@manyoars/oars 0.1.1 → 0.3.0

package/dist/gate/report.js

@@ -0,0 +1,89 @@
+// `oars gate report`: counts over the rows the hook and a replay wrote, each crossing once. No judgment word appears here; a count says what was seen, and `LIMITS` says what was not.
+import { AGAINST_LATEST, ARMS, LINE_IDS, CROSSING_CLASSES, CROSSING_FORMS, DEPTHS, DECIDERS, MISSES, NEXTS, NOVELTIES, ORIGINS, PERMISSIONS, REGISTRY_AGES, REGISTRY_STATES, STATUSES, VIAS, crossingsOf, } from './record.js';
+import { POLICY_SOURCES } from './policy.js';
+import { REGISTRY_NOT_READ } from './replay.js';
+/** What a replay of logs on disk cannot see, said every time so a count is never read as the whole. */
+export const LIMITS = [
+    'a command run from a script, an alias, or a Makefile target, because only the call the agent made is in the log',
+    'a change to a manifest or lockfile that a later bare install picked up',
+    'what a person saw or approved on screen; the permission mode is what the log kept',
+    'an MCP server that was started and never called',
+    'folders off the allowlist, and logs the harness has already cleaned up',
+    'a session in Codex, Cursor, Copilot, Gemini CLI, Grok Build, or VS Code Copilot Chat, which replay does not read (`--allow codex`, `--allow cursor`, `--allow copilot`, `--allow gemini`, `--allow grok`, and `--allow vscode-copilot` add nothing to it): they keep sessions in their own formats, not as transcript files',
+    'pool reads, sign-in, and deposit prompts; this release reads none of them',
+];
+const tally = (vocabulary, rows, pick) => vocabulary.map((value) => ({ value, count: rows.filter((row) => pick(row) === value).length }));
+const classCounts = (rows) => CROSSING_CLASSES.flatMap((cls) => CROSSING_FORMS.flatMap((form) => {
+    const these = rows.filter((row) => row.class === cls && row.form === form);
+    return these.length === 0 ? [] : [{ class: cls, form, count: these.length, distinct: new Set(these.map((row) => row.name)).size }];
+}));
+export const reportOf = (rows) => {
+    const run = rows.find((row) => row.kind === 'run');
+    const crossings = crossingsOf(rows);
+    return {
+        ok: true,
+        transcripts: run?.transcripts ?? 0,
+        unreadable: run?.unreadable ?? 0,
+        badLines: run?.badLines ?? 0,
+        calls: run?.calls ?? 0,
+        crossings: crossings.length,
+        replayed: run !== undefined,
+        // A hook row carries the registry as it stood at its crossing, so a file with such a row has registry state to show even when no replay asked for it.
+        registryRead: (run?.registryRead ?? false) || crossings.some((row) => row.registryState !== 'not-read'),
+        via: tally(VIAS, crossings, (row) => row.via ?? 'replay'),
+        classes: classCounts(crossings),
+        origin: tally(ORIGINS, crossings, (row) => row.origin),
+        novelty: tally(NOVELTIES, crossings, (row) => row.novelty),
+        decidedBy: tally(DECIDERS, crossings, (row) => row.decidedBy),
+        permission: tally(PERMISSIONS, crossings, (row) => row.permission),
+        status: tally(STATUSES, crossings, (row) => row.status),
+        next: tally(NEXTS, crossings, (row) => row.next),
+        miss: tally(MISSES, crossings, (row) => row.miss),
+        depth: tally(DEPTHS, crossings, (row) => row.depth),
+        againstLatest: tally(AGAINST_LATEST, crossings, (row) => row.againstLatest),
+        registryState: tally(REGISTRY_STATES, crossings, (row) => row.registryState),
+        registryAge: tally(REGISTRY_AGES, crossings, (row) => row.registryAge),
+        arm: tally(ARMS, crossings, (row) => row.arm),
+        lineShown: tally(LINE_IDS, crossings, (row) => row.lineShown),
+        lineHeld: tally(LINE_IDS, crossings, (row) => row.lineHeld),
+        policy: tally(POLICY_SOURCES, crossings.filter((row) => row.policy !== undefined), (row) => row.policy ?? 'default'),
+        removedLater: crossings.filter((row) => row.removedLater === true).length,
+        unseen: Object.entries(run?.unread ?? {}).map(([value, count]) => ({ value, count })),
+        limits: [...LIMITS],
+    };
+};
+const line = (label, counts) => {
+    const shown = counts.filter((one) => one.count > 0).map((one) => `${one.value} ${String(one.count)}`);
+    return `${label}: ${shown.length === 0 ? 'none' : shown.join(', ')}`;
+};
+export const formatReport = (report) => {
+    const registry = report.registryRead
+        ? [line('Against latest', report.againstLatest), line('Registry state', report.registryState), line('Registry age', report.registryAge)]
+        : [REGISTRY_NOT_READ];
+    const books = report.replayed
+        ? [`Read ${String(report.transcripts)} transcripts (${String(report.unreadable)} unreadable, ${String(report.badLines)} torn lines) and ${String(report.calls)} tool calls.`]
+        : ['No replay has run: these rows come from the hook, and what a transcript gives reads not-read until `oars gate replay` fills it in.'];
+    return [
+        ...books,
+        `Crossings: ${String(report.crossings)}`,
+        line('Recorded by', report.via),
+        ...report.classes.map((one) => `  ${one.class} ${one.form}: ${String(one.count)} (${String(one.distinct)} distinct)`),
+        line('Name came from', report.origin),
+        line('New to', report.novelty),
+        line('Decided by', report.decidedBy),
+        line('Permission mode', report.permission),
+        line('Result', report.status),
+        line('What happened next', report.next),
+        line('Name not found', report.miss),
+        line('Line', report.depth),
+        `Removed later: ${String(report.removedLater)}`,
+        line('Notes', report.arm),
+        line('Line shown', report.lineShown),
+        line('Line held', report.lineHeld),
+        ...(report.policy.some((one) => one.count > 0) ? [line('Policy', report.policy)] : []),
+        ...registry,
+        'Replay cannot see:',
+        ...report.unseen.map((one) => `- ${String(one.count)} ${one.value} commands that state no name to record`),
+        ...report.limits.map((limit) => `- ${limit}`),
+    ].join('\n');
+};

