@join-pantheon/cli 0.26.5 → 0.28.0

package/dist/hooks-install.js

@@ -2,7 +2,8 @@ import { readFileSync, writeFileSync, existsSync, mkdirSync, rmSync } from "node
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import { MAX_CONSECUTIVE_BLOCKS, isOurHookCommand } from "./notify.js";
-import { copilotHome } from "./agents.js";
+import { copilotHome, kiroHome } from "./agents.js";
+import { KIRO_AGENT_NAME, kiroAgentFile, kiroAgentDoc, readKiroAgent, writeKiroAgent, kiroDefaultIsPantheon } from "./kiro-files.js";
 function ours(cmd) {
     return isOurHookCommand(cmd);
 }
@@ -247,4 +248,48 @@ export function removeCopilotHooks(projectDir = process.cwd()) {
     }
     return out;
 }
+export { KIRO_AGENT_NAME };
+export function kiroAgentPath(scope, projectDir = process.cwd()) {
+    return kiroAgentFile(scope === "user" ? kiroHome() : join(projectDir, ".kiro"));
+}
+export function kiroHookState(scope, projectDir = process.cwd()) {
+    const file = kiroAgentPath(scope, projectDir);
+    const a = readKiroAgent(file);
+    return a?.ours
+        ? { agent: "kiro", label: "Kiro", installed: true, scope, file, events: a.events }
+        : { agent: "kiro", label: "Kiro", installed: false };
+}
+export function installKiroHooks(bin, scope, projectDir = process.cwd(), allowed = []) {
+    const file = kiroAgentPath(scope, projectDir);
+    const a = readKiroAgent(file);
+    if (a && !a.ours)
+        return [`  skipped    ${file} is an agent called "${KIRO_AGENT_NAME}" that pantheon did not write — left as it is`];
+    writeKiroAgent(file, kiroAgentDoc(bin, allowed));
+    return [
+        `  ${a ? "updated" : "installed"}  ${file}   (an agent: Kiro's default, plus pantheon's hooks)`,
+        `  runs       ${bin} hook kiro-stop`,
+        `             ${bin} hook kiro-prompt`,
+        kiroDefaultIsPantheon()
+            ? `  ${""}(it is your default agent, so every kiro-cli chat uses it)`
+            : `  \x1b[33mKiro uses these only in the pantheon agent:\x1b[0m kiro-cli chat --agent pantheon`,
+        ...(kiroDefaultIsPantheon() ? [] : [`  ${""}(or always: kiro-cli agent set-default pantheon — pantheon never changes your default)`]),
+    ];
+}
+export function removeKiroHooks(projectDir = process.cwd()) {
+    const out = [];
+    for (const scope of ["project", "user"]) {
+        const file = kiroAgentPath(scope, projectDir);
+        if (!kiroHookState(scope, projectDir).installed)
+            continue;
+        try {
+            rmSync(file, { force: true });
+            out.push(`  removed ${file}`);
+        }
+        catch { }
+    }
+    if (out.length && kiroDefaultIsPantheon()) {
+        out.push("  Kiro's default was the pantheon agent; it now falls back to kiro_default and warns each session — kiro-cli agent set-default kiro_default");
+    }
+    return out;
+}
 //# sourceMappingURL=hooks-install.js.map

package/dist/install.js

@@ -4,11 +4,12 @@ import { homedir, platform } from "node:os";
 import { join, dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { grantToolPermissions, claudeSettingsFile, cursorCliConfigFile } from "./grants.js";
-import { PANTHEON_TOOL_NAMES, WRITE_TOOL_NAMES } from "./tools.js";
+import { PANTHEON_TOOL_NAMES, WRITE_TOOL_NAMES, toolsAllowed } from "./tools.js";
 import { load } from "./config.js";
 import { loadProfile } from "./profile.js";
 import { agentSpawn, onPathNamed, which } from "./which.js";
 import { FEEDBACK_ADDRESS } from "./feedback.js";
+import { kiroDir, kiroAgentFile, refreshKiroAgentAllowed } from "./kiro-files.js";
 const HERE = dirname(fileURLToPath(import.meta.url));
 export function onPath() {
     return onPathNamed("pantheon");
@@ -40,7 +41,7 @@ function mergeMcpJson(file, entry, shape = {}) {
     const existed = existsSync(file);
     doc.mcpServers ??= {};
     const before = JSON.stringify(doc.mcpServers["pantheon"] ?? null);
-    doc.mcpServers["pantheon"] = { ...shape, ...entry, env: {} };
+    doc.mcpServers["pantheon"] = { ...shape, ...entry, env: shape.env ?? {} };
     if (before === JSON.stringify(doc.mcpServers["pantheon"]))
         return "unchanged";
     mkdirSync(dirname(file), { recursive: true });
@@ -61,6 +62,12 @@ export function mergeVsCodeMcpJson(file, entry) {
