@hwip/cli 0.0.1 → 0.1.1

package/dist/gate.js

@@ -0,0 +1,336 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.autoPushMode = exports.readPushMode = exports.NONREADONLY_COUNT_FLAG = exports.TOOL_COUNT_FLAG = exports.PUSHMODE_DEFAULT_FLAG = exports.PUSHMODE_DEFAULT = exports.isMuted = exports.clearRemoteActive = exports.touchRemoteActive = exports.isRemoteActive = exports.remoteStatePath = exports.REMOTE_TTL_SEC = exports.remoteDigest = exports.remoteMarkerPath = exports.projectHash = exports.posixCksum = exports.stateDir = exports.decidePush = exports.normalizePushMode = exports.normalizeMarker = exports.GATE_DEFAULTS = void 0;
+/**
+ * Push-gate decision — the portable half of the Hwip Stop-hook logic.
+ *
+ * `decidePush` is the TS twin of `plugin/hooks/gate.sh` (hwipit/plugin).
+ * Both implementations are locked to the same semantics by the shared
+ * vector file `src/fixtures/gate-vectors.json` (vendored from the plugin
+ * repo's canonical copy via `npm run sync:plugin`): the bash side and this
+ * side run the exact same cases in their CIs, so a semantic change to one
+ * that isn't mirrored in the other fails a build. Edit them together.
+ *
+ * Ordering is contractual (encoded as named vectors):
+ *   1. alreadyAsked wins over EVERYTHING — even loud (dedup beats the dial).
+ *   2. priority is high iff marker === 'high', decided BEFORE the mode
+ *      switch, so quiet+high and loud+high both push at high priority.
+ *   3. quiet → a high marker or an away user pushes; loud → always push; normal →
+ *      marker overrides the heuristic (skip → silent, push/high → push),
+ *      no marker → push iff toolCount ≥ 2 AND nonReadonlyCount > 0
+ *      (the B1 read-only floor).
+ */
+const crypto_1 = require("crypto");
+const fs_1 = require("fs");
+const os_1 = require("os");
+const path_1 = require("path");
+const private_files_js_1 = require("./private-files.js");
+/**
+ * "Assume real work" defaults for hooks that can't supply turn facts
+ * (most non-Claude agents pass no counts): in normal mode the push still
+ * fires — preserving the historical always-push behavior of the dumb
+ * hooks — while quiet/loud now work everywhere.
+ *
+ * These defaults cannot rescue a quiet dial: quiet only lets a `high` marker
+ * or an away user (presence.ts) through, and a hook with no turn facts has no
+ * marker either. That is why the installed templates pass `--pushmode-default
+ * normal` (see templates.ts) — for them quiet is not a lower volume, it is
+ * silence while the user is at the terminal.
+ */
+exports.GATE_DEFAULTS = {
+    toolCount: 2,
+    nonReadonlyCount: 1,
+    alreadyAsked: false,
+};
+const normalizeMarker = (raw) => raw === 'skip' || raw === 'push' || raw === 'high' ? raw : 'none';
+exports.normalizeMarker = normalizeMarker;
+const normalizePushMode = (raw) => raw === 'quiet' || raw === 'loud' ? raw : 'normal';
+exports.normalizePushMode = normalizePushMode;
+const decidePush = (input) => {
+    if (input.alreadyAsked)
+        return { push: false, priority: 'normal' };
+    const priority = input.marker === 'high' ? 'high' : 'normal';
+    if (input.pushMode === 'quiet')
+        return { push: input.marker === 'high' || input.away === true, priority };
+    if (input.pushMode === 'loud')
+        return { push: true, priority };
+    if (input.marker === 'skip')
+        return { push: false, priority };
+    if (input.marker === 'push' || input.marker === 'high')
+        return { push: true, priority };
+    return { push: input.toolCount >= 2 && input.nonReadonlyCount > 0, priority };
+};
+exports.decidePush = decidePush;
+// ── Per-project gate state (mute + push-mode dial) ───────────────
+//
+// State lives under ${XDG_STATE_HOME:-~/.local/state}/hwip — a per-user
+// directory. It used to live at predictable names in world-writable /tmp,
+// where any local user could pre-create a victim's mute file (and sticky
+// /tmp makes that file un-deletable by the victim). Legacy /tmp files are
+// still honored during the migration window, but only when owned by the
+// current user, which neutralizes planted files.