package/dist/gate/scope.d.ts

@@ -0,0 +1,7 @@
+/** Claude Code names a worktree's folder `<repository>--claude-worktrees-<name>`, and a worktree is its repository. */
+export declare const repositoryOf: (project: string) => string;
+/**
+ * The repository a working directory is in: its nearest ancestor holding `.git` (a file in a worktree), after a worktree folder is taken off. The hook is handed
+ * where the session is now, which can be a subfolder; a few `stat` calls are all it costs.
+ */
+export declare const repositoryOfCwd: (cwd: string) => Promise<string>;

package/dist/gate/scope.js

@@ -0,0 +1,27 @@
+// The scopes a name is new in: the whole record (fleet), one repository, and one session. A repository is named by the slug Claude Code gives its project folder, with a
+// worktree counted as its repository, so a replay (which reads project folders) and a hook (which is handed a working directory) name the same repository the same way.
+import { stat } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { slugOf } from '../sessions/allow.js';
+/** Claude Code names a worktree's folder `<repository>--claude-worktrees-<name>`, and a worktree is its repository. */
+export const repositoryOf = (project) => project.replace(/--claude-worktrees-.*$/, '');
+const WORKTREE_FOLDER = /[\\/]\.claude[\\/]worktrees[\\/].*$/;
+const LEVELS = 12;
+const exists = (path) => stat(path).then(() => true, () => false);
+/**
+ * The repository a working directory is in: its nearest ancestor holding `.git` (a file in a worktree), after a worktree folder is taken off. The hook is handed
+ * where the session is now, which can be a subfolder; a few `stat` calls are all it costs.
+ */
+export const repositoryOfCwd = async (cwd) => {
+    const base = cwd.replace(WORKTREE_FOLDER, '');
+    let folder = base;
+    for (let level = 0; level < LEVELS; level += 1) {
+        if (await exists(join(folder, '.git')))
+            return repositoryOf(slugOf(folder));
+        const parent = dirname(folder);
+        if (parent === folder)
+            break;
+        folder = parent;
+    }
+    return repositoryOf(slugOf(base));
+};

