=1` only
-  when no Codex binary is available locally. Public CI loud-skips the model
-  gate unless `DREAMUX_RUN_LIVE_MODEL_GATE=1` is set in an environment with
-  usable Codex model auth.
-- `tests/claude-code-live.test.ts` — opt-in Claude Code live contract. Set
-  `DREAMUX_RUN_LIVE_CLAUDE_CODE=1` only in an environment with a usable
-  `claude` binary and auth.
+- `tests/doctor-plugins.test.ts`, `tests/onboard.test.ts` and
+  `tests/uninstall.test.ts` — provider diagnostics, onboarding, existence-only
+  uninstall previews and recursive removal of the whole Dreamux root, including
+  other files inside it. Preview changes no files and does not enumerate root
+  contents; actual filesystem removal errors still propagate. After path
+  normalization, a removal path inside or containing a provider-derived
+  operator home is refused before changing the service. Physical symlink
+  aliases are not resolved.
+- `tests/official-provider-entries.test.ts`, `tests/plugin-loader.test.ts` and
+  `tests/provider-ref.test.ts` — package defaults, plugin contributions and
+  configured provider references.
+- `tests/teammate-completion-lifecycle.test.ts`,
+  `tests/completion-delivery-owners.test.ts` and
+  `tests/mcp-delegate-catalog.test.ts` — actual service completion owners and
+  MCP tool reachability, with controlled runtimes.
+- `tests/codex-live.test.ts` — installed-version and real app-server
+  initialization/thread compatibility with an empty home and no model auth.
+  Missing Codex fails unless `DREAMUX_SKIP_LIVE_CODEX=1` explicitly excludes
+  live checks for an environment without Codex.
+- `tests/codex-inbound-live.test.ts`, `tests/codex-native-contracts-live.test.ts`
+  and `tests/codex-activity-live.test.ts` — six native model cases for issue #63
+  non-blocking inbound, effort, resume, structured output and live activity.
+  These require `DREAMUX_RUN_LIVE_MODEL_GATE=1` and usable model auth in both
+  local and CI runs. The default auth-free run explicitly excludes them and
+  does not certify their contracts. The inbound gate uses real Codex and MCP
+  with fake Feishu platform IO.
+  Provider constructors and defaults use public package entries. Native RPC,
+  protocol types, version/initialization probes and Feishu bot IO interception
+  retain test-only internal imports because no public instrumentation seam
+  exposes these facts. Provider changes must preserve those live assertions.
+- `../agent-runtime/claude-code/tests/` contains Claude runtime, session and
+  RPC tests using synthetic protocol and subprocess fixtures. These tests do
+  not certify authenticated Claude model behavior.
 
 ## License
 

package/dist/admin/client.js

@@ -13,23 +13,34 @@
  * only this side can observe.
  */
 import { connect } from 'node:net';
-import { errorMessage, TransportError } from '../platform/errors.js';
+import { errorMessage } from '@excitedjs/dreamux-utils';
+import { TransportError } from '../platform/errors.js';
 import { adminSocketPath as defaultAdminSocketPath } from '../platform/paths.js';
-/** A failure the SERVER reported, carrying the server's own stable code. */
+/**
+ * A failure the SERVER reported, carrying the server's own stable code.
+ *
+ * Structurally exactly `command/errors.ts`'s `CommandFailure`: `action` is
+ * typed as an exact optional `string`, matching that interface's `action?:
+ * string` field. A constructor parameter property typed `action?: string`
+ * would instead give the field the type an optional *parameter* has inside
+ * the constructor body, `string | undefined`, which `exactOptionalPropertyTypes`
+ * rejects where a `CommandFailure` is expected — so the field is declared and
+ * conditionally assigned by hand instead.
+ */
 export class AdminClientError extends Error {
     code;
-    action;
-    constructor(code, message, 
     /**
      * The next step the failure stated for itself, when it stated one. Absent
      * means the failure never authored one, so a caller renders the code and
      * the message alone.