+//
+// The plugin's bash hooks key these files off `cksum` of the project dir
+// (`printf '%s' "$dir" | cksum`). `posixCksum` is that CRC computed in
+// process — a notify used to spawn `cksum` up to ~8 times — and the vector
+// test pins it to the real `cksum`, so every already-written file keeps its name.
+const stateDir = () => (0, path_1.join)(process.env.XDG_STATE_HOME || (0, path_1.join)((0, os_1.homedir)(), '.local', 'state'), 'hwip');
+exports.stateDir = stateDir;
+const ownedByCurrentUser = (path) => {
+    try {
+        const st = (0, fs_1.statSync)(path);
+        return typeof process.getuid !== 'function' || st.uid === process.getuid();
+    }
+    catch {
+        return false;
+    }
+};
+/**
+ * Resolve a state file: current location first, then user-owned legacy /tmp,
+ * then — for `pushmode` only — the machine-wide default written by
+ * `/hwip-mode quiet --global`. Mirrors plugin/hooks/gate.sh hwip_state_present,
+ * including the deliberate absence of a global mute (see the comment there).
+ */
+const findStateFile = (kind, hash) => {
+    const current = (0, path_1.join)((0, exports.stateDir)(), `${kind}-${hash}`);
+    if ((0, fs_1.existsSync)(current))
+        return current;
+    const legacy = `/tmp/hwip-${kind}-${hash}`;
+    if (ownedByCurrentUser(legacy))
+        return legacy;
+    if (kind !== 'pushmode')
+        return null;
+    const globalDefault = (0, path_1.join)((0, exports.stateDir)(), 'pushmode-default');
+    return (0, fs_1.existsSync)(globalDefault) ? globalDefault : null;
+};
+/** CRC table for POSIX `cksum`: polynomial 0x04C11DB7, most significant bit first. */
+const CKSUM_TABLE = (() => {
+    const table = new Uint32Array(256);
+    for (let i = 0; i < 256; i++) {
+        let c = i << 24;
+        for (let k = 0; k < 8; k++)
+            c = c & 0x80000000 ? (c << 1) ^ 0x04c11db7 : c << 1;
+        table[i] = c >>> 0;
+    }
+    return table;
+})();
+/**
+ * The first field of POSIX `cksum` over `data`: the CRC of the bytes, then of
+ * the length (low byte first, no trailing zero bytes), complemented.
+ */
+const posixCksum = (data) => {
+    let crc = 0;
+    const step = (byte) => {
+        crc = ((crc << 8) ^ CKSUM_TABLE[((crc >>> 24) ^ byte) & 0xff]) >>> 0;
+    };
+    for (const byte of data)
+        step(byte);
+    for (let n = data.length; n > 0; n = Math.floor(n / 256))
+        step(n & 0xff);
+    return ~crc >>> 0;
+};
+exports.posixCksum = posixCksum;
+/** `cksum` of the project dir as the plugin computes it. */
+const projectHash = (dir) => String((0, exports.posixCksum)(Buffer.from(dir, 'utf-8')));
+exports.projectHash = projectHash;
+// ── Remote-origin marker (ADR-0002) ──────────────────────────────
+//
+// The listener records every phone→pane text injection as a one-shot
+// marker file; a prompt-submit hook (Claude Code plugin's hwip-remote.sh,
+// or `hwip remote-hook` for Gemini/Codex) consumes it on an exact-text
+// match and flags the prompt as remote-originated. Writer and TS reader
+// share these two helpers so their bytes can never diverge; the bash
+// reader is held to the same semantics by the plugin's test suite.
+/** Marker path for a project hash: `<stateDir>/remote-<cksum(projectDir)>`. */
+const remoteMarkerPath = (hash) => (0, path_1.join)((0, exports.stateDir)(), `remote-${hash}`);
+exports.remoteMarkerPath = remoteMarkerPath;
+/**
+ * sha256 over the ASCII-only-trimmed text — recorded at inject time,
+ * recomputed at prompt submit. Trim strips ONLY ' \t\r\n\f\v', NOT
+ * String.trim(): trim() also eats Unicode whitespace (U+00A0 etc.) that
+ * the bash reader keeps, and both sides must hash identical bytes.
