@kauakdev/kauak 0.0.0-stage → 0.1.1

package/bridge/server.js

@@ -0,0 +1,2387 @@
+import fs$1, { existsSync } from "node:fs";
+import path from "node:path";
+import http from "node:http";
+import { WebSocketServer } from "ws";
+import fs from "node:fs/promises";
+import os from "node:os";
+import { spawn, execFile } from "node:child_process";
+import { EventEmitter } from "node:events";
+import net from "node:net";
+const AGENT_STATUSES = ["idle", "working", "blocked", "done", "unknown"];
+const SSH_TARGET = /^[A-Za-z0-9_][A-Za-z0-9._@-]{0,127}$/;
+const GIT_REF = /^[A-Za-z0-9_.][A-Za-z0-9_./-]{0,199}$/;
+const AGENT_KIND = /^[a-z][a-z0-9_-]{0,31}$/;
+const KEY = /^(?:(?:ctrl|alt|shift)\+){0,3}(?:enter|esc|tab|backspace|up|down|left|right|[a-z0-9])$/;
+const MAX_READ_LINES = 5e3;
+const MAX_INPUT_OPS = 256;
+const MAX_INPUT_TEXT = 64 * 1024;
+const MAX_ID = 512;
+const MAX_FIELD = 4096;
+const PARSERS = {
+  add_machine: (m) => str(m.ssh, MAX_FIELD, true) ? { type: "add_machine", ssh: m.ssh.trim(), label: str(m.label, MAX_FIELD) ? m.label.trim() : "" } : null,
+  remove_machine: (m) => str(m.machine) ? { type: "remove_machine", machine: m.machine } : null,
+  refresh: (m) => str(m.machine) ? { type: "refresh", machine: m.machine } : null,
+  // Everything else is about something on one floor, named in `machine`.
+  focus: (m) => str(m.machine) && str(m.pane_id) ? { type: "focus", machine: m.machine, pane_id: m.pane_id } : null,
+  commands: (m) => str(m.machine) && str(m.pane_id) ? { type: "commands", machine: m.machine, pane_id: m.pane_id } : null,
+  read: (m) => {
+    if (!str(m.machine) || !str(m.pane_id)) return null;
+    const lines2 = int(m.lines) && m.lines > 0 ? Math.min(m.lines, MAX_READ_LINES) : null;
+    return { type: "read", machine: m.machine, pane_id: m.pane_id, lines: lines2, ...typeof m.seq === "number" ? { seq: m.seq } : {} };
+  },
+  input: (m) => {
+    if (!str(m.machine) || !str(m.pane_id) || !Array.isArray(m.ops)) return null;
+    return { type: "input", machine: m.machine, pane_id: m.pane_id, ops: inputOps(m.ops), ...idOf(m) };
+  },
+  uncommitted: (m) => str(m.machine) && str(m.root, MAX_FIELD) ? { type: "uncommitted", machine: m.machine, root: m.root, ...idOf(m) } : null,
+  create_desk: (m) => {
+    if (!str(m.machine) || !str(m.workspace_id)) return null;
+    return { type: "create_desk", machine: m.machine, workspace_id: m.workspace_id, agent: agentOf(m.agent), ...idOf(m) };
+  },
+  create_room: (m) => {
+    if (!str(m.machine)) return null;
+    const room = roomSpec$1(m.room);
+    return room ? { type: "create_room", machine: m.machine, room, agent: agentOf(m.agent), ...idOf(m) } : null;
+  }
+};
+function parseClientMessage(value) {
+  if (!isObject(value) || typeof value.type !== "string" || !isClientType(value.type)) return null;
+  return PARSERS[value.type](value);
+}
+function isClientType(type) {
+  return Object.hasOwn(PARSERS, type);
+}
+function idOf(m) {
+  return int(m.id) ? { id: m.id } : {};
+}
+function inputOps(list2) {
+  const ops = [];
+  for (const op of list2.slice(0, MAX_INPUT_OPS)) {
+    if (typeof op?.text === "string") {
+      if (op.text) ops.push({ text: op.text.slice(0, MAX_INPUT_TEXT) });
+    } else if (Array.isArray(op?.keys)) {
+      const keys = op.keys.filter((k) => typeof k === "string" && KEY.test(k));
+      if (keys.length) ops.push({ keys });
+    }
+  }
+  return ops;
+}
+function agentOf(v) {
+  return typeof v === "string" && v ? v.slice(0, 64) : null;
+}
+function roomSpec$1(r) {
+  if (!isObject(r) || !str(r.cwd, MAX_FIELD, true) || r.label !== void 0 && !str(r.label, MAX_FIELD, true)) return null;
+  const label = typeof r.label === "string" ? { label: r.label } : {};
+  if (r.kind === "folder") return { kind: r.kind, cwd: r.cwd, ...label };
+  if (r.kind !== "worktree" || !str(r.branch, MAX_FIELD, true) || r.base !== void 0 && !str(r.base, MAX_FIELD, true)) return null;
+  return { kind: r.kind, cwd: r.cwd, branch: r.branch, ...typeof r.base === "string" ? { base: r.base } : {}, ...label };
+}
+function isObject(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function int(v) {
+  return Number.isInteger(v);
+}
+function str(v, max = MAX_ID, empty = false) {
+  return typeof v === "string" && v.length <= max && (empty || v.length > 0);
+}
+const MAX_BYTES$1 = 64 * 1024;
+async function readAppearances(settings) {
+  const dir = path.resolve(settings.appearanceDir);
+  const files = /* @__PURE__ */ new Set();
+  let names = [];
+  try {
+    names = (await fs.readdir(dir)).filter((name) => name.toLowerCase().endsWith(".json") && !name.startsWith("."));
+  } catch {
+  }
+  for (const name of names.sort()) files.add(path.join(dir, name));
+  for (const file of settings.appearanceFiles) files.add(path.resolve(file));
+  return { dir, packages: await Promise.all([...files].map(readPackage)) };
+}
+async function readPackage(file) {
+  try {
+    const st = await fs.stat(file);
+    if (!st.isFile()) return { file, error: "not a file" };
+    if (st.size > MAX_BYTES$1) return { file, error: `${Math.ceil(st.size / 1024)} KB; a package is 64 KB at most` };
+    return { file, package: JSON.parse(await fs.readFile(file, "utf8")) };
+  } catch (err) {
+    const e = err;
+    return { file, error: e.code === "ENOENT" ? "no such file" : e instanceof SyntaxError ? `not valid JSON (${e.message})` : e.message };
+  }
+}
+const CONTENT_TYPES = {
+  ".html": "text/html; charset=utf-8",
+  ".js": "text/javascript; charset=utf-8",
+  ".css": "text/css; charset=utf-8",
+  ".svg": "image/svg+xml",
+  ".png": "image/png",
+  ".ico": "image/x-icon",
+  ".json": "application/json",
+  ".woff2": "font/woff2"
+};
+const APPEARANCES_PATH = "/appearances.json";
+class WsServer {
+  settings;
+  /** The built page's folder, ending in a separator so nothing beside it can pass for a file in it; null for none. */
+  pageDir;
+  hasPage;
+  allowedOrigins;
+  server;
+  wss;
+  constructor(settings, connected) {
+    this.settings = settings;
+    this.pageDir = settings.pageDir === null ? null : path.resolve(settings.pageDir) + path.sep;
+    this.hasPage = this.pageDir !== null && fs$1.existsSync(path.join(this.pageDir, "index.html"));
+    this.allowedOrigins = new Set(settings.origins);
+    this.server = http.createServer((req, res) => this.servePage(req, res));
+    this.wss = new WebSocketServer({
+      server: this.server,
+      // Browsers let any web page open a WebSocket to 127.0.0.1; only accept our own page.
+      verifyClient: ({ origin }) => !origin || this.ours(origin)
+      // no origin: not a browser
+    });
+    this.wss.on("connection", (ws) => {
+      console.log(`[bridge] client connected (${this.wss.clients.size})`);
+      const received = connected({ send: (msg) => ws.send(JSON.stringify(msg)) });
+      ws.on("message", (raw) => received(raw.toString()));
+    });
+  }
+  /** Whether a page at this URL is ours: its hostname is this computer's, or one KAUAK_ORIGINS adds. */
+  ours(url) {
+    try {
+      return this.allowedOrigins.has(new URL(url).hostname);
+    } catch {
+      return false;
+    }
+  }
+  /** Static files from the built page, which are not secret, and the installed appearances, which only our own pages get. */
+  servePage(req, res) {
+    if (req.method !== "GET" && req.method !== "HEAD") return res.writeHead(405).end();
+    let rel;
+    try {
+      rel = decodeURIComponent(new URL(req.url ?? "/", "http://x").pathname);
+    } catch {
+      return res.writeHead(400).end();
+    }
+    if (rel.endsWith("/")) rel += "index.html";
+    if (rel === APPEARANCES_PATH) {
+      this.serveAppearances(req, res).catch(() => res.headersSent || res.writeHead(500).end());
+      return;
+    }
+    const notFound = () => {
+      res.writeHead(404, { "content-type": "text/plain; charset=utf-8" });
+      res.end(this.hasPage ? "Not found\n" : "The office page is not built. Run `pnpm build`, or `pnpm dev` for the Vite dev server.\n");
+    };
+    if (this.pageDir === null) return notFound();
+    const file = path.resolve(this.pageDir, `.${rel}`);
+    if (!file.startsWith(this.pageDir)) return res.writeHead(404).end();
+    fs$1.stat(file, (err, st) => {
+      if (err || !st.isFile()) return notFound();
+      res.writeHead(200, {
+        "content-type": CONTENT_TYPES[path.extname(file)] ?? "application/octet-stream",
+        "content-length": st.size,
+        // Vite puts a content hash in every asset name; index.html must always be fresh.
+        "cache-control": rel.startsWith("/assets/") ? "public, max-age=31536000, immutable" : "no-cache",
+        "x-content-type-options": "nosniff"
+      });
+      if (req.method === "HEAD") return res.end();
+      fs$1.createReadStream(file).pipe(res);
+    });
+  }
+  /**
+   * The appearance packages installed on this machine, read now, so an edited
+   * file shows on reload. They carry this machine's paths and whatever the
+   * files hold, so they are answered only under a name the WebSocket accepts
+   * a page from: a site that points its own name at 127.0.0.1 (DNS rebinding)
+   * is refused. A HEAD reads nothing.
+   */
+  async serveAppearances(req, res) {
+    const { host, origin } = req.headers;
+    if (!host || !this.ours(`http://${host}`) || origin !== void 0 && !this.ours(origin)) return res.writeHead(403).end();
+    const headers = { "content-type": "application/json", "cache-control": "no-cache", "x-content-type-options": "nosniff" };
+    if (req.method === "HEAD") return res.writeHead(200, headers).end();
+    const body = JSON.stringify(await readAppearances(this.settings));
+    res.writeHead(200, { ...headers, "content-length": Buffer.byteLength(body) }).end(body);
+  }
+  /** To every page connected, encoded once. */
+  broadcast(msg) {
+    const data = JSON.stringify(msg);
+    for (const client of this.wss.clients) if (client.readyState === 1) client.send(data);
+  }
+  /**
+   * Opens the port. Resolves with the WebSocket's address and the office's
+   * URL, null when there is no built page; rejects when the port cannot be
+   * opened, after saying why.
