@fased/fased 0.1.54 → 0.1.56

package/dist/plugin-sdk/{outbound-mf2y6KuY.js → outbound-0oN9IfNw.js}

@@ -2,15 +2,15 @@ import { t as __exportAll } from "./rolldown-runtime-Cbj13DAv.js";
 import { t as createSubsystemLogger } from "./subsystem-DBPNbQDQ.js";
 import { p as getChildLogger } from "./globals-B_jjtAje.js";
 import { o as escapeRegExp, x as toWhatsappJid } from "./utils-CYk9EKoq.js";
-import { n as loadConfig } from "./config-rySyVtKs.js";
-import { n as generateSecureUuid } from "./secure-random-Bl-AVLVb.js";
-import { t as redactIdentifier } from "./redact-identifier-Q3tkvxhm.js";
-import { n as resolveMarkdownTableMode } from "./markdown-tables-BOG5sSQQ.js";
-import { n as loadWebMedia } from "./media-Bu-nJpPs.js";
-import { n as normalizePollInput } from "./polls-DQrR-qT3.js";
-import { t as convertMarkdownTables } from "./tables-0mhUOh5v.js";
-import { n as requireActiveWebListener } from "./active-listener-BZQWZPF7.js";
-import { n as formatError } from "./session-DyMtb5YQ.js";
+import { n as loadConfig } from "./config-Bt5GhnA-.js";
+import { n as generateSecureUuid } from "./secure-random-BIkG-k4s.js";
+import { t as redactIdentifier } from "./redact-identifier-Lt7t3l7S.js";
+import { n as resolveMarkdownTableMode } from "./markdown-tables-Mkx7k92Y.js";
+import { n as loadWebMedia } from "./media-CA8sTmVE.js";
+import { n as normalizePollInput } from "./polls-DKQXVfJp.js";
+import { t as convertMarkdownTables } from "./tables-CjlQJV4r.js";
+import { n as requireActiveWebListener } from "./active-listener-x4MLhYUw.js";
+import { n as formatError } from "./session-C_n2S5ub.js";
 
 //#region src/markdown/whatsapp.ts
 /**

package/dist/plugin-sdk/{outbound-attachment-ivAHpWnn.js → outbound-attachment-DdVkqUzE.js}

@@ -1,6 +1,6 @@
 import { p as resolveConfigDir } from "./utils-CYk9EKoq.js";
-import { c as detectMime, l as extensionForMime } from "./image-ops-CcBfoMLW.js";
-import { n as loadWebMedia } from "./media-Bu-nJpPs.js";
+import { c as detectMime, l as extensionForMime } from "./image-ops-CUaLtIFj.js";
+import { n as loadWebMedia } from "./media-CA8sTmVE.js";
 import path from "node:path";
 import { createWriteStream } from "node:fs";
 import fs$1 from "node:fs/promises";

package/dist/plugin-sdk/{pairing-message-CvJ6Qa1Q.d.ts → pairing-message-BMkkS038.d.ts}

@@ -1,5 +1,5 @@
-import { At as FasedAgentConfig, t as ChannelConfigSchema } from "./types.plugin-CvUiB3Kh.js";
-import { v as FasedAgentPluginConfigSchema } from "./types-DV5TNhMK.js";
+import { At as FasedAgentConfig, t as ChannelConfigSchema } from "./types.plugin-_fbu40Re.js";
+import { v as FasedAgentPluginConfigSchema } from "./types-BYDL6dQj.js";
 import { ZodTypeAny } from "zod";
 
 //#region src/plugins/config-schema.d.ts

package/dist/plugin-sdk/{pairing-message-CqYG12t-.js → pairing-message-ClqhfCUk.js}

@@ -1,4 +1,4 @@
-import { Or as formatCliCommand } from "./config-rySyVtKs.js";
+import { _a as formatCliCommand } from "./config-Bt5GhnA-.js";
 import { f as DEFAULT_ACCOUNT_ID, p as normalizeAccountId } from "./session-key-HSJ2KQTc.js";
 
 //#region src/plugins/config-schema.ts

package/dist/plugin-sdk/{pairing-store-D-21Sphe.js → pairing-store-B01mCSct.js}

@@ -1,7 +1,7 @@
-import { ct as listChannelPlugins, st as getChannelPlugin } from "./runtime-ClSakPxR.js";
+import { ct as listChannelPlugins, st as getChannelPlugin } from "./runtime-Dy420wBu.js";
 import { a as resolveOAuthDir, s as resolveStateDir, u as resolveRequiredHomeDir } from "./paths-BEmvSyOV.js";
 import { g as safeParseJson } from "./utils-CYk9EKoq.js";
-import { In as withFileLock$1 } from "./config-rySyVtKs.js";
+import { In as withFileLock$1 } from "./config-Bt5GhnA-.js";
 import { f as DEFAULT_ACCOUNT_ID } from "./session-key-HSJ2KQTc.js";
 import path from "node:path";
 import fs from "node:fs";

package/dist/plugin-sdk/{pi-model-discovery-B6gD1clF.js → pi-model-discovery-Buz0JC1Y.js}

@@ -1,5 +1,5 @@
 import { t as __exportAll } from "./rolldown-runtime-Cbj13DAv.js";
-import { Kt as normalizeProviderId, jn as ensureAuthProfileStore } from "./config-rySyVtKs.js";
+import { Kt as normalizeProviderId, jn as ensureAuthProfileStore } from "./config-Bt5GhnA-.js";
 import path from "node:path";
 import fs from "node:fs";
 import * as PiCodingAgent from "@mariozechner/pi-coding-agent";

package/dist/plugin-sdk/{pi-model-discovery-runtime-3yDxS3ro.js → pi-model-discovery-runtime-DuwuoteY.js}