      */
-    action) {
+    action;
+    constructor(code, message, action) {
         super(message);
-        this.code = code;
-        this.action = action;
         this.name = 'AdminClientError';
+        this.code = code;
+        if (action !== undefined)
+            this.action = action;
     }
 }
 const DEFAULT_TIMEOUT_MS = 10_000;

package/dist/admin/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/admin/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,OAAO,EAAe,MAAM,UAAU,CAAC;AAIhD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,eAAe,IAAI,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAQjF,4EAA4E;AAC5E,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAEvB;IAOA;IARlB,YACkB,IAAY,EAC5B,OAAe;IACf;;;;OAIG;IACa,MAAe;QAE/B,KAAK,CAAC,OAAO,CAAC,CAAC;QATC,SAAI,GAAJ,IAAI,CAAQ;QAOZ,WAAM,GAAN,MAAM,CAAS;QAG/B,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,IAAI,aAAa,GAAG,CAAC,CAAC;AAEtB,MAAM,UAAU,gBAAgB,CAC9B,UAA+B,EAAE;IAEjC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,sBAAsB,EAAE,CAAC;IAClE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAC1D,OAAO;QACL,MAAM,CAAC,MAAc,EAAE,MAAiB;YACtC,MAAM,OAAO,GAAiB;gBAC5B,EAAE,EAAE,cAAc,EAAE;gBACpB,MAAM;gBACN,wEAAwE;gBACxE,MAAM,EAAE,MAAiC;aAC1C,CAAC;YACF,kEAAkE;YAClE,OAAO,OAAO,CAAC,UAAU,EAAE,OAAO,EAAE,SAAS,CAAuB,CAAC;QACvE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CACd,UAAkB,EAClB,OAAqB,EACrB,SAAiB;IAEjB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,IAAI,GAAkB,IAAI,CAAC;QAC/B,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,CACJ,IAAI,cAAc,CAChB,wCAAwC,SAAS,IAAI,CACtD,CACF,CAAC;YACF,IAAI,CAAC;gBACH,IAAI,EAAE,OAAO,EAAE,CAAC;YAClB,CAAC;YAAC,MAAM,CAAC;gBACP,kBAAkB;YACpB,CAAC;QACH,CAAC,EAAE,SAAS,CAAC,CAAC;QACd,KAAK,CAAC,KAAK,EAAE,CAAC;QAEd,SAAS,MAAM,CAAC,KAAc,EAAE,OAAO,GAAG,IAAI;YAC5C,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,IAAI,OAAO;gBAAE,MAAM,CAAC,KAAK,CAAC,CAAC;;gBACtB,OAAO,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;QAED,IAAI,CAAC;YACH,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CACJ,IAAI,cAAc,CAChB,gCAAgC,UAAU,MAAM,YAAY,CAAC,GAAG,CAAC,EAAE,CACpE,CACF,CAAC;YACF,OAAO;QACT,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACzB,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;YACtB,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YACxB,GAAG,IAAI,KAAK,CAAC;YACb,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC7B,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,OAAO;gBAAE,OAAO;YACjC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACrC,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAkB,CAAC;gBACnD,IAAI,QAAQ,CAAC,EAAE;oBAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;;oBAE9C,MAAM,CACJ,IAAI,gBAAgB,CAClB,QAAQ,CAAC,KAAK,CAAC,IAAI,EACnB,QAAQ,CAAC,KAAK,CAAC,OAAO,EACtB,QAAQ,CAAC,KAAK,CAAC,MAAM,CACtB,CACF,CAAC;YACN,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,qEAAqE;gBACrE,oBAAoB;gBACpB,MAAM,CACJ,IAAI,cAAc,CAChB,gDAAgD,YAAY,CAAC,GAAG,CAAC,EAAE,CACpE,CACF,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACvB,IAAI,OAAO;gBAAE,OAAO;YACpB,yEAAyE;YACzE,sEAAsE;YACtE,qEAAqE;YACrE,gDAAgD;YAChD,MAAM,CACJ,IAAI,cAAc,CAChB,8BAA8B,UAAU,aAAa,YAAY,CAAC,GAAG,CAAC,EAAE,CACzE,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACpB,MAAM,CAAC,IAAI,cAAc,CAAC,wCAAwC,CAAC,CAAC,CAAC;QACvE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc;IACrB,OAAO,OAAO,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,aAAa,EAAE,EAAE,CAAC;AAC/D,CAAC"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/admin/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,OAAO,EAAe,MAAM,UAAU,CAAC;AAGhD,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAExD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,eAAe,IAAI