     return existed ? "updated" : "created";
 }
 export const copilotMcpConfigFile = (home = homedir(), env = process.env) => join(env.COPILOT_HOME || join(home, ".copilot"), "mcp-config.json");
+export { kiroDir };
+export const kiroMcpConfigFile = (home = homedir(), env = process.env) => join(kiroDir(home, env), "settings", "mcp.json");
+export const kiroEntryShape = (approval) => ({
+    autoApprove: toolsAllowed(approval),
+    env: { PANTHEON_AGENT: "kiro" },
+});
 export function vsCodeUserDir(home = homedir(), os = platform(), env = process.env) {
     const dir = os === "darwin" ? join(home, "Library", "Application Support", "Code", "User")
         : os === "win32" ? join(env.APPDATA || join(home, "AppData", "Roaming"), "Code", "User")
@@ -131,6 +138,9 @@ export function install(projectDir, cfg, force, os = platform(), claudeLocal = c
         if (existsSync(p) || f === "AGENTS.md")
             out.push(`  ${f.padEnd(25)} ${upsertBrief(p, cfg)}   (the collaboration brief)`);
     }
+    if (existsSync(kiroDir()) || onPathNamed("kiro-cli")) {
+        out.push(`  .kiro/settings/mcp.json   ${"not used".padEnd(9)} Kiro reads ~/.kiro/settings/mcp.json, which pantheon join wrote — a repo copy would override each teammate's own   (kiro)`);
+    }
     out.push("");
     out.push("  Copilot asks once to trust this folder before it reads the repo's MCP servers and hooks.");
     out.push("  Codex reads ~/.codex/config.toml, which `pantheon join` already wrote at user scope.");
@@ -251,6 +261,21 @@ function copilotUserScope(entry) {
         return { tool, where: file, status: `failed: ${e.message}` };
     }
 }
+function kiroUserScope(entry, approval) {
+    const tool = "kiro";
+    const file = kiroMcpConfigFile();
+    if (!existsSync(kiroDir()) && !onPathNamed("kiro-cli"))
+        return { tool, where: "-", status: "skipped (kiro-cli not on PATH)" };
+    try {
+        const status = mergeMcpJson(file, entry, kiroEntryShape(approval));
+        const agent = refreshKiroAgentAllowed(kiroAgentFile(kiroDir()), toolsAllowed(approval));
+        const which = approval === "ask-before-sending" ? "reads run without asking; send, open_goal and claim prompt" : `the ${PANTHEON_TOOL_NAMES.length} pantheon tools run without asking`;
+        return { tool, where: file, status: `${status} — in the Kiro IDE, ${which}${agent === "absent" ? "; the CLI asks per call unless you use the pantheon agent (pantheon hook install)" : `; in the CLI's pantheon agent too (${agent})`}` };
+    }
+    catch (e) {
+        return { tool, where: file, status: `failed: ${e.message}` };
+    }
+}
 function vsCodeUserScope(entry) {
     const tool = "vs code";
     const dir = vsCodeUserDir();
@@ -268,7 +293,7 @@ export const CODEX_APPROVAL_LINE = `default_tools_approval_mode = "approve"`;
 export function approvalSummary(approval) {
     return approval === "ask-before-sending"
         ? `your agent asks you before each send, goal or claim in your name; reading and waiting run without a prompt. Unattended runs keep their own per-run approvals — this governs the agent you sit in front of`
-        : `pantheon's ${PANTHEON_TOOL_NAMES.length} tools run without a per-call prompt in Claude Code, Cursor and Codex — your agent coordinates for you without stopping to ask. Copilot has no allow-list file: it asks once per tool per folder and remembers your answer`;
+        : `pantheon's ${PANTHEON_TOOL_NAMES.length} tools run without a per-call prompt in Claude Code, Cursor, Codex, the Kiro IDE and Kiro's pantheon agent — your agent coordinates for you without stopping to ask. Copilot has no allow-list file: it asks once per tool per folder and remembers your answer; Kiro's default CLI agent asks per call`;
 }
 export function codexTomlBlock(entry, env = { PANTHEON_AGENT: "codex" }, approval = "approve") {
     const envToml = Object.entries(env)
@@ -466,7 +491,7 @@ export function installForUser(approval = chosenApproval()) {
     const entry = userEntry();
     return [
         claudeUserScope(entry), cursorUserScope(entry), codexUserScope(entry, approval),
-        copilotUserScope(entry), vsCodeUserScope(entry),
+        copilotUserScope(entry), vsCodeUserScope(entry), kiroUserScope(entry, approval),
