@infomity/remogent 0.0.0-stage → 0.2.1

package/dist/adapters/gemini.js

@@ -0,0 +1,287 @@
+import { homedir } from "node:os";
+import { RpcError, RpcPeer } from "./rpc.js";
+import { findOnPath, killTree, spawnCli } from "./util.js";
+const isObj = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+const str = (v) => (typeof v === "string" && v.length > 0 ? v : undefined);
+/** Cap on tool output stored in a transcript event. */
+const MAX_OUTPUT = 64 * 1024;
+// ---- ACP -> Remogent mapping ----
+/** ACP ToolKind -> protocol risk. */
+function riskOf(kind) {
+    switch (kind) {
+        case "read":
+        case "search":
+            return "read";
+        case "edit":
+        case "delete":
+        case "move":
+            return "edit";
+        case "execute":
+            return "shell";
+        case "fetch":
+            return "network";
+        default:
+            return "other";
+    }
+}
+/** Not a strict unified diff (no hunks); old lines prefixed "-", new lines "+". Enough for a phone review sheet. */
+function simpleDiff(path, oldText, newText) {
+    const lines = (v, p) => (typeof v === "string" && v ? v.split("\n").map((l) => p + l) : []);
+    return [`--- ${path}`, `+++ ${path}`, ...lines(oldText, "-"), ...lines(newText, "+")].join("\n");
+}
+function extractContent(content) {
+    if (!Array.isArray(content))
+        return {};
+    const texts = [];
+    const diffs = [];
+    for (const c of content) {
+        if (!isObj(c))
+            continue;
+        if (c["type"] === "content" && isObj(c["content"]) && c["content"]["type"] === "text") {
+            const t = str(c["content"]["text"]);
+            if (t)
+                texts.push(t);
+        }
+        else if (c["type"] === "diff" && typeof c["path"] === "string") {
+            diffs.push(simpleDiff(c["path"], c["oldText"], c["newText"]));
+        }
+    }
+    return {
+        ...(texts.length ? { output: texts.join("\n").slice(0, MAX_OUTPUT) } : {}),
+        ...(diffs.length ? { diff: diffs.join("\n\n").slice(0, MAX_OUTPUT) } : {}),
+    };
+}
+function textOf(update) {
+    const c = update["content"];
+    return isObj(c) && c["type"] === "text" ? str(c["text"]) : undefined;
+}
+function toEvent(update) {
+    switch (update["sessionUpdate"]) {
+        case "agent_message_chunk": {
+            const text = textOf(update);
+            // Gemini echoes mode changes as message text ("[MODE_UPDATE] yolo"); that is CLI noise, not agent output.
+            return text && !/^\[MODE_UPDATE\]/.test(text) ? { kind: "agent_text_delta", text } : undefined;
+        }
+        case "agent_thought_chunk": {
+            const text = textOf(update);
+            return text ? { kind: "agent_thought_delta", text } : undefined;
+        }
+        case "tool_call": {
+            const toolCallId = str(update["toolCallId"]);
+            if (!toolCallId)
+                return undefined;
+            const title = str(update["title"]);
+            const kind = str(update["kind"]);
+            return {
+                kind: "tool_call",
+                toolCallId,
+                name: kind ?? title ?? "tool",
+                ...(title ? { title } : {}),
+                risk: riskOf(kind),
+                input: update["rawInput"] ?? {},
+            };
+        }
+        case "tool_call_update": {
+            const toolCallId = str(update["toolCallId"]);
+            if (!toolCallId)
+                return undefined;
+            const s = str(update["status"]);
+            const status = s === "completed" ? "completed" : s === "failed" ? "failed" : "running";
+            return { kind: "tool_call_update", toolCallId, status, ...extractContent(update["content"]) };
+        }
+        default:
+            return undefined; // plan, available_commands_update, current_mode_update, user_message_chunk (history on load)
+    }
+}
+const MODE_IDS = { ask: "default", plan: "plan", auto_edit: "autoEdit", auto: "yolo" };
+/** Path of the `gemini` executable if it is installed on this host. */
+export function findGemini() {
+    return findOnPath("gemini");
+}
+function lastLine(s) {
+    const lines = s.trim().split(/\r?\n/);
+    return lines[lines.length - 1] ?? "";
+}
+/**
+ * Reads `models` from a `session/new` result: `{ availableModels: [{ modelId, name, description? }], currentModelId }`
+ * (verified on Gemini CLI 0.68.0). The model the CLI starts with (`currentModelId`, usually `auto`) is marked as default.