@@ -2,13 +2,13 @@ import "./subsystem-DBPNbQDQ.js";
 import "./globals-B_jjtAje.js";
 import "./paths-BEmvSyOV.js";
 import "./utils-CYk9EKoq.js";
-import "./config-rySyVtKs.js";
+import "./config-Bt5GhnA-.js";
 import "./agent-scope-BbgPlhtw.js";
 import "./logger-BbFvCoKk.js";
 import "./exec-DQ8j4Fm3.js";
 import "./redact-Bm8vu_ju.js";
 import "./github-copilot-token-CUK__1s1.js";
 import "./retry-DstNBhDW.js";
-import { i as discoverModels, n as PiModelRegistryClass, r as discoverAuthStorage, t as PiAuthStorageClass } from "./pi-model-discovery-B6gD1clF.js";
+import { i as discoverModels, n as PiModelRegistryClass, r as discoverAuthStorage, t as PiAuthStorageClass } from "./pi-model-discovery-Buz0JC1Y.js";
 
 export { discoverAuthStorage, discoverModels };

package/dist/plugin-sdk/{probe-Cyb-DGA3.js → probe--7xtfzMm.js}

@@ -1,5 +1,5 @@
-import { t as withTimeout } from "./with-timeout-BYrRAYFV.js";
-import { n as createSlackWebClient } from "./client-D2N7hqVu.js";
+import { t as withTimeout } from "./with-timeout-ckWB8rTo.js";
+import { n as createSlackWebClient } from "./client-pI228AVT.js";
 
 //#region src/slack/probe.ts
 async function probeSlack(token, timeoutMs = 2500) {
@@ -38,4 +38,4 @@ async function probeSlack(token, timeoutMs = 2500) {
 }
 
 //#endregion
-export { probeSlack };
+export { probeSlack as t };

package/dist/plugin-sdk/{probe-Dlk0Jxpw.js → probe-BFroeK3g.js}

@@ -1,7 +1,7 @@
 import { t as __exportAll } from "./rolldown-runtime-Cbj13DAv.js";
 import { t as normalizeDiscordToken } from "./token-D4-H0ByG.js";
 import { n as fetchWithTimeout } from "./fetch-timeout-l_6RdoMw.js";
-import { t as resolveFetch } from "./fetch-Cu-ahkie.js";
+import { t as resolveFetch } from "./fetch-BtmoPIlf.js";
 
 //#region src/discord/probe.ts
 var probe_exports = /* @__PURE__ */ __exportAll({

package/dist/plugin-sdk/{probe-D8JAILir.js → probe-l_whvGLY.js}

@@ -1,5 +1,5 @@
 import { n as fetchWithTimeout } from "./fetch-timeout-l_6RdoMw.js";
-import { t as makeProxyFetch } from "./proxy-7xs_rsnV.js";
+import { t as makeProxyFetch } from "./proxy-DWpYcsvR.js";
 
 //#region src/telegram/probe.ts
 const TELEGRAM_API_BASE = "https://api.telegram.org";

package/dist/plugin-sdk/{resolve-channels-zEnvugag.js → probe-xY3Ky0Tx.js}

@@ -1,8 +1,7 @@
-import { t as __exportAll } from "./rolldown-runtime-Cbj13DAv.js";
-import { n as createSlackWebClient } from "./client-D2N7hqVu.js";
+import { n as createSlackWebClient } from "./client-pI228AVT.js";
+import { t as probeSlack } from "./probe--7xtfzMm.js";
 
 //#region src/slack/resolve-channels.ts
-var resolve_channels_exports = /* @__PURE__ */ __exportAll({ resolveSlackChannelAllowlist: () => resolveSlackChannelAllowlist });
 function parseSlackChannelMention(raw) {
 	const trimmed = raw.trim();
 	if (!trimmed) return {};
@@ -87,4 +86,4 @@ async function resolveSlackChannelAllowlist(params) {
 }
 
 //#endregion
-export { resolve_channels_exports as n, resolveSlackChannelAllowlist as t };
+export { probeSlack, resolveSlackChannelAllowlist as t };

package/dist/plugin-sdk/provider-web-search-config-contract.d.ts

@@ -1,5 +1,5 @@
-import { At as FasedAgentConfig } from "./types.plugin-CvUiB3Kh.js";
-import { Q as RuntimeWebSearchMetadata, R as WebSearchProviderPlugin, z as WebSearchProviderToolDefinition } from "./types-DV5TNhMK.js";
+import { At as FasedAgentConfig } from "./types.plugin-_fbu40Re.js";
+import { Q as RuntimeWebSearchMetadata, R as WebSearchProviderPlugin, z as WebSearchProviderToolDefinition } from "./types-BYDL6dQj.js";
 
