@moxxy/plugin-self-update 0.26.0

package/dist/deps.d.ts

@@ -0,0 +1,49 @@
+import type { SessionId, ToolContext, TurnId } from '@moxxy/sdk';
+import type { RegistrySnapshot } from './transaction.js';
+import { type CoreInstallInfo } from './core-update.js';
+export declare const PLUGIN_ID = "@moxxy/plugin-self-update";
+export interface SkipInfo {
+    readonly pluginName: string;
+    readonly packageName?: string;
+    readonly message: string;
+}
+export interface SelfUpdateEmit {
+    readonly subtype: string;
+    readonly payload: unknown;
+    readonly sessionId: SessionId;
+    readonly turnId: TurnId;
+}
+export interface SelfUpdateDeps {
+    /** Base user dir, normally `~/.moxxy`. Overridable for tests. */
+    readonly moxxyDir: string;
+    /** Hot-reload the plugin host (rescans user plugin dirs). */
+    readonly reload: () => Promise<void>;
+    /** Unload a plugin by name so a modified version re-imports fresh on reload. */
+    readonly unload: (name: string) => Promise<void>;
+    /** Current registered contribution names per kind. */
+    readonly snapshot: () => RegistrySnapshot;
+    /** Plugins the host failed to load (so we can surface a load error). */
+    readonly skipped: () => ReadonlyArray<SkipInfo>;
+    /** Append a `plugin_event` audit record. Best-effort. */
+    readonly emit: (e: SelfUpdateEmit) => Promise<void>;
+    /** How many terminal transactions to keep on GC. Default 5. */
+    readonly maxTxnRetained?: number;
+    /** Tier-2 core-patching config. Omit or set enabled:false to hide core tools. */
+    readonly coreUpdate?: {
+        /** Enable the Tier-2 core-update tools. Default true. */
+        readonly enabled?: boolean;
+        /** Module URL used to resolve the live @moxxy/core install. Default import.meta.url. */
+        readonly fromUrl?: string;
+        /** Override the git repository URL (else read from @moxxy/core package.json). */
+        readonly repoUrlOverride?: string;
+    };
+}
+export declare function readJsonName(dir: string): Promise<string | undefined>;
+export declare function findSkip(skipped: ReadonlyArray<SkipInfo>, names: ReadonlyArray<string>): SkipInfo | undefined;
+export declare function emitSafe(deps: SelfUpdateDeps, ctx: ToolContext, subtype: string, payload: unknown): Promise<void>;
+/**
+ * The fromUrl default is provided by the caller — `detectCoreInstall` resolves
+ * the live `@moxxy/core` install relative to that module URL.
+ */
+export declare function resolveCoreInstall(deps: SelfUpdateDeps, fromUrlDefault: string): CoreInstallInfo | null;
+//# sourceMappingURL=deps.d.ts.map

package/dist/deps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deps.d.ts","sourceRoot":"","sources":["../src/deps.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAqB,KAAK,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAE3E,eAAO,MAAM,SAAS,8BAA8B,CAAC;AAErD,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,iEAAiE;IACjE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,6DAA6D;IAC7D,QAAQ,CAAC,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,gFAAgF;IAChF,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,sDAAsD;IACtD,QAAQ,CAAC,QAAQ,EAAE,MAAM,gBAAgB,CAAC;IAC1C,wEAAwE;IACxE,QAAQ,CAAC,OAAO,EAAE,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;IAChD,yDAAyD;IACzD,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,+DAA+D;IAC/D,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,iFAAiF;IACjF,QAAQ,CAAC,UAAU,CAAC,EAAE;QACpB,yDAAyD;QACzD,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;QAC3B,wFAAwF;QACxF,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAC1B,iFAAiF;QACjF,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;KACnC,CAAC;CACH;AAED,wBAAsB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAS3E;AAED,wBAAgB,QAAQ,CACtB,OAAO,EAAE,aAAa,CAAC,QAAQ,CAAC,EAChC,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,GAC3B,QAAQ,GAAG,SAAS,CAGtB;AAED,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,WAAW,EAChB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,IAAI,CAAC,CAIf;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAEvG"}