+ */
+function parseGeminiModels(res) {
+    const block = isObj(res) && isObj(res["models"]) ? res["models"] : undefined;
+    if (!block || !Array.isArray(block["availableModels"]))
+        return [];
+    const current = str(block["currentModelId"]);
+    return block["availableModels"].filter(isObj).flatMap((x) => {
+        const id = str(x["modelId"]);
+        if (!id)
+            return [];
+        const description = str(x["description"]);
+        return [{ id, name: str(x["name"]) ?? id, ...(description ? { description } : {}), ...(id === current ? { isDefault: true } : {}) }];
+    });
+}
+/** Asks a short-lived `gemini --acp` process for its model list (initialize + session/new; no model call is made). */
+async function queryGeminiModels(binary) {
+    const child = spawnCli(binary, ["--acp"], homedir());
+    const rpc = new RpcPeer(child);
+    let stderrTail = "";
+    child.stderr.on("data", (d) => {
+        stderrTail = (stderrTail + d.toString()).slice(-2000);
+    });
+    child.on("error", (e) => rpc.failAll(new Error(`gemini failed to start: ${e.message}`)));
+    child.on("exit", (code) => rpc.failAll(new Error(stderrTail ? `gemini exited (code ${code}): ${lastLine(stderrTail)}` : `gemini exited (code ${code})`)));
+    let timer;
+    try {
+        const work = (async () => {
+            await rpc.request("initialize", { protocolVersion: 1, clientCapabilities: { fs: { readTextFile: false, writeTextFile: false } } });
+            return parseGeminiModels(await rpc.request("session/new", { cwd: homedir(), mcpServers: [] }));
+        })();
+        const timeout = new Promise((_, reject) => {
+            timer = setTimeout(() => reject(new Error("gemini did not answer in time")), 20_000);
+        });
+        return await Promise.race([work, timeout]);
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+        killTree(child);
+    }
+}
+export function createGeminiAdapter(binary) {
+    return {
+        engine: "gemini",
+        listModels: () => queryGeminiModels(binary),
+        async start({ cwd, permissionMode, model }, sink) {
+            const child = spawnCli(binary, ["--acp"], cwd);
+            const rpc = new RpcPeer(child);
+            let closed = false; // set once the session is intentionally closed or has died
+            let inTurn = false; // a prompt request is in flight (its rejection reports process death)
+            let stderrTail = "";
+            let sessionId;
+            child.stderr.on("data", (d) => {
+                stderrTail = (stderrTail + d.toString()).slice(-2000); // kept only for exit diagnostics; never logged
+            });
+            const died = (why) => {
+                const err = new Error(stderrTail ? `${why}: ${lastLine(stderrTail)}` : why);
+                rpc.failAll(err);
+                if (closed)
+                    return;
+                closed = true;
+                if (!inTurn)
+                    sink.emit({ kind: "error", message: err.message });
+                sink.emit({ kind: "status", status: "error" });
+            };
+            child.on("exit", (code) => died(`gemini exited (code ${code})`));
+            child.on("error", (e) => died(`gemini failed to start: ${e.message}`));
+            rpc.onNotification = (method, params) => {
+                if (method !== "session/update" || !isObj(params) || !isObj(params["update"]))
+                    return;
+                if (sessionId && params["sessionId"] !== sessionId)
+                    return;
+                const ev = toEvent(params["update"]);
+                if (ev)
+                    sink.emit(ev);
+            };
+            rpc.onRequest = async (method, params) => {
+                if (method !== "session/request_permission" || !isObj(params)) {
+                    throw new RpcError(-32601, `unsupported method: ${method}`);
+                }
+                const tc = isObj(params["toolCall"]) ? params["toolCall"] : {};
+                const options = Array.isArray(params["options"]) ? params["options"].filter(isObj) : [];
+                const kind = str(tc["kind"]);
+                const title = str(tc["title"]);
+                const toolCallId = str(tc["toolCallId"]);
+                const { diff } = extractContent(tc["content"]);
+                // `tool` is the ACP kind (not the title) so a host-side allow_session covers the tool class, not one exact command.