 //#region src/plugin-sdk/provider-web-search-config-contract.d.ts
 type WebSearchCredentialResolutionSource = "config" | "env" | "none";

package/dist/plugin-sdk/{pw-ai-CMplwiwf.js → pw-ai-B0domrii.js}

@@ -2,20 +2,18 @@ import "./subsystem-DBPNbQDQ.js";
 import { w as resolvePreferredFasedAgentTmpDir } from "./globals-B_jjtAje.js";
 import "./paths-BEmvSyOV.js";
 import "./utils-CYk9EKoq.js";
-import { Or as formatCliCommand, _r as formatErrorMessage } from "./config-rySyVtKs.js";
+import { _a as formatCliCommand, oa as formatErrorMessage } from "./config-Bt5GhnA-.js";
 import "./agent-scope-BbgPlhtw.js";
 import "./logger-BbFvCoKk.js";
 import "./exec-DQ8j4Fm3.js";
 import "./redact-Bm8vu_ju.js";
 import "./github-copilot-token-CUK__1s1.js";
 import "./retry-DstNBhDW.js";
-import "./ip-C70a-YlD.js";
-import "./ssrf-BZG8Ztod.js";
-import "./optional-runtime-dependency-DEojVNfv.js";
-import { A as fetchJson, C as normalizeCdpWsUrl, D as assertBrowserNavigationResultAllowed, E as assertBrowserNavigationAllowed, M as getHeadersWithAuth, N as withCdpSocket, O as withBrowserNavigationPolicy, S as formatAriaSnapshot, c as resolveStrictExistingPathsWithinRoot, f as getChromeWebSocketUrl, k as appendCdpPath, n as loadPlaywrightCore, o as DEFAULT_UPLOAD_DIR, u as DEFAULT_FILL_FIELD_TYPE } from "./runtime-dependency-yAWxH4El.js";
-import "./ws-CocpWGhl.js";
-import "./path-alias-guards-Dg3gU-MA.js";
-import "./fs-safe-BG-VzVkL.js";
+import "./ssrf-fG4UHKBw.js";
+import "./optional-runtime-dependency-DKmk9PZa.js";
+import { A as fetchJson, C as normalizeCdpWsUrl, D as assertBrowserNavigationResultAllowed, E as assertBrowserNavigationAllowed, M as getHeadersWithAuth, N as withCdpSocket, O as withBrowserNavigationPolicy, S as formatAriaSnapshot, c as resolveStrictExistingPathsWithinRoot, f as getChromeWebSocketUrl, k as appendCdpPath, n as loadPlaywrightCore, o as DEFAULT_UPLOAD_DIR, u as DEFAULT_FILL_FIELD_TYPE } from "./runtime-dependency-CIw9t7-k.js";
+import "./path-alias-guards-BJZD5JMJ.js";
+import "./fs-safe-xBqok6yR.js";
 import path from "node:path";
 import fs from "node:fs/promises";
 import crypto from "node:crypto";

package/dist/plugin-sdk/{qmd-manager-DCUE21Kj.js → qmd-manager-CFFeM4Fl.js}

@@ -7,9 +7,9 @@ import "./logger-BbFvCoKk.js";
 import "./exec-DQ8j4Fm3.js";
 import "./redact-Bm8vu_ju.js";
 import "./paths-CTZ2RS_E.js";
-import { m as statRegularFile, p as isFileMissingError } from "./internal-qo16nNU1.js";
-import { i as listSessionFilesForAgent, n as requireNodeSqlite, r as buildSessionEntry, t as extractKeywords } from "./query-expansion-Zr9qQixm.js";
-import { n as deriveQmdScopeChatType, r as isQmdScopeAllowed, t as deriveQmdScopeChannel } from "./qmd-scope-D1sSG_Rx.js";
+import { m as statRegularFile, p as isFileMissingError } from "./internal-CG_nHo-2.js";
+import { i as listSessionFilesForAgent, n as requireNodeSqlite, r as buildSessionEntry, t as extractKeywords } from "./query-expansion-CAI2kKLQ.js";
+import { n as deriveQmdScopeChatType, r as isQmdScopeAllowed, t as deriveQmdScopeChannel } from "./qmd-scope-CdX34VCV.js";
 import path from "node:path";
 import os from "node:os";
 import fs from "node:fs/promises";

package/dist/plugin-sdk/{query-expansion-Zr9qQixm.js → query-expansion-CAI2kKLQ.js}

@@ -1,7 +1,7 @@
 import { t as createSubsystemLogger } from "./subsystem-DBPNbQDQ.js";
 import { n as redactSensitiveText } from "./redact-Bm8vu_ju.js";
 import { c as resolveSessionTranscriptsDirForAgent } from "./paths-CTZ2RS_E.js";
-import { a as hashText } from "./internal-qo16nNU1.js";
+import { a as hashText } from "./internal-CG_nHo-2.js";
 import { createRequire } from "node:module";
 import path from "node:path";
 import fs from "node:fs/promises";

package/dist/plugin-sdk/{replies-wiI4veI7.js → replies-1macZ1mZ.js}

@@ -1,8 +1,8 @@
 import { t as __exportAll } from "./rolldown-runtime-Cbj13DAv.js";
-import { i as chunkMarkdownTextWithMode } from "./chunk-B2ffJ-LR.js";
-import { i as isSilentReplyText, n as SILENT_REPLY_TOKEN } from "./tokens-BvtlOzVP.js";
-import { r as markdownToSlackMrkdwnChunks, t as sendMessageSlack } from "./send-D264hFVb.js";
-import { t as createReplyReferencePlanner } from "./reply-reference-BkbK_DWT.js";
+import { i as chunkMarkdownTextWithMode } from "./chunk-B8EZkwiT.js";
+import { i as isSilentReplyText, n as SILENT_REPLY_TOKEN } from "./tokens-BbnqfVuu.js";
+import { r as markdownToSlackMrkdwnChunks, t as sendMessageSlack } from "./send-2VcOMTN5.js";
+import { t as createReplyReferencePlanner } from "./reply-reference-Bqk-7HXE.js";
 
 //#region src/slack/monitor/replies.ts
 var replies_exports = /* @__PURE__ */ __exportAll({

package/dist/plugin-sdk/{resolve-channels-ChWKWtA9.js → resolve-channels-87LZrFk_.js}