+ */
+const remoteDigest = (text) => (0, crypto_1.createHash)('sha256')
+    .update(text.replace(/^[ \t\r\n\f\v]+|[ \t\r\n\f\v]+$/g, ''))
+    .digest('hex');
+exports.remoteDigest = remoteDigest;
+// ── Sticky REMOTE state ──────────────────────────────────────────
+//
+// The marker above is a ONE-SHOT entry signal, consumed the moment a prompt
+// matches it. REMOTE outlives that turn — the user can answer from the phone
+// and then type at the terminal — so the mode itself lives in
+// `remote-active-<hash>`, holding the epoch second it was last confirmed.
+// Keeping it in a file is also what lets it survive context compaction.
+// Bash twin: plugin/hooks/gate.sh hwip_remote_active / hwip_remote_touch.
+//
+// Deliberately not routed through findStateFile. That helper also honors a
+// legacy /tmp copy so files written by older versions keep working; this kind
+// has never had a /tmp writer, so the branch could only ever match something
+// stale — and since the refresh always writes the XDG path, such a file would
+// never expire.
+/**
+ * How long REMOTE stays live without a refresh. Generous on purpose: the state
+ * is refreshed on every phone prompt and every answered `hwip_ask`, so it only
+ * has to outlive a working session, never an idle user. It is the backstop and
+ * not the usual exit — a terminal-typed prompt, a Done-like answer and the
+ * model's `<!-- hwip: exit -->` all delete the file outright. What none of them
+ * covers is a session that simply died: there is no SessionEnd hook, so without
+ * a TTL a crash or Ctrl-C would latch REMOTE forever.
+ */
+exports.REMOTE_TTL_SEC = 14400;
+/** State path for a project hash: `<stateDir>/remote-active-<cksum(dir)>`. */
+const remoteStatePath = (hash) => (0, path_1.join)((0, exports.stateDir)(), `remote-active-${hash}`);
+exports.remoteStatePath = remoteStatePath;
+/**
+ * True while REMOTE is live for this project. A time ahead of the clock counts
+ * as now (and is rewritten as now). State that is expired or
+ * unparseable is deleted on sight — the same housekeeping a stale entry
+ * marker gets, since state that can never flag again is dead weight.
+ */
+const isRemoteActive = (dir, now = Date.now) => {
+    const hash = (0, exports.projectHash)(dir);
+    const file = (0, exports.remoteStatePath)(hash);
+    let raw;
+    try {
+        // The first line, without the spaces around it: what `read -r ts` hands the bash twin.
+        raw = ((0, fs_1.readFileSync)(file, 'utf-8').split('\n')[0] ?? '').replace(/^[ \t]+|[ \t]+$/g, '');
+    }
+    catch {
+        return false;
+    }
+    // A plain number of at most 12 digits, matching the bash twin (`hwip_age_sec`): digits only
+    // (Number() alone reads '1e10' as ten billion, so a file bash would sweep would live on here as a
+    // far-future timestamp), and nothing longer is a time (year 33658). A leading 0 is decimal.
+    const ageSec = /^\d{1,12}$/.test(raw) ? Math.floor(now() / 1000) - Number(raw) : null;
+    const sweep = () => {
+        try {
+            (0, fs_1.unlinkSync)(file);
+        }
+        catch {
+            /* best-effort housekeeping */
+        }
+    };
+    if (ageSec === null || ageSec > exports.REMOTE_TTL_SEC) {
+        sweep();
+        return false;
+    }
+    if (ageSec < 0) {
+        // A time ahead of the clock (it was set back, or the file is damaged) reads as now, and now is written
+        // back: left alone the file would stay live until the clock caught up with it, however far ahead it is.
+        // If now cannot be written (a read-only state folder) nothing would ever end it: it is not REMOTE.
+        if (!writeRemoteNow(dir, now)) {
+            sweep();
+            return false;
+        }
+    }
+    return true;
+};
+exports.isRemoteActive = isRemoteActive;
+/**
+ * Enter REMOTE, or push its expiry back. Best-effort by contract: the prompt
+ * hooks that call this must never fail a prompt over state IO.
+ */
+const touchRemoteActive = (dir, now = Date.now) => {
+    writeRemoteNow(dir, now);
+};
+exports.touchRemoteActive = touchRemoteActive;
+/** The state file holds now; false when it could not be written. */
+const writeRemoteNow = (dir, now) => {
+    const hash = (0, exports.projectHash)(dir);
+    try {
+        (0, private_files_js_1.mkdirHandedBack)((0, exports.stateDir)());
+        // Before the write, so a file root makes is the sudo user's from the start (and the write follows it).