package/dist/gate/transcripts.d.ts

@@ -0,0 +1,68 @@
+import type { Allow } from '../sessions/allow.js';
+import type { Redactor } from '../sessions/redact.js';
+import { type Crossing, type Removal, type UnreadShape } from './checks.js';
+import { type Miss, type Origin, type Permission, type Status } from './record.js';
+export interface TranscriptFile {
+    file: string;
+    project: string;
+    /** The main session: a subagent's is its parent's. */
+    session: string;
+    /** The subagent transcript's own name; null on a main transcript. */
+    agent: string | null;
+}
+/** One copy per project and relative path. `raw/` hard-links the same file, and the harness's copy, when it still has one, is at least as long. */
+export declare const discover: (roots: readonly string[], allow: Allow) => Promise<{
+    files: TranscriptFile[];
+    unreadable: number;
+}>;
+export interface Found {
+    crossing: Crossing;
+    ts: string | null;
+    /** In memory only: where a registry option would ask. Never written. */
+    cwd: string | null;
+    toolUseId: string | null;
+    permission: Permission;
+    /** The call's position in its transcript, and the line it sits on. */
+    call: number;
+    line: number;
+    side: boolean;
+    status: Status;
+    miss: Miss;
+}
+export interface FoundRemoval {
+    removal: Removal;
+    ts: string | null;
+    status: Status;
+}
+/** A call's answer can sit in another file when a resumed transcript holds it, so the entries are shared across a run. */
+interface CallEntry {
+    found: Found[];
+    removals: FoundRemoval[];
+}
+export type CallsSeen = Map<string, CallEntry>;
+export interface TranscriptRead {
+    found: Found[];
+    removals: FoundRemoval[];
+    unread: UnreadShape[];
+    /** The positions of the calls that pipe a download into a shell: a way around a stopped install. */
+    pipes: number[];
+    /** Every tool call line in this transcript, a replay of a resumed transcript's included: the position `Found.call` and `pipes` count in. */
+    calls: number;
+    /** The calls this transcript added to the run: those a transcript read earlier had not already shown. The run row's `calls`. */
+    fresh: number;
+    badLines: number;
+}
+/** The first pass: every call and its answer. Text is read only to settle a status; nothing of it leaves this function. */
+export declare const readCalls: (file: string, agent: string | null, redact: Redactor, seen: CallsSeen) => Promise<TranscriptRead>;
+/**
+ * The second pass, only for a transcript with a crossing, so the text of the rest is not read twice. A name's origin is what first showed it before
+ * its first crossing in this transcript, because after that the crossing's own output names it. Nothing shown, and it is `none-seen`, which says the
+ * transcript shows no source; the agent's own words do not count, since they are the thing being asked about.
+ */
+export interface Origins {
+    origins: Map<string, Origin>;
+    /** Names a main-line or subagent prompt showed before their first crossing, whatever showed them first: the operator typing a name is a decision whoever saw it first. */
+    prompted: Set<string>;
+}
+export declare const readOrigins: (file: string, firstLines: ReadonlyMap<string, number>, servers: ReadonlySet<string>) => Promise<Origins>;
+export {};