@@ -1,7 +1,7 @@
 import { t as __exportAll } from "./rolldown-runtime-Cbj13DAv.js";
 import { t as normalizeDiscordToken } from "./token-D4-H0ByG.js";
-import { _ as fetchDiscord, i as normalizeDiscordSlug } from "./allow-list-BYeKk0Sy.js";
-import { t as listGuilds } from "./guilds-BeT3iHHJ.js";
+import { _ as fetchDiscord, i as normalizeDiscordSlug } from "./allow-list-DyAxs4yw.js";
+import { t as listGuilds } from "./guilds-CDhRIX57.js";
 
 //#region src/discord/resolve-channels.ts
 var resolve_channels_exports = /* @__PURE__ */ __exportAll({ resolveDiscordChannelAllowlist: () => resolveDiscordChannelAllowlist });

package/dist/plugin-sdk/resolve-channels-CwB2_019.js

@@ -0,0 +1,4 @@
+import "./client-pI228AVT.js";
+import { t as resolveSlackChannelAllowlist } from "./probe-xY3Ky0Tx.js";
+
+export { resolveSlackChannelAllowlist };

package/dist/plugin-sdk/{resolve-outbound-target-bm9RUK5q.js → resolve-outbound-target-BdH6LUoW.js}

@@ -1,5 +1,5 @@
-import { It as isWhatsAppGroupJid, Lt as normalizeWhatsAppTarget } from "./runtime-ClSakPxR.js";
-import { n as missingTargetError } from "./target-errors-C_SVKoEv.js";
+import { It as isWhatsAppGroupJid, Lt as normalizeWhatsAppTarget } from "./runtime-Dy420wBu.js";
+import { n as missingTargetError } from "./target-errors-Ckufe179.js";
 
 //#region src/whatsapp/resolve-outbound-target.ts
 function resolveWhatsAppOutboundTarget(params) {

package/dist/plugin-sdk/{resolve-route-ekGNc6os.js → resolve-route-CkNIKKEW.js}

@@ -1,5 +1,5 @@
 import { t as __exportAll } from "./rolldown-runtime-Cbj13DAv.js";
-import { sn as listBindings } from "./runtime-ClSakPxR.js";
+import { sn as listBindings } from "./runtime-Dy420wBu.js";
 import { s as shouldLogVerbose } from "./globals-B_jjtAje.js";
 import { u as resolveDefaultAgentId } from "./agent-scope-BbgPlhtw.js";
 import { t as normalizeChatType } from "./chat-type-C0osVllE.js";

package/dist/plugin-sdk/{resolve-users-BTvjQuui.js → resolve-users-Cxb5wpAQ.js}

@@ -1,5 +1,5 @@
 import { t as __exportAll } from "./rolldown-runtime-Cbj13DAv.js";
-import { n as createSlackWebClient } from "./client-D2N7hqVu.js";
+import { n as createSlackWebClient } from "./client-pI228AVT.js";
 
 //#region src/slack/resolve-users.ts
 var resolve_users_exports = /* @__PURE__ */ __exportAll({ resolveSlackUserAllowlist: () => resolveSlackUserAllowlist });

package/dist/plugin-sdk/{resolve-users-CTzoruIZ.js → resolve-users-V6dHh_2B.js}

@@ -1,7 +1,7 @@
 import { t as __exportAll } from "./rolldown-runtime-Cbj13DAv.js";
 import { t as normalizeDiscordToken } from "./token-D4-H0ByG.js";
-import { _ as fetchDiscord, i as normalizeDiscordSlug } from "./allow-list-BYeKk0Sy.js";
-import { t as listGuilds } from "./guilds-BeT3iHHJ.js";
+import { _ as fetchDiscord, i as normalizeDiscordSlug } from "./allow-list-DyAxs4yw.js";
+import { t as listGuilds } from "./guilds-CDhRIX57.js";
 
 //#region src/discord/resolve-users.ts
 var resolve_users_exports = /* @__PURE__ */ __exportAll({ resolveDiscordUserAllowlist: () => resolveDiscordUserAllowlist });

package/dist/plugin-sdk/{retry-policy-BvlC2SPh.js → retry-policy-9ybIh4Fq.js}

@@ -1,5 +1,5 @@
 import { t as createSubsystemLogger } from "./subsystem-DBPNbQDQ.js";
-import { _r as formatErrorMessage } from "./config-rySyVtKs.js";
+import { oa as formatErrorMessage } from "./config-Bt5GhnA-.js";
 import { n as retryAsync, t as resolveRetryConfig } from "./retry-DstNBhDW.js";
 