+        (0, private_files_js_1.createdHandedBack)((0, exports.remoteStatePath)(hash));
+        (0, fs_1.writeFileSync)((0, exports.remoteStatePath)(hash), `${Math.floor(now() / 1000)}\n`);
+        return true;
+    }
+    catch {
+        /* a hook must never fail on state IO */
+        return false;
+    }
+};
+/**
+ * Leave REMOTE. Best-effort like its twin: an absent file is success, and the
+ * caller is a hook with its own job to finish. Bash twin: gate.sh
+ * hwip_remote_clear.
+ */
+const clearRemoteActive = (dir) => {
+    const hash = (0, exports.projectHash)(dir);
+    try {
+        (0, fs_1.unlinkSync)((0, exports.remoteStatePath)(hash));
+    }
+    catch {
+        /* already gone, or unwritable — the prompt still goes through */
+    }
+};
+exports.clearRemoteActive = clearRemoteActive;
+/** True when the user ran /hwip-mode mute for this project. */
+const isMuted = (dir) => {
+    const hash = (0, exports.projectHash)(dir);
+    return findStateFile('muted', hash) !== null;
+};
+exports.isMuted = isMuted;
+/**
+ * Push mode for an install that has never set a dial. The twin is
+ * plugin/hooks/gate.sh's missing-5th-argument default; the shared vectors
+ * never reach either one (every vector passes pushMode explicitly), so both
+ * sides pin it in their own tests.
+ */
+exports.PUSHMODE_DEFAULT = 'quiet';
+/**
+ * `notify` flag naming the push mode to assume when the project has no dial.
+ * Written by templates.ts into every hook-driven agent's completion hook and
+ * read back in cli.ts — shared so the two can never drift apart.
+ */
+exports.PUSHMODE_DEFAULT_FLAG = 'pushmode-default';
+/**
+ * `notify` flags carrying the turn's tool counts. Only the drop-in artifacts
+ * (pi extension, opencode plugin) can supply them — they are the only installed
+ * hooks that see per-tool events. Shared for the same reason as the flag above:
+ * templates.ts writes them, cli.ts reads them, and a rename on one side alone
+ * would send `gateCount` back to GATE_DEFAULTS with nothing to show for it.
+ */
+exports.TOOL_COUNT_FLAG = 'tools';
+exports.NONREADONLY_COUNT_FLAG = 'nonreadonly';
+/**
+ * The user's session push-mode dial (/hwip-mode quiet | /hwip-mode loud | /hwip-mode normal).
+ *
+ * Three failure shapes, three answers — "no dial" is the only one that gets
+ * the quiet default:
+ *   - no dial file          → `fallback` (PUSHMODE_DEFAULT unless the caller
+ *                             overrides it with --pushmode-default)
+ *   - unusable dial file    → normal. An unreadable
+ *                             file, or a garbled/empty value is a broken
+ *                             setting, and resolving breakage to silence
+ *                             leaves the user with no symptom to debug. The
+ *                             point of the new default is quiet, not hidden
+ *                             errors.
+ *   - readable dial file    → whatever it says.
+ */
+const readPushMode = (dir, fallback = exports.PUSHMODE_DEFAULT) => {
+    const hash = (0, exports.projectHash)(dir);
+    const file = findStateFile('pushmode', hash);
+    if (!file)
+        return fallback;
+    try {
+        return (0, exports.normalizePushMode)((0, fs_1.readFileSync)(file, 'utf-8').replace(/\s+/g, ''));
+    }
+    catch {
+        return 'normal';
+    }
+};
+exports.readPushMode = readPushMode;
+/**
+ * Push mode for a `--auto` notify: the user's dial if they set one, otherwise
+ * the mode named by `--pushmode-default`, otherwise the built-in quiet.
+ *
+ * The dial outranks the flag deliberately. The flag exists so an agent whose
+ * hook cannot participate in the heuristic still pushes out of the box; if it
+ * outranked the dial, `/hwip-mode quiet` would silently do nothing for that agent.
+ *
+ * A flag value that isn't one of the three modes resolves to `normal`, not to
+ * the quiet default — same rule as a garbled dial file. A caller that passes
+ * nonsense has a bug, and answering a bug with silence hides it.