+                const decision = await sink.requestPermission({
+                    ...(toolCallId ? { toolCallId } : {}),
+                    tool: kind ?? "tool",
+                    risk: riskOf(kind),
+                    summary: title ?? kind ?? "tool call",
+                    input: tc["rawInput"] ?? {},
+                    ...(diff ? { diff } : {}),
+                });
+                const pick = (...kinds) => {
+                    for (const k of kinds) {
+                        const o = options.find((x) => x["kind"] === k);
+                        if (o && typeof o["optionId"] === "string")
+                            return o["optionId"];
+                    }
+                    return undefined;
+                };
+                // allow_session is tracked by the host; toward Gemini it is a plain one-time allow, so Gemini never
+                // persists an "always" trust rule on disk.
+                const optionId = decision === "deny" ? pick("reject_once", "reject_always") : pick("allow_once", "allow_always");
+                return { outcome: optionId ? { outcome: "selected", optionId } : { outcome: "cancelled" } };
+            };
+            try {
+                await rpc.request("initialize", {
+                    protocolVersion: 1,
+                    clientCapabilities: { fs: { readTextFile: false, writeTextFile: false } },
+                });
+                const res = await rpc.request("session/new", { cwd, mcpServers: [] });
+                sessionId = isObj(res) ? str(res["sessionId"]) : undefined;
+                if (!sessionId)
+                    throw new Error("gemini did not return a sessionId");
+                // set_model accepts any id without complaint (host validated it against the listed models); skip it when the
+                // CLI already runs that model.
+                const startModel = isObj(res) && isObj(res["models"]) ? str(res["models"]["currentModelId"]) : undefined;
+                if (model && model !== startModel)
+                    await rpc.request("session/set_model", { sessionId, modelId: model });
+                if (permissionMode !== "ask") {
+                    await rpc.request("session/set_mode", { sessionId, modeId: MODE_IDS[permissionMode] });
+                }
+            }
+            catch (e) {
+                closed = true;
+                killTree(child);
+                const msg = e instanceof Error ? e.message : String(e);
+                throw new Error(/auth/i.test(msg) ? `${msg} (run \`gemini\` once on the host to sign in)` : msg);
+            }
+            const sid = sessionId;
+            return {
+                async prompt(text) {
+                    if (closed)
+                        throw new Error("gemini process is not running");
+                    inTurn = true;
+                    try {
+                        const res = await rpc.request("session/prompt", { sessionId: sid, prompt: [{ type: "text", text }] });
+                        const stop = isObj(res) ? str(res["stopReason"]) : undefined;
+                        const usage = isObj(res) ? res["_meta"] : undefined;
+                        if (stop === "refusal")
+                            sink.emit({ kind: "error", message: "the model refused this request" });
+                        sink.emit({
+                            kind: "turn_end",
+                            stopReason: stop === "cancelled"
+                                ? "cancelled"
+                                : stop === "max_tokens" || stop === "max_turn_requests"
+                                    ? "max_budget"
+                                    : stop === "refusal"
+                                        ? "error"
+                                        : "end_turn",
+                            ...(usage !== undefined ? { usage } : {}),
+                        });
+                    }
+                    finally {
+                        inTurn = false;
+                    }
+                },
+                cancel() {
+                    if (!closed)
+                        rpc.notify("session/cancel", { sessionId: sid });
+                },
+                async setModel(next) {
+                    if (closed)