 //#region src/infra/retry-policy.ts

package/dist/plugin-sdk/{runtime-ClSakPxR.js → runtime-Dy420wBu.js}

@@ -3,7 +3,7 @@ import { c as CHANNEL_IDS, d as normalizeChannelKey, f as normalizeChatChannelId
 import { i as logVerbose } from "./globals-B_jjtAje.js";
 import { s as resolveStateDir, u as resolveRequiredHomeDir } from "./paths-BEmvSyOV.js";
 import { c as isRecord$1, d as normalizeE164, h as resolveUserPath, o as escapeRegExp } from "./utils-CYk9EKoq.js";
-import { Ar as isTruthyEnvValue, G as isAvatarDataUrl, H as parseDurationMs, Ht as inferUniqueProviderFromConfiguredModels, Jt as resolveConfiguredModelRef, K as isAvatarHttpUrl, Kt as normalizeProviderId, Ln as resolveProcessScopedMap, Lr as resolvePluginAdminRpcActionGrant, Nr as isPluginRuntimeSessionReadAllowed, Pn as resolveFasedAgentDir, Pr as normalizePluginsConfig, Rn as isPidAlive, U as parseByteSize, W as AVATAR_MAX_BYTES, X as resolveAvatarMime, Xt as resolveExplicitConfiguredModelRef, Y as isWorkspaceRelativeAvatarPath, Yt as resolveDefaultModelForAgent, dr as DEFAULT_PROVIDER, in as resolveImplicitProviders, lr as DEFAULT_CONTEXT_TOKENS, n as loadConfig, nn as normalizeProviders, q as isPathWithinRoot, qt as parseModelRef, rn as resolveImplicitCopilotProvider, ur as DEFAULT_MODEL } from "./config-rySyVtKs.js";
+import { $i as DEFAULT_MODEL, Ca as normalizePluginsConfig, Ea as resolvePluginAdminRpcActionGrant, G as isAvatarDataUrl, H as parseDurationMs, Ht as inferUniqueProviderFromConfiguredModels, Jt as resolveConfiguredModelRef, K as isAvatarHttpUrl, Kt as normalizeProviderId, Ln as resolveProcessScopedMap, Pn as resolveFasedAgentDir, Qi as DEFAULT_CONTEXT_TOKENS, Rn as isPidAlive, Sa as isPluginRuntimeSessionReadAllowed, U as parseByteSize, W as AVATAR_MAX_BYTES, X as resolveAvatarMime, Xt as resolveExplicitConfiguredModelRef, Y as isWorkspaceRelativeAvatarPath, Yt as resolveDefaultModelForAgent, ea as DEFAULT_PROVIDER, in as resolveImplicitProviders, n as loadConfig, nn as normalizeProviders, q as isPathWithinRoot, qt as parseModelRef, rn as resolveImplicitCopilotProvider, ya as isTruthyEnvValue } from "./config-Bt5GhnA-.js";
 import { A as openBoundaryFileSync, G as normalizeHyphenSlug, W as normalizeAtHashSlug, l as resolveAgentWorkspaceDir, u as resolveDefaultAgentId } from "./agent-scope-BbgPlhtw.js";
 import { t as normalizeChatType } from "./chat-type-C0osVllE.js";
 import { n as resolveConversationLabel } from "./conversation-label-BoVqak2R.js";
@@ -11,7 +11,7 @@ import { n as resolveAccountEntry, t as createAccountListHelpers } from "./accou
 import { S as parseAgentSessionKey, c as normalizeMainKey, f as DEFAULT_ACCOUNT_ID, l as resolveAgentIdFromSessionKey, m as normalizeOptionalAccountId, p as normalizeAccountId$1, r as buildAgentMainSessionKey, s as normalizeAgentId, t as DEFAULT_AGENT_ID, y as isCronRunSessionKey } from "./session-key-HSJ2KQTc.js";
 import { a as resolveDiscordAccount, o as createAccountActionGate } from "./accounts-RHZyaB73.js";
 import { a as resolveSlackReplyToMode, i as resolveSlackAccount } from "./accounts-CuqIKU8X.js";
-import { i as resolveWhatsAppAccount } from "./accounts-DW9OS5Ll.js";
+import { i as resolveWhatsAppAccount } from "./accounts-DzWlKv1U.js";
 import { a as resolveSessionTranscriptPath, c as resolveSessionTranscriptsDirForAgent, i as resolveSessionFilePathOptions, l as resolveStorePath, n as resolveDefaultSessionStorePath, o as resolveSessionTranscriptPathInDir, r as resolveSessionFilePath, s as resolveSessionTranscriptsDir, t as SAFE_SESSION_ID_RE, u as validateSessionId } from "./paths-CTZ2RS_E.js";
 import { t as emitSessionTranscriptUpdate } from "./transcript-events-BJQWUdmU.js";
 import path from "node:path";
@@ -5411,7 +5411,7 @@ async function loadContextCache() {
 		await ensureFasedModelsJson(cfg);
 	} catch {}
 	try {
-		const { discoverAuthStorage, discoverModels } = await import("./pi-model-discovery-runtime-3yDxS3ro.js");
+		const { discoverAuthStorage, discoverModels } = await import("./pi-model-discovery-runtime-DuwuoteY.js");
 		const agentDir = resolveFasedAgentDir();
 		const modelRegistry = discoverModels(discoverAuthStorage(agentDir), agentDir);
 		applyDiscoveredContextWindows({

package/dist/plugin-sdk/{runtime-dependency-yAWxH4El.js → runtime-dependency-CIw9t7-k.js}