+   */
+  listen() {
+    const { port, host } = this.settings;
+    return new Promise((resolve, reject) => {
+      this.wss.once("error", (err) => {
+        console.error(
+          err.code === "EADDRINUSE" ? `[bridge] port ${port} is already in use. Is the office already running? Pick another port with --port or KAUAK_PORT.` : `[bridge] cannot listen on ${host}:${port}: ${err.message}`
+        );
+        reject(err);
+      });
+      this.server.listen(port, host, () => {
+        const shown = host.includes(":") ? `[${host}]` : host;
+        resolve({
+          address: `ws://${shown}:${port}`,
+          page: this.hasPage ? `http://${shown === "0.0.0.0" || shown === "[::]" ? "127.0.0.1" : shown}:${port}/` : null
+        });
+      });
+    });
+  }
+  /** Drops every page and closes the port. */
+  close() {
+    for (const ws of this.wss.clients) ws.terminate();
+    return new Promise((resolve) => {
+      this.wss.close();
+      this.server.close(() => resolve());
+      this.server.closeAllConnections();
+    });
+  }
+}
+async function build(page, m, msg) {
+  const agent = msg.agent;
+  let paneId;
+  try {
+    if (agent && !AGENT_KIND.test(agent)) throw new Error(`Unknown agent kind "${agent}".`);
+    paneId = msg.type === "create_desk" ? await m.createDesk(msg.workspace_id) : await m.createRoom(roomSpec(m, msg.room));
+    await m.refresh();
+  } catch (err) {
+    page.send({ machine: m.id, id: msg.id, type: "create_error", message: err.message });
+    return;
+  }
+  page.send({ machine: m.id, id: msg.id, type: "created", pane_id: paneId });
+  if (!agent) return;
+  try {
+    await m.startAgent(agent, paneId);
+  } catch (err) {
+    const message = `The desk is ready, but ${agent} did not start: ${err.message}`;
+    page.send({ machine: m.id, id: msg.id, type: "create_error", pane_id: paneId, message });
+  }
+}
+function roomSpec(m, room) {
+  const cwd = roomPath(m, room.cwd);
+  const label = room.label?.trim() ? room.label.trim().slice(0, 60) : void 0;
+  if (room.kind === "folder") return { kind: "folder", cwd, label };
+  const branch = room.branch.trim();
+  const base = room.base?.trim() || void 0;
+  if (!GIT_REF.test(branch)) throw new Error("Enter a branch name like feat/my-change.");
+  if (base && !GIT_REF.test(base)) throw new Error(`"${base}" is not a branch or commit.`);
+  return { kind: "worktree", cwd, branch, base, label };
+}
+function roomPath(m, raw) {
+  let p = raw.trim();
+  if (!p || p.length > 1024) throw new Error("Enter a folder.");
+  if (!m.ssh && (p === "~" || p.startsWith("~/"))) p = path.join(os.homedir(), p.slice(1));
+  if (!p.startsWith("/")) throw new Error(`Use an absolute path${m.ssh ? ` on ${m.label}` : ""}, like /home/you/code/project.`);
+  if (!m.ssh && !fs$1.statSync(p, { throwIfNoEntry: false })?.isDirectory()) throw new Error(`There is no folder at ${p}.`);
+  return p;
+}
+function onFloor(handle2) {
+  return (msg, page, bridge) => {
+    const m = bridge.machines.get(msg.machine);
+    if (m) return handle2(m, msg, page, bridge);
+  };
+}
+const HANDLERS = {
+  add_machine: (msg, page, bridge) => {
+    const ssh = msg.ssh;
+    if (!SSH_TARGET.test(ssh)) {
+      page.send({ type: "machine_error", message: "Use an SSH host, user@host, or a Host alias from ~/.ssh/config." });
+      return;
+    }
+    if ([...bridge.machines.values()].some((m2) => m2.ssh === ssh)) {
+      page.send({ type: "machine_error", message: `${ssh} already has a floor.` });
+      return;
+    }
+    const label = msg.label || ssh.split("@").pop();
+    const m = bridge.addMachine({ id: bridge.uniqueId(label), label: label.slice(0, 40), ssh });
+    bridge.startMachine(m);
+    bridge.saveConfig();
+    bridge.broadcastMachines();
+    page.send({ type: "machine_added", machine: m.id });
+  },
+  remove_machine: onFloor((m, _msg, _page, bridge) => {
+    if (m.id === "local") return;
+    bridge.removeMachine(m);
+    bridge.saveConfig();
+    bridge.broadcastMachines();
+  }),
+  focus: onFloor(async (m, msg, page) => {
+    try {
+      await m.focusPane(msg.pane_id);
+    } catch (err) {
+      page.send({ type: "error", machine: m.id, message: err.message });
+    }
+  }),
+  // Terminal view: the pane's screen, or with `lines` the last `lines` rows
+  // of its history and screen. Reads run in parallel (each Herdr request
+  // takes ~100 ms); `seq` is echoed so the client can drop replies that
+  // arrive out of order.
+  read: onFloor(async (m, msg, page) => {
+    try {
+      const text = await m.readPane(msg.pane_id, msg.lines);
+      page.send({ type: "pane_output", machine: m.id, pane_id: msg.pane_id, text, seq: msg.seq });
+    } catch (err) {
+      page.send({ type: "error", machine: m.id, pane_id: msg.pane_id, message: err.message });
+    }
+  }),
+  // Keystrokes from the browser terminal. `ops` is an ordered list of
+  // { text } (literal bytes) and { keys } (named keys such as "enter" or
+  // "ctrl+c"), queued per pane (core/input.ts).
+  input: onFloor((m, msg, page, bridge) => bridge.input.queue(page, m, msg.pane_id, msg.ops, msg.id)),
+  // The message box's "/" menu. The agent and its folder come from the
+  // snapshot, not the page; only this machine's files are read.
+  commands: onFloor(async (m, msg, page, bridge) => {
+    const pane = m.snapshot?.panes.find((p) => p.pane_id === msg.pane_id);
+    if (!pane) return;
+    const commands = await bridge.deps.commands(pane.agent, pane.cwd, !m.ssh);
+    page.send({ type: "commands", machine: m.id, pane_id: msg.pane_id, agent: pane.agent, commands });
+  }),
+  // A printer's uncommitted view. Only checkouts a room is in are read (the floor's Printers).
+  uncommitted: onFloor(async (m, msg, page, bridge) => {
+    const uncommitted = await bridge.enriched.get(m.id).printers.uncommitted(msg.root);
+    page.send({ type: "uncommitted", machine: m.id, root: msg.root, id: msg.id, ...uncommitted });
+  }),
+  refresh: onFloor((m) => m.scheduleRefresh()),
+  // Build mode (core/build.ts).
+  create_desk: onFloor((m, msg, page) => build(page, m, msg)),
+  create_room: onFloor((m, msg, page) => build(page, m, msg))
+};
+function handle(msg, page, bridge) {
+  return run(msg.type, msg, page, bridge);
+}
+function run(type, msg, page, bridge) {
+  return HANDLERS[type](msg, page, bridge);
+}
+class InputQueue {
+  /** "machine/pane" → promise chain (see queue) */
+  queues;
+  /** "machine/pane" → batch still waiting for its turn */
+  openBatches;
+  constructor() {
+    this.queues = /* @__PURE__ */ new Map();
+    this.openBatches = /* @__PURE__ */ new Map();
+  }
+  /** Runs `job` after every job before it with the same key, whether they failed or not. */
+  enqueue(key, job) {
+    const prev = this.queues.get(key) ?? Promise.resolve();
+    const next = prev.then(job, job).finally(() => {
+      if (this.queues.get(key) === next) this.queues.delete(key);
+    });
+    this.queues.set(key, next);
+  }
+  /** `ops` for the pane, merged into this page's batch for it when one is still waiting for its turn. */
+  queue(page, machine, paneId, ops, id) {
+    const key = `${machine.id}/${paneId}`;
+    let batch = this.openBatches.get(key);
+    if (!batch || batch.page !== page) {
+      batch = { page, ops: [], id };
+      this.openBatches.set(key, batch);
+      const b = batch;
+      this.enqueue(key, async () => {
+        if (this.openBatches.get(key) === b) this.openBatches.delete(key);
+        try {
+          for (const op of b.ops) {
+            if ("text" in op) await machine.sendText(paneId, op.text);
+            else await machine.sendKeys(paneId, op.keys);
+          }
+          b.page.send({ type: "input_ack", machine: machine.id, pane_id: paneId, id: b.id });
+        } catch (err) {
+          b.page.send({ type: "error", machine: machine.id, pane_id: paneId, id: b.id, message: err.message });
+        }
+      });
+    }
+    batch.id = id;
+    for (const op of ops) {
+      const last = batch.ops[batch.ops.length - 1];
+      if ("text" in op) {
+        if (last && "text" in last && last.text.length + op.text.length <= MAX_INPUT_TEXT) last.text += op.text;
+        else batch.ops.push({ text: op.text });
+      } else if (last && "keys" in last) last.keys.push(...op.keys);
+      else batch.ops.push({ keys: [...op.keys] });
+    }
+  }
+}
+class Bridge {
+  config;
+  deps;
+  /** id → Runtime, in floor order. */
+  machines;
+  /** id → what the bridge adds to the floor */
+  enriched;
+  /** Every page's input, queued per pane. */
+  input;
+  /** The HTTP server, the page and the WebSocket. */
+  transport;
+  closing;
+  constructor(config, deps) {
+    this.config = config;
+    this.deps = deps;
+    this.machines = /* @__PURE__ */ new Map();
+    this.enriched = /* @__PURE__ */ new Map();
+    this.input = new InputQueue();
+    this.transport = new WsServer(config, (page) => this.connected(page));
+    this.closing = null;
+    this.addFloors();
+  }
+  // -------------------------------------------------------------- machines
+  /** The saved floors, as saveConfig writes them; each is checked before it is used. */
+  loadConfig() {
+    const file = this.config.machinesFile;
+    try {
+      const cfg = JSON.parse(fs$1.readFileSync(file, "utf8"));
+      return Array.isArray(cfg.machines) ? cfg.machines : [];
+    } catch (err) {
+      if (err.code !== "ENOENT") console.error(`[bridge] ignoring ${file}: ${err.message}`);
+      return [];
+    }
+  }
+  saveConfig() {
+    const list2 = [...this.machines.values()].filter((m) => m.id !== "local").map((m) => m.config);
+    fs$1.mkdirSync(path.dirname(this.config.machinesFile), { recursive: true });
+    fs$1.writeFileSync(this.config.machinesFile, `${JSON.stringify({ machines: list2 }, null, 2)}
+`);
+  }
+  /** This machine's floor (its runtime's default socket), then the saved ones. */
+  addFloors() {
+    this.addMachine({ id: "local", label: "local" });
+    for (const c of this.loadConfig()) {
+      if (typeof c?.label !== "string" || (c.ssh ? !SSH_TARGET.test(c.ssh) : typeof c.socket !== "string")) {
+        console.error(`[bridge] skipping machine in ${this.config.machinesFile}: ${JSON.stringify(c)}`);
+        continue;
+      }
+      this.addMachine({ ...c, id: typeof c.id === "string" && !this.machines.has(c.id) ? c.id : this.uniqueId(c.label) });
+    }
+  }
+  /** A floor's runtime and what the bridge adds to it, not started. */
+  addMachine(cfg) {
+    const m = this.deps.runtime(cfg);
+    this.machines.set(m.id, m);
+    this.enriched.set(m.id, this.deps.enrichers(m));
+    return m;
+  }
+  /**
+   * The enrichers start first, so they hear of each snapshot before the
+   * pages are sent it; then the runtime, which connects.
+   */
+  startMachine(m) {
+    const { enrichers, printers } = this.enriched.get(m.id);
+    for (const e of enrichers) {
+      e.start();
+      e.on("change", () => {
+        if (m.snapshot) this.broadcast(this.snapshotMessage(m, m.snapshot));
+      });
+    }
+    printers.on("print", (sheet) => this.broadcast({ type: "print", machine: m.id, sheet }));
+    m.on("status", () => this.broadcastMachines());
+    m.on("snapshot", (snapshot) => this.broadcast(this.snapshotMessage(m, snapshot)));
+    m.start();
+  }
+  removeMachine(m) {
+    m.stop();
+    for (const e of this.enriched.get(m.id)?.enrichers ?? []) e.stop();
+    this.enriched.delete(m.id);
+    this.machines.delete(m.id);
+  }
+  uniqueId(base) {
+    const slug = base.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "") || "machine";
+    let id = slug, n = 2;
+    while (this.machines.has(id)) id = `${slug}-${n++}`;
+    return id;
+  }
+  machineInfos() {
+    return [...this.machines.values()].map((m) => m.info);
+  }
+  /** The floor's snapshot, decorated by each of its enrichers in turn. */
+  snapshotMessage(m, snapshot) {
+    for (const e of this.enriched.get(m.id)?.enrichers ?? []) snapshot = e.decorate(snapshot);
+    return { type: "snapshot", machine: m.id, snapshot };
+  }
+  // -------------------------------------------------------------- pages
+  broadcast(msg) {
+    this.transport.broadcast(msg);
+  }
+  broadcastMachines() {
+    this.broadcast({ type: "machines", machines: this.machineInfos() });
+  }
+  /** A page connected: it is sent the floors, their snapshots and their sheets; then each message from it goes to its handler (handlers.ts). */
+  connected(page) {
+    page.send({ type: "machines", machines: this.machineInfos() });
+    for (const m of this.machines.values()) {
+      if (m.snapshot) page.send(this.snapshotMessage(m, m.snapshot));
+      page.send({ type: "prints", machine: m.id, sheets: this.enriched.get(m.id)?.printers.history() ?? [] });
+    }
+    return async (data) => {
+      let msg;
+      try {
+        msg = parseClientMessage(JSON.parse(data));
+      } catch {
+        return;
+      }
+      if (msg) await handle(msg, page, this);
+    };
+  }
+  // -------------------------------------------------------------- listen and close
+  /** Starts the floors and opens the port; resolves with the office's URL, null when there is no built page. */
+  listen() {
+    for (const m of this.machines.values()) this.startMachine(m);
+    return this.transport.listen().then(({ address, page }) => {
+      const floors = `${this.machines.size} floor${this.machines.size === 1 ? "" : "s"} (${this.config.machinesFile})`;
+      console.log(`[bridge] websocket listening on ${address} · ${floors}`);
+      return page;
+    });
+  }
+  // The floors stop before the first await, so a process "exit" handler that
+  // cannot wait still takes the SSH tunnels and remote helpers down with it.