         ...grantToolPermissions(approval).map((g) => ({
             tool: g.tool,
             where: g.tool.startsWith("claude") ? claudeSettingsFile() : cursorCliConfigFile(),

package/dist/kiro-files.js

@@ -0,0 +1,56 @@
+import { existsSync, readFileSync, writeFileSync, mkdirSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+export const kiroDir = (home = homedir(), env = process.env) => env.KIRO_HOME || join(home, ".kiro");
+export const KIRO_AGENT_NAME = "pantheon";
+export const kiroAgentFile = (kiroBase) => join(kiroBase, "agents", `${KIRO_AGENT_NAME}.json`);
+export const isOurKiroHook = (cmd) => !!cmd && /\bhook\s+kiro-(?:prompt|stop)\b/.test(cmd);
+export const kiroAllowed = (tools) => tools.map((t) => `@pantheon/${t}`);
+export function kiroAgentDoc(bin, allowed) {
+    return {
+        name: KIRO_AGENT_NAME,
+        description: "Kiro's default agent, plus Pantheon: its tools run without asking, and a turn is held open while a teammate is waiting on you",
+        tools: ["*"],
+        allowedTools: kiroAllowed(allowed),
+        includeMcpJson: true,
+        hooks: {
+            userPromptSubmit: [{ command: `${bin} hook kiro-prompt >/dev/null 2>&1` }],
+            stop: [{ command: `${bin} hook kiro-stop` }],
+        },
+    };
+}
+export function readKiroAgent(file) {
+    if (!existsSync(file))
+        return null;
+    try {
+        const doc = JSON.parse(readFileSync(file, "utf8"));
+        const events = Object.entries(doc.hooks ?? {}).filter(([, es]) => (es ?? []).some((h) => isOurKiroHook(h.command))).map(([e]) => e);
+        return { doc, ours: events.length > 0, events };
+    }
+    catch {
+        return { doc: {}, ours: false, events: [] };
+    }
+}
+export function writeKiroAgent(file, doc) {
+    mkdirSync(dirname(file), { recursive: true });
+    writeFileSync(file, JSON.stringify(doc, null, 2) + "\n");
+}
+export function refreshKiroAgentAllowed(file, allowed) {
+    const a = readKiroAgent(file);
+    if (!a?.ours)
+        return "absent";
+    const want = kiroAllowed(allowed);
+    if (JSON.stringify(a.doc.allowedTools) === JSON.stringify(want))
+        return "unchanged";
+    writeKiroAgent(file, { ...a.doc, allowedTools: want });
+    return "updated";
+}
+export function kiroDefaultIsPantheon(base = kiroDir()) {
+    try {
+        return JSON.parse(readFileSync(join(base, "settings", "cli.json"), "utf8"))["chat.defaultAgent"] === KIRO_AGENT_NAME;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=kiro-files.js.map

package/dist/machine.js

@@ -4,7 +4,7 @@ import { homedir, platform } from "node:os";
 import { join } from "node:path";
 import { CONFIG_DIR } from "./config.js";
 import { plistPath } from "./service.js";
-import { copilotMcpConfigFile, vsCodeUserDir } from "./install.js";
+import { copilotMcpConfigFile, vsCodeUserDir, kiroMcpConfigFile, kiroDir } from "./install.js";
 const sh = (cmd) => {
     try {
         return execFileSync("sh", ["-lc", cmd], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim() || null;
@@ -120,6 +120,10 @@ export function wiring() {
         const f = join(vscodeDir, "mcp.json");
         out.push({ tool: "vs code", state: existsSync(f) && /"pantheon"/.test(readFileSync(f, "utf8")) ? "wired" : "not wired" });
     }
+    if (existsSync(kiroDir())) {
+        const f = kiroMcpConfigFile();
+        out.push({ tool: "kiro", state: existsSync(f) && /"pantheon"/.test(readFileSync(f, "utf8")) ? "wired" : "not wired" });
+    }
     return out;
 }
 export function logFileFor(kind, proc) {

package/dist/measure.js

@@ -3,7 +3,7 @@ import { existsSync } from "node:fs";
 import { resolve, dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { claudeGrantedEffective, cursorGrantedEffective, claudeAllow, cursorAllow, isServerWide } from "./grants.js";
-import { codexApprovalState, copilotMcpConfigFile } from "./install.js";
+import { codexApprovalState, copilotMcpConfigFile, kiroMcpConfigFile } from "./install.js";
 import { existsSync as fileExists, readFileSync } from "node:fs";
 import { dirname as dirOf } from "node:path";
 import { PANTHEON_TOOL_NAMES, WRITE_TOOL_NAMES } from "./tools.js";