package/dist/deps.js

@@ -0,0 +1,30 @@
+import { promises as fs } from 'node:fs';
+import * as path from 'node:path';
+import { detectCoreInstall } from './core-update.js';
+export const PLUGIN_ID = '@moxxy/plugin-self-update';
+export async function readJsonName(dir) {
+    try {
+        const pkg = JSON.parse(await fs.readFile(path.join(dir, 'package.json'), 'utf8'));
+        return pkg.name;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function findSkip(skipped, names) {
+    const want = new Set(names.filter(Boolean));
+    return skipped.find((s) => want.has(s.pluginName) || (s.packageName ? want.has(s.packageName) : false));
+}
+export async function emitSafe(deps, ctx, subtype, payload) {
+    await deps
+        .emit({ subtype, payload, sessionId: ctx.sessionId, turnId: ctx.turnId })
+        .catch(() => undefined);
+}
+/**
+ * The fromUrl default is provided by the caller — `detectCoreInstall` resolves
+ * the live `@moxxy/core` install relative to that module URL.
+ */
+export function resolveCoreInstall(deps, fromUrlDefault) {
+    return detectCoreInstall(deps.coreUpdate?.fromUrl ?? fromUrlDefault);
+}
+//# sourceMappingURL=deps.js.map

package/dist/deps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deps.js","sourceRoot":"","sources":["../src/deps.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,OAAO,EAAE,iBAAiB,EAAwB,MAAM,kBAAkB,CAAC;AAE3E,MAAM,CAAC,MAAM,SAAS,GAAG,2BAA2B,CAAC;AAyCrD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAW;IAC5C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAE/E,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,QAAQ,CACtB,OAAgC,EAChC,KAA4B;IAE5B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5C,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AAC1G,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,IAAoB,EACpB,GAAgB,EAChB,OAAe,EACf,OAAgB;IAEhB,MAAM,IAAI;SACP,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;SACxE,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAoB,EAAE,cAAsB;IAC7E,OAAO,iBAAiB,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,IAAI,cAAc,CAAC,CAAC;AACvE,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,22 @@
+import { type LifecycleHooks, type Plugin } from '@moxxy/sdk';
+import { type SelfUpdateDeps } from './deps.js';
+export type { SelfUpdateDeps, SelfUpdateEmit, SkipInfo } from './deps.js';
+export { beginTransaction, restoreSnapshot, listTransactions, gcTransactions, type Journal, type RegistrySnapshot, } from './transaction.js';
+export { classify, gatherSignals, type ClassifyResult } from './classify.js';
+export { finalizeStagedCoreUpdate, gcCoreTxns, listCoreTxns, detectCoreInstall, readCoreJournal, restoreOverlay, reconcileOverlay, corePreflight, type CoreJournal, type CoreInstallInfo, } from './core-update.js';
+export declare function buildSelfUpdatePlugin(deps: SelfUpdateDeps, hooks?: LifecycleHooks): Plugin;
+/**
+ * Discovery-loadable default export. Resolves the plugin host (`'pluginHost'`),
+ * the registry-name snapshot (`'registrySnapshot'`), the writable event-append
+ * (`'appendEvent'` — the counterpart to the read-only `ctx.log`) and this
+ * plugin's config options (`'getPluginOptions'`) from the inter-plugin service
+ * registry in `onInit`, instead of the host `SelfUpdateDeps` closure.
+ *
+ * The Tier-2 core-update tools are gated at BUILD time on
+ * `MOXXY_NO_CORE_UPDATE` (the env the desktop sets to hide them); the softer
+ * `allowCoreUpdate`/`repoUrl` config prefs are resolved in `onInit` and applied
+ * to `coreUpdate.repoUrlOverride` + the GC retention.
+ */
+export declare const selfUpdatePlugin: Plugin;
+export default selfUpdatePlugin;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAML,KAAK,cAAc,EACnB,KAAK,MAAM,EAGZ,MAAM,YAAY,CAAC;AAkBpB,OAAO,EAA+C,KAAK,cAAc,EAAE,MAAM,WAAW,CAAC;AAG7F,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAE1E,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,KAAK,OAAO