+                        throw new Error("gemini process is not running");
+                    if (inTurn)
+                        throw new Error("a turn is already running");
+                    await rpc.request("session/set_model", { sessionId: sid, modelId: next });
+                },
+                close() {
+                    closed = true;
+                    killTree(child);
+                },
+            };
+        },
+    };
+}
+//# sourceMappingURL=gemini.js.map

package/dist/adapters/rpc.js

@@ -0,0 +1,83 @@
+import { createInterface } from "node:readline";
+const isObj = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+export class RpcError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+    }
+}
+export class RpcPeer {
+    child;
+    nextId = 1;
+    pending = new Map();
+    versionField;
+    onNotification = () => { };
+    onRequest = async (m) => {
+        throw new RpcError(-32601, `method not found: ${m}`);
+    };
+    constructor(child, opts = {}) {
+        this.child = child;
+        this.versionField = opts.jsonrpcField ?? true;
+        child.stdin.on("error", () => { });
+        createInterface({ input: child.stdout }).on("line", (line) => this.handleLine(line));
+    }
+    request(method, params) {
+        const id = this.nextId++;
+        return new Promise((resolve, reject) => {
+            this.pending.set(id, { resolve, reject });
+            this.write({ id, method, params });
+        });
+    }
+    notify(method, params) {
+        this.write(params === undefined ? { method } : { method, params });
+    }
+    failAll(err) {
+        for (const p of this.pending.values())
+            p.reject(err);
+        this.pending.clear();
+    }
+    write(msg) {
+        if (this.child.stdin.writable)
+            this.child.stdin.write(JSON.stringify(this.versionField ? { jsonrpc: "2.0", ...msg } : msg) + "\n");
+    }
+    handleLine(line) {
+        const t = line.trim();
+        if (!t.startsWith("{"))
+            return; // ignore any non-JSON noise on stdout
+        let m;
+        try {
+            m = JSON.parse(t);
+        }
+        catch {
+            return;
+        }
+        if (!isObj(m))
+            return;
+        const id = m["id"];
+        const method = m["method"];
+        if (typeof method === "string") {
+            if (id === undefined || id === null) {
+                this.onNotification(method, m["params"]);
+                return;
+            }
+            this.onRequest(method, m["params"]).then((result) => this.write({ id, result }), (e) => this.write({
+                id,
+                error: { code: e instanceof RpcError ? e.code : -32603, message: e instanceof Error ? e.message : String(e) },
+            }));
+            return;
+        }
+        if (typeof id === "number") {
+            const p = this.pending.get(id);
+            if (!p)
+                return;
+            this.pending.delete(id);
+            const err = m["error"];
+            if (isObj(err))
+                p.reject(new RpcError(Number(err["code"] ?? -32603), String(err["message"] ?? "rpc error")));
+            else
+                p.resolve(m["result"]);
+        }
+    }
+}
+//# sourceMappingURL=rpc.js.map

package/dist/adapters/util.js

@@ -0,0 +1,90 @@
+import { execFile, execSync, spawn } from "node:child_process";
+import { existsSync, readdirSync } from "node:fs";
+import { homedir } from "node:os";
+import { delimiter, dirname, join } from "node:path";
+let npmPrefixBin;
+/** `npm prefix -g` (+ /bin on POSIX): where `npm i -g` puts shims when the prefix was customised. Asked once, best effort. */
+function npmGlobalBin() {
+    if (npmPrefixBin === undefined) {
+        try {
+            const win = process.platform === "win32";
+            const out = execSync("npm prefix -g", { encoding: "utf8", timeout: 5000, windowsHide: true, stdio: ["ignore", "pipe", "ignore"] }).trim();
+            npmPrefixBin = out ? (win ? out : join(out, "bin")) : null;
+        }
+        catch {
+            npmPrefixBin = null;
+        }
+    }
+    return npmPrefixBin ?? undefined;
+}
+/**
+ * Directories where the engine CLIs usually live but a background service (Task Scheduler, launchd, systemd --user)
+ * often does not have on PATH: native installer, npm -g, Volta, pnpm, Bun, nvm, Homebrew, scoop.