@@ -161,13 +161,41 @@ export function toolsReport(registered, seen, approval, opts = {}) {
     }
     const copilot = seen.copilot === undefined || seen.copilot === null ? null
         : seen.copilot ? "Copilot wired (it asks once per tool per folder and remembers)" : "Copilot has no pantheon entry";
-    const detail = `${head}; ${claude.text}, ${cursor.text}, ${codex}${copilot ? `, ${copilot}` : ""}`;
+    let kiro = null;
+    if (seen.kiro === "absent")
+        kiro = "Kiro has no pantheon entry";
+    else if (Array.isArray(seen.kiro)) {
+        const want = [...(approval === "ask-before-sending" ? PANTHEON_TOOL_NAMES.filter((t) => !WRITE_TOOL_NAMES.includes(t)) : PANTHEON_TOOL_NAMES)].sort();
+        const have = [...new Set(seen.kiro)].filter((t) => t.startsWith("pantheon_")).sort();
+        const extra = have.filter((t) => !want.includes(t)), missing = want.filter((t) => !have.includes(t));
+        if (!extra.length && !missing.length)
+            kiro = `Kiro IDE allows ${have.length}`;
+        else {
+            kiro = `Kiro IDE allows ${have.length}${missing.length ? `, missing ${missing.map((t) => t.replace(/^pantheon_/, "")).join(", ")}` : ""}${extra.length ? `, and allows ${extra.map((t) => t.replace(/^pantheon_/, "")).join(", ")} you chose to be asked about` : ""}`;
+            problems.push("Kiro's autoApprove does not match");
+        }
+    }
+    const detail = `${head}; ${claude.text}, ${cursor.text}, ${codex}${copilot ? `, ${copilot}` : ""}${kiro ? `, ${kiro}` : ""}`;
     if (!problems.length)
         return { level: "pass", detail };
     return { level: "warn", detail, fix: `${problems.join("; ")} — pantheon install --user rewrites every grant in your own settings to match this build and your approval choice; a rule in this repo's .claude/settings*.json or .cursor/cli.json is yours to edit by hand` };
 }
 export function grantsSeen(projectDir = null) {
-    return { claude: claudeGrantedEffective(projectDir), cursor: cursorGrantedEffective(projectDir), codex: codexApprovalState(), copilot: copilotWired() };
+    return { claude: claudeGrantedEffective(projectDir), cursor: cursorGrantedEffective(projectDir), codex: codexApprovalState(), copilot: copilotWired(), kiro: kiroApproved() };
+}
+export function kiroApproved(file = kiroMcpConfigFile()) {
+    if (!fileExists(dirOf(dirOf(file))))
+        return null;
+    try {
+        const doc = JSON.parse(readFileSync(file, "utf8"));
+        const entry = doc.mcpServers?.["pantheon"];
+        if (!entry)
+            return "absent";
+        return Array.isArray(entry.autoApprove) ? entry.autoApprove.filter((t) => typeof t === "string") : [];
+    }
+    catch {
+        return "absent";
+    }
 }
 export function copilotWired(file = copilotMcpConfigFile()) {
     if (!fileExists(dirOf(file)))

package/dist/network.js

@@ -0,0 +1,394 @@
+import { execFileSync } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import http from "node:http";
+import https from "node:https";
+import net from "node:net";
+import tls from "node:tls";
+import { platform } from "node:os";
+import { join } from "node:path";
+const LOOPBACK = ["localhost", "127.0.0.1", "::1", "[::1]"];
+const NONE = { https: null, http: null, noProxy: LOOPBACK, source: "none", fallbackOnly: false };
+const pick = (env, ...names) => {
+    for (const n of names) {
+        const v = env[n]?.trim();
+        if (v)
+            return v;
+    }
+    return undefined;
+};
+export function normalizeProxy(raw) {
+    const v = raw.trim();
+    if (!v)
+        return null;
+    try {
+        const u = new URL(/^[a-z][a-z0-9+.-]*:\/\//i.test(v) ? v : `http://${v}`);
+        if (u.protocol !== "http:" && u.protocol !== "https:")
+            return null;
+        if (!u.hostname)
+            return null;
+        return u.toString().replace(/\/$/, "");
+    }
+    catch {
+        return null;
+    }
+}
+export function redactProxy(url) {
+    if (!url)
+        return "direct";
+    try {
+        const u = new URL(url);
+        if (u.username || u.password) {
+            u.username = u.username ? "***" : "";
+            u.password = "";
+        }
+        return u.toString().replace(/\/$/, "");
+    }
+    catch {