+ */
+const autoPushMode = (dir, flag) => (0, exports.readPushMode)(dir, typeof flag === 'string' ? (0, exports.normalizePushMode)(flag) : exports.PUSHMODE_DEFAULT);
+exports.autoPushMode = autoPushMode;

package/dist/gemini-transcript.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Gemini CLI's transcript format, projected into the events the timeline draws.
+ *
+ * Gemini's vocabulary belongs to this file alone — the formats share none, so
+ * nothing here is borrowed from the Claude, pi or Codex projectors beyond the
+ * `transcript-tail` helpers that are about `TurnEvent` itself.
+ *
+ * Shape measured 2026-10-08 against `~/.gemini/tmp/<project>/chats/session-*.jsonl`
+ * (8 sessions, structure only — no conversation text was opened) and the writer
+ * that produces it: `@google/gemini-cli` 0.46.0, `bundle/chunk-6ZHP2EJW.js`
+ * (line types at 281975-281983, `pushMessage`/`$set` handling at 282072-282074,
+ * append at 282289-282291). The version that wrote each of the 8 files is not
+ * knowable; 0.46.0's reader and writer agree on the shape below.
+ *
+ * Three kinds of line, one per `JSON.parse`:
+ *
+ *  - a header `{sessionId, projectHash, startTime, …}` — no `id`;
+ *  - `{ $set: {…} }` — a patch to the session record;
+ *  - a message `{id, timestamp, type, content, …}`.
+ *
+ * The writer also emits `{ $rewindTo: id }` (282532) when the user rewinds. It
+ * has no `id`, so it is skipped with the header, and the messages it rewinds
+ * past still project: the timeline records what was said, not what the session
+ * later forgot.
+ *
+ * Nothing here refuses to read another version: an unknown record type is
+ * named through `onUnknown` and skipped, so the timeline is thinner by one row
+ * rather than stopped.
+ */
+import { type TranscriptProjector } from './transcript-tail.js';
+export declare const projectGeminiEntries: TranscriptProjector;
+//# sourceMappingURL=gemini-transcript.d.ts.map

package/dist/gemini-transcript.js

@@ -0,0 +1,189 @@
+"use strict";
+/**
+ * Gemini CLI's transcript format, projected into the events the timeline draws.
+ *
+ * Gemini's vocabulary belongs to this file alone — the formats share none, so
+ * nothing here is borrowed from the Claude, pi or Codex projectors beyond the
+ * `transcript-tail` helpers that are about `TurnEvent` itself.
+ *
+ * Shape measured 2026-10-08 against `~/.gemini/tmp/<project>/chats/session-*.jsonl`
+ * (8 sessions, structure only — no conversation text was opened) and the writer
+ * that produces it: `@google/gemini-cli` 0.46.0, `bundle/chunk-6ZHP2EJW.js`
+ * (line types at 281975-281983, `pushMessage`/`$set` handling at 282072-282074,
+ * append at 282289-282291). The version that wrote each of the 8 files is not
+ * knowable; 0.46.0's reader and writer agree on the shape below.
+ *
+ * Three kinds of line, one per `JSON.parse`:
+ *
+ *  - a header `{sessionId, projectHash, startTime, …}` — no `id`;
+ *  - `{ $set: {…} }` — a patch to the session record;
+ *  - a message `{id, timestamp, type, content, …}`.
+ *
+ * The writer also emits `{ $rewindTo: id }` (282532) when the user rewinds. It
+ * has no `id`, so it is skipped with the header, and the messages it rewinds
+ * past still project: the timeline records what was said, not what the session
+ * later forgot.
+ *
+ * Nothing here refuses to read another version: an unknown record type is
+ * named through `onUnknown` and skipped, so the timeline is thinner by one row
+ * rather than stopped.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.projectGeminiEntries = void 0;
+const transcript_tail_js_1 = require("./transcript-tail.js");
+/**
+ * Which tool argument reads as "what this call is about", first match wins.
+ *
+ * The names are Gemini's built-in tool parameters, read out of the bundle
+ * (`PARAM_*` constants, 276613-276684) rather than guessed. `description` and
+ * `title` lead because they are the sentence the model wrote for a person
+ * (`run_shell_command` carries one); the rest are the target of the file and
+ * search tools, in the order of how directly they name a thing.