package/dist/gate/transcripts.js

@@ -0,0 +1,232 @@
+// Where a replay reads: the raw transcripts of the allowed folders, the harness's copy first and then what only the archive still holds. Reads only.
+import { join } from 'node:path';
+import { INJECTED_TAGS, isErrorResult, isObj, LEADING_TAG, resultText } from '../sessions/extract.js';
+import { SOURCES } from '../sessions/sources.js';
+import { listDir, logLines, sessionFolders, subagentFiles } from '../sessions/store.js';
+import { checkCall } from './checks.js';
+import { permissionOf } from './record.js';
+const projectTranscripts = async (folder, project, seen) => {
+    const found = [];
+    const add = (file, relative) => {
+        if (seen.has(`${project}/${relative}`))
+            return;
+        seen.add(`${project}/${relative}`);
+        found.push(file);
+    };
+    for (const entry of await listDir(folder)) {
+        if (entry.isFile() && entry.name.endsWith('.jsonl'))
+            add({ file: join(folder, entry.name), project, session: entry.name.slice(0, -'.jsonl'.length), agent: null }, entry.name);
+    }
+    for (const { dir, path, parent, name } of await subagentFiles(folder, await sessionFolders(folder))) {
+        add({ file: join(dir, name), project, session: parent, agent: name.slice(0, -'.jsonl'.length) }, [parent, 'subagents', ...path, name].join('/'));
+    }
+    return found;
+};
+/** One copy per project and relative path. `raw/` hard-links the same file, and the harness's copy, when it still has one, is at least as long. */
+export const discover = async (roots, allow) => {
+    const seen = new Set();
+    const files = [];
+    let unreadable = 0;
+    for (const root of roots) {
+        // Replay reads only the harness's transcript format: a source-table folder (Cursor, Codex, Copilot, Gemini CLI, Grok Build, VS Code Copilot Chat) is not that format, and a project folder is never named for one.
+        const projects = (await listDir(root)).filter((entry) => entry.isDirectory() && !SOURCES.some((source) => source.name === entry.name) && allow.allows(entry.name));
+        for (const project of projects) {
+            try {
+                files.push(...(await projectTranscripts(join(root, project.name), project.name, seen)));
+            }
+            catch {
+                unreadable += 1;
+            }
+        }
+    }
+    return { files, unreadable };
+};
+/** What a call that named nothing leaves in `CallsSeen`: shared, since nothing is ever added to it. */
+const NO_ENTRY = { found: [], removals: [] };
+const stringOf = (value) => (typeof value === 'string' && value !== '' ? value : null);
+const blocksOf = (line) => {
+    const content = isObj(line.message) ? line.message.content : undefined;
+    return Array.isArray(content) ? content.filter(isObj) : [];
+};
+const REFUSED = /^The user doesn't want to (?:proceed|take)/;
+/** What a failed result says when the thing named does not exist. Read here and never kept: the record holds only the closed value. */
+const NOT_FOUND = [
+    /\bE404\b|404 Not Found|is not in this registry|could not determine executable/i,
+    /No matching distribution|Could not find a version|404 Client Error|Package .{0,200} not found/i,
+    // The harness says "No such tool available". A server's own "unknown tool" names one of its actions (a batch step), so the server exists.
+    /No such tool available|server .{0,200} not (?:found|connected)/i,
+    /Unknown skill|skill .{0,200} not found/i,
+];
+const statusOf = (block, text) => {
+    if (!isErrorResult(block, text))
+        return 'ok';
+    return REFUSED.test(text) ? 'refused' : 'error';
+};
+const settle = (entry, block) => {
+    if (entry.found.every((one) => one.status !== 'none') && entry.removals.every((one) => one.status !== 'none'))
+        return;
+    const text = resultText(block);
+    const status = statusOf(block, text);
+    const miss = status === 'error' && NOT_FOUND.some((pattern) => pattern.test(text)) ? 'not-found' : 'none';
+    for (const found of entry.found) {
+        found.status = status;
+        found.miss = miss;
+    }
+    for (const removal of entry.removals)
+        removal.status = status;
+};
+const parseLine = (raw) => {
+    if (raw === '')
+        return { line: null, bad: false };
+    try {
+        const parsed = JSON.parse(raw);
+        return { line: isObj(parsed) && parsed.type !== 'api-request-blob' ? parsed : null, bad: false };
+    }
+    catch {
+        return { line: null, bad: true };
+    }
+};
+/** The first pass: every call and its answer. Text is read only to settle a status; nothing of it leaves this function. */
+export const readCalls = async (file, agent, redact, seen) => {
+    const read = { found: [], removals: [], unread: [], pipes: [], calls: 0, fresh: 0, badLines: 0 };
+    let position = -1;
+    let permission = 'unknown';
+    const readUse = (line, block) => {
+        read.calls += 1;
+        const id = stringOf(block.id);
+        if (id !== null && seen.has(id))
+            return;
+        read.fresh += 1;
+        const check = checkCall({ tool: stringOf(block.name) ?? '', input: block.input }, redact);
+        if (check.crossings.length === 0 && check.unread.length === 0 && check.removals.length === 0) {
+            // Seen all the same, so a transcript that replays this call does not count it twice.
+            if (id !== null)
+                seen.set(id, NO_ENTRY);
+            return;
+        }
+        const ts = stringOf(line.timestamp);
+        const side = agent !== null || line.isSidechain === true;