+        return "(unparseable)";
+    }
+}
+export function splitNoProxy(raw) {
+    return [...new Set([...(raw ?? "").split(/[,\s]+/).map((s) => s.trim().toLowerCase()).filter(Boolean), ...LOOPBACK])];
+}
+export function bypassesProxy(host, port, noProxy) {
+    const h = host.toLowerCase().replace(/^\[|\]$/g, "");
+    for (const raw of noProxy) {
+        if (raw === "*")
+            return true;
+        let entry = raw.replace(/^\[|\]$/g, "");
+        let entryPort;
+        const m = /^(.*):(\d+)$/.exec(entry);
+        if (m && !entry.includes("::")) {
+            entry = m[1];
+            entryPort = m[2];
+        }
+        if (entryPort && entryPort !== port)
+            continue;
+        if (entry.includes("/") && net.isIP(h)) {
+            if (inCidr(h, entry))
+                return true;
+            continue;
+        }
+        const bare = entry.replace(/^\*?\./, "");
+        if (h === bare || h.endsWith(`.${bare}`))
+            return true;
+    }
+    return false;
+}
+function inCidr(ip, cidr) {
+    const [base, bitsRaw] = cidr.split("/");
+    const bits = Number(bitsRaw);
+    if (!base || net.isIPv4(ip) !== net.isIPv4(base) || !net.isIPv4(ip) || !(bits >= 0 && bits <= 32))
+        return false;
+    const n = (s) => s.split(".").reduce((a, o) => (a << 8) + Number(o), 0) >>> 0;
+    const mask = bits === 0 ? 0 : (~0 << (32 - bits)) >>> 0;
+    return (n(ip) & mask) === (n(base) & mask);
+}
+export function parseScutil(out) {
+    const val = (k) => new RegExp(`^\\s*${k}\\s*:\\s*(.+?)\\s*$`, "m").exec(out)?.[1];
+    const on = (k) => val(k) === "1";
+    const hp = (host, port) => (host ? normalizeProxy(`${host}${port ? `:${port}` : ""}`) : null);
+    const exceptions = [];
+    const block = /ExceptionsList\s*:\s*<array>\s*\{([\s\S]*?)\}/.exec(out)?.[1] ?? "";
+    for (const line of block.split("\n")) {
+        const m = /:\s*(\S+)\s*$/.exec(line);
+        if (m)
+            exceptions.push(m[1]);
+    }
+    const pac = on("ProxyAutoConfigEnable") ? val("ProxyAutoConfigURLString") : undefined;
+    return {
+        https: on("HTTPSEnable") ? hp(val("HTTPSProxy"), val("HTTPSPort")) : null,
+        http: on("HTTPEnable") ? hp(val("HTTPProxy"), val("HTTPPort")) : null,
+        noProxy: exceptions,
+        ...(pac ? { pac } : {}),
+    };
+}
+export function parseWindowsReg(out) {
+    const val = (k) => new RegExp(`^\\s*${k}\\s+REG_\\w+\\s+(.*?)\\s*$`, "mi").exec(out)?.[1];
+    const pac = val("AutoConfigURL") || undefined;
+    const enabled = /^0x0*1$/i.test(val("ProxyEnable") ?? "");
+    const server = enabled ? val("ProxyServer") ?? "" : "";
+    let httpsP = null, httpP = null;
+    if (server.includes("=")) {
+        for (const part of server.split(";")) {
+            const [k, v] = part.split("=");
+            if (k?.trim().toLowerCase() === "https" && v)
+                httpsP = normalizeProxy(v);
+            if (k?.trim().toLowerCase() === "http" && v)
+                httpP = normalizeProxy(v);
+        }
+        httpsP ??= httpP;
+    }
+    else if (server) {
+        httpsP = httpP = normalizeProxy(server);
+    }
+    const override = (val("ProxyOverride") ?? "").split(";").map((s) => s.trim()).filter((s) => s && s !== "<local>");
+    return { https: httpsP, http: httpP, noProxy: override, ...(pac ? { pac } : {}) };
+}
+const run = (cmd, args) => {
+    try {
+        return execFileSync(cmd, args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 3000 });
+    }
+    catch {
+        return null;
+    }
+};
+function savedFromConfig(env) {
+    try {
+        const home = env.PANTHEON_HOME ?? join(env.HOME ?? env.USERPROFILE ?? "", ".pantheon");
+        const f = join(home, "config.json");
+        if (!existsSync(f))
+            return null;
+        return JSON.parse(readFileSync(f, "utf8")).network ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+export const defaultNetworkDeps = () => ({
+    env: process.env,
+    os: platform(),
+    saved: () => savedFromConfig(process.env),
+    scutil: () => run("/usr/sbin/scutil", ["--proxy"]),
+    winReg: () => run("reg", ["query", "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings"]),
+});
+export function resolveProxyPlan(d = defaultNetworkDeps()) {