+ *
+ * `command` is absent for the reason it is absent from every other list — a
+ * command line is the argument most likely to carry a secret. `prompt`
+ * (`web_fetch`, which embeds URLs) and `instruction` (`replace`) are absent for
+ * the same reason of not knowing what a person pasted into them.
+ */
+const GEMINI_TARGET_KEYS = ['description', 'title', 'file_path', 'dir_path', 'path', 'pattern', 'query', 'name'];
+/** Text out of a message's `content`: a string, or parts of which only `text` is prose. */
+const textOf = (content) => {
+    if (typeof content === 'string')
+        return content;
+    if (!Array.isArray(content))
+        return '';
+    let text = '';
+    for (const part of content) {
+        if (part && typeof part === 'object' && typeof part.text === 'string') {
+            text += part.text;
+        }
+    }
+    return text;
+};
+/**
+ * What the person typed, out of a `user` message.
+ *
+ * `content` is what went to the model, and for a prompt with `@path` references
+ * that includes the referenced files' bodies after a
+ * `--- Content from referenced files ---` line (`REFERENCE_CONTENT_START`,
+ * `bundle:250454`). The message may also carry `displayContent`, the version the
+ * UI shows (`bundle:330220-330232`: recorded only when it differs from
+ * `content`). Either way the file bodies must not reach the phone as a prompt:
+ * prefer `displayContent`, and cut `content` at the marker when it is all there
+ * is. Read from the vendor source; no message on this machine carried either.
+ */
+const REFERENCE_CONTENT_MARKER = '--- Content from referenced files ---';
+const typedText = (entry) => {
+    const shown = textOf(entry.displayContent);
+    const text = shown.trim() ? shown : textOf(entry.content);
+    const cut = text.indexOf(REFERENCE_CONTENT_MARKER);
+    return cut === -1 ? text : text.slice(0, cut);
+};
+/** `toolCalls[].status` values that mean the call is over; the rest are still in flight. */
+const SETTLED = new Set(['success', 'error', 'cancelled']);
+const projectGeminiEntries = (lines, opts = {}) => {
+    const events = [];
+    for (const raw of lines) {
+        let entry;
+        try {
+            const parsed = JSON.parse(raw);
+            if (!parsed || typeof parsed !== 'object')
+                continue;
+            entry = parsed;
+        }
+        catch {
+            continue;
+        }
+        // `$set.messages` replaces the whole message list, so reading it would
+        // repeat everything already written above it; and the one a session
+        // opens with is the context Gemini injects, not anything a person said.
+        // The other keys (`lastUpdated`, `summary`, …) are bookkeeping.
+        if ('$set' in entry)
+            continue;
+        // The header is the only line without an `id`.
+        if (typeof entry.id !== 'string')
+            continue;
+        const at = typeof entry.timestamp === 'string' ? entry.timestamp : undefined;
+        const stamp = at ? { at } : {};
+        if (entry.type === 'user') {
+            // A `user` message is either typed text or the answers to tool
+            // calls (`functionResponse` parts, no `text`) — the latter joins to
+            // nothing and is skipped. No wrapper filter on the text: of the
+            // typed messages measured, none opened with `<`, and a guess at an
+            // injection wrapper nobody has seen deletes real sentences.
+            const text = typedText(entry).trim();
+            if (text)
+                events.push({ kind: 'prompt', text: (0, transcript_tail_js_1.clamp)(text, transcript_tail_js_1.MAX_EVENT_TEXT_CHARS), ...stamp });
+            continue;
+        }
+        if (entry.type === 'info' || entry.type === 'error')
+            continue;
+        if (entry.type !== 'gemini') {
+            opts.onUnknown?.(`gemini record type ${typeof entry.type === 'string' ? entry.type : '(none)'}`);
+            continue;
+        }
+        const tokens = entry.tokens;
+        if (tokens && typeof tokens === 'object') {
+            const t = tokens;
+            const thinking = Array.isArray(entry.thoughts) ? entry.thoughts.length : 0;
+            events.push({
+                kind: 'msg',
+                mid: (0, transcript_tail_js_1.clamp)(entry.id),
+                ...(typeof entry.model === 'string' ? { model: (0, transcript_tail_js_1.clamp)(entry.model) } : {}),
+                out: (0, transcript_tail_js_1.finiteNumber)(t.output),
+                // `input` is the prompt token count and already includes the
+                // cached share (measured: cached <= input in 9 of 9), so adding
+                // `cached` would count it twice.