+  close() {
+    if (this.closing) return this.closing;
+    for (const m of this.machines.values()) m.stop();
+    for (const { enrichers } of this.enriched.values()) for (const e of enrichers) e.stop();
+    this.closing = this.transport.close();
+    return this.closing;
+  }
+}
+const CLAUDE_BUILTINS = [
+  ["add-dir", "Add a new working directory", "<path>"],
+  ["advisor", "Let Claude consult a stronger model at key moments"],
+  ["autocompact", "Set how full the context gets before auto-summarizing", "[auto|<tokens>]"],
+  ["background", "Send this session to the background and free the terminal", "[prompt]", ["bg"]],
+  ["batch", "Plan a large change; background agents each open a PR"],
+  ["branch", "Create a branch of the current conversation at this point", "[name]"],
+  ["btw", "Ask a quick side question without interrupting the main conversation", "[question]"],
+  ["cd", "Move this session to a new working directory", "<path>"],
+  ["clear", "Start a new session with empty context; the previous one stays resumable", "[name]", ["reset", "new"]],
+  ["code-review", "Review the current diff for correctness bugs", "[level]"],
+  ["color", "Set the prompt bar color for this session"],
+  ["compact", "Free up context by summarizing the conversation so far", "[instructions]"],
+  ["config", "Open settings", "[key=value]", ["settings"]],
+  ["context", "Show current context usage"],
+  ["copy", "Copy Claude's last response to clipboard (or /copy N for the Nth-latest)"],
+  ["daemon", "Manage background services and routines"],
+  ["debug", "Turn on debug logging and investigate problems", "[issue description]"],
+  ["diff", "View uncommitted changes and per-turn diffs"],
+  ["doctor", "Check the health of your Claude Code installation", "", ["checkup"]],
+  ["effort", "Set effort level for model usage"],
+  ["exit", "Exit Claude Code", "", ["quit"]],
+  ["export", "Export the current conversation to a file or clipboard", "[filename]"],
+  ["fast", "Toggle fast mode"],
+  ["feedback", "Send feedback to Anthropic or report a bug", "[report]", ["bug"]],
+  ["focus", "Toggle focus view: just your prompt, summary, and response"],
+  ["fork", "Copy this conversation into a new background session and keep working here", "[prompt]"],
+  ["goal", "Set a goal Claude checks before stopping", "[<condition> | clear]"],
+  ["help", "Show help and available commands"],
+  ["hooks", "View hook configurations for tool events"],
+  ["ide", "Manage IDE integrations and show status", "[open]"],
+  ["init", "Initialize a new CLAUDE.md file with codebase documentation"],
+  ["insights", "Generate a report analyzing your Claude Code sessions"],
+  ["install-github-app", "Set up Claude GitHub Actions for a repository"],
+  ["keybindings", "Open your keyboard shortcuts file"],
+  ["login", "Sign in with your Anthropic account"],
+  ["logout", "Sign out from your Anthropic account"],
+  ["loop", "Run a prompt or slash command on a recurring interval", "[interval] <prompt>"],
+  ["mcp", "Manage MCP servers", "[reconnect|enable|disable [<server>|all]]"],
+  ["memory", "Edit CLAUDE.md files and memory settings"],
+  ["model", "Set the AI model for Claude Code", "[model]"],
+  ["output-style", "List output styles or switch to one", "[style]"],
+  ["permissions", "Manage allow and deny tool permission rules", "", ["allowed-tools"]],
+  ["plan", "Enable plan mode or view the current session plan", "[open|<description>]"],
+  ["plugin", "Manage Claude Code plugins", "", ["plugins", "marketplace"]],
+  ["privacy-settings", "View and update your privacy settings"],
+  ["recap", "Generate a one-line session recap now"],
+  ["release-notes", "View release notes"],
+  ["reload-plugins", "Activate pending plugin changes in the current session"],
+  ["reload-skills", "Pick up skills added or changed on disk during this session"],
+  ["remote-control", "Control this session from your phone or claude.ai/code", "", ["rc"]],
+  ["rename", "Rename the current conversation", "[name]", ["name"]],
+  ["resume", "Resume a previous conversation", "[conversation id or search term]", ["continue"]],
+  ["review", "Review a pull request", "[PR]"],
+  ["rewind", "Restore the code and/or conversation to a previous point", "", ["checkpoint", "undo"]],
+  ["run", "Launch this project's app to see your change working"],
+  ["sandbox", "Configure sandboxed Bash"],
+  ["schedule", "Create and manage scheduled remote Claude Code agents", "", ["routines"]],
+  ["security-review", "Complete a security review of the pending changes on the current branch"],
+  ["simplify", "Review the changed code for reuse, simplification and efficiency"],
+  ["skills", "List available skills"],
+  ["status", "Show version, model, account, API connectivity, and tool statuses"],
+  ["statusline", "Set up Claude Code's status line"],
+  ["subtask", "Send a subagent off with your full context; its result comes back here", "<task>"],
+  ["tasks", "View and manage everything running in the background", "", ["bashes"]],
+  ["terminal-setup", "Install the Shift+Enter key binding for newlines"],
+  ["theme", "Change the theme"],
+  ["todos", "List current todo items"],
+  ["tui", "Set the terminal UI renderer", "[default|fullscreen]"],
+  ["usage", "Show session cost, plan usage, and activity stats", "", ["cost", "stats"]],
+  ["workflows", "Browse running and completed workflows"]
+];
+const CODEX_BUILTINS = [
+  ["apps", "manage apps"],
+  ["cd", "change the current working directory"],
+  ["clear", "clear the terminal and start a new chat"],
+  ["compact", "summarize conversation to prevent hitting the context limit"],
+  ["copy", "copy the last response or part of it"],
+  ["diff", "show git diff (including untracked files)"],
+  ["exit", "exit Codex", "", ["quit"]],
+  ["export", "export the conversation as markdown"],
+  ["feedback", "send logs to maintainers"],
+  ["fork", "fork the current chat"],
+  ["goal", "set or view the goal for a long-running task"],
+  ["hooks", "view and manage lifecycle hooks"],
+  ["init", "create an AGENTS.md file with instructions for Codex"],
+  ["logout", "log out of Codex"],
+  ["mcp", "list configured MCP tools; use /mcp verbose for details"],
+  ["mention", "mention a file"],
+  ["model", "choose what model and reasoning effort to use"],
+  ["new", "start a new chat during a conversation"],
+  ["permissions", "choose what Codex is allowed to do", "", ["approvals"]],
+  ["plan", "switch to Plan mode"],
+  ["plugins", "browse plugins"],
+  ["ps", "list background terminals"],
+  ["rename", "rename the current thread"],
+  ["resume", "resume a saved chat"],
+  ["review", "review my current changes and find issues"],
+  ["side", "start a side conversation in an ephemeral fork"],
+  ["skills", "use skills to improve how Codex performs specific tasks"],
+  ["status", "show current session configuration and token usage"],
+  ["statusline", "configure which items appear in the status line"],
+  ["stop", "stop all background terminals"],
+  ["theme", "choose a syntax highlighting theme"],
+  ["usage", "view account usage or use a usage limit reset"],
+  ["vim", "toggle Vim mode for the composer"],
+  ["worktree", "start or continue a conversation in a new worktree"]
+];
+const builtins = (rows) => rows.map(([name, description, hint, aliases]) => ({
+  name,
+  description,
+  ...hint ? { hint } : {},
+  ...aliases ? { aliases } : {},
+  source: "built-in"
+}));
+const HEAD_BYTES = 4096;
+const MAX_DESCRIPTION = 200;
+async function slashCommands(agent, cwd, local, dirs) {
+  if (agent === "claude") return dedupe([...builtins(CLAUDE_BUILTINS), ...local ? await claudeFiles(dirs.claudeDir, cwd) : []]);
+  if (agent === "codex") return dedupe([...builtins(CODEX_BUILTINS), ...local ? await codexPrompts(dirs.codexDir) : []]);
+  return [];
+}
+async function claudeFiles(home, cwd) {
+  const projects = projectDirs(cwd);
+  const out = [];
+  for (const dir of projects) {
+    out.push(...await commandDir(path.join(dir, ".claude", "commands"), "project"));
+    out.push(...await skillDir(path.join(dir, ".claude", "skills"), "project"));
+  }
+  out.push(...await commandDir(path.join(home, "commands"), "user"));
+  out.push(...await skillDir(path.join(home, "skills"), "user"));
+  out.push(...await pluginCommands(home, cwd, projects));
+  return out;
+}
+function projectDirs(cwd) {
+  const dirs = [];
+  if (!cwd || !path.isAbsolute(cwd)) return dirs;
+  const home = os.homedir();
+  for (let dir = path.resolve(cwd); dir !== home; dir = path.dirname(dir)) {
+    dirs.push(dir);
+    if (dir === path.dirname(dir) || existsSync(path.join(dir, ".git"))) break;
+  }
+  return dirs;
+}
+async function commandDir(dir, source, prefix = "") {
+  const out = [];
+  for (const file of await walk(dir, 3)) {
+    if (!file.endsWith(".md")) continue;
+    const head = await readHead(file);
+    if (head === null) continue;
+    const { meta, body } = frontmatter(head);
+    out.push(command(prefix + path.basename(file, ".md"), meta.description || firstLine(body), meta["argument-hint"], source));
+  }
+  return out;
+}
+async function skillDir(dir, source, prefix = "") {
+  const out = [];
+  for (const entry of await list$1(dir)) {
+    const head = await readHead(path.join(dir, entry, "SKILL.md"));
+    if (head === null) continue;
+    const { meta, body } = frontmatter(head);
+    if (meta["user-invocable"] === "false") continue;
+    out.push(command(prefix + (meta.name || entry), meta.description || firstLine(body), meta["argument-hint"], source));
+  }
+  return out;
+}
+async function pluginCommands(home, cwd, projects) {
+  const installed = await readJson(path.join(home, "plugins", "installed_plugins.json"));
+  if (!installed?.plugins || typeof installed.plugins !== "object") return [];
+  const enabled = { ...(await readJson(path.join(home, "settings.json")))?.enabledPlugins };
+  for (const dir of [...projects].reverse()) {
+    for (const f of ["settings.json", "settings.local.json"])
+      Object.assign(enabled, (await readJson(path.join(dir, ".claude", f)))?.enabledPlugins);
+  }
+  const here = cwd ? path.resolve(cwd) : "";
+  const out = [];
+  for (const [key, entries] of Object.entries(installed.plugins)) {
+    if (enabled[key] !== true || !Array.isArray(entries)) continue;
+    const entry = entries.find((e) => e?.scope === "user" || typeof e?.projectPath === "string" && inside(here, e.projectPath));
+    if (typeof entry?.installPath !== "string") continue;
+    const manifest = await readJson(path.join(entry.installPath, ".claude-plugin", "plugin.json"));
+    const name = typeof manifest?.name === "string" ? manifest.name : key.split("@")[0];
+    out.push(...await commandDir(path.join(entry.installPath, "commands"), name, `${name}:`));
+    out.push(...await skillDir(path.join(entry.installPath, "skills"), name, `${name}:`));
+  }
+  return out;
+}
+async function codexPrompts(home) {
+  const out = [];
+  for (const entry of await list$1(path.join(home, "prompts"))) {
+    if (!entry.endsWith(".md")) continue;
+    const head = await readHead(path.join(home, "prompts", entry));
+    if (head === null) continue;
+    const { meta, body } = frontmatter(head);
+    out.push(command(`prompts:${entry.slice(0, -3)}`, meta.description || firstLine(body), meta["argument-hint"], "user"));
+  }
+  return out;
+}
+function command(name, description, hint, source) {
+  return { name, description: clip(description ?? ""), ...hint ? { hint: clip(hint) } : {}, source };
+}
+function dedupe(cmds) {
+  const seen = /* @__PURE__ */ new Set();
+  return cmds.filter((c) => /^[\w.:-]+$/.test(c.name) && !seen.has(c.name) && seen.add(c.name));
+}
+function frontmatter(text) {
+  const meta = {};
+  const m = /^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/.exec(text);
+  if (!m) return { meta, body: text };
+  const lines2 = m[1].split(/\r?\n/);
+  for (let i = 0; i < lines2.length; i++) {
+    const kv = /^([\w-]+):\s*(.*)$/.exec(lines2[i]);
+    if (!kv) continue;
+    let value = kv[2].trim();
+    if (/^[|>][+-]?$/.test(value)) {
+      const block = [];
+      while (i + 1 < lines2.length && (/^\s/.test(lines2[i + 1]) || lines2[i + 1] === "")) block.push(lines2[++i].trim());
+      value = block.filter(Boolean).join(" ");
+    } else if (/^(["']).*\1$/.test(value)) {
+      value = value.slice(1, -1);
+    }
+    meta[kv[1]] = value;
+  }
+  return { meta, body: text.slice(m[0].length) };
+}
+function firstLine(body) {
+  return body.split(/\r?\n/).map((l) => l.replace(/^#+\s*/, "").trim()).find(Boolean) ?? "";
+}
+function clip(s) {
+  s = s.replace(/\s+/g, " ").trim();
+  return s.length > MAX_DESCRIPTION ? `${s.slice(0, MAX_DESCRIPTION - 1)}…` : s;
+}
+function inside(dir, root) {
+  const rel = path.relative(path.resolve(root), dir);
+  return rel === "" || !rel.startsWith("..") && !path.isAbsolute(rel);
+}
+async function list$1(dir) {
+  try {
+    return (await fs.readdir(dir)).filter((e) => !e.startsWith(".")).sort();
+  } catch {
+    return [];
+  }
+}
+async function walk(dir, depth) {
+  let entries;
+  try {
+    entries = await fs.readdir(dir, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const e of entries.sort((a, b) => a.name.localeCompare(b.name))) {
+    if (e.name.startsWith(".")) continue;
+    const p = path.join(dir, e.name);
+    if (e.isDirectory() && depth > 0) out.push(...await walk(p, depth - 1));
+    else if (e.isFile() || e.isSymbolicLink()) out.push(p);
+  }
+  return out;
+}
+async function readHead(file) {
+  let fh;
+  try {
+    fh = await fs.open(file, "r");
+    const buf = Buffer.alloc(HEAD_BYTES);
+    const { bytesRead } = await fh.read(buf, 0, HEAD_BYTES, 0);
+    return buf.subarray(0, bytesRead).toString("utf8");
+  } catch {
+    return null;
+  } finally {
+    await fh?.close();
+  }
+}
+async function readJson(file) {
+  try {
+    return JSON.parse(await fs.readFile(file, "utf8"));
+  } catch {
+    return null;
+  }
+}
+const SSH_OPTS = ["-o", "BatchMode=yes", "-o", "ConnectTimeout=8", "-o", "ServerAliveInterval=15", "-o", "ServerAliveCountMax=3"];
+const TIMEOUT_MS = 2e4;
+const RETRY_MS$1 = 3e4;
+const NO_PYTHON_RETRY_MS = 5 * 6e4;
+class RemoteScript {
+  m;
+  sshCommand;
+  what;
+  command;
+  child;
+  buf;
+  stderr;
+  seq;
+  /** request id → resolve */
+  waiting;
+  retryAt;
+  stopped;
+  /**
+   * `sshCommand`: the ssh executable (config.ts); `file`: the script, which
+   * its caller keeps beside itself; `what`: what stops working when it dies,
+   * for the log.