+        const found = check.crossings.map((crossing) => ({ crossing, ts, cwd: stringOf(line.cwd), toolUseId: id, permission, call: read.calls, line: position, side, status: 'none', miss: 'none' }));
+        const removals = check.removals.map((removal) => ({ removal, ts, status: 'none' }));
+        read.found.push(...found);
+        read.removals.push(...removals);
+        read.unread.push(...check.unread);
+        if (check.unread.includes('pipe-to-shell'))
+            read.pipes.push(read.calls);
+        if (id !== null)
+            seen.set(id, { found, removals });
+    };
+    for await (const raw of logLines(file)) {
+        position += 1;
+        const { line, bad } = parseLine(raw);
+        if (bad)
+            read.badLines += 1;
+        if (line === null)
+            continue;
+        const mode = stringOf(line.permissionMode);
+        if (mode !== null)
+            permission = permissionOf(mode);
+        for (const block of blocksOf(line)) {
+            if (block.type === 'tool_use')
+                readUse(line, block);
+            else if (block.type === 'tool_result') {
+                const entry = seen.get(stringOf(block.tool_use_id) ?? '');
+                if (entry !== undefined)
+                    settle(entry, block);
+            }
+        }
+    }
+    return read;
+};
+const REPO_TOOLS = new Set(['Read', 'NotebookRead', 'Grep', 'Glob', 'LS']);
+const WEB_TOOLS = new Set(['WebFetch', 'WebSearch']);
+const resultSource = (tool) => {
+    if (tool === undefined)
+        return 'tool-output';
+    if (REPO_TOOLS.has(tool))
+        return 'repo-file';
+    if (WEB_TOOLS.has(tool))
+        return 'web';
+    return tool === 'Skill' ? 'skill' : 'tool-output';
+};
+/** A meta line is a skill's or a command's body. A leading tag the harness injects is the harness speaking, not the operator. */
+const textSource = (line, text) => {
+    if (line.isMeta === true)
+        return 'skill';
+    const tag = LEADING_TAG.exec(text)?.[1];
+    return tag !== undefined && INJECTED_TAGS.has(tag) ? 'harness' : 'prompt';
+};
+const sourcedTexts = (line, tools) => {
+    if (line.type === 'attachment')
+        return isObj(line.attachment) ? [['harness', JSON.stringify(line.attachment)]] : [];
+    if (line.type === 'assistant') {
+        for (const block of blocksOf(line)) {
+            const id = stringOf(block.id);
+            const name = stringOf(block.name);
+            if (block.type === 'tool_use' && id !== null && name !== null)
+                tools.set(id, name);
+        }
+        return [];
+    }
+    if (line.type !== 'user')
+        return [];
+    const content = isObj(line.message) ? line.message.content : undefined;
+    if (typeof content === 'string')
+        return [[textSource(line, content), content]];
+    return blocksOf(line).flatMap((block) => {
+        if (block.type === 'tool_result')
+            return [[resultSource(tools.get(stringOf(block.tool_use_id) ?? '')), resultText(block)]];
+        const text = block.type === 'text' ? stringOf(block.text) : null;
+        return text === null ? [] : [[textSource(line, text), text]];
+    });
+};
+const canon = (name) => name.toLowerCase().replace(/[-_.]+/g, '-');
+const patternOf = (name) => name
+    .split(/[-_.]+/)
+    .map((part) => part.replace(/[\\^$.*+?()[\]{}|/]/g, '\\$&'))
+    .join('[-_.]+');
+export const readOrigins = async (file, firstLines, servers) => {
+    const origins = new Map();
+    const prompted = new Set();
+    const byCanon = new Map();
+    for (const name of firstLines.keys())
+        byCanon.set(canon(name), [...(byCanon.get(canon(name)) ?? []), name]);
+    const alternatives = [...firstLines.keys()]
+        .sort((one, two) => two.length - one.length)
+        .map(patternOf)
+        .join('|');
+    // Not inside a longer word or a path: `lib` is neither `lib-extra` nor `other/lib`, while `/lib` is how a skill is typed.
+    // An MCP server reaches the agent only as `mcp__<server>__<tool>`, which that rule refuses (`_` joins words), so that spelling is a mention too,
+    // but only of a name that crossed as a server, so a listed server that was never called lends its name to nothing; origins are keyed by name, so a package that also crossed as that server in the same transcript shares its origin. With no server the branch is
+    // left out, since an empty alternation matches everywhere.
+    const serverNames = [...servers]
+        .sort((one, two) => two.length - one.length)
+        .map(patternOf)
+        .join('|');
+    const serverBranch = serverNames === '' ? '' : `|(?<=(?<!\\w)mcp__)(?:${serverNames})(?=__)`;
+    const words = new RegExp(`(?<![\\w@.-])(?<![\\w.-]/)(?:${alternatives})(?![\\w-]|\\.\\w)${serverBranch}`, 'gi');
+    const last = Math.max(...firstLines.values());
+    const tools = new Map();
+    let position = -1;
+    for await (const raw of logLines(file)) {
+        position += 1;
+        if (position >= last)
+            break;
+        const { line } = parseLine(raw);
+        if (line === null)
+            continue;
+        for (const [source, text] of sourcedTexts(line, tools)) {
+            for (const match of text.matchAll(words)) {
+                for (const name of byCanon.get(canon(match[0])) ?? []) {
+                    if (position >= (firstLines.get(name) ?? 0))
+                        continue;
+                    if (!origins.has(name))
+                        origins.set(name, source);
+                    if (source === 'prompt')
+                        prompted.add(name);
+                }
+            }
+        }
+    }
+    return { origins, prompted };
+};