+ */
+export function extraSearchDirs() {
+    const win = process.platform === "win32";
+    const home = homedir();
+    const env = process.env;
+    const dirs = [dirname(process.execPath), join(home, ".local", "bin"), join(home, ".claude", "local")];
+    if (win) {
+        dirs.push(env["APPDATA"] && join(env["APPDATA"], "npm"), env["LOCALAPPDATA"] && join(env["LOCALAPPDATA"], "pnpm"), env["LOCALAPPDATA"] && join(env["LOCALAPPDATA"], "Volta", "bin"), env["NVM_SYMLINK"], env["ProgramFiles"] && join(env["ProgramFiles"], "nodejs"), join(home, "scoop", "shims"), join(home, ".bun", "bin"));
+    }
+    else {
+        dirs.push(join(home, ".npm-global", "bin"), join(home, ".volta", "bin"), join(home, ".bun", "bin"), join(home, ".local", "share", "pnpm"), "/opt/homebrew/bin", "/usr/local/bin", "/usr/bin");
+        const nvm = join(env["NVM_DIR"] ?? join(home, ".nvm"), "versions", "node");
+        try {
+            // Newest node version first, so the CLI installed under the active-most version wins.
+            for (const v of readdirSync(nvm).sort().reverse())
+                dirs.push(join(nvm, v, "bin"));
+        }
+        catch {
+            /* no nvm */
+        }
+    }
+    dirs.push(npmGlobalBin());
+    return [...new Set(dirs.filter((d) => !!d))];
+}
+/** Resolve an executable on PATH first, then in the usual install locations (honours PATHEXT on Windows). */
+export function findOnPath(name) {
+    const win = process.platform === "win32";
+    const exts = win ? (process.env["PATHEXT"] ?? ".EXE;.CMD;.BAT").split(";").map((e) => e.toLowerCase()) : [""];
+    const search = (dirs) => {
+        for (const dir of dirs) {
+            for (const ext of exts) {
+                const candidate = join(dir, name + ext);
+                if (existsSync(candidate))
+                    return candidate;
+            }
+        }
+        return undefined;
+    };
+    // The extra locations are only computed (one `npm prefix -g` call at most) when PATH itself has no match.
+    return search((process.env["PATH"] ?? process.env["Path"] ?? "").split(delimiter).filter(Boolean)) ?? search(extraSearchDirs());
+}
+/**
+ * Spawn an engine CLI with piped stdio. Windows npm shims (.cmd/.bat) must run through a shell; `args`
+ * are fixed adapter constants (never user input), so the simple quoting below is safe.
+ */
+export function spawnCli(file, args, cwd, env) {
+    // Background services start with a minimal PATH; npm shims and `#!/usr/bin/env node` scripts need `node` (and the
+    // CLI's own folder) on it, so prepend both rather than assume the login shell's PATH.
+    const base = { ...process.env, ...env };
+    const pathKey = Object.keys(base).find((k) => k.toLowerCase() === "path") ?? "PATH";
+    base[pathKey] = [...new Set([dirname(process.execPath), dirname(file), ...(base[pathKey] ?? "").split(delimiter)])].filter(Boolean).join(delimiter);
+    const opts = { cwd, windowsHide: true, env: base };
+    if (process.platform === "win32" && /\.(cmd|bat)$/i.test(file)) {
+        const q = (s) => `"${s}"`;
+        return spawn([q(file), ...args.map(q)].join(" "), { ...opts, shell: true });
+    }
+    return spawn(file, args, opts);
+}
+/** Kill a child and its descendants (a Windows shell wrapper would otherwise leave the CLI running). */
+export function killTree(child) {
+    if (child.pid === undefined || child.exitCode !== null)
+        return;
+    if (process.platform === "win32")
+        execFile("taskkill", ["/pid", String(child.pid), "/t", "/f"], () => { });
+    else
+        child.kill("SIGTERM");
+}
+//# sourceMappingURL=util.js.map

package/dist/firewall.js

@@ -0,0 +1,75 @@
+import { ps } from "./service.js";
+/** Windows Defender Firewall rule that lets the phone reach the host over the LAN (and Tailscale).