+   */
+  constructor(machine, sshCommand, file, what) {
+    this.m = machine;
+    this.sshCommand = sshCommand;
+    this.what = what;
+    const script = fs$1.readFileSync(file).toString("base64");
+    this.command = `python3 -u -c "import base64; exec(base64.b64decode('${script}'))"`;
+    this.child = null;
+    this.buf = "";
+    this.stderr = "";
+    this.seq = 0;
+    this.waiting = /* @__PURE__ */ new Map();
+    this.retryAt = 0;
+    this.stopped = false;
+  }
+  stop() {
+    this.stopped = true;
+    this.child?.kill();
+  }
+  /** The script's answer, or null when it is not running or did not answer within `timeout` ms. */
+  call(request, timeout = TIMEOUT_MS) {
+    if (this.stopped) return Promise.resolve(null);
+    if (!this.child) {
+      if (Date.now() < this.retryAt) return Promise.resolve(null);
+      this.start();
+    }
+    const id = ++this.seq;
+    return new Promise((resolve) => {
+      const timer = setTimeout(() => {
+        this.waiting.delete(id);
+        this.child?.kill();
+        resolve(null);
+      }, timeout);
+      this.waiting.set(id, (result) => {
+        clearTimeout(timer);
+        resolve(result);
+      });
+      this.child.stdin.write(`${JSON.stringify({ ...request, id })}
+`);
+    });
+  }
+  start() {
+    const child = spawn(this.sshCommand, [...SSH_OPTS, "-o", "ControlPath=none", "--", this.m.ssh, this.command], {
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    this.child = child;
+    this.buf = "";
+    this.stderr = "";
+    child.stdout.setEncoding("utf8");
+    child.stderr.setEncoding("utf8");
+    child.stdin.on("error", () => {
+    });
+    child.stdout.on("data", (chunk) => {
+      this.buf += chunk;
+      let nl;
+      while ((nl = this.buf.indexOf("\n")) !== -1) {
+        const line = this.buf.slice(0, nl);
+        this.buf = this.buf.slice(nl + 1);
+        let msg;
+        try {
+          msg = JSON.parse(line);
+        } catch {
+          continue;
+        }
+        const done = this.waiting.get(msg.id);
+        this.waiting.delete(msg.id);
+        done?.(msg.result ?? null);
+      }
+    });
+    child.stderr.on("data", (d) => {
+      this.stderr = (this.stderr + d).slice(-2e3);
+    });
+    const gone = (code, signal) => {
+      if (this.child !== child) return;
+      this.child = null;
+      for (const done of this.waiting.values()) done(null);
+      this.waiting.clear();
+      if (this.stopped) return;
+      const noPython = code === 127;
+      this.retryAt = Date.now() + (noPython ? NO_PYTHON_RETRY_MS : RETRY_MS$1);
+      const why = noPython ? "python3 is not installed there" : lastLine$1(this.stderr) || (signal ? `killed by ${signal}` : `exit ${code}`);
+      console.warn(`[bridge] ${this.m.label}: ${this.what} stopped (${why}); retrying in ${(this.retryAt - Date.now()) / 1e3}s`);
+    };
+    child.once("exit", gone);
+    child.once("error", (err) => {
+      this.stderr += err.message;
+      gone(null, null);
+    });
+  }
+}
+function lastLine$1(s) {
+  return (s.trim().split("\n").map((l) => l.trim()).filter(Boolean).pop() ?? "").replace(/^ssh: /, "");
+}
+const KINDS = /* @__PURE__ */ new Set(["claude", "codex"]);
+const POLL_MS$1 = 2e3;
+const KICK_MS = 300;
+const MISS_MS = 15e3;
+const FIRST_READ_MAX = 32 * 1024 * 1024;
+const CLAUDE_WINDOW = 1e6;
+const CLAUDE_WINDOW_SMALL = 2e5;
+const CLAUDE_SMALL_MODEL = /^claude-(?:3|haiku)|^claude-(?:opus|sonnet)-4(?:-[015])?(?:-\d{8})?$/;
+const SESSION_ID = /^[A-Za-z0-9-]{1,64}$/;
+class ContextTracker extends EventEmitter {
+  m;
+  reader;
+  /** pane_id → { used, max } */
+  usage;
+  /** pane_id → pid of its agent's process (Claude Code's, or Codex's) */
+  pids;
+  /** pane_id → when to ask Herdr for its processes again */
+  misses;
+  running;
+  again;
+  kickTimer;
+  timer;
+  /** Makes the tracker for `machine`'s floor; `start()` begins reading. */
+  constructor(machine, settings) {
+    super();
+    this.m = machine;
+    this.reader = machine.ssh ? new RemoteReader(machine, settings.sshCommand) : new LocalReader(settings);
+    this.usage = /* @__PURE__ */ new Map();
+    this.pids = /* @__PURE__ */ new Map();
+    this.misses = /* @__PURE__ */ new Map();
+    this.running = false;
+    this.again = false;
+    this.kickTimer = null;
+    this.timer = null;
+  }
+  start() {
+    this.timer = setInterval(() => this.refresh(), POLL_MS$1);
+    this.timer.unref();
+    this.m.on("snapshot", () => this.kick());
+  }
+  stop() {
+    clearInterval(this.timer);
+    clearTimeout(this.kickTimer);
+    this.reader.stop();
+  }
+  /** The Kauak snapshot with `context` on every pane whose use is known. */
+  decorate(snapshot) {
+    if (this.usage.size === 0) return snapshot;
+    return {
+      ...snapshot,
+      panes: snapshot.panes.map((p) => this.usage.has(p.pane_id) ? { ...p, context: this.usage.get(p.pane_id) } : p)
+    };
+  }
+  kick() {
+    if (this.kickTimer) return;
+    this.kickTimer = setTimeout(() => {
+      this.kickTimer = null;
+      this.refresh();
+    }, KICK_MS);
+  }
+  async refresh() {
+    if (this.running) {
+      this.again = true;
+      return;
+    }
+    this.running = true;
+    try {
+      do {
+        this.again = false;
+        await this.update();
+      } while (this.again);
+    } catch (err) {
+      console.error(`[bridge] ${this.m.label}: context meters:`, err.message);
+    } finally {
+      this.running = false;
+    }
+  }
+  async update() {
+    const snap = this.m.snapshot;
+    if (!snap || this.m.state !== "live") return;
+    const panes = [];
+    const asked = /* @__PURE__ */ new Set();
+    const sessionOf = (pane) => this.m.paneSession(pane.pane_id);
+    const folderOf = (pane) => pane.cwd;
+    const codexFolders = /* @__PURE__ */ new Map();
+    for (const pane of snap.panes) {
+      if (pane.agent === "codex" && !sessionOf(pane)) codexFolders.set(folderOf(pane), (codexFolders.get(folderOf(pane)) ?? 0) + 1);
+    }
+    for (const pane of snap.panes) {
+      if (!KINDS.has(pane.agent)) continue;
+      const session = sessionOf(pane);
+      let pids = [];
+      if (!session && (pane.agent === "claude" || codexFolders.get(folderOf(pane)) === 1)) {
+        const known = this.pids.get(pane.pane_id);
+        if (known) pids = [known];
+        else if ((this.misses.get(pane.pane_id) ?? 0) <= Date.now()) {
+          asked.add(pane.pane_id);
+          pids = await this.processesOf(pane.pane_id);
+        }
+      }
+      panes.push({ pane_id: pane.pane_id, agent: pane.agent, session, pids, cwd: folderOf(pane) });
+    }
+    const results = panes.length ? await this.reader.read(panes) : /* @__PURE__ */ new Map();
+    if (!results) return;
+    const next = /* @__PURE__ */ new Map();
+    for (const p of panes) {
+      const r = results.get(p.pane_id);
+      if (r?.usage) next.set(p.pane_id, r.usage);
+      if (r?.pid) {
+        this.pids.set(p.pane_id, r.pid);
+        this.misses.delete(p.pane_id);
+      } else if (p.pids.length || asked.has(p.pane_id)) {
+        this.pids.delete(p.pane_id);
+        if (asked.has(p.pane_id)) this.misses.set(p.pane_id, Date.now() + MISS_MS);
+      }
+    }
+    const live = new Set(snap.panes.map((p) => p.pane_id));
+    for (const id of [...this.pids.keys()]) if (!live.has(id)) this.pids.delete(id);
+    if (sameUsage(next, this.usage)) return;
+    this.usage = next;
+    this.emit("change");
+  }
+  processesOf(paneId) {
+    return this.m.paneProcesses(paneId).catch(() => []);
+  }
+}
+function sameUsage(a, b) {
+  if (a.size !== b.size) return false;
+  for (const [id, u] of a) {
+    const v = b.get(id);
+    if (!v || v.used !== u.used || v.max !== u.max) return false;
+  }
+  return true;
+}
+class LocalReader {
+  dirs;
+  /** transcript path → Transcript */
+  transcripts;
+  /** kind:session id → transcript path */
+  found;
+  /** kind:session id → when to look again */
+  misses;
+  /** rollout path → its session_meta: { cwd, originator, source } */
+  rollouts;
+  constructor(dirs) {
+    this.dirs = dirs;
+    this.transcripts = /* @__PURE__ */ new Map();
+    this.found = /* @__PURE__ */ new Map();
+    this.misses = /* @__PURE__ */ new Map();
+    this.rollouts = /* @__PURE__ */ new Map();
+  }
+  stop() {
+  }
+  async read(panes) {
+    const results = /* @__PURE__ */ new Map();
+    const read = /* @__PURE__ */ new Set();
+    for (const pane of panes) {
+      const { file, pid } = await this.transcriptOf(pane).catch(() => ({ file: null, pid: null }));
+      let usage = null;
+      if (file) {
+        read.add(file);
+        let t = this.transcripts.get(file);
+        if (!t) this.transcripts.set(file, t = new Transcript(file, pane.agent));
+        usage = await t.usage().catch(() => null);
+      }
+      results.set(pane.pane_id, { usage, pid });
+    }
+    for (const file of [...this.transcripts.keys()]) if (!read.has(file)) this.transcripts.delete(file);
+    return results;
+  }
+  async transcriptOf({ agent, session, pids, cwd }) {
+    if (session?.kind === "path") return { file: session.value.endsWith(".jsonl") ? session.value : null, pid: null };
+    if (session?.kind === "id") return { file: await this.find(agent, session.value, cwd), pid: null };
+    if (agent === "codex") {
+      const started = await processStart(pids);
+      return started ? { file: await this.codexByFolder(cwd, started.at), pid: started.pid } : { file: null, pid: null };
+    }
+    for (const pid of pids) {
+      const meta = await readSessionFile(this.dirs.claudeDir, pid);
+      if (meta) return { file: await this.find("claude", meta.sessionId, meta.cwd), pid };
+    }
+    return { file: null, pid: null };
+  }
+  /** The newest terminal Codex rollout for `cwd` written since `since` (when Codex started), from the day it started on. */
+  async codexByFolder(cwd, since) {
+    let best = null, bestTime = 0;
+    for (const dir of codexDayDirs(this.dirs.codexDir, since)) {
+      for (const name of await fs$1.promises.readdir(dir).catch(() => [])) {
+        if (!name.startsWith("rollout-") || !name.endsWith(".jsonl")) continue;
+        const file = path.join(dir, name);
+        const st = await fs$1.promises.stat(file).catch(() => null);
+        if (!st || st.mtimeMs < since || st.mtimeMs <= bestTime) continue;
+        let meta = this.rollouts.get(file);
+        if (!meta) {
+          meta = await rolloutMeta(file).catch(() => null);
+          if (meta) this.rollouts.set(file, meta);
+        }
+        if (meta?.cwd === cwd && meta.originator === "codex-tui" && typeof meta.source === "string") {
+          best = file;
+          bestTime = st.mtimeMs;
+        }
+      }
+    }
+    return best;
+  }
+  /** A session id's transcript. Remembered once found; a miss is retried after a while (the file shows up with the first message). */
+  async find(kind, id, cwd = null) {
+    if (typeof id !== "string" || !SESSION_ID.test(id)) return null;
+    const key = `${kind}:${id}`;
+    const known = this.found.get(key);
+    if (known && fs$1.existsSync(known)) return known;
+    if ((this.misses.get(key) ?? 0) > Date.now()) return null;
+    const file = kind === "claude" ? await findClaudeTranscript(this.dirs.claudeDir, id, cwd) : await findCodexRollout(this.dirs.codexDir, id);
+    if (file) {
+      this.found.set(key, file);
+      this.misses.delete(key);
+    } else this.misses.set(key, Date.now() + MISS_MS);
+    return file;
+  }
+}
+class RemoteReader {
+  script;