package/dist/hook-bin.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/hook-bin.js

@@ -0,0 +1,25 @@
+// The one entry file the installed hooks and the nightly task run: `node hook-bin.js <session-start|pre-tool|post-tool|stop|nightly>`, with the
+// hook event JSON on stdin. It imports only the store modules (not the CLI), so a call costs little more than the node start, and it
+// always exits 0 with no output on any failure: a hook must never fail or block a session.
+import { homedir } from 'node:os';
+import { HOOK_EVENTS, hookRuntime, runHook } from './sessions/hooks.js';
+const readStdin = async () => {
+    process.stdin.setEncoding('utf8');
+    let text = '';
+    for await (const chunk of process.stdin)
+        text += String(chunk);
+    return text;
+};
+const eventOf = (name) => HOOK_EVENTS.find((event) => event === name);
+try {
+    const event = eventOf(process.argv[2]);
+    if (event !== undefined) {
+        const output = await runHook(event, event === 'nightly' ? '' : await readStdin(), hookRuntime(event, process.env, process.platform, homedir(), { stdin: process.stdin, stdout: process.stdout }), Date.now);
+        if (output !== undefined)
+            process.stdout.write(output);
+    }
+}
+catch {
+    // Fail-open.
+}
+process.exitCode = 0;

package/dist/issuer.d.ts

@@ -0,0 +1,16 @@
+import type { RunDeps } from './cli.js';
+/**
+ * The production Keycloak realm (the platform's k8s/configmap.yaml: KEYCLOAK_ISSUER_URI). It ships in the CLI, reviewed with it:
+ * the launch flag below only switches it on, so a compromised site cannot send logins anywhere else.
+ */
+export declare const PRODUCTION_ISSUER_URL = "https://login.manyoars.com/realms/aor";
+/** The marketing site serves `{"launched": true}` here from launch day. */
+export declare const LAUNCH_FLAG_URL = "https://manyoars.com/.well-known/oars.json";
+/**
+ * The built-in issuer is in use only when neither `--issuer-url` nor `OARS_ISSUER_URL` named one. If the flag is on but that
+ * issuer does not answer discovery (no answer, an error status, or a body that is not discovery JSON), the platform is not
+ * really open yet, so say what `login` says before launch (exit 2). An issuer the developer named keeps its own error.
+ */
+export declare const discoverIssuer: <T>(deps: RunDeps, flag: string | undefined, discover: () => Promise<T>) => Promise<T>;
+/** `--issuer-url`, else `OARS_ISSUER_URL`, else the built-in production issuer once the launch flag is on. */
+export declare const resolveIssuerUrl: (deps: RunDeps, flag?: string) => Promise<string>;