+ *  Without it Windows silently drops inbound connections on a Private network and the app shows "Can't reach <pc>"
+ *  although the daemon is running. Port-based (survives Node upgrades), Private profile only, remote side limited to the
+ *  local subnet and the Tailscale range. Creating a rule needs an elevated shell, so failure is normal: callers show
+ *  `ELEVATE_HINT` instead of failing. macOS/Linux: not applicable (no change is made). */
+export const RULE_NAME = "Remogent Host";
+const REMOTE = "LocalSubnet,100.64.0.0/10";
+export const ELEVATE_HINT = "node dist/index.js firewall --elevate";
+const q = (s) => `'${s.replace(/'/g, "''")}'`;
+function createScript(port) {
+    return [
+        `Get-NetFirewallRule -DisplayName ${q(RULE_NAME)} -ErrorAction SilentlyContinue | Remove-NetFirewallRule -ErrorAction Stop`,
+        `New-NetFirewallRule -DisplayName ${q(RULE_NAME)} -Description 'Lets the Remogent phone app reach the Remogent Host (inbound TCP, private networks, local subnet and Tailscale only)' ` +
+            `-Direction Inbound -Action Allow -Protocol TCP -LocalPort ${port} -Profile Private -RemoteAddress ${REMOTE} -ErrorAction Stop | Out-Null`,
+    ].join("\n");
+}
+/** Is there an enabled allow rule for this port? */
+export function firewallState(port) {
+    if (process.platform !== "win32")
+        return { state: "unsupported", detail: "not applicable on this OS" };
+    const r = ps(`$r = Get-NetFirewallRule -DisplayName ${q(RULE_NAME)} -ErrorAction SilentlyContinue | Select-Object -First 1\n` +
+        `if (-not $r) { 'missing'; return }\n` +
+        `$p = ($r | Get-NetFirewallPortFilter).LocalPort\n` +
+        `if ($r.Enabled -eq 'True' -and $r.Action -eq 'Allow' -and ($p -contains '${port}')) { 'open' } else { 'stale' }`);
+    const word = r.out.trim().split(/\s+/).pop() ?? "";
+    if (word === "open")
+        return { state: "open", detail: `rule "${RULE_NAME}" allows TCP ${port} on private networks` };
+    if (word === "missing")
+        return { state: "missing", detail: `no "${RULE_NAME}" rule` };
+    if (word === "stale")
+        return { state: "stale", detail: `rule "${RULE_NAME}" exists but is disabled or for another port` };
+    return { state: "unknown", detail: r.out.trim().split(/\r?\n/)[0] || "could not query the firewall" };
+}
+/** Try to create/replace the rule as the current user. ok=false normally just means "not elevated". */
+export function ensureFirewallRule(port) {
+    if (process.platform !== "win32")
+        return { ok: true, message: "firewall: nothing to do on this OS" };
+    const cur = firewallState(port);
+    if (cur.state === "open")
+        return { ok: true, message: `firewall: ${cur.detail}` };
+    const r = ps(createScript(port));
+    if (r.ok && firewallState(port).state === "open")
+        return { ok: true, message: `firewall: created rule "${RULE_NAME}" (TCP ${port}, private networks)` };
+    return {
+        ok: false,
+        message: `firewall: could not create the "${RULE_NAME}" rule (it needs an administrator). Until it exists the phone can only connect over USB or if the firewall is off.\n` +
+            `          Fix with one command (a Windows permission prompt appears): ${ELEVATE_HINT}`,
+    };
+}
+/** Run the rule creation in an elevated PowerShell (UAC prompt) and report whether it worked. */
+export function elevateFirewallRule(port) {
+    if (process.platform !== "win32")
+        return { ok: true, message: "firewall: nothing to do on this OS" };
+    const encoded = Buffer.from(createScript(port), "utf16le").toString("base64");
+    const r = ps(`try { Start-Process -FilePath powershell.exe -Verb RunAs -Wait -WindowStyle Hidden ` +