+  constructor(machine, sshCommand) {
+    this.script = new RemoteScript(machine, sshCommand, new URL("./context_remote.py", import.meta.url), "context meters");
+  }
+  stop() {
+    this.script.stop();
+  }
+  async read(panes) {
+    const result = await this.script.call({ panes });
+    return result ? new Map(Object.entries(result)) : null;
+  }
+}
+function processStart(pids) {
+  if (!pids.length) return Promise.resolve(null);
+  return new Promise((resolve) => {
+    execFile("ps", ["-o", "pid=,lstart=", "-p", pids.join(",")], { env: { ...process.env, LC_ALL: "C" } }, (_err, out) => {
+      let best = null;
+      for (const line of String(out ?? "").split("\n")) {
+        const m = line.trim().match(/^(\d+)\s+(.+)$/);
+        const at = m ? Date.parse(m[2]) : NaN;
+        if (!Number.isNaN(at) && (!best || at < best.at)) best = { pid: Number(m[1]), at };
+      }
+      resolve(best);
+    });
+  });
+}
+function codexDayDirs(codexDir, since) {
+  const dirs = [];
+  const day = new Date(since - 864e5);
+  day.setHours(12, 0, 0, 0);
+  for (let i = 0; i < 31 && day.getTime() <= Date.now() + 864e5; i++, day.setDate(day.getDate() + 1)) {
+    const pad = (n) => String(n).padStart(2, "0");
+    dirs.push(path.join(codexDir, "sessions", String(day.getFullYear()), pad(day.getMonth() + 1), pad(day.getDate())));
+  }
+  return dirs;
+}
+async function rolloutMeta(file) {
+  const fh = await fs$1.promises.open(file, "r").catch(() => null);
+  if (!fh) return null;
+  try {
+    const buf = Buffer.alloc(1 << 20);
+    const { bytesRead } = await fh.read(buf, 0, buf.length, 0);
+    const nl = buf.subarray(0, bytesRead).indexOf(10);
+    if (nl === -1) return null;
+    let e;
+    try {
+      e = JSON.parse(buf.subarray(0, nl).toString("utf8"));
+    } catch {
+      return {};
+    }
+    const p = e?.type === "session_meta" ? e.payload : null;
+    return p ? { cwd: p.cwd ?? null, originator: p.originator ?? null, source: p.source ?? null } : {};
+  } finally {
+    await fh.close();
+  }
+}
+async function readSessionFile(claudeDir, pid) {
+  if (!Number.isInteger(pid) || !alive(pid)) return null;
+  try {
+    const meta = JSON.parse(await fs$1.promises.readFile(path.join(claudeDir, "sessions", `${pid}.json`), "utf8"));
+    return meta.pid === pid && typeof meta.sessionId === "string" ? meta : null;
+  } catch {
+    return null;
+  }
+}
+function alive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    return err.code === "EPERM";
+  }
+}
+async function findClaudeTranscript(claudeDir, id, cwd) {
+  const projects = path.join(claudeDir, "projects");
+  if (cwd) {
+    const guess = path.join(projects, cwd.replace(/[^A-Za-z0-9]/g, "-"), `${id}.jsonl`);
+    if (fs$1.existsSync(guess)) return guess;
+  }
+  for (const dir of await fs$1.promises.readdir(projects).catch(() => [])) {
+    const file = path.join(projects, dir, `${id}.jsonl`);
+    if (fs$1.existsSync(file)) return file;
+  }
+  return null;
+}
+async function findCodexRollout(codexDir, id) {
+  const ls = async (dir) => (await fs$1.promises.readdir(dir).catch(() => [])).sort().reverse();
+  const root = path.join(codexDir, "sessions");
+  for (const y of await ls(root))
+    for (const m of await ls(path.join(root, y)))
+      for (const d of await ls(path.join(root, y, m))) {
+        const dir = path.join(root, y, m, d);
+        const name = (await ls(dir)).find((f) => f.endsWith(`-${id}.jsonl`));
+        if (name) return path.join(dir, name);
+      }
+  return null;
+}
+class Transcript {
+  file;
+  parser;
+  offset;
+  rest;
+  skipFirst;
+  constructor(file, kind) {
+    this.file = file;
+    this.parser = kind === "claude" ? new ClaudeLog() : new CodexLog();
+    this.offset = 0;
+    this.rest = Buffer.alloc(0);
+    this.skipFirst = false;
+  }
+  async usage() {
+    const { size } = await fs$1.promises.stat(this.file);
+    if (size < this.offset) {
+      this.parser = this.parser.fresh();
+      this.offset = 0;
+      this.rest = Buffer.alloc(0);
+    }
+    if (size > this.offset) await this.readTo(size);
+    return this.parser.usage();
+  }
+  async readTo(size) {
+    let start = this.offset;
+    if (start === 0 && size > FIRST_READ_MAX) {
+      start = size - FIRST_READ_MAX;
+      this.skipFirst = true;
+    }
+    const stream = fs$1.createReadStream(this.file, { start, end: size - 1, highWaterMark: 1 << 20 });
+    for await (const buf of stream) {
+      let from = 0, nl;
+      while ((nl = buf.indexOf(10, from)) !== -1) {
+        const line = this.rest.length ? Buffer.concat([this.rest, buf.subarray(from, nl)]) : buf.subarray(from, nl);
+        this.rest = Buffer.alloc(0);
+        from = nl + 1;
+        if (this.skipFirst) {
+          this.skipFirst = false;
+          continue;
+        }
+        if (this.parser.wants(line)) {
+          try {
+            this.parser.add(JSON.parse(line.toString("utf8")));
+          } catch {
+          }
+        }
+      }
+      this.rest = Buffer.concat([this.rest, buf.subarray(from)]);
+    }
+    this.offset = size;
+  }
+}
+class ClaudeLog {
+  used = null;
+  /** The model of the last call, e.g. "claude-opus-5-5". */
+  model = null;
+  /** Claude Code's name for it, which ends in "[1m]" when it asked for the 1M window. */
+  modelId = null;
+  fresh() {
+    return new ClaudeLog();
+  }
+  wants(line) {
+    return line.includes('"usage"') || line.includes('"compact_boundary"') || line.includes('"modelId"');
+  }
+  add(e) {
+    if (e.isSidechain) return;
+    if (e.type === "assistant") {
+      const u = e.message?.usage;
+      if (!u || e.message.model === "<synthetic>") return;
+      const used = (u.input_tokens ?? 0) + (u.cache_creation_input_tokens ?? 0) + (u.cache_read_input_tokens ?? 0);
+      if (used > 0) this.used = used;
+      if (typeof e.message.model === "string") this.model = e.message.model;
+    } else if (e.type === "system" && e.subtype === "compact_boundary") {
+      const post = e.compactMetadata?.postTokens;
+      this.used = typeof post === "number" ? post : null;
+    } else if (e.type === "attachment" && e.attachment?.type === "model") {
+      this.modelId = e.attachment.identity?.modelId ?? this.modelId;
+    }
+  }
+  usage() {
+    if (this.used === null) return null;
+    const small = this.used <= CLAUDE_WINDOW_SMALL && !/\[1m\]/i.test(this.modelId ?? "") && CLAUDE_SMALL_MODEL.test(this.model ?? this.modelId ?? "");
+    return { used: this.used, max: small ? CLAUDE_WINDOW_SMALL : CLAUDE_WINDOW };
+  }
+}
+class CodexLog {
+  used = null;
+  max = null;
+  fresh() {
+    return new CodexLog();
+  }
+  wants(line) {
+    return line.includes('"token_count"');
+  }
+  add(e) {
+    const info = e.type === "event_msg" && e.payload?.type === "token_count" ? e.payload.info : null;
+    if (!info) return;
+    if (typeof info.last_token_usage?.total_tokens === "number") this.used = info.last_token_usage.total_tokens;
+    if (typeof info.model_context_window === "number") this.max = info.model_context_window;
+  }
+  usage() {
+    return this.used !== null && this.max ? { used: this.used, max: this.max } : null;
+  }
+}
+const POLL_MS = 2e3;
+const ROOT_TTL_MS = 3e4;
+const FAIL_MS = 3e4;
+const MAX_FILES = 400;
+const MAX_BYTES = 512 * 1024;
+const MAX_SHEETS = 50;
+const MAX_DIFF_LINES = 800;
+const MAX_LINE = 400;
+const CONTEXT = 3;
+const LCS_CELLS = 1e6;
+const GIT_TIMEOUT_MS = 15e3;
+const MAX_GIT_OUT = 16 * 1024 * 1024;
+const MAX_DIFF_OUT = 8 * 1024 * 1024;
+const MAX_PAGES = 300;
+const MAX_TOTAL_LINES = 2e4;
+const MAX_UNTRACKED = 100;
+const UNCOMMITTED_TIMEOUT_MS = 6e4;
+const BINARY = Symbol("binary");
+const LARGE = Symbol("large");
+let sheetSeq = 0;
+class HostDown extends Error {
+  constructor() {
+    super("the remote helper is not running");
+  }
+}
+class DiffTracker extends EventEmitter {
+  m;
+  host;
+  /** folder → { root, at } */
+  folders;
+  /** git root → Checkout */
+  checkouts;
+  /** git root → sheets, oldest first */
+  sheets;
+  /** workspace id → git root */
+  roots;
+  updating;
+  again;
+  stopped;
+  timer;
+  /** Makes the printers for `machine`'s floor; `start()` begins following its rooms. */
+  constructor(machine, settings) {
+    super();
+    this.m = machine;
+    this.host = machine.ssh ? new RemoteHost(machine, settings.sshCommand) : new LocalHost();
+    this.folders = /* @__PURE__ */ new Map();
+    this.checkouts = /* @__PURE__ */ new Map();
+    this.sheets = /* @__PURE__ */ new Map();
+    this.roots = /* @__PURE__ */ new Map();
+    this.updating = false;
+    this.again = false;
+    this.stopped = false;
+    this.timer = null;
+  }
+  start() {
+    this.m.on("snapshot", () => this.update());
+    this.timer = setTimeout(() => this.poll(), POLL_MS);
+  }
+  stop() {
+    this.stopped = true;
+    clearTimeout(this.timer);
+    this.host.stop();
+  }
+  /** The Kauak snapshot with each room's `git_root`. */
+  decorate(snapshot) {
+    if (this.roots.size === 0) return snapshot;
+    return { ...snapshot, workspaces: snapshot.workspaces.map((w) => ({ ...w, git_root: this.roots.get(w.workspace_id) ?? null })) };
+  }
+  /** Every sheet still kept, oldest first. */
+  history() {
+    return [...this.sheets.values()].flat().sort((a, b) => a.at - b.at);
+  }
+  /** Everything not committed in a checkout a room is in: { files, incomplete, error? }. */
+  async uncommitted(root) {
+    const co = this.checkouts.get(root);
+    if (!co) return { files: [], incomplete: false, error: "That room is not in a git checkout." };
+    try {
+      return await co.uncommitted();
+    } catch (err) {
+      return {
+        files: [],
+        incomplete: false,
+        error: err instanceof HostDown ? `${this.m.label} is not answering.` : lastLine(err)
+      };
+    }
+  }
+  update() {
+    if (this.updating) {
+      this.again = true;
+      return;
+    }
+    this.updating = true;
+    this.resolveRooms().catch((err) => console.error(`[bridge] ${this.m.label}: printers:`, err.message)).finally(() => {
+      this.updating = false;
+      if (this.again) {
+        this.again = false;
+        this.update();
+      }
+    });
+  }
+  async resolveRooms() {
+    const snap = this.m.snapshot;
+    if (!snap) return;
+    const next = /* @__PURE__ */ new Map();
+    for (const ws of snap.workspaces) {
+      const folder = ws.repo?.checkout ?? snap.panes.find((p) => p.workspace_id === ws.workspace_id)?.cwd;
+      const root = folder ? await this.rootOf(folder) : null;
+      if (root) next.set(ws.workspace_id, root);
+    }
+    if (this.stopped) return;
+    const used = new Set(next.values());
+    for (const root of [...this.checkouts.keys()]) {
+      if (!used.has(root)) {
+        this.checkouts.delete(root);
+        this.sheets.delete(root);
+      }
+    }
+    for (const root of used) if (!this.checkouts.has(root)) this.checkouts.set(root, new Checkout(root, this.host));
+    if (!sameMap(next, this.roots)) {
+      this.roots = next;
+      this.emit("change");
+    }
+  }
+  async rootOf(folder) {
+    const known = this.folders.get(folder);
+    if (known && (known.root || Date.now() - known.at < ROOT_TTL_MS)) return known.root;
+    let root = null;
+    try {
+      root = (await this.host.git(folder, ["rev-parse", "--show-toplevel"])).out.toString().trim() || null;
+    } catch (err) {
+      if (err instanceof HostDown) return known?.root ?? null;
+    }
+    this.folders.set(folder, { root, at: Date.now() });
+    return root;
+  }
+  async poll() {