@@ -1,12 +1,11 @@
 import { t as createSubsystemLogger } from "./subsystem-DBPNbQDQ.js";
 import { w as resolvePreferredFasedAgentTmpDir } from "./globals-B_jjtAje.js";
 import { t as CONFIG_DIR } from "./utils-CYk9EKoq.js";
-import { n as loadConfig, yr as isErrno } from "./config-rySyVtKs.js";
+import { ca as isErrno, n as loadConfig } from "./config-Bt5GhnA-.js";
 import { F as isNotFoundPathError, I as isPathInside } from "./agent-scope-BbgPlhtw.js";
-import { s as resolvePinnedHostnameWithPolicy } from "./ssrf-BZG8Ztod.js";
-import { t as importOptionalRuntimeDependency } from "./optional-runtime-dependency-DEojVNfv.js";
-import { n as isLoopbackAddress, r as isLoopbackHost, t as rawDataToString } from "./ws-CocpWGhl.js";
-import { n as openFileWithinRoot, t as SafeOpenError } from "./fs-safe-BG-VzVkL.js";
+import { d as normalizeIpAddress, l as isIpInCidr, s as resolvePinnedHostnameWithPolicy, u as isLoopbackIpAddress } from "./ssrf-fG4UHKBw.js";
+import { t as importOptionalRuntimeDependency } from "./optional-runtime-dependency-DKmk9PZa.js";
+import { n as openFileWithinRoot, t as SafeOpenError } from "./fs-safe-xBqok6yR.js";
 import path from "node:path";
 import fs from "node:fs";
 import os from "node:os";
@@ -14,9 +13,118 @@ import fs$1 from "node:fs/promises";
 import { execFileSync, spawn } from "node:child_process";
 import { createHmac } from "node:crypto";
 import { createServer } from "node:http";
+import WebSocket$1, { WebSocketServer } from "ws";
+import { Buffer as Buffer$1 } from "node:buffer";
 import net from "node:net";
-import WebSocket, { WebSocketServer } from "ws";
 
+//#region src/infra/ws.ts
+function rawDataToString(data, encoding = "utf8") {
+	if (typeof data === "string") return data;
+	if (Buffer$1.isBuffer(data)) return data.toString(encoding);
+	if (Array.isArray(data)) return Buffer$1.concat(data).toString(encoding);
+	if (data instanceof ArrayBuffer) return Buffer$1.from(data).toString(encoding);
+	return Buffer$1.from(String(data)).toString(encoding);
+}
+
+//#endregion
+//#region src/gateway/net.ts
+function isLoopbackAddress(ip) {
+	return isLoopbackIpAddress(ip);
+}
+function normalizeIp(ip) {
+	return normalizeIpAddress(ip);
+}
+function stripOptionalPort(ip) {
+	if (ip.startsWith("[")) {
+		const end = ip.indexOf("]");
+		if (end !== -1) return ip.slice(1, end);
+	}
+	if (net.isIP(ip)) return ip;
+	const lastColon = ip.lastIndexOf(":");
+	if (lastColon > -1 && ip.includes(".") && ip.indexOf(":") === lastColon) {
+		const candidate = ip.slice(0, lastColon);
+		if (net.isIP(candidate) === 4) return candidate;
+	}
+	return ip;
+}
+function parseIpLiteral(raw) {
+	const trimmed = raw?.trim();
+	if (!trimmed) return;
+	const normalized = normalizeIp(stripOptionalPort(trimmed));
+	if (!normalized || net.isIP(normalized) === 0) return;
+	return normalized;
+}
+function parseRealIp(realIp) {
+	return parseIpLiteral(realIp);
+}
+function resolveForwardedClientIp(params) {
+	const { forwardedFor, trustedProxies } = params;
+	if (!trustedProxies?.length) return;
+	const forwardedChain = [];
+	for (const entry of forwardedFor?.split(",") ?? []) {
+		const normalized = parseIpLiteral(entry);
+		if (normalized) forwardedChain.push(normalized);
+	}
+	if (forwardedChain.length === 0) return;
+	for (let index = forwardedChain.length - 1; index >= 0; index -= 1) {
+		const hop = forwardedChain[index];
+		if (!isTrustedProxyAddress(hop, trustedProxies)) return hop;
+	}
+}
+function isTrustedProxyAddress(ip, trustedProxies) {
+	const normalized = normalizeIp(ip);
+	if (!normalized || !trustedProxies || trustedProxies.length === 0) return false;
+	return trustedProxies.some((proxy) => {
+		const candidate = proxy.trim();
+		if (!candidate) return false;
+		return isIpInCidr(normalized, candidate);
+	});
+}
+function resolveClientIp(params) {
+	const remote = normalizeIp(params.remoteAddr);
+	if (!remote) return;
+	if (!isTrustedProxyAddress(remote, params.trustedProxies)) return remote;
+	const forwardedIp = resolveForwardedClientIp({
+		forwardedFor: params.forwardedFor,
+		trustedProxies: params.trustedProxies
+	});
+	if (forwardedIp) return forwardedIp;
+	if (params.allowRealIpFallback) return parseRealIp(params.realIp);
+}
+/**
+* Check if a hostname or IP refers to the local machine.
+* Handles: localhost, 127.x.x.x, ::1, [::1], ::ffff:127.x.x.x
+* Note: 0.0.0.0 and :: are NOT loopback - they bind to all interfaces.
+*/
+function isLoopbackHost(host) {
+	if (!host) return false;
+	const h = host.trim().toLowerCase();
+	if (h === "localhost") return true;
+	return isLoopbackAddress(h.startsWith("[") && h.endsWith("]") ? h.slice(1, -1) : h);
+}
+/**
+* Security check for WebSocket URLs (CWE-319: Cleartext Transmission of Sensitive Information).
+*
+* Returns true if the URL is secure for transmitting data:
+* - wss:// (TLS) is always secure
+* - ws:// is only secure for loopback addresses (localhost, 127.x.x.x, ::1)
+*
+* All other ws:// URLs are considered insecure because both credentials
+* AND chat/conversation data would be exposed to network interception.
+*/
+function isSecureWebSocketUrl(url) {
+	let parsed;
+	try {
+		parsed = new URL(url);
+	} catch {
+		return false;
+	}
+	if (parsed.protocol === "wss:") return true;
+	if (parsed.protocol !== "ws:") return false;
+	return isLoopbackHost(parsed.hostname);
+}
+
+//#endregion
 //#region src/browser/constants.ts
 const DEFAULT_FASED_BROWSER_ENABLED = true;
 const DEFAULT_BROWSER_EVALUATE_ENABLED = true;
@@ -167,7 +275,7 @@ async function ensureChromeExtensionRelayServer(opts) {
 		let extensionWs = null;
 		const cdpClients = /* @__PURE__ */ new Set();
 		const connectedTargets = /* @__PURE__ */ new Map();
-		const extensionConnected = () => extensionWs?.readyState === WebSocket.OPEN;
+		const extensionConnected = () => extensionWs?.readyState === WebSocket$1.OPEN;
 		let extensionDisconnectCleanupTimer = null;
 		const extensionReconnectWaiters = /* @__PURE__ */ new Set();
 		const flushExtensionReconnectWaiters = (connected) => {
@@ -218,7 +326,7 @@ async function ensureChromeExtensionRelayServer(opts) {
 		let nextExtensionId = 1;
 		const sendToExtension = async (payload) => {
 			const ws = extensionWs;
-			if (!ws || ws.readyState !== WebSocket.OPEN) throw new Error("Chrome extension not connected");
+			if (!ws || ws.readyState !== WebSocket$1.OPEN) throw new Error("Chrome extension not connected");
 			ws.send(JSON.stringify(payload));
 			return await new Promise((resolve, reject) => {
 				const timer = setTimeout(() => {
@@ -235,12 +343,12 @@ async function ensureChromeExtensionRelayServer(opts) {
 		const broadcastToCdpClients = (evt) => {
 			const msg = JSON.stringify(evt);
 			for (const ws of cdpClients) {
-				if (ws.readyState !== WebSocket.OPEN) continue;
+				if (ws.readyState !== WebSocket$1.OPEN) continue;
 				ws.send(msg);
 			}
 		};
 		const sendResponseToCdp = (ws, res) => {
-			if (ws.readyState !== WebSocket.OPEN) return;
+			if (ws.readyState !== WebSocket$1.OPEN) return;
 			ws.send(JSON.stringify(res));
 		};
 		const ensureTargetEventsForClient = (ws, mode) => {
@@ -450,7 +558,7 @@ async function ensureChromeExtensionRelayServer(opts) {
 					rejectUpgrade(socket, 401, "Unauthorized");
 					return;
 				}
-				if (extensionWs && extensionWs.readyState !== WebSocket.OPEN) {
+				if (extensionWs && extensionWs.readyState !== WebSocket$1.OPEN) {
 					try {
 						extensionWs.terminate();
 					} catch {}
@@ -487,7 +595,7 @@ async function ensureChromeExtensionRelayServer(opts) {
 			clearExtensionDisconnectCleanupTimer();
 			flushExtensionReconnectWaiters(true);
 			const ping = setInterval(() => {
-				if (ws.readyState !== WebSocket.OPEN) return;
+				if (ws.readyState !== WebSocket$1.OPEN) return;
 				ws.send(JSON.stringify({ method: "ping" }));
 			}, 5e3);
 			ws.on("message", (data) => {
@@ -829,7 +937,7 @@ async function fetchOk(url, timeoutMs = 1500, init) {
 }
 async function withCdpSocket(wsUrl, fn, opts) {
 	const headers = getHeadersWithAuth(wsUrl, opts?.headers ?? {});
-	const ws = new WebSocket(wsUrl, {
+	const ws = new WebSocket$1(wsUrl, {
 		handshakeTimeout: typeof opts?.handshakeTimeoutMs === "number" && Number.isFinite(opts.handshakeTimeoutMs) ? Math.max(1, Math.floor(opts.handshakeTimeoutMs)) : 5e3,
 		...Object.keys(headers).length ? { headers } : {}
 	});
@@ -1755,7 +1863,7 @@ async function getChromeWebSocketUrl(cdpUrl, timeoutMs = 500) {
 async function canOpenWebSocket(wsUrl, timeoutMs = 800) {
 	return await new Promise((resolve) => {
 		const headers = getHeadersWithAuth(wsUrl);
-		const ws = new WebSocket(wsUrl, {
+		const ws = new WebSocket$1(wsUrl, {
 			handshakeTimeout: timeoutMs,
 			...Object.keys(headers).length ? { headers } : {}
 		});
@@ -2107,4 +2215,4 @@ async function loadLinkedom() {
 }
 