package/dist/issuer.js

@@ -0,0 +1,55 @@
+import { CliError, ExitCode } from './errors.js';
+/**
+ * The production Keycloak realm (the platform's k8s/configmap.yaml: KEYCLOAK_ISSUER_URI). It ships in the CLI, reviewed with it:
+ * the launch flag below only switches it on, so a compromised site cannot send logins anywhere else.
+ */
+export const PRODUCTION_ISSUER_URL = 'https://login.manyoars.com/realms/aor';
+/** The marketing site serves `{"launched": true}` here from launch day. */
+export const LAUNCH_FLAG_URL = 'https://manyoars.com/.well-known/oars.json';
+const FLAG_TIMEOUT_MS = 5000;
+const NOT_LAUNCHED = 'Many Oars has not launched yet: pass --issuer-url or set OARS_ISSUER_URL.';
+/** True only for a 200 answer whose JSON is an object with `launched: true`; every other answer, or none, means not launched. */
+const hasLaunched = async (deps) => {
+    try {
+        const response = await fetch(LAUNCH_FLAG_URL, {
+            headers: { 'User-Agent': `oars/${deps.version}`, Accept: 'application/json' },
+            redirect: 'error',
+            signal: AbortSignal.timeout(FLAG_TIMEOUT_MS),
+        });
+        if (!response.ok)
+            return false;
+        const body = await response.json();
+        return typeof body === 'object' && body !== null && Reflect.get(body, 'launched') === true;
+    }
+    catch {
+        return false;
+    }
+};
+/**
+ * The built-in issuer is in use only when neither `--issuer-url` nor `OARS_ISSUER_URL` named one. If the flag is on but that
+ * issuer does not answer discovery (no answer, an error status, or a body that is not discovery JSON), the platform is not
+ * really open yet, so say what `login` says before launch (exit 2). An issuer the developer named keeps its own error.
+ */
+export const discoverIssuer = async (deps, flag, discover) => {
+    try {
+        return await discover();
+    }
+    catch (error) {
+        const named = flag !== undefined || (deps.env.OARS_ISSUER_URL !== undefined && deps.env.OARS_ISSUER_URL !== '');
+        const unanswered = error instanceof CliError && (error.exitCode === ExitCode.UNREACHABLE || error.exitCode === ExitCode.UNEXPECTED);
+        if (!named && unanswered)
+            throw new CliError(NOT_LAUNCHED, ExitCode.USAGE, 'usage');
+        throw error;
+    }
+};
+/** `--issuer-url`, else `OARS_ISSUER_URL`, else the built-in production issuer once the launch flag is on. */
+export const resolveIssuerUrl = async (deps, flag) => {
+    if (flag !== undefined)
+        return flag;
+    const fromEnv = deps.env.OARS_ISSUER_URL;
+    if (fromEnv !== undefined && fromEnv !== '')
+        return fromEnv;
+    if (await hasLaunched(deps))
+        return PRODUCTION_ISSUER_URL;
+    throw new CliError(NOT_LAUNCHED, ExitCode.USAGE, 'usage');
+};