+    for (const co of [...this.checkouts.values()]) {
+      if (this.stopped) return;
+      if (this.checkouts.get(co.root) !== co || Date.now() < co.failedUntil) continue;
+      try {
+        for (const sheet of await co.scan()) this.print(co.root, sheet);
+      } catch (err) {
+        if (err instanceof HostDown) break;
+        co.failedUntil = Date.now() + FAIL_MS;
+        for (const [folder, f] of this.folders) if (f.root === co.root) this.folders.delete(folder);
+        console.warn(`[bridge] ${this.m.label}: cannot read ${co.root}: ${lastLine(err)}`);
+      }
+    }
+    if (!this.stopped) this.timer = setTimeout(() => this.poll(), POLL_MS);
+  }
+  print(root, sheet) {
+    sheet.root = root;
+    const list2 = this.sheets.get(root) ?? [];
+    list2.push(sheet);
+    if (list2.length > MAX_SHEETS) list2.splice(0, list2.length - MAX_SHEETS);
+    this.sheets.set(root, list2);
+    this.emit("print", sheet);
+  }
+}
+class Checkout {
+  root;
+  host;
+  /** repo-relative path → { sig, content } */
+  files;
+  ready;
+  failedUntil;
+  constructor(root, host) {
+    this.root = root;
+    this.host = host;
+    this.files = /* @__PURE__ */ new Map();
+    this.ready = false;
+    this.failedUntil = 0;
+  }
+  /** The sheets for what changed since the last scan (none on the first: that is the baseline). */
+  async scan() {
+    const status = parseStatus(
+      (await this.host.git(this.root, ["status", "--porcelain=v1", "-z", "--untracked-files=all"])).out.toString("utf8")
+    );
+    const paths = [.../* @__PURE__ */ new Set([...status.keys(), ...this.files.keys()])];
+    const stats = paths.length ? await this.host.stat(this.root, paths) : /* @__PURE__ */ new Map();
+    const changed = [];
+    for (const file of paths) {
+      const st = stats.get(file) ?? null;
+      if (st === "other") continue;
+      const known = this.files.get(file);
+      if (known?.sig === (st ?? "-")) {
+        if (!status.has(file)) this.files.delete(file);
+        continue;
+      }
+      changed.push(file);
+    }
+    if (!changed.length) {
+      this.ready = true;
+      return [];
+    }
+    const present = changed.filter((f) => stats.get(f));
+    const contents = present.length ? await this.host.read(this.root, present) : /* @__PURE__ */ new Map();
+    const fresh = this.ready ? changed.filter((f) => !this.files.has(f)) : [];
+    const heads = fresh.length ? await this.headContents(fresh.map((f) => status.get(f)?.orig ?? f)) : /* @__PURE__ */ new Map();
+    const sheets = [];
+    for (const file of changed) {
+      const now = decode(contents.get(file) ?? null);
+      const known = this.files.get(file);
+      const before = known ? known.content : this.ready ? heads.get(status.get(file)?.orig ?? file) ?? null : void 0;
+      if (status.has(file)) this.files.set(file, { sig: stats.get(file) ?? "-", content: now });
+      else this.files.delete(file);
+      if (before === void 0) continue;
+      const sheet = makeSheet(file, before, now);
+      if (sheet) sheets.push(sheet);
+    }
+    this.ready = true;
+    return sheets;
+  }
+  /** What HEAD has at each path (null where it has nothing), in one `git cat-file --batch`. */
+  async headContents(paths) {
+    const result = new Map(paths.map((p) => [p, null]));
+    const asked = paths.filter((p) => !p.includes("\n"));
+    if (!asked.length) return result;
+    const { out } = await this.host.git(this.root, ["cat-file", "--batch"], {
+      input: Buffer.from(asked.map((p) => `HEAD:${p}
+`).join(""))
+    });
+    let at = 0;
+    for (const p of asked) {
+      const nl = out.indexOf(10, at);
+      if (nl === -1) break;
+      const m = /^[0-9a-f]{40,64} (\w+) (\d+)$/.exec(out.subarray(at, nl).toString("utf8"));
+      at = nl + 1;
+      if (!m) continue;
+      const size = Number(m[2]);
+      if (m[1] === "blob") result.set(p, decode(out.subarray(at, at + size)));
+      at += size + 1;
+    }
+    return result;
+  }
+  /** Everything not committed: `git diff` against HEAD and the untracked files, one page per file, by path. */
+  async uncommitted() {
+    const opts = { timeout: UNCOMMITTED_TIMEOUT_MS };
+    const base = await this.host.git(this.root, ["rev-parse", "-q", "--verify", "HEAD"], opts).then(
+      () => "HEAD",
+      async () => (await this.host.git(this.root, ["hash-object", "-t", "tree", "--stdin"], { ...opts, input: Buffer.alloc(0) })).out.toString().trim()
+    );
+    const diff = await this.host.git(
+      this.root,
+      [
+        "diff",
+        base,
+        "--no-color",
+        "--no-ext-diff",
+        "--no-textconv",
+        "--no-relative",
+        "--find-renames",
+        "--src-prefix=a/",
+        "--dst-prefix=b/",
+        `-U${CONTEXT}`,
+        "--"
+      ],
+      { ...opts, max: MAX_DIFF_OUT }
+    );
+    const pages = parseGitDiff(diff.out.toString("utf8"));
+    let incomplete = diff.truncated;
+    const untracked = (await this.host.git(this.root, ["ls-files", "--others", "--exclude-standard", "-z"], opts)).out.toString("utf8").split("\0").filter(Boolean);
+    const read = untracked.slice(0, MAX_UNTRACKED);
+    const contents = read.length ? await this.host.read(this.root, read, opts) : /* @__PURE__ */ new Map();
+    for (const file of untracked) {
+      const page = { path: file, change: "added", untracked: true, added: 0, removed: 0, diff: "", truncated: false };
+      const content = contents.has(file) ? decode(contents.get(file)) : void 0;
+      if (content === void 0) pages.push({ ...page, note: "Not printed: too many new files." });
+      else if (content === null)
+        continue;
+      else if (typeof content === "symbol") pages.push({ ...page, note: content === LARGE ? "Too large to print." : "Binary file." });
+      else pages.push({ ...page, ...lineDiff([], lines(content)) });
+    }
+    pages.sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+    if (pages.length > MAX_PAGES) {
+      pages.length = MAX_PAGES;
+      incomplete = true;
+    }
+    let total = 0;
+    for (const page of pages) {
+      const n = page.diff ? page.diff.split("\n").length : 0;
+      if (total + n <= MAX_TOTAL_LINES) {
+        total += n;
+        continue;
+      }
+      Object.assign(page, { diff: "", truncated: false, note: "Not printed: there was too much to print." });
+      incomplete = true;
+    }
+    return { files: pages, incomplete };
+  }
+}
+class LocalHost {
+  stop() {
+  }
+  git(cwd, args, { input = null, max = MAX_GIT_OUT } = {}) {
+    return new Promise((resolve, reject) => {
+      const child = execFile(
+        "git",
+        ["-c", "core.quotepath=off", ...args],
+        {
+          cwd,
+          encoding: "buffer",
+          maxBuffer: max,
+          timeout: GIT_TIMEOUT_MS,
+          env: { ...process.env, GIT_OPTIONAL_LOCKS: "0" }
+        },
+        (err, stdout, stderr) => {
+          if (err?.code === "ERR_CHILD_PROCESS_STDIO_MAXBUFFER") resolve({ out: stdout, truncated: true });
+          else if (err) reject(Object.assign(err, { stderr }));
+          else resolve({ out: stdout, truncated: false });
+        }
+      );
+      child.stdin.on("error", () => {
+      });
+      child.stdin.end(input ?? void 0);
+    });
+  }
+  async stat(root, paths) {
+    const stats = await Promise.all(paths.map((p) => fs$1.promises.lstat(path.join(root, p)).catch(() => null)));
+    return new Map(
+      paths.map((p, i) => {
+        const st = stats[i];
+        return [p, !st ? null : st.isFile() ? `${st.size}:${st.mtimeMs}` : "other"];
+      })
+    );
+  }
+  async read(root, paths) {
+    const out = await Promise.all(
+      paths.map(async (p) => {
+        const file = path.join(root, p);
+        const st = await fs$1.promises.stat(file).catch(() => null);
+        if (!st) return null;
+        if (st.size > MAX_BYTES) return LARGE;
+        return fs$1.promises.readFile(file).catch(() => null);
+      })
+    );
+    return new Map(paths.map((p, i) => [p, out[i]]));
+  }
+}
+class RemoteHost {
+  script;
+  constructor(machine, sshCommand) {
+    this.script = new RemoteScript(machine, sshCommand, new URL("./diffs_remote.py", import.meta.url), "printers");
+  }
+  stop() {
+    this.script.stop();
+  }
+  async call(request, timeout) {
+    const result = await this.script.call(request, timeout);
+    if (result == null) throw new HostDown();
+    return result;
+  }
+  async git(cwd, args, { input = null, max = MAX_GIT_OUT, timeout } = {}) {
+    const r = await this.call(
+      { op: "git", cwd, args, input: input ? input.toString("base64") : null, max },
+      timeout
+    );
+    if (!r.ok) throw Object.assign(new Error(r.err || `git ${args[0]} failed`), { stderr: r.err });
+    return { out: Buffer.from(r.out, "base64"), truncated: r.truncated };
+  }
+  async stat(root, paths) {
+    return new Map(Object.entries(await this.call({ op: "stat", root, paths })));
+  }
+  async read(root, paths, { timeout } = {}) {
+    const r = await this.call({ op: "read", root, paths, max: MAX_BYTES }, timeout);
+    return new Map(
+      Object.entries(r).map(([p, v]) => [p, v === "large" ? LARGE : v === null ? null : Buffer.from(v, "base64")])
+    );
+  }
+}
+function parseStatus(out) {
+  const entries = /* @__PURE__ */ new Map();
+  const parts = out.split("\0");
+  for (let i = 0; i < parts.length && entries.size < MAX_FILES; i++) {
+    const e = parts[i];
+    if (e.length < 4) continue;
+    const code = e.slice(0, 2);
+    const orig = code[0] === "R" || code[0] === "C" ? parts[++i] ?? null : null;
+    entries.set(e.slice(3), { code, orig });
+  }
+  return entries;
+}
+function parseGitDiff(text) {
+  const pages = [];
+  let page = null, rows = [], inHunk = false, mode = false;
+  const done = () => {
+    if (!page) return;
+    page.diff = rows.join("\n");
+    if (!page.diff && !page.note)
+      page.note = page.change === "renamed" ? "Renamed; the contents did not change." : mode ? "Only the file's mode changed." : "Nothing to print.";
+    pages.push(page);
+  };
+  for (const line of text.split("\n")) {
+    if (line.startsWith("diff --git ")) {
+      done();
+      page = { path: gitLinePath(line.slice(11)), change: "modified", added: 0, removed: 0, diff: "", truncated: false };
+      rows = [];
+      inHunk = false;
+      mode = false;
+      continue;
+    }
+    if (!page) continue;
+    if (!inHunk) {
+      if (line.startsWith("new file mode")) page.change = "added";
+      else if (line.startsWith("deleted file mode")) page.change = "deleted";
+      else if (line.startsWith("old mode")) mode = true;
+      else if (line.startsWith("rename from ")) {
+        page.change = "renamed";
+        page.from = unquote(line.slice(12));
+      } else if (line.startsWith("rename to ")) page.path = unquote(line.slice(10));
+      else if (line.startsWith("--- ") && line !== "--- /dev/null") page.path = headerPath(line.slice(4), "a/");
+      else if (line.startsWith("+++ ") && line !== "+++ /dev/null") page.path = headerPath(line.slice(4), "b/");
+      else if (line.startsWith("Binary files ")) page.note = "Binary file.";
+      if (!line.startsWith("@@")) continue;
+      inHunk = true;
+    }
+    const kind = line[0];
+    if (kind === "+") page.added++;
+    else if (kind === "-") page.removed++;
+    else if (kind !== " " && kind !== "@") continue;
+    if (rows.length >= MAX_DIFF_LINES) {
+      page.truncated = true;
+      continue;
+    }