+        `-ArgumentList '-NoProfile','-NonInteractive','-ExecutionPolicy','Bypass','-EncodedCommand','${encoded}'; 'started' } catch { 'cancelled' }`);
+    if (r.out.includes("cancelled"))
+        return { ok: false, message: "firewall: the permission prompt was cancelled; no rule was added" };
+    const after = firewallState(port);
+    return after.state === "open"
+        ? { ok: true, message: `firewall: created rule "${RULE_NAME}" (TCP ${port}, private networks, local subnet + Tailscale)` }
+        : { ok: false, message: `firewall: rule still not in place (${after.detail}); check the prompt was accepted` };
+}
+/** Remove the rule (used by `uninstall`). Best effort; needs elevation like creation. */
+export function removeFirewallRule() {
+    if (process.platform !== "win32")
+        return { ok: true, message: "" };
+    const r = ps(`Get-NetFirewallRule -DisplayName ${q(RULE_NAME)} -ErrorAction SilentlyContinue | Remove-NetFirewallRule -ErrorAction Stop`);
+    const left = firewallState(0).state === "missing";
+    return r.ok || left
+        ? { ok: true, message: `firewall: rule "${RULE_NAME}" removed` }
+        : { ok: false, message: `firewall: could not remove the "${RULE_NAME}" rule (needs an administrator); delete it in Windows Defender Firewall if you want it gone` };
+}
+//# sourceMappingURL=firewall.js.map

package/dist/identity.js

@@ -0,0 +1,56 @@
+import { randomBytes, X509Certificate } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir, hostname } from "node:os";
+import { join } from "node:path";
+import selfsigned from "selfsigned";
+export const REMOGENT_DIR = join(homedir(), ".remogent");
+const IDENTITY_FILE = join(REMOGENT_DIR, "identity.json");
+export const DEFAULT_PORT = 9876;
+function fingerprintOf(certPem) {
+    return new X509Certificate(certPem).fingerprint256.replace(/:/g, "");
+}
+function generateCert() {
+    const pems = selfsigned.generate([{ name: "commonName", value: "remogent-host" }], {
+        keySize: 2048,
+        days: 3650,
+        algorithm: "sha256",
+    });
+    return { certPem: pems.cert, keyPem: pems.private };
+}
+/** The port stored with the identity (what the installed host and the paired phones use), if an identity exists. */
+export function savedPort() {
+    try {
+        const p = JSON.parse(readFileSync(IDENTITY_FILE, "utf8")).port;
+        return typeof p === "number" && p > 0 ? p : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Load the persisted identity, or create one (token + self-signed TLS cert).
+ *  `port` overrides the stored port for this run only; add `persistPort` (used by `install`) to also store it. */
+export function loadOrCreateIdentity(opts = {}) {
+    mkdirSync(REMOGENT_DIR, { recursive: true });
+    if (!opts.rotate && existsSync(IDENTITY_FILE)) {
+        const saved = JSON.parse(readFileSync(IDENTITY_FILE, "utf8"));
+        if (opts.port) {
+            const changed = saved.port !== opts.port;
+            saved.port = opts.port;
+            if (changed && opts.persistPort)
+                writeFileSync(IDENTITY_FILE, JSON.stringify(saved, null, 2), { mode: 0o600 });
+        }
+        return saved;
+    }
+    const { certPem, keyPem } = generateCert();
+    const identity = {
+        name: hostname(),
+        port: opts.port ?? DEFAULT_PORT,
+        token: randomBytes(32).toString("base64url"),
+        certPem,
+        keyPem,
+        fingerprint: fingerprintOf(certPem),
+    };
+    writeFileSync(IDENTITY_FILE, JSON.stringify(identity, null, 2), { mode: 0o600 });
+    return identity;
+}
+//# sourceMappingURL=identity.js.map