+                ctx: (0, transcript_tail_js_1.finiteNumber)(t.input),
+                ...(thinking ? { thinking } : {}),
+                ...stamp,
+            });
+        }
+        // Gemini rewrites a whole message as a new line whenever it changes, so
+        // a reply that called tools is on disk twice: first with its `content`,
+        // then again with the same `content` and `toolCalls`. The prose already
+        // went out with the first line, so a line with `toolCalls` sends none.
+        // That loses text only for a reply first written together with its
+        // `toolCalls`, which the writer does not do: a message it creates for a
+        // tool call starts with `content: ""` (`recordToolCalls`, 282401-282451).
+        // The opposite miss is accepted: `recordMessageTokens` (282374) rewrites
+        // a reply once its `tokens` arrive late, and that second line repeats
+        // the same text (measured 0 of 12) — a doubled row beats a lost one.
+        const toolCalls = Array.isArray(entry.toolCalls) ? entry.toolCalls : undefined;
+        if (!toolCalls) {
+            const text = textOf(entry.content);
+            if (text.trim())
+                events.push({ kind: 'text', text: (0, transcript_tail_js_1.clamp)(text, transcript_tail_js_1.MAX_EVENT_TEXT_CHARS), ...stamp });
+            continue;
+        }
+        for (const item of toolCalls) {
+            if (!item || typeof item !== 'object')
+                continue;
+            const call = item;
+            if (typeof call.id !== 'string' || typeof call.name !== 'string')
+                continue;
+            const target = (0, transcript_tail_js_1.oneLine)((0, transcript_tail_js_1.targetFrom)(call.args, GEMINI_TARGET_KEYS));
+            events.push({
+                kind: 'tool',
+                id: (0, transcript_tail_js_1.clamp)(call.id),
+                name: (0, transcript_tail_js_1.clamp)(call.name),
+                ...(target ? { target } : {}),
+                ...stamp,
+            });
+            // Settled calls carry their outcome on the same line as the call.
+            // Only the line count of the display text leaves, never the text.
+            if (typeof call.status === 'string' && SETTLED.has(call.status)) {
+                const resultLines = typeof call.resultDisplay === 'string' ? (0, transcript_tail_js_1.resultLinesOf)(call.resultDisplay) : 0;
+                events.push({
+                    kind: 'tool_result',
+                    id: (0, transcript_tail_js_1.clamp)(call.id),
+                    ok: call.status === 'success',
+                    ...(resultLines ? { lines: resultLines } : {}),
+                    ...stamp,
+                });
+            }
+        }
+    }
+    return (0, transcript_tail_js_1.sliceSinceLastPrompt)(events, opts);
+};
+exports.projectGeminiEntries = projectGeminiEntries;

package/dist/http-failure.d.ts

@@ -0,0 +1,98 @@
+import type http from 'node:http';
+/**
+ * Did `fetch` reject because the answer was a redirect (every call that carries
+ * the API key passes `redirect: 'error'`)? The reason sits in the error's cause
+ * chain, one or two levels down depending on who wrapped it.
+ */
+export declare const isRedirectRefusal: (err: unknown) => boolean;
+/**
+ * Did `fetch` reject before the request could be sent? Any other rejection — a socket reset, a body
+ * that stops halfway — is also a `TypeError`, and may be of a request the server took. The code sits
+ * in the cause chain, as for a refused redirect. The shapes are Node 24.21's (undici 7.29), read
+ * 2026-10-14: `{ code, syscall }` on the cause, and an `AggregateError` of them for a host with two addresses.
+ */
+export declare const neverConnected: (err: unknown) => boolean;
+/** Did `fetch` reject because the address is not one? It will say so again however often it is asked. */
+export declare const isInvalidUrl: (err: unknown) => boolean;
+/**
+ * Is this failure a permanent configuration problem (bad base URL, unsendable API key) rather than a
+ * network blip? Such errors say so in fixed words — `apiFetch` throws them before any `fetch`, and
+ * `resolveBaseUrl` throws them before any request — so swallowing them as "could not fetch" or
+ * retrying them with backoff only repeats them. Matched by message, as the throwers sanitize it — so
+ * never on an error that carries an HTTP status (`HttpError`, a `HwipError` from a reply): its message
+ * is the server's own text, and a 5xx that happens to say "is unknown" is still worth another try.