,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAQjF;;;;;;;;;;GAUG;AACH,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACzB,IAAI,CAAS;IAC7B;;;;OAIG;IACa,MAAM,CAAU;IAEhC,YAAY,IAAY,EAAE,OAAe,EAAE,MAAe;QACxD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACjD,CAAC;CACF;AAED,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,IAAI,aAAa,GAAG,CAAC,CAAC;AAEtB,MAAM,UAAU,gBAAgB,CAC9B,UAA+B,EAAE;IAEjC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,sBAAsB,EAAE,CAAC;IAClE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAC1D,OAAO;QACL,MAAM,CAAC,MAAc,EAAE,MAAiB;YACtC,MAAM,OAAO,GAAiB;gBAC5B,EAAE,EAAE,cAAc,EAAE;gBACpB,MAAM;gBACN,wEAAwE;gBACxE,MAAM,EAAE,MAAiC;aAC1C,CAAC;YACF,kEAAkE;YAClE,OAAO,OAAO,CAAC,UAAU,EAAE,OAAO,EAAE,SAAS,CAAuB,CAAC;QACvE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CACd,UAAkB,EAClB,OAAqB,EACrB,SAAiB;IAEjB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,IAAI,GAAkB,IAAI,CAAC;QAC/B,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,CACJ,IAAI,cAAc,CAChB,wCAAwC,SAAS,IAAI,CACtD,CACF,CAAC;YACF,IAAI,CAAC;gBACH,IAAI,EAAE,OAAO,EAAE,CAAC;YAClB,CAAC;YAAC,MAAM,CAAC;gBACP,kBAAkB;YACpB,CAAC;QACH,CAAC,EAAE,SAAS,CAAC,CAAC;QACd,KAAK,CAAC,KAAK,EAAE,CAAC;QAEd,SAAS,MAAM,CAAC,KAAc,EAAE,OAAO,GAAG,IAAI;YAC5C,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,IAAI,OAAO;gBAAE,MAAM,CAAC,KAAK,CAAC,CAAC;;gBACtB,OAAO,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;QAED,IAAI,CAAC;YACH,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CACJ,IAAI,cAAc,CAChB,gCAAgC,UAAU,MAAM,YAAY,CAAC,GAAG,CAAC,EAAE,CACpE,CACF,CAAC;YACF,OAAO;QACT,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACzB,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;YACtB,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YACxB,GAAG,IAAI,KAAK,CAAC;YACb,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC7B,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,OAAO;gBAAE,OAAO;YACjC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACrC,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAkB,CAAC;gBACnD,IAAI,QAAQ,CAAC,EAAE;oBAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;;oBAE9C,MAAM,CACJ,IAAI,gBAAgB,CAClB,QAAQ,CAAC,KAAK,CAAC,IAAI,EACnB,QAAQ,CAAC,KAAK,CAAC,OAAO,EACtB,QAAQ,CAAC,KAAK,CAAC,MAAM,CACtB,CACF,CAAC;YACN,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,qEAAqE;gBACrE,oBAAoB;gBACpB,MAAM,CACJ,IAAI,cAAc,CAChB,gDAAgD,YAAY,CAAC,GAAG,CAAC,EAAE,CACpE,CACF,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACvB,IAAI,OAAO;gBAAE,OAAO;YACpB,yEAAyE;YACzE,sEAAsE;YACtE,qEAAqE;YACrE,gDAAgD;YAChD,MAAM,CACJ,IAAI,cAAc,CAChB,8BAA8B,UAAU,aAAa,YAAY,CAAC,GAAG,CAAC,EAAE,CACzE,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACpB,MAAM,CAAC,IAAI,cAAc,CAAC,wCAAwC,CAAC,CAAC,CAAC;QACvE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc;IACrB,OAAO,OAAO,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,aAAa,EAAE,EAAE,CAAC;AAC/D,CAAC"}

package/dist/admin/socket.js

@@ -12,22 +12,17 @@
  * Command port the in-process Channel invoker does, which is where bounding,
  * schema validation, and shutdown admission happen for both.
  */
+import { chmod, rm } from 'node:fs/promises';
 import { createServer } from 'node:net';
-import { chmod, readFile, rm, writeFile } from 'node:fs/promises';
 import { dirname } from 'node:path';
-import { ensureOwnerOnlyDir } from '@excitedjs/dreamux-utils';
+import { ensureOwnerOnlyDir, errorInfo } from '@excitedjs/dreamux-utils';
 import { DreamuxError, TransportError, ValidationError, commandFailure, } from '../command/errors.js';
-import { errorInfo } from '../platform/error-info.js';
-/**
- * Max attempts to reclaim a stale pidfile before yielding to a competitor.
- * Mirrors claudemux's instance-lock policy.