 //#endregion
-export { fetchJson as A, DEFAULT_BROWSER_EVALUATE_ENABLED as B, normalizeCdpWsUrl as C, assertBrowserNavigationResultAllowed as D, assertBrowserNavigationAllowed as E, stopChromeExtensionRelayServer as F, DEFAULT_FASED_BROWSER_ENABLED as H, DEFAULT_AI_SNAPSHOT_EFFICIENT_DEPTH as I, DEFAULT_AI_SNAPSHOT_EFFICIENT_MAX_CHARS as L, getHeadersWithAuth as M, withCdpSocket as N, withBrowserNavigationPolicy as O, ensureChromeExtensionRelayServer as P, DEFAULT_AI_SNAPSHOT_MAX_CHARS as R, formatAriaSnapshot as S, InvalidBrowserNavigationUrlError as T, DEFAULT_FASED_BROWSER_PROFILE_NAME as U, DEFAULT_FASED_BROWSER_COLOR as V, stopFasedAgentChrome as _, DEFAULT_TRACE_DIR as a, captureScreenshot as b, resolveStrictExistingPathsWithinRoot as c, normalizeBrowserFormField as d, getChromeWebSocketUrl as f, resolveFasedAgentUserDataDir as g, launchFasedAgentChrome as h, DEFAULT_DOWNLOAD_DIR as i, fetchOk as j, appendCdpPath as k, resolveWritablePathWithinRoot as l, isChromeReachable as m, loadPlaywrightCore as n, DEFAULT_UPLOAD_DIR as o, isChromeCdpReady as p, loadReadability as r, resolveExistingPathsWithinRoot as s, loadLinkedom as t, DEFAULT_FILL_FIELD_TYPE as u, resolveBrowserExecutableForPlatform as v, snapshotAria as w, createTargetViaCdp as x, resolveLsofCommandSync as y, DEFAULT_BROWSER_DEFAULT_PROFILE_NAME as z };
+export { fetchJson as A, DEFAULT_BROWSER_EVALUATE_ENABLED as B, normalizeCdpWsUrl as C, assertBrowserNavigationResultAllowed as D, assertBrowserNavigationAllowed as E, stopChromeExtensionRelayServer as F, isLoopbackHost as G, DEFAULT_FASED_BROWSER_ENABLED as H, DEFAULT_AI_SNAPSHOT_EFFICIENT_DEPTH as I, resolveClientIp as J, isSecureWebSocketUrl as K, DEFAULT_AI_SNAPSHOT_EFFICIENT_MAX_CHARS as L, getHeadersWithAuth as M, withCdpSocket as N, withBrowserNavigationPolicy as O, ensureChromeExtensionRelayServer as P, DEFAULT_AI_SNAPSHOT_MAX_CHARS as R, formatAriaSnapshot as S, InvalidBrowserNavigationUrlError as T, DEFAULT_FASED_BROWSER_PROFILE_NAME as U, DEFAULT_FASED_BROWSER_COLOR as V, isLoopbackAddress as W, rawDataToString as X, resolveForwardedClientIp as Y, stopFasedAgentChrome as _, DEFAULT_TRACE_DIR as a, captureScreenshot as b, resolveStrictExistingPathsWithinRoot as c, normalizeBrowserFormField as d, getChromeWebSocketUrl as f, resolveFasedAgentUserDataDir as g, launchFasedAgentChrome as h, DEFAULT_DOWNLOAD_DIR as i, fetchOk as j, appendCdpPath as k, resolveWritablePathWithinRoot as l, isChromeReachable as m, loadPlaywrightCore as n, DEFAULT_UPLOAD_DIR as o, isChromeCdpReady as p, isTrustedProxyAddress as q, loadReadability as r, resolveExistingPathsWithinRoot as s, loadLinkedom as t, DEFAULT_FILL_FIELD_TYPE as u, resolveBrowserExecutableForPlatform as v, snapshotAria as w, createTargetViaCdp as x, resolveLsofCommandSync as y, DEFAULT_BROWSER_DEFAULT_PROFILE_NAME as z };