+    const noProxy = splitNoProxy(pick(d.env, "no_proxy", "NO_PROXY"));
+    const forced = d.env.PANTHEON_PROXY?.trim();
+    if (forced) {
+        if (/^(none|direct|off|false|0)$/i.test(forced))
+            return { ...NONE, noProxy };
+        const p = normalizeProxy(forced);
+        if (p)
+            return { https: p, http: p, noProxy, source: "PANTHEON_PROXY", fallbackOnly: false };
+    }
+    const envHttps = pick(d.env, "https_proxy", "HTTPS_PROXY", "all_proxy", "ALL_PROXY");
+    const envHttp = pick(d.env, "http_proxy", "HTTP_PROXY", "all_proxy", "ALL_PROXY");
+    if (envHttps || envHttp) {
+        const hs = envHttps ? normalizeProxy(envHttps) : null;
+        const h = envHttp ? normalizeProxy(envHttp) : null;
+        if (hs || h)
+            return { https: hs, http: h, noProxy, source: "env", fallbackOnly: false };
+    }
+    const saved = d.saved();
+    if (saved && saved.proxy === "")
+        return { ...NONE, noProxy };
+    const sp = saved?.proxy ? normalizeProxy(saved.proxy) : null;
+    if (sp)
+        return { https: sp, http: sp, noProxy: splitNoProxy([saved?.no_proxy, ...noProxy].filter(Boolean).join(",")), source: "config", fallbackOnly: false };
+    const sys = d.os === "darwin" ? (() => { const o = d.scutil(); return o ? parseScutil(o) : null; })()
+        : d.os === "win32" ? (() => { const o = d.winReg(); return o ? parseWindowsReg(o) : null; })()
+            : null;
+    if (sys && (sys.https || sys.http)) {
+        return { https: sys.https ?? sys.http, http: sys.http ?? sys.https, noProxy: splitNoProxy([...sys.noProxy, ...noProxy].join(",")),
+            source: d.os === "darwin" ? "macos" : "windows", fallbackOnly: true, ...(sys.pac ? { pac: sys.pac } : {}) };
+    }
+    return { ...NONE, noProxy, ...(sys?.pac ? { pac: sys.pac } : {}) };
+}
+export function proxyFor(target, plan) {
+    let u;
+    try {
+        u = new URL(target);
+    }
+    catch {
+        return null;
+    }
+    const secure = u.protocol === "https:" || u.protocol === "wss:";
+    const port = u.port || (secure ? "443" : "80");
+    const p = secure ? plan.https : plan.http;
+    if (!p || bypassesProxy(u.hostname, port, plan.noProxy))
+        return null;
+    return p;
+}
+export function tunnelAgent(proxyUrl, secure) {
+    const proxy = new URL(proxyUrl);
+    const auth = proxy.username || proxy.password
+        ? `Basic ${Buffer.from(`${decodeURIComponent(proxy.username)}:${decodeURIComponent(proxy.password)}`).toString("base64")}`
+        : undefined;
+    const Base = secure ? https.Agent : http.Agent;
+    class Tunnel extends Base {
+        createConnection(options, callback) {
+            const cb = (err, s) => callback?.(err, s);
+            const host = String(options.hostname ?? options.host ?? "");
+            const port = Number(options.port ?? (secure ? 443 : 80));
+            const req = (proxy.protocol === "https:" ? https : http).request({
+                host: proxy.hostname, port: Number(proxy.port || (proxy.protocol === "https:" ? 443 : 80)),
+                method: "CONNECT", path: `${host.includes(":") ? `[${host}]` : host}:${port}`,
+                headers: { host: `${host}:${port}`, ...(auth ? { "proxy-authorization": auth } : {}) },
+                timeout: 10_000,
+            });
+            let done = false;
+            const fail = (e) => { if (!done) {
+                done = true;
+                cb(e);
+            } };
+            req.once("connect", (res, socket) => {
+                if (res.statusCode !== 200) {
+                    socket.destroy();
+                    const err = new Error(`the proxy ${redactProxy(proxyUrl)} answered ${res.statusCode} ${res.statusMessage ?? ""} to a tunnel request for ${host}:${port}`.trim());
+                    err.code = res.statusCode === 407 ? "PROXY_AUTH_REQUIRED" : "PROXY_REFUSED";
+                    return fail(err);
+                }
+                if (!secure) {
+                    done = true;
+                    return cb(null, socket);
+                }
+                const t = tls.connect({ ...options, socket, servername: net.isIP(host) ? undefined : host });
+                t.once("secureConnect", () => { if (!done) {