+    rows.push(line.length > MAX_LINE + 1 ? `${line.slice(0, MAX_LINE + 1)}…` : line);
+  }
+  done();
+  return pages;
+}
+function gitLinePath(s) {
+  const n = (s.length - 5) / 2;
+  if (Number.isInteger(n) && s.startsWith("a/") && s.slice(2 + n) === ` b/${s.slice(2, 2 + n)}`) return s.slice(2, 2 + n);
+  const b = s.lastIndexOf(" b/");
+  return unquote(b > 0 ? s.slice(b + 3) : s);
+}
+function headerPath(s, prefix) {
+  const p = unquote(s.replace(/\t$/, ""));
+  return p.startsWith(prefix) ? p.slice(prefix.length) : p;
+}
+function unquote(s) {
+  if (s.length < 2 || !s.startsWith('"') || !s.endsWith('"')) return s;
+  const bytes = [];
+  const body = s.slice(1, -1);
+  for (let i = 0; i < body.length; i++) {
+    if (body[i] !== "\\") {
+      bytes.push(...Buffer.from(body[i]));
+      continue;
+    }
+    const c = body[++i] ?? "";
+    if (/[0-7]/.test(c)) {
+      bytes.push(parseInt(body.slice(i, i + 3), 8));
+      i += 2;
+    } else bytes.push({ n: 10, t: 9, r: 13, a: 7, b: 8, f: 12, v: 11 }[c] ?? c.charCodeAt(0));
+  }
+  return Buffer.from(bytes).toString("utf8");
+}
+function decode(buf) {
+  if (buf === null || typeof buf === "symbol") return buf;
+  if (buf.length > MAX_BYTES) return LARGE;
+  return buf.subarray(0, 8e3).includes(0) ? BINARY : buf.toString("utf8");
+}
+function makeSheet(file, before, after) {
+  if (before === after && typeof before !== "symbol") return null;
+  const sheet = {
+    id: `${Date.now().toString(36)}-${(++sheetSeq).toString(36)}`,
+    path: file,
+    change: before === null ? "added" : after === null ? "deleted" : "modified",
+    at: Date.now()
+  };
+  if (typeof before === "symbol" || typeof after === "symbol") {
+    const note = before === LARGE || after === LARGE ? "Too large to print." : "Binary file.";
+    return { ...sheet, added: 0, removed: 0, diff: "", truncated: false, note };
+  }
+  const d = lineDiff(before === null ? [] : lines(before), after === null ? [] : lines(after));
+  return d.added || d.removed ? { ...sheet, ...d } : null;
+}
+function lines(text) {
+  const rows = text.split("\n");
+  if (rows[rows.length - 1] === "") rows.pop();
+  return rows.map((r) => r.endsWith("\r") ? r.slice(0, -1) : r);
+}
+function lineDiff(a, b) {
+  let pre = 0;
+  while (pre < a.length && pre < b.length && a[pre] === b[pre]) pre++;
+  let suf = 0;
+  while (suf < a.length - pre && suf < b.length - pre && a[a.length - 1 - suf] === b[b.length - 1 - suf]) suf++;
+  const ops = a.slice(0, pre).map((t) => [" ", t]);
+  ops.push(...middle(a.slice(pre, a.length - suf), b.slice(pre, b.length - suf)));
+  for (let i = a.length - suf; i < a.length; i++) ops.push([" ", a[i]]);
+  return hunks(ops);
+}
+function middle(A, B) {
+  const n = A.length, m = B.length;
+  if (n * m > LCS_CELLS) return [...A.map((t) => ["-", t]), ...B.map((t) => ["+", t])];
+  const w = m + 1;
+  const L = new Uint16Array((n + 1) * w);
+  for (let i2 = n - 1; i2 >= 0; i2--) {
+    for (let j2 = m - 1; j2 >= 0; j2--) {
+      L[i2 * w + j2] = A[i2] === B[j2] ? L[(i2 + 1) * w + j2 + 1] + 1 : Math.max(L[(i2 + 1) * w + j2], L[i2 * w + j2 + 1]);
+    }
+  }
+  const out = [];
+  let i = 0, j = 0;
+  while (i < n && j < m) {
+    if (A[i] === B[j]) {
+      out.push([" ", A[i]]);
+      i++;
+      j++;
+    } else if (L[(i + 1) * w + j] >= L[i * w + j + 1]) out.push(["-", A[i++]]);
+    else out.push(["+", B[j++]]);
+  }
+  while (i < n) out.push(["-", A[i++]]);
+  while (j < m) out.push(["+", B[j++]]);
+  return out;
+}
+function hunks(ops) {
+  let added = 0, removed = 0;
+  const changes = [];
+  const oldAt = new Int32Array(ops.length + 1), newAt = new Int32Array(ops.length + 1);
+  for (let k = 0, o = 1, n = 1; k <= ops.length; k++) {
+    oldAt[k] = o;
+    newAt[k] = n;
+    const kind = ops[k]?.[0];
+    if (kind === "+") {
+      added++;
+      n++;
+      changes.push(k);
+    } else if (kind === "-") {
+      removed++;
+      o++;
+      changes.push(k);
+    } else if (kind === " ") {
+      o++;
+      n++;
+    }
+  }
+  const out = [];
+  let truncated = false;
+  for (let c = 0; c < changes.length && !truncated; c++) {
+    const start = Math.max(0, changes[c] - CONTEXT);
+    let end = changes[c];
+    while (c + 1 < changes.length && changes[c + 1] - end <= CONTEXT * 2 + 1) end = changes[++c];
+    const slice = ops.slice(start, Math.min(ops.length, end + CONTEXT + 1));
+    const oldLen = slice.filter(([k]) => k !== "+").length, newLen = slice.filter(([k]) => k !== "-").length;
+    out.push(`@@ -${oldAt[start] - (oldLen ? 0 : 1)},${oldLen} +${newAt[start] - (newLen ? 0 : 1)},${newLen} @@`);
+    for (const [k, t] of slice) out.push(k + (t.length > MAX_LINE ? `${t.slice(0, MAX_LINE)}…` : t));
+    if (out.length > MAX_DIFF_LINES) truncated = true;
+  }
+  return { added, removed, diff: out.slice(0, MAX_DIFF_LINES).join("\n"), truncated };
+}
+function sameMap(a, b) {
+  if (a.size !== b.size) return false;
+  for (const [k, v] of a) if (b.get(k) !== v) return false;
+  return true;
+}
+function lastLine(err) {
+  const text = err.stderr?.toString() || err.message;
+  return text.trim().split("\n").pop();
+}
+const RUNTIME = "Herdr";
+const STATUSES = new Set(AGENT_STATUSES);
+function toSnapshot(raw) {
+  const rects = /* @__PURE__ */ new Map();
+  for (const layout of list(raw?.layouts)) for (const p of list(layout?.panes)) rects.set(p?.pane_id, p?.rect);
+  return {
+    workspaces: list(raw?.workspaces).map((w) => ({
+      workspace_id: String(w.workspace_id),
+      number: Number.isInteger(w.number) ? w.number : 0,
+      label: typeof w.label === "string" ? w.label : "",
+      focused: w.focused === true,
+      repo: repoOf(w.worktree),
+      git_root: null
+    })),
+    panes: list(raw?.panes).map((p) => ({
+      pane_id: String(p.pane_id),
+      workspace_id: String(p.workspace_id),
+      focused: p.focused === true,
+      cwd: p.foreground_cwd || p.cwd || null,
+      // Herdr strips the spinner or status glyph an agent puts in front of its title.
+      title: p.terminal_title_stripped || p.terminal_title || "",
+      agent: typeof p.agent === "string" && p.agent ? p.agent : null,
+      agent_status: STATUSES.has(p.agent_status) ? p.agent_status : "unknown",
+      screen: screenOf(p.scroll, rects.get(p.pane_id)),
+      scrollback: (p.scroll?.max_offset_from_bottom ?? 0) > 0,
+      context: null
+    }))
+  };
+}
+function repoOf(wt) {
+  if (!wt || typeof wt.repo_key !== "string") return null;
+  return { key: wt.repo_key, name: wt.repo_name, root: wt.repo_root, checkout: wt.checkout_path, linked: wt.is_linked_worktree === true };
+}
+function screenOf(scroll, rect) {
+  const rows = scroll?.viewport_rows || rect?.height;
+  if (!rows) return null;
+  return { rows, cols: rect?.width ?? null, exact: rect !== void 0 && rect.height === scroll?.viewport_rows };
+}
+function paneSession(raw, paneId) {
+  const pane = list(raw?.panes).find((p) => p.pane_id === paneId);
+  const s = pane?.agent_session;
+  return s && s.agent === pane.agent && (s.kind === "id" || s.kind === "path") && typeof s.value === "string" ? { kind: s.kind, value: s.value } : null;
+}
+function errorMessage(err) {
+  if (err?.code === "ENOENT" || err?.code === "ECONNREFUSED") return `${RUNTIME} is not running`;
+  const text = String(err?.message ?? err);
+  return text.split("\n").map((l) => l.trim()).filter(Boolean).pop() ?? text;
+}
+function list(v) {
+  return Array.isArray(v) ? v.filter((x) => x && typeof x === "object") : [];
+}
+const TUNNEL_READY_MS = 2e4;
+const RETRY_MS = [2e3, 4e3, 8e3, 15e3, 3e4];
+const SNAPSHOT_DEBOUNCE_MS = 80;
+const MAX_KEYS_PER_CALL = 64;
+const AGENT_WAIT_MS = 1e4;
+const AGENT_RETRY_MS = 300;
+const REMOTE_PROBE = `sh -c '${[
+  `p="\${HERDR_SOCKET_PATH:-\${XDG_CONFIG_HOME:-$HOME/.config}/herdr/herdr.sock}"`,
+  `printf "%s" "$p"`,
+  `[ -S "$p" ] || exit 3`
+].join("; ")}'`;
+const SUBSCRIPTIONS = [
+  "workspace.created",
+  "workspace.updated",
+  "workspace.metadata_updated",
+  "workspace.renamed",
+  "workspace.moved",
+  "workspace.reordered",
+  "workspace.closed",
+  "workspace.focused",
+  "worktree.created",
+  "worktree.opened",
+  "worktree.removed",
+  "tab.created",
+  "tab.closed",
+  "tab.focused",
+  "tab.renamed",
+  "tab.moved",
+  "pane.created",
+  "pane.closed",
+  "pane.updated",
+  "pane.focused",
+  "pane.moved",
+  "pane.exited",
+  "pane.agent_detected",
+  "layout.updated"
+].map((type) => ({ type }));
+let reqSeq = 0;
+function herdrRequest(socketPath, method, params = {}) {
+  return new Promise((resolve, reject) => {
+    const id = `office:${++reqSeq}`;
+    const sock = net.createConnection(socketPath);
+    let buf = "";
+    sock.setEncoding("utf8");
+    sock.on("connect", () => sock.write(`${JSON.stringify({ id, method, params })}
+`));
+    sock.on("data", (chunk) => {
+      buf += chunk;
+      const nl = buf.indexOf("\n");
+      if (nl === -1) return;
+      const line = buf.slice(0, nl);
+      sock.end();
+      try {
+        const msg = JSON.parse(line);
+        if (msg.error) reject(Object.assign(new Error(msg.error.message), { code: msg.error.code, method }));
+        else resolve(msg.result);
+      } catch (err) {
+        reject(err);
+      }
+    });
+    sock.on("close", () => reject(Object.assign(new Error("no reply from Herdr"), { method })));
+    sock.on("error", reject);
+  });
+}
+class Machine extends EventEmitter {
+  settings;
+  id;
+  label;
+  ssh;
+  remoteSocket;
+  socketPath;
+  state;
+  message;
+  /** Herdr's latest `session.snapshot`; only this file and herdr.ts read it. */
+  raw;
+  /** The same as a Kauak Snapshot. */
+  snapshot;
+  tunnel;
+  sub;
+  retryTimer;
+  refreshTimer;
+  attempt;
+  stopped;
+  constructor({ id, label, ssh = null, socket = null, remoteSocket = null }, settings) {
+    super();
+    this.settings = settings;
+    this.id = id;
+    this.label = label;
+    this.ssh = ssh;
+    this.remoteSocket = remoteSocket;
+    this.socketPath = ssh ? path.join(settings.tunnelDir, `${id}.sock`) : socket ?? settings.herdrSocket;
+    this.state = "connecting";
+    this.message = ssh ? `ssh ${ssh}…` : "";
+    this.raw = null;
+    this.snapshot = null;
+    this.tunnel = null;
+    this.sub = null;
+    this.retryTimer = null;
+    this.refreshTimer = null;
+    this.attempt = 0;
+    this.stopped = false;
+  }
+  /** The floor's Kauak MachineInfo. */
+  get info() {
+    return {
+      id: this.id,
+      label: this.label,
+      ssh: this.ssh,
+      state: this.state,
+      message: this.message,
+      runtime: { name: RUNTIME, version: this.raw?.version ?? null }
+    };
+  }
+  /** Settings that go in the config file. */
+  get config() {
+    const c = { id: this.id, label: this.label };
+    if (this.ssh) c.ssh = this.ssh;
+    if (this.remoteSocket) c.remoteSocket = this.remoteSocket;
+    if (!this.ssh && this.socketPath !== this.settings.herdrSocket) c.socket = this.socketPath;
+    return c;
+  }
+  start() {
+    this.connect();
+  }
+  stop() {
+    this.stopped = true;
+    clearTimeout(this.retryTimer);
+    clearTimeout(this.refreshTimer);
+    this.sub?.destroy();
+    this.closeTunnel();
+  }
+  request(method, params) {
+    return herdrRequest(this.socketPath, method, params);
+  }
+  // ------------------------------------------------------------ Kauak operations
+  //
+  // What the core and the enrichers ask of a floor (the Runtime port). Each is
+  // a Herdr request or two; a failure rejects with a message fit to show
+  // (herdr.ts).