- */
-const RECLAIM_ATTEMPTS = 3;
+import { acquireInstanceLock, defaultIsPidAlive, readPidFile, releaseInstanceLock, } from '../platform/instance-lock.js';
+import { adminSocketLockPath } from '../platform/paths.js';
 export function createAdminSocketServer(server, socketPath, options = {}) {
-    const chmodFn = options.chmodFn ?? chmod;
     const isAlive = options.isPidAlive ?? defaultIsPidAlive;
     const myPid = options.selfPid ?? process.pid;
-    const lockPath = `${socketPath}.lock`;
+    const lockPath = adminSocketLockPath(socketPath);
     let netServer = null;
     let holdLock = false;
     return {
@@ -40,13 +35,14 @@ export function createAdminSocketServer(server, socketPath, options = {}) {
             // (probe, cleanup, bind) behind a pidfile that's created with the
             // exclusive `wx` flag — atomic at the filesystem level. Once we
             // hold it, nobody else can be inside this start() concurrently.
-            // Stale pidfiles (dead holder) are reclaimed up to RECLAIM_ATTEMPTS
-            // times; a live holder always loses the race.
+            // Stale pidfiles (dead holder) are reclaimed up to a bounded number of
+            // times (`platform/instance-lock.ts`); a live holder always loses the
+            // race.
             // The socket + lock live under the volatile run root (issue #182),
             // which may not exist yet on a fresh install — create it owner-only, and
             // tighten it if a pre-existing run dir is group/world-traversable.
             await ensureOwnerOnlyDir(dirname(socketPath));
-            await acquirePidLock(lockPath, myPid, isAlive);
+            await acquireInstanceLock(lockPath, myPid, isAlive);
             holdLock = true;
             try {
                 // Lock is held — stale socket cleanup is now race-free.
@@ -57,9 +53,9 @@ export function createAdminSocketServer(server, socketPath, options = {}) {
                     netServer.listen(socketPath, () => res());
                 });
                 // PR #3 review #2: chmod is a hard requirement, not best-effort —
-                // a 0666 admin socket exposes server-ctl methods to every local user.
+                // a 0666 admin socket exposes every admin Command to every local user.
                 try {
-                    await chmodFn(socketPath, 0o600);
+                    await chmod(socketPath, 0o600);
                 }
                 catch (e) {
                     const chmodErr = e instanceof Error ? e.message : String(e);
@@ -81,7 +77,7 @@ export function createAdminSocketServer(server, socketPath, options = {}) {
                 catch {
                     /* best-effort */
                 }
-                await releasePidLock(lockPath, myPid);
+                await releaseInstanceLock(lockPath, myPid);
                 holdLock = false;
                 throw err;
             }
@@ -98,98 +94,12 @@ export function createAdminSocketServer(server, socketPath, options = {}) {
                 }
             }
             if (holdLock) {
-                await releasePidLock(lockPath, myPid);
+                await releaseInstanceLock(lockPath, myPid);
                 holdLock = false;
             }
         },
     };
 }
-/**
- * Acquire the single-instance pidfile lock.
- *
- * Atomic `wx` create races safely: two competing startups both attempt the
- * same call; one wins, one gets EEXIST. The loser then reads the holder's
- * PID and decides:
- *   - alive holder  → throw (split-brain prevention)
- *   - dead holder   → remove the stale file and retry the `wx` create
- *
- * RECLAIM_ATTEMPTS bounds the retry so a pathologically broken filesystem
- * doesn't spin forever.
- */
-async function acquirePidLock(lockPath, myPid, isAlive) {
-    for (let attempt = 0; attempt < RECLAIM_ATTEMPTS; attempt++) {
-        try {
-            await writeFile(lockPath, `${myPid}\n`, { flag: 'wx', mode: 0o600 });
-            return;
-        }
-        catch (err) {
-            if (err.code !== 'EEXIST')
-                throw err;
-        }
-        const holder = await readPidFile(lockPath);
-        if (holder === myPid) {
-            // Re-entrant — shouldn't happen in normal use, but treat as held.
-            return;
-        }
-        if (holder !== null && isAlive(holder)) {
-            throw new Error(`admin socket lockfile ${lockPath} is held by another live dreamux serve process (pid ${holder}). ` +
-                'Refusing to bind to avoid split-brain admin control. ' +
-                'Stop the other instance before starting a new one.');
-        }
-        // Stale lock (unreadable PID, or PID belongs to a dead process).
-        // Remove and retry the exclusive create. A competitor reclaiming the
-        // same stale file simply wins this round of `wx`, and we'll see *their*
-        // live PID on the next iteration and bail out.
-        try {
-            await rm(lockPath, { force: true });
-        }
-        catch {
-            /* concurrent reclaim — retry the wx open */
-        }
-    }
-    throw new Error(`admin socket lockfile ${lockPath} could not be acquired after ${RECLAIM_ATTEMPTS} reclaim attempts; ` +
-        'a competitor is racing us. Retry after the other startup finishes.');
-}
-/**
- * Release the pidfile lock — but only if it still names us. A holder whose
- * file was already reclaimed by a competitor (e.g. we were paused long
- * enough for our PID to look dead) must not delete the new holder's lock.