package/dist/plugin-sdk/{sandbox-paths-lj7_EVuA.js → sandbox-paths-w64tYl0v.js}

@@ -1,6 +1,6 @@
 import { w as resolvePreferredFasedAgentTmpDir } from "./globals-B_jjtAje.js";
 import { I as isPathInside } from "./agent-scope-BbgPlhtw.js";
-import { n as assertNoPathAliasEscape } from "./path-alias-guards-Dg3gU-MA.js";
+import { n as assertNoPathAliasEscape } from "./path-alias-guards-BJZD5JMJ.js";
 import path from "node:path";
 import os from "node:os";
 import { URL, fileURLToPath } from "node:url";

package/dist/plugin-sdk/sat-runtime.d.ts

@@ -1,6 +1,6 @@
-import { At as FasedAgentConfig, Bt as WalletRuntimeKind, Ht as WalletToolAccessMode, It as WalletAuthMode, Lt as WalletChain, Rt as WalletExecutionMode, Vt as WalletRuntimeMode, _n as GatewayClientName, gn as GatewayClientMode, s as loadConfig, zt as WalletProviderId } from "./types.plugin-CvUiB3Kh.js";
-import { A as createSubsystemLogger, V as resolveGatewayPort, g as ErrorShape, i as OperatorScope, n as AuthProfileStore, u as RespondFn } from "./types-BI2njxWJ.js";
-import { a as resolveAgentDir, i as resolveAgentConfig, n as fetchWithSsrFGuard$1, o as resolveAgentEffectiveModelPrimary, s as resolveDefaultAgentId, t as resolvePreferredFasedAgentTmpDir } from "./tmp-fased-dir-C_xfeEN9.js";
+import { At as FasedAgentConfig, Bt as WalletProviderId, Ht as WalletRuntimeMode, Lt as WalletAuthMode, Rt as WalletChain, Ut as WalletToolAccessMode, Vt as WalletRuntimeKind, _n as GatewayClientMode, s as loadConfig, vn as GatewayClientName, zt as WalletExecutionMode } from "./types.plugin-_fbu40Re.js";
+import { A as createSubsystemLogger, V as resolveGatewayPort, g as ErrorShape, i as OperatorScope, n as AuthProfileStore, u as RespondFn } from "./types-CLIvQaVg.js";
+import { a as resolveAgentDir, i as resolveAgentConfig, n as fetchWithSsrFGuard$1, o as resolveAgentEffectiveModelPrimary, s as resolveDefaultAgentId, t as resolvePreferredFasedAgentTmpDir } from "./tmp-fased-dir-BdFQvrvw.js";
 import { Api, Model } from "@mariozechner/pi-ai";
 import { AuthStorage, ModelRegistry } from "@mariozechner/pi-coding-agent";
 import * as _sinclair_typebox0 from "@sinclair/typebox";