+  async focusPane(paneId) {
+    await this.call("pane.focus", { pane_id: paneId });
+  }
+  /** The pane's screen as ANSI text; with `lines`, the last `lines` rows of its history and screen. */
+  async readPane(paneId, lines2 = null) {
+    const res = await this.call("pane.read", {
+      pane_id: paneId,
+      source: lines2 ? "recent" : "visible",
+      format: "ansi",
+      strip_ansi: false,
+      lines: lines2
+    });
+    return res.read.text;
+  }
+  async sendText(paneId, text) {
+    await this.call("pane.send_text", { pane_id: paneId, text });
+  }
+  /** Kauak's key names (KEY in @kauak/protocol) are Herdr's own, so they go as they are. */
+  async sendKeys(paneId, keys) {
+    for (let i = 0; i < keys.length; i += MAX_KEYS_PER_CALL) {
+      await this.call("pane.send_keys", { pane_id: paneId, keys: keys.slice(i, i + MAX_KEYS_PER_CALL) });
+    }
+  }
+  /**
+   * A new desk: a new tab in the room, in the room's folder. Returns its
+   * pane's id. A tab rather than a split: a split pane gets only part of the
+   * Herdr window, and the side panel mirrors a pane at its real size, so a
+   * desk split off another came out as a narrow strip with the rest of the
+   * panel empty.
+   */
+  async createDesk(workspaceId) {
+    const snap = this.raw;
+    const room = snap?.workspaces.find((w) => w.workspace_id === workspaceId);
+    if (!room) throw new Error("That room is gone.");
+    const panes = snap.panes.filter((p) => p.workspace_id === room.workspace_id);
+    const cwd = room.worktree?.checkout_path ?? (panes.find((p) => p.tab_id === room.active_tab_id) ?? panes[0])?.cwd ?? null;
+    const res = await this.call("tab.create", { workspace_id: room.workspace_id, cwd, focus: false });
+    return res.root_pane.pane_id;
+  }
+  /**
+   * A new room (a Kauak RoomSpec, its folder already checked by the core): a
+   * git worktree on a new branch, or a workspace in a folder. Returns its
+   * first pane's id.
+   */
+  async createRoom(room) {
+    const res = room.kind === "worktree" ? await this.call("worktree.create", {
+      cwd: room.cwd,
+      branch: room.branch,
+      base: room.base ?? null,
+      label: room.label ?? null,
+      focus: false
+    }) : await this.call("workspace.create", { cwd: room.cwd, label: room.label ?? null, focus: false });
+    return res.root_pane.pane_id;
+  }
+  /** Start an agent of `kind` in a pane, once the pane's shell is ready for it. */
+  async startAgent(kind, paneId) {
+    const name = `${kind}-${Math.random().toString(36).slice(2, 6)}`.slice(0, 32);
+    for (const started = Date.now(); ; await new Promise((r) => setTimeout(r, AGENT_RETRY_MS))) {
+      try {
+        await this.request("agent.start", { name, kind, pane_id: paneId });
+        return;
+      } catch (err) {
+        if (err.code !== "agent_pane_busy" || Date.now() - started > AGENT_WAIT_MS)
+          throw new Error(errorMessage(err));
+      }
+    }
+  }
+  /** The agent session reported for the pane's agent (a transcript path or a session id), or null. */
+  paneSession(paneId) {
+    return paneSession(this.raw, paneId);
+  }
+  /** The pids of the pane's foreground processes. */
+  async paneProcesses(paneId) {
+    const res = await this.call("pane.process_info", { pane_id: paneId });
+    return (res?.process_info?.foreground_processes ?? []).map((p) => p.pid).filter(Number.isInteger);
+  }
+  async call(method, params) {
+    try {
+      return await this.request(method, params);
+    } catch (err) {
+      throw new Error(errorMessage(err));
+    }
+  }
+  // ------------------------------------------------------------ lifecycle
+  async connect() {
+    this.retryTimer = null;
+    if (this.stopped) return;
+    try {
+      if (this.ssh && this.tunnel && !fs$1.existsSync(this.socketPath)) this.closeTunnel();
+      if (this.ssh && !this.tunnel) await this.openTunnel();
+      this.subscribe();
+    } catch (err) {
+      this.fail(err.message);
+    }
+  }
+  /** Mark the floor down and retry. A tunnel failure explains more than the connection drop it causes, so it wins. */
+  fail(message, fromTunnel = false) {
+    if (this.stopped) return;
+    this.sub?.destroy();
+    this.sub = null;
+    if (this.retryTimer && !fromTunnel) return;
+    this.setState("down", message);
+    if (this.retryTimer) return;
+    const wait = RETRY_MS[Math.min(this.attempt++, RETRY_MS.length - 1)];
+    console.warn(`[bridge] ${this.label}: ${message}; retrying in ${wait / 1e3}s`);
+    this.retryTimer = setTimeout(() => this.connect(), wait);
+  }
+  setState(state, message = "") {
+    if (state === this.state && message === this.message) return;
+    this.state = state;
+    this.message = message;
+    this.emit("status", this.info);
+  }
+  subscribe() {
+    const sock = net.createConnection(this.socketPath);
+    this.sub = sock;
+    let buf = "";
+    let answered = false;
+    sock.setEncoding("utf8");
+    sock.on("connect", () => {
+      sock.write(`${JSON.stringify({ id: "office:sub", method: "events.subscribe", params: { subscriptions: SUBSCRIPTIONS } })}
+`);
+    });
+    sock.on("data", (chunk) => {
+      if (!answered) {
+        answered = true;
+        console.log(`[bridge] ${this.label}: subscribed to herdr events`);
+        this.scheduleRefresh();
+      }
+      buf += chunk;
+      let nl;
+      while ((nl = buf.indexOf("\n")) !== -1) {
+        const line = buf.slice(0, nl).trim();
+        buf = buf.slice(nl + 1);
+        if (!line) continue;
+        let msg;
+        try {
+          msg = JSON.parse(line);
+        } catch {
+          continue;
+        }
+        if (msg.error) {
+          console.error(`[bridge] ${this.label}: subscribe error:`, msg.error);
+          continue;
+        }
+        if (msg.event) this.scheduleRefresh();
+      }
+    });
+    const lost = (why) => {
+      if (this.sub === sock) this.fail(why);
+    };
+    sock.on(
+      "error",
+      (err) => lost(err.code === "ENOENT" || err.code === "ECONNREFUSED" ? `Herdr is not running (${err.code})` : err.message)
+    );
+    sock.on("close", () => lost(answered ? "Herdr closed the event stream" : `no reply from Herdr${this.ssh ? ` on ${this.ssh}` : ""}`));
+  }
+  scheduleRefresh() {
+    clearTimeout(this.refreshTimer);
+    this.refreshTimer = setTimeout(() => {
+      this.refresh().catch((err) => console.error(`[bridge] ${this.label}: snapshot failed:`, err.message));
+    }, SNAPSHOT_DEBOUNCE_MS);
+  }
+  /** Fetch a fresh `session.snapshot` now and emit it as a Kauak snapshot. */
+  async refresh() {
+    clearTimeout(this.refreshTimer);
+    this.raw = (await this.request("session.snapshot")).snapshot;
+    this.snapshot = toSnapshot(this.raw);
+    this.attempt = 0;
+    this.setState("live");
+    this.emit("snapshot", this.snapshot);
+  }
+  // ------------------------------------------------------------ ssh tunnel
+  async openTunnel() {
+    fs$1.mkdirSync(this.settings.tunnelDir, { recursive: true, mode: 448 });
+    fs$1.chmodSync(this.settings.tunnelDir, 448);
+    const remote = this.remoteSocket ?? await this.probeRemoteSocket();
+    try {
+      fs$1.unlinkSync(this.socketPath);
+    } catch {
+    }
+    const child = spawn(
+      this.settings.sshCommand,
+      [
+        ...SSH_OPTS,
+        "-o",
+        "ControlPath=none",
+        "-N",
+        "-o",
+        "ExitOnForwardFailure=yes",
+        "-o",
+        "StreamLocalBindUnlink=yes",
+        "-L",
+        `${this.socketPath}:${remote}`,
+        "--",
+        this.ssh
+      ],
+      { stdio: ["ignore", "ignore", "pipe"] }
+    );
+    this.tunnel = child;
+    let stderr = "";
+    child.stderr.setEncoding("utf8");
+    child.stderr.on("data", (d) => {
+      stderr = (stderr + d).slice(-2e3);
+    });
+    const why = (code, signal) => lastLine$1(stderr) || (signal ? `killed by ${signal}` : `connection closed (exit ${code})`);
+    await new Promise((resolve, reject) => {
+      const started = Date.now();
+      let settled = false;
+      const died = (message) => {
+        if (settled) return;
+        settled = true;
+        clearInterval(poll);
+        if (this.tunnel === child) this.closeTunnel();
+        reject(new Error(message));
+      };
+      const poll = setInterval(() => {
+        if (fs$1.existsSync(this.socketPath)) {
+          settled = true;
+          clearInterval(poll);
+          resolve();
+        } else if (Date.now() - started > TUNNEL_READY_MS) died("ssh: timed out opening the tunnel");
+      }, 100);
+      child.once("exit", (code, signal) => died(`ssh: ${why(code, signal)}`));
+      child.once("error", (err) => died(`ssh: ${err.message}`));
+    });
+    console.log(`[bridge] ${this.label}: tunnel up (${this.socketPath} → ${this.ssh}:${remote})`);
+    child.once("exit", (code, signal) => {
+      if (this.tunnel !== child) return;
+      this.tunnel = null;
+      this.fail(`ssh tunnel closed: ${why(code, signal)}`, true);
+    });
+  }
+  closeTunnel() {
+    const child = this.tunnel;
+    this.tunnel = null;
+    child?.kill();
+    if (this.ssh)
+      try {
+        fs$1.unlinkSync(this.socketPath);
+      } catch {
+      }
+  }
+  probeRemoteSocket() {
+    return new Promise((resolve, reject) => {
+      execFile(
+        this.settings.sshCommand,
+        [...SSH_OPTS, "--", this.ssh, REMOTE_PROBE],
+        { timeout: TUNNEL_READY_MS },
+        (err, stdout, stderr) => {
+          if (!err) return resolve(stdout.trim());
+          if (err.code === 3) return reject(new Error(`Herdr is not running on ${this.ssh} (no socket at ${stdout.trim()})`));
+          reject(new Error(`ssh: ${lastLine$1(stderr) || err.message}`));
+        }
+      );
+    });
+  }
+}
+function createBridge(config, deps = {}) {
+  const bridge = new Bridge(config, { ...herdrBridge(config), ...deps });
+  const floors = bridge.machines;
+  return { listen: () => bridge.listen(), close: () => bridge.close(), floors };
+}
+function herdrBridge(config) {
+  return {
+    runtime: (floor) => new Machine(floor, config),
+    enrichers: (floor) => {
+      const context = new ContextTracker(floor, config);
+      const diffs = new DiffTracker(floor, config);
+      return { enrichers: [context, diffs], printers: diffs };
+    },
+    commands: (agent, cwd, local) => slashCommands(agent, cwd, local, config)
+  };
+}
+export {
+  createBridge
+};