+                    done = true;
+                    cb(null, t);
+                } });
+                t.once("error", fail);
+            });
+            req.once("timeout", () => { req.destroy(Object.assign(new Error(`the proxy ${redactProxy(proxyUrl)} did not answer within 10s`), { code: "ETIMEDOUT" })); });
+            req.once("error", fail);
+            req.end();
+            return undefined;
+        }
+    }
+    return new Tunnel({ keepAlive: false });
+}
+let installed = null;
+let fallbackUsed = false;
+export function wsOptions(address) {
+    const plan = currentPlan();
+    if (plan.fallbackOnly && !fallbackUsed)
+        return {};
+    const p = proxyFor(address, plan);
+    if (!p)
+        return {};
+    return { agent: tunnelAgent(p, /^wss:/.test(address)) };
+}
+export function currentPlan() {
+    if (!installed)
+        installed = { plan: resolveProxyPlan(), active: null };
+    return installed.plan;
+}
+export async function installNetwork() {
+    const plan = currentPlan();
+    if (plan.https || plan.http) {
+        if (!plan.fallbackOnly)
+            await useProxyForFetch(plan);
+        else
+            wrapFetchWithFallback(plan);
+    }
+    return plan;
+}
+async function useProxyForFetch(plan) {
+    if (installed?.active)
+        return;
+    const { EnvHttpProxyAgent, setGlobalDispatcher } = await import("undici");
+    setGlobalDispatcher(new EnvHttpProxyAgent({
+        ...(plan.https ? { httpsProxy: plan.https } : {}),
+        ...(plan.http ? { httpProxy: plan.http } : {}),
+        noProxy: plan.noProxy.join(","),
+    }));
+    if (installed)
+        installed.active = plan.https ?? plan.http;
+}
+const BLOCKED = /ENOTFOUND|EAI_AGAIN|ECONNREFUSED|ETIMEDOUT|EHOSTUNREACH|ENETUNREACH|EPROTO|wrong version number|UND_ERR_CONNECT_TIMEOUT|UND_ERR_SOCKET|handshake has timed out|socket hang up/i;
+export const isBlockedPath = (e) => {
+    const err = e;
+    return BLOCKED.test(`${err?.code ?? ""} ${err?.message ?? ""} ${err?.cause?.code ?? ""} ${err?.cause?.message ?? ""}`);
+};
+function wrapFetchWithFallback(plan) {
+    const g = globalThis;
+    if (g.__pantheonFetch)
+        return;
+    g.__pantheonFetch = true;
+    const direct = g.fetch.bind(globalThis);
+    g.fetch = (async (input, init) => {
+        if (fallbackUsed)
+            return direct(input, init);
+        try {
+            return await direct(input, init);
+        }
+        catch (e) {
+            const url = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
+            if (!isBlockedPath(e) || !proxyFor(url, plan))
+                throw e;
+            await useProxyForFetch(plan);
+            fallbackUsed = true;
+            return direct(input, init);
+        }
+    });
+}
+export function trySystemFallback(address, e) {
+    const plan = currentPlan();
+    if (!plan.fallbackOnly || fallbackUsed || !isBlockedPath(e) || !proxyFor(address, plan))
+        return false;
+    fallbackUsed = true;
+    void useProxyForFetch(plan);
+    return true;
+}
+export const usedSystemFallback = () => fallbackUsed;
+export function proxyEnvFor(plan = currentPlan()) {
+    if (!(plan.https || plan.http) || plan.source === "env")
+        return {};
+    if (plan.fallbackOnly && !fallbackUsed)
+        return {};
+    return {
+        ...(plan.https ? { HTTPS_PROXY: plan.https, https_proxy: plan.https } : {}),
+        ...(plan.http ? { HTTP_PROXY: plan.http, http_proxy: plan.http } : {}),
+        NO_PROXY: plan.noProxy.join(","), no_proxy: plan.noProxy.join(","),
+    };
+}
+export function resetNetworkForTests(plan) {
+    installed = plan ? { plan, active: null } : null;
+    fallbackUsed = false;
+    const g = globalThis;
+    delete g.__pantheonFetch;
+}
+export function explainNetError(e, plan = currentPlan()) {
+    const err = e;
+    const text = `${err?.code ?? ""} ${err?.message ?? ""} ${err?.cause?.code ?? ""} ${err?.cause?.message ?? ""}`;
+    const proxy = plan.https ?? plan.http;
+    const shown = proxy ? redactProxy(proxy) : "";
+    const orProxy = "Behind a company proxy? pantheon network --proxy http://host:port";
+    if (/PROXY_AUTH_REQUIRED|\b407\b/.test(text)) {