package/dist/main.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/main.js

@@ -0,0 +1,64 @@
+import { readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { spawn } from 'node:child_process';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { setTimeout as sleep } from 'node:timers/promises';
+import { openBrowser } from './browser.js';
+import { run } from './cli.js';
+import { defaultConfigDir, fileCredentialStore } from './credentials.js';
+import { cursorRoot } from './sessions/cursor.js';
+import { claudeEvaluator, runClaude } from './sessions/gold-arms.js';
+import { SOURCES } from './sessions/sources.js';
+/** The version in this package's package.json (one folder up from dist/). */
+const readVersion = () => {
+    const manifest = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8'));
+    const version = typeof manifest === 'object' && manifest !== null ? Reflect.get(manifest, 'version') : undefined;
+    return typeof version === 'string' ? version : '0.0.0';
+};
+const configDir = defaultConfigDir(process.env, process.platform, homedir());
+// exitCode rather than process.exit(), so a piped stdout is flushed before the process ends.
+process.exitCode = await run(process.argv.slice(2), {
+    env: process.env,
+    io: {
+        stdout: (text) => process.stdout.write(text),
+        stderr: (text) => process.stderr.write(text),
+    },
+    store: fileCredentialStore(configDir),
+    version: readVersion(),
+    sleep: (ms) => sleep(ms),
+    random: Math.random,
+    now: Date.now,
+    openBrowser,
+    install: {
+        nodePath: process.execPath,
+        hookBin: fileURLToPath(new URL('./hook-bin.js', import.meta.url)),
+        userSettings: join(process.env.CLAUDE_CONFIG_DIR ?? join(homedir(), '.claude'), 'settings.json'),
+        cwd: process.cwd(),
+        schtasks: (args) => new Promise((resolve) => {
+            let output = '';
+            const child = spawn('schtasks', args, { windowsHide: true });
+            child.stdout.on('data', (chunk) => {
+                output += chunk.toString();
+            });
+            child.stderr.on('data', (chunk) => {
+                output += chunk.toString();
+            });
+            child.on('error', (error) => {
+                resolve({ code: 1, output: error.message });
+            });
+            child.on('close', (code) => {
+                resolve({ code: code ?? 1, output });
+            });
+        }),
+    },
+    sessions: {
+        storeDir: join(configDir, 'oars', 'sessions'),
+        projectsRoot: join(process.env.CLAUDE_CONFIG_DIR ?? join(homedir(), '.claude'), 'projects'),
+        cursorRoot: cursorRoot(process.platform, process.env),
+        evaluator: claudeEvaluator(runClaude, process.env),
+        sourceRoots: Object.fromEntries(SOURCES.map((source) => [source.name, source.root(process.platform, process.env, homedir())])),
+        stdin: process.stdin,
+        stdout: process.stdout,
+    },
+});

package/dist/oidc.js

@@ -21,7 +21,7 @@ const keycloakFetch = ({ version, step, sleep, random }, isTokenEndpoint) => {
             response = await (isTokenEndpoint(url) ? fetch(request) : retrying(request));
         }
         catch (error) {
-            throw unreachableError(step, error);
+            throw unreachableError(step, error, new URL(url).origin);
         }
         const { status } = response;
         if (status === 429 || status === 502 || status === 503 || status === 504) {

package/dist/sessions/actions.d.ts

@@ -0,0 +1,35 @@
+import type { Harness } from './schema.js';
+export declare const CANONICAL_ACTIONS: readonly ["file.read", "file.edit", "file.write", "file.search", "shell.exec", "web.search", "web.fetch", "mcp.call", "skill.run", "agent.spawn", "plan.update", "ask.user", "recall.pull", "recall.push", "other"];
+export type CanonicalAction = (typeof CANONICAL_ACTIONS)[number];
+export interface ActionTable {
+    /** Native name to action. A row may say `other`: that is a known public name with no canonical action, so it keeps its name. */
+    rows: {
+        readonly [native: string]: CanonicalAction;
+    };
+    /** How this harness spells an MCP call, with named groups `server` and `tool`; null when it has no such calls. */
+    mcp: RegExp | null;
+    /** Whether that spelling marks where the server name ends. One that cannot may have read a private server's name as the tool, so the tool stays out of class P. */
+    toolDelimited: boolean;
+    /** Native shell tool to the shell it runs, for the frame; a tool not listed does not say which shell it is. */
+    shells: {
+        readonly [native: string]: string;
+    };
+}
+export declare const ACTION_TABLES: {
+    readonly [harness in Harness]: ActionTable;
+};
+/** The MCP call a native name spells, in full, as the transcript wrote it; undefined for any other name. */
+export declare const mcpOf: (table: ActionTable, native: string) => {
+    server: string;
+    tool: string;
+} | undefined;
+/**
+ * What a native name becomes on a step. Rows win over the MCP pattern, so a harness can name a recall that travels over MCP. `native` is the
+ * name itself only when a row lists it; an MCP name holds a server name, so `callIdentity` decides whether it is shown.
+ */
+export declare const actionOf: (table: ActionTable, native: string) => {
+    action: CanonicalAction;
+    native: string;
+};
+/** The shell a native tool runs, or null when the table does not say. */
+export declare const shellOf: (table: ActionTable, native: string) => string | null;