+ */
+export declare const isConfigFailure: (err: unknown) => boolean;
+/**
+ * Did `fetch` reject for a header value it cannot send? It does so before it opens a connection, and the
+ * same way however often it is asked. Two shapes (Node 24.21, read 2026-10-14 — held to a real `fetch`
+ * in http-failure.test.ts): a `TypeError` with no cause that says which value — whole for a line break
+ * or a NUL, by place for a character past U+00FF — and, for any other control character, undici's
+ * `UND_ERR_INVALID_ARG` ("invalid X-API-Key header") under "fetch failed". Looked for down the cause
+ * chain, as the callers hand on what `fetch` threw inside an error in their own words.
+ */
+export declare const isUnsendableHeader: (err: unknown) => boolean;
+/** "could not reach api.hwip.app (ENOTFOUND)" from a rejected `fetch`. */
+export declare const networkFailureMessage: (err: unknown, url: string) => string;
+/** The body as JSON when it is JSON, else null. A read that fails (an abort
+ *  mid-body) still throws: that is a timeout or a dropped connection, not a
+ *  page that is not ours. */
+export declare const readJsonBody: (response: Response) => Promise<unknown>;
+export declare const httpFailureMessage: (status: number, body: unknown) => string;
+/** What to do about a rejected key, appended to its message. */
+export declare const AUTH_HINT = "run `hwip login`, or check --key / HWIP_API_KEY";
+/**
+ * The proxy variables, read the way undici's `EnvHttpProxyAgent` reads them
+ * (6.29): lower case before upper case, an https target falls back to the http
+ * proxy, and `NO_PROXY` is a list of hosts, `.suffix`es and `host:port`s. The
+ * listener's socket is not `fetch` and never reaches its dispatcher, so it asks
+ * the same question here and the two cannot disagree about what goes direct.
+ */
+export interface ProxyEnv {
+    http_proxy?: string;
+    HTTP_PROXY?: string;
+    https_proxy?: string;
+    HTTPS_PROXY?: string;
+    no_proxy?: string;
+    NO_PROXY?: string;
+}
+/** The proxy a request to `rawUrl` goes through, or null for a direct connection. `ws` / `wss` follow `http` / `https`. */
+export declare const proxyForUrl: (rawUrl: string, env?: ProxyEnv) => string | null;
+/** The proxy settings `~/.hwip/config.json` can hold: what a launchd service, which never sees the shell's variables, reads instead. */
+export interface ProxyConfig {
+    httpProxy?: unknown;
+    httpsProxy?: unknown;
+    noProxy?: unknown;
+}
+/**
+ * Route `fetch` and the listener's socket through HTTPS_PROXY / HTTP_PROXY,
+ * honouring NO_PROXY, when the variables are set; a no-op otherwise.
+ *
+ * `config` (`httpProxy`, `httpsProxy`, `noProxy` of ~/.hwip/config.json) fills
+ * in what the environment leaves unset, one setting at a time: a launchd
+ * service starts with its own environment and the plist must not hold a proxy
+ * password, so the file is where it finds them. The environment wins when it
+ * sets a name at all, empty included.
+ *
+ * Not through Node's own `http.setGlobalProxyFromEnv`: it exists only from 24.14
+ * and 25.4, and the CLI runs on older Nodes. `fetch` gets undici's
+ * `EnvHttpProxyAgent` as the global dispatcher (undici 6, Node >= 18.17); `ws`
+ * opens its own connection, so it gets a CONNECT-tunnelling agent from
+ * `https-proxy-agent` (`webSocketProxyOptions`). Both libraries load only here,
+ * so a run with no proxy pays nothing for them.
+ *
+ * A proxy that cannot be set up is an error, not a direct connection: going
+ * around a proxy someone configured is the wrong way to fail. The error names
+ * the setting and never quotes it: the value may carry the proxy's password.
+ */
+export declare const useProxyFromEnv: (env?: ProxyEnv, config?: ProxyConfig) => Promise<void>;
+/**
+ * Options for the listener's `new WebSocket`: `ws` opens its own connection
+ * and never reaches fetch's dispatcher, so with a proxy set it is handed an
+ * agent that tunnels through it (CONNECT, for `ws:` as well as `wss:`) — unless
+ * NO_PROXY says that host goes direct.
+ */
+export declare const webSocketProxyOptions: (url: string) => {
+    agent?: http.Agent;
+};
+//# sourceMappingURL=http-failure.d.ts.map