+        return { why: `the proxy ${shown} asked for a login`, fix: "put it in the proxy address: http://user:password@host:port", share: "proxy requires authentication" };
+    }
+    if (/PROXY_REFUSED/.test(text)) {
+        return { why: `the proxy ${shown} would not open a connection to the relay`, fix: "ask whoever runs it to allow HTTPS to relay.joinpantheon.network", share: "proxy refused the tunnel" };
+    }
+    if (/wrong version number|EPROTO|packet length too long|unknown protocol/i.test(text)) {
+        return proxy
+            ? { why: `the proxy ${shown} answered in plain text where a secure connection was expected`, fix: "check its address: company proxies are usually http://host:port, even for secure traffic", share: "TLS answered in plain text (via proxy)" }
+            : { why: "this network answered the relay's secure connection in plain text, which is what a network that requires a proxy does", fix: "set the proxy and run it again: export HTTPS_PROXY=http://host:port (or save it: pantheon network --proxy http://host:port)", share: "TLS answered in plain text (direct) — likely a required proxy" };
+    }
+    if (/SELF_SIGNED_CERT_IN_CHAIN|UNABLE_TO_GET_ISSUER_CERT_LOCALLY|UNABLE_TO_VERIFY_LEAF_SIGNATURE|self[- ]signed certificate|unable to get local issuer/i.test(text)) {
+        return { why: "the relay's certificate was swapped for one this machine does not trust, which happens on networks that inspect secure traffic", fix: "point Node at your company's root certificate: export NODE_EXTRA_CA_CERTS=/path/to/root.pem (or on Node 22.15+: NODE_USE_SYSTEM_CA=1)", share: "certificate not trusted — TLS inspection" };
+    }
+    if (/CERT_HAS_EXPIRED|certificate has expired|ERR_TLS_CERT_ALTNAME_INVALID|Hostname\/IP does not match/i.test(text)) {
+        return { why: "the relay's certificate looks expired or belongs to another name", fix: "check this machine's date and time, then try another network", share: "certificate expired or for another name" };
+    }
+    if (/ENOTFOUND|EAI_AGAIN|getaddrinfo/i.test(text)) {
+        return proxy
+            ? { why: `the proxy ${shown} could not find the relay's address`, fix: "check the relay address with pantheon doctor", share: "name did not resolve" }
+            : { why: "the relay's address did not resolve — this machine may be offline", fix: `check the connection and try again. ${orProxy}`, share: "name did not resolve" };
+    }
+    if (/ECONNREFUSED/i.test(text)) {
+        return proxy
+            ? { why: `nothing is accepting connections at the proxy ${shown}`, fix: "check the proxy address and port, or clear it: pantheon network --clear", share: "proxy refused the connection" }
+            : { why: "nothing is accepting connections at the relay's address — it may be down or restarting", fix: "try again in a minute; pantheon doctor shows more", share: "connection refused" };
+    }
+    if (/ETIMEDOUT|UND_ERR_CONNECT_TIMEOUT|handshake has timed out|timed out|EHOSTUNREACH|ENETUNREACH/i.test(text)) {
+        return proxy
+            ? { why: `the proxy ${shown} did not answer in time`, fix: "check it is reachable from this machine, or clear it: pantheon network --clear", share: "connection timed out" }
+            : { why: "the relay did not answer in time", fix: `check this machine is online and try again. ${orProxy}`, share: "connection timed out" };
+    }
+    if (/ECONNRESET|socket hang up/i.test(text)) {
+        return proxy
+            ? { why: `the connection through the proxy ${shown} was cut`, fix: "the proxy may not allow WebSockets; ask for relay.joinpantheon.network to be allowed", share: "connection reset" }
+            : { why: "the connection dropped before the relay answered", fix: "try again", share: "connection reset" };
+    }
+    return null;
+}
+export function describeNetError(e, plan) {
+    const raw = e?.message ?? String(e);
+    const x = explainNetError(e, plan);
+    const first = (raw.split("\n")[0] ?? "").slice(0, 120);
+    const fix = x ? x.fix.charAt(0).toUpperCase() + x.fix.slice(1) : "";
+    return x ? `${x.why}. ${fix}.  (${first})`.replace(/\.\.  \(/, ".  (").replace(/\?\.  \(/, "?  (") : raw;
+}
+//# sourceMappingURL=network.js.map