- */
-async function releasePidLock(lockPath, myPid) {
-    if ((await readPidFile(lockPath)) !== myPid)
-        return;
-    try {
-        await rm(lockPath, { force: true });
-    }
-    catch {
-        /* best-effort */
-    }
-}
-async function readPidFile(path) {
-    let txt;
-    try {
-        txt = (await readFile(path, 'utf8')).trim();
-    }
-    catch {
-        return null;
-    }
-    if (txt === '')
-        return null;
-    const n = Number.parseInt(txt, 10);
-    return Number.isInteger(n) && n > 0 ? n : null;
-}
-function defaultIsPidAlive(pid) {
-    if (!Number.isInteger(pid) || pid <= 0)
-        return false;
-    try {
-        process.kill(pid, 0);
-        return true;
-    }
-    catch (e) {
-        // EPERM means the process exists but we can't signal it (still alive).
-        return e.code === 'EPERM';
-    }
-}
 /**
  * Fail loud when a still-running OLD-version dreamux server holds the
  * pre-#182 admin socket lock (issue #182 PR-1, PR #183 review P1).
@@ -306,7 +216,8 @@ function reportedFailure(server, method, error) {
  */
 function adminInvocation(req) {
     const params = req.params;
-    if (params !== undefined && (typeof params !== 'object' || Array.isArray(params))) {
+    if (params !== undefined &&
+        (typeof params !== 'object' || Array.isArray(params))) {
         throw new ValidationError("request 'params' must be an object");
     }
     const { dispatcher_id: dispatcherId, ...rest } = params ?? {};

package/dist/admin/socket.js.map

@@ -1 +1 @@
-{"version":3,"file":"socket.js","sourceRoot":"","sources":["../../src/admin/socket.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,YAAY,EAAyC,MAAM,UAAU,CAAC;AAC/E,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9D,OAAO,EACL,YAAY,EACZ,cAAc,EACd,eAAe,EACf,cAAc,GAEf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AA6BtD;;;GAGG;AACH,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAE3B,MAAM,UAAU,uBAAuB,CACrC,MAAc,EACd,UAAkB,EAClB,UAA8B,EAAE;IAEhC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC;IACzC,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,IAAI,iBAAiB,CAAC;IACxD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC;IAC7C,MAAM,QAAQ,GAAG,GAAG,UAAU,OAAO,CAAC;IACtC,IAAI,SAAS,GAAqB,IAAI,CAAC;IACvC,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,OAAO;QACL,UAAU;QAEV,KAAK,CAAC,KAAK;YACT,oEAAoE;YACpE,oEAAoE;YACpE,kEAAkE;YAClE,mEAAmE;YACnE,kEAAkE;YAClE,gEAAgE;YAChE,gEAAgE;YAChE,oEAAoE;YACpE,8CAA8C;YAC9C,mEAAmE;YACnE,yEAAyE;YACzE,mEAAmE;YACnE,MAAM,kBAAkB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;YAC9C,MAAM,cAAc,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YAC/C,QAAQ,GAAG,IAAI,CAAC;YAEhB,IAAI,CAAC;gBACH,wDAAwD;gBACxD,MAAM,EAAE,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAEtC,SAAS,GAAG,YAAY,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;gBACnE,MAAM,IAAI,OAAO,CAAO,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;oBACnC,SAAU,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;oBAC9B,SAAU,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;gBAC7C,CAAC,CAAC,CAAC;gBAEH,kEAAkE;gBAClE,sEAAsE;gBACtE,IAAI,CAAC;oBACH,MAAM,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;gBACnC,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,MAAM,QAAQ,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;oBAC5D,MAAM,IAAI,KAAK,CACb,gBAAgB,UAAU,sCAAsC,QAAQ,+CAA+C,CACxH,CAAC;gBACJ,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,iEAAiE;gBACjE,gEAAgE;gBAChE,iBAAiB;gBACjB,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;oBACvB,MAAM,OAAO,GAAG,SAAS,CAAC;oBAC1B,SAAS,GAAG,IAAI,CAAC;oBACjB,MAAM,IAAI,OAAO,CAAO,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;gBAC/D,CAAC;gBACD,IAAI,CAAC;oBACH,MAAM,EAAE,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBACxC,CAAC;gBAAC,MAAM,CAAC;oBACP,iBAAiB;gBACnB,CAAC;gBACD,MAAM,cAAc,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;gBACtC,QAAQ,GAAG,KAAK,CAAC;gBACjB,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QAED,KAAK,CAAC,KAAK;YACT,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACvB,MAAM,IAAI,OAAO,CAAO,CAAC,GAAG,EAAE,EAAE,CAAC,SAAU,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;gBAChE,SAAS,GAAG,IAAI,CAAC;gBACjB,IAAI,CAAC;oBACH,MAAM,EAAE,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBACxC,CAAC;gBAAC,MAAM,CAAC;oBACP,KAAK;gBACP,CAAC;YACH,CAAC;YACD,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,cAAc,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;gBACtC,QAAQ,GAAG,KAAK,CAAC;YACnB,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,cAAc,CAC3B,QAAgB,EAChB,KAAa,EACb,OAAiC;IAEjC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,gBAAgB,EAAE,OAAO,EAAE,EAAE,CAAC;QAC5D,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,QAAQ,EAAE,GAAG,KAAK,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACrE,OAAO;QACT,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,GAAG,CAAC;QAClE,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC3C,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YACrB,kEAAkE;YAClE,OAAO;QACT,CAAC;QACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CACb,yBAAyB,QAAQ,uDAAuD,MAAM,KAAK;gBACjG,uDAAuD;gBACvD,oDAAoD,CACvD,CAAC;QACJ,CAAC;QACD,iEAAiE;QACjE,qEAAqE;QACrE,wEAAwE;QACxE,+CAA+C;QAC/C,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,4CAA4C;QAC9C,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CACb,yBAAyB,QAAQ,gCAAgC,gBAAgB,qBAAqB;QACpG,oEAAoE,CACvE,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,cAAc,CAAC,QAAgB,EAAE,KAAa;IAC3D,IAAI,CAAC,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAC,KAAK,KAAK;QAAE,OAAO;IACpD,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB;IACnB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAY;IACrC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACnC,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAW;IACpC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACrD,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,uEAAuE;QACvE,OAAQ,CAA2B,CAAC,IAAI,KAAK,OAAO,CAAC;IACvD,CAAC;AACH,CAAC;AASD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAAsC;IAEtC,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,IAAI,iBAAiB,CAAC;IACxD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACzD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,uCAAuC,MAAM,sCAAsC;YACjF,kBAAkB,OAAO,CAAC,cAAc,2CAA2C;YACnF,kFAAkF;YAClF,oFAAoF;YACpF,oFAAoF;YACpF,0DAA0D,CAC7D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAc,EAAE,IAAY;IACpD,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IACzB,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;QACxB,GAAG,IAAI,KAAK,CAAC;QACb,IAAI,GAAW,CAAC;QAChB,OAAO,CAAC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YACtC,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;YACzB,IAAI,IAAI,KAAK,EAAE;gBAAE,SAAS;YAC1B,KAAK,WAAW,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QACpB,qDAAqD;IACvD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,MAAc,EAAE,IAAY,EAAE,IAAY;IACnE,IAAI,GAAiB,CAAC;IACtB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAiB,CAAC;QACvC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YAC1E,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,wEAAwE;QACxE,+CAA+C;QAC/C,MAAM,KAAK,GAAG,IAAI,cAAc,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACnF,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClE,OAAO;IACT,CAAC;IAED,IAAI,OAA2B,CAAC;IAChC,IAAI,OAAkB,CAAC;IACvB,IAAI,CAAC;QACH,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,0EAA0E;QAC1E,2EAA2E;QAC3E,qEAAqE;QACrE,KAAK,CAAC,IAAI,EAAE;YACV,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,eAAe,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC;SAChD,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,IAAI,CAAC;QACH,uEAAuE;QACvE,wEAAwE;QACxE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC1E,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,0EAA0E;QAC1E,uEAAuE;QACvE,oCAAoC;QACpC,KAAK,CAAC,IAAI,EAAE;YACV,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,eAAe,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC;SAChD,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CACtB,MAAc,EACd,MAAc,EACd,KAAc;IAEd,IAAI,CAAC,CAAC,KAAK,YAAY,YAAY,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,KAAK,CACjB,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,EACjC,sBAAsB,CACvB,CAAC;IACJ,CAAC;IACD,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,eAAe,CAAC,GAAiB;IAIxC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;IAC1B,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QAClF,MAAM,IAAI,eAAe,CAAC,oCAAoC,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,IAAI,EAAE,CAAC;IAC9D,IAAI,YAAY,KAAK,SAAS,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;QACnE,MAAM,IAAI,eAAe,CAAC,wCAAwC,CAAC,CAAC;IACtE,CAAC;IACD,OAAO;QACL,OAAO,EAAE;YACP,MAAM,EAAE,cAAc;YACtB,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvE;QACD,uEAAuE;QACvE,wDAAwD;QACxD,OAAO,EAAE,IAA4B;KACtC,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,IAAY,EAAE,QAAuB;IAClD,IAAI,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB;IACnB,CAAC;AACH,CAAC"}
+{"version":3,"file":"socket.js","sourceRoot":"","sources":["../../src/admin/socket.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAyC,MAAM,UAAU,CAAC;AAC/E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,EACL,YAAY,EACZ,cAAc,EACd,eAAe,EACf,cAAc,GAEf,MAAM,sBAAsB,CAAC;AAK9B,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,WAAW,EACX,mBAAmB,GACpB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAuC3D,MAAM,UAAU,uBAAuB,CACrC,MAAuB,EACvB,UAAkB,EAClB,UAA8B,EAAE;IAEhC,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,IAAI,iBAAiB,CAAC;IACxD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC;IAC7C,MAAM,QAAQ,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,SAAS,GAAqB,IAAI,CAAC;IACvC,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,OAAO;QACL,UAAU;QAEV,KAAK,CAAC,KAAK;YACT,oEAAoE;YACpE,oEAAoE;YACpE,kEAAkE;YAClE,mEAAmE;YACnE,kEAAkE;YAClE,gEAAgE;YAChE,gEAAgE;YAChE,uEAAuE;YACvE,sEAAsE;YACtE,QAAQ;YACR,mEAAmE;YACnE,yEAAyE;YACzE,mEAAmE;YACnE,MAAM,kBAAkB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;YAC9C,MAAM,mBAAmB,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YACpD,QAAQ,GAAG,IAAI,CAAC;YAEhB,IAAI,CAAC;gBACH,wDAAwD;gBACxD,MAAM,EAAE,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAEtC,SAAS,GAAG,YAAY,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;gBACnE,MAAM,IAAI,OAAO,CAAO,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;oBACnC,SAAU,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;oBAC9B,SAAU,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;gBAC7C,CAAC,CAAC,CAAC;gBAEH,kEAAkE;gBAClE,uEAAuE;gBACvE,IAAI,CAAC;oBACH,MAAM,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;gBACjC,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,MAAM,QAAQ,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;oBAC5D,MAAM,IAAI,KAAK,CACb,gBAAgB,UAAU,sCAAsC,QAAQ,+CAA+C,CACxH,CAAC;gBACJ,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,iEAAiE;gBACjE,gEAAgE;gBAChE,iBAAiB;gBACjB,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;oBACvB,MAAM,OAAO,GAAG,SAAS,CAAC;oBAC1B,SAAS,GAAG,IAAI,CAAC;oBACjB,MAAM,IAAI,OAAO,CAAO,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;gBAC/D,CAAC;gBACD,IAAI,CAAC;oBACH,MAAM,EAAE,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBACxC,CAAC;gBAAC,MAAM,CAAC;oBACP,iBAAiB;gBACnB,CAAC;gBACD,MAAM,mBAAmB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;gBAC3C,QAAQ,GAAG,KAAK,CAAC;gBACjB,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QAED,KAAK,CAAC,KAAK;YACT,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACvB,MAAM,IAAI,OAAO,CAAO,CAAC,GAAG,EAAE,EAAE,CAAC,SAAU,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;gBAChE,SAAS,GAAG,IAAI,CAAC;gBACjB,IAAI,CAAC;oBACH,MAAM,EAAE,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBACxC,CAAC;gBAAC,MAAM,CAAC;oBACP,KAAK;gBACP,CAAC;YACH,CAAC;YACD,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,mBAAmB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;gBAC3C,QAAQ,GAAG,KAAK,CAAC;YACnB,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AASD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAAsC;IAEtC,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,IAAI,iBAAiB,CAAC;IACxD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACzD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,uCAAuC,MAAM,sCAAsC;YACjF,kBAAkB,OAAO,CAAC,cAAc,2CAA2C;YACnF,kFAAkF;YAClF,oFAAoF;YACpF,oFAAoF;YACpF,0DAA0D,CAC7D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAuB,EAAE,IAAY;IAC7D,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IACzB,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;QACxB,GAAG,IAAI,KAAK,CAAC;QACb,IAAI,GAAW,CAAC;QAChB,OAAO,CAAC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YACtC,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;YACzB,IAAI,IAAI,KAAK,EAAE;gBAAE,SAAS;YAC1B,KAAK,WAAW,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QACpB,qDAAqD;IACvD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,MAAuB,EACvB,IAAY,EACZ,IAAY;IAEZ,IAAI,GAAiB,CAAC;IACtB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAiB,CAAC;QACvC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YAC1E,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,wEAAwE;QACxE,+CAA+C;QAC/C,MAAM,KAAK,GAAG,IAAI,cAAc,CAC9B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;QACF,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClE,OAAO;IACT,CAAC;IAED,IAAI,OAA2B,CAAC;IAChC,IAAI,OAAkB,CAAC;IACvB,IAAI,CAAC;QACH,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,0EAA0E;QAC1E,2EAA2E;QAC3E,qEAAqE;QACrE,KAAK,CAAC,IAAI,EAAE;YACV,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,eAAe,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC;SAChD,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,IAAI,CAAC;QACH,uEAAuE;QACvE,wEAAwE;QACxE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC1E,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,0EAA0E;QAC1E,uEAAuE;QACvE,oCAAoC;QACpC,KAAK,CAAC,IAAI,EAAE;YACV,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,eAAe,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC;SAChD,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CACtB,MAAuB,EACvB,MAAc,EACd,KAAc;IAEd,IAAI,CAAC,CAAC,KAAK,YAAY,YAAY,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,KAAK,CACjB,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,EACjC,sBAAsB,CACvB,CAAC;IACJ,CAAC;IACD,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,eAAe,CAAC,GAAiB;IAIxC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;IAC1B,IACE,MAAM,KAAK,SAAS;QACpB,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EACrD,CAAC;QACD,MAAM,IAAI,eAAe,CAAC,oCAAoC,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,IAAI,EAAE,CAAC;IAC9D,IAAI,YAAY,KAAK,SAAS,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;QACnE,MAAM,IAAI,eAAe,CAAC,wCAAwC,CAAC,CAAC;IACtE,CAAC;IACD,OAAO;QACL,OAAO,EAAE;YACP,MAAM,EAAE,cAAc;YACtB,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvE;QACD,uEAAuE;QACvE,wDAAwD;QACxD,OAAO,EAAE,IAA4B;KACtC,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,IAAY,EAAE,QAAuB;IAClD,IAAI,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB;IACnB,CAAC;AACH,CAAC"}

package/dist/agent-runtime/capabilities.js

@@ -8,15 +8,7 @@
  * cannot pass a valid object at load and return a different or invalid one when
  * the catalog later asks.
  */
-import { canonicalJsonValue, isPlainObject, JsonValueError, } from '../platform/json-value.js';
-/** Core's independent bounds on a provider's declared capabilities. */
-const MAX_TAGS = 32;
-const MAX_TAG_LENGTH = 64;
-const PUBLIC_CONFIG_BOUNDS = {
-    maxDepth: 4,
-    maxEntries: 32,
-    maxBytes: 4096,
-};
+import { canonicalJsonValue, isPlainObject, JSON_VALUE_UNBOUNDED, JsonValueError, } from '../platform/json-value.js';
 export class InvalidAgentRuntimeCapabilitiesError extends Error {
     providerRef;
     detail;
@@ -69,16 +61,11 @@ function normalizeTags(value, ref) {
     if (!Array.isArray(value)) {
         throw new InvalidAgentRuntimeCapabilitiesError(ref, 'tags must be an array');
     }
-    if (value.length > MAX_TAGS) {
-        throw new InvalidAgentRuntimeCapabilitiesError(ref, `tags may hold at most ${MAX_TAGS} entries`);
-    }
     const seen = new Set();
     const tags = [];
     for (const entry of value) {
-        if (typeof entry !== 'string' ||
-            entry.length === 0 ||
-            entry.length > MAX_TAG_LENGTH) {
-            throw new InvalidAgentRuntimeCapabilitiesError(ref, `each tag must be a non-empty string of at most ${MAX_TAG_LENGTH} characters`);
+        if (typeof entry !== 'string' || entry.length === 0) {
+            throw new InvalidAgentRuntimeCapabilitiesError(ref, 'each tag must be a non-empty string');
         }
         // Declaration order is the provider's; duplicates are simply collapsed.
         if (seen.has(entry))
@@ -95,7 +82,7 @@ function normalizePublicConfig(value, ref) {
         throw new InvalidAgentRuntimeCapabilitiesError(ref, 'publicConfig must be an object when present');
     }
     try {
-        return canonicalJsonValue(value, PUBLIC_CONFIG_BOUNDS);
+        return canonicalJsonValue(value, JSON_VALUE_UNBOUNDED);
     }
     catch (error) {
         if (error instanceof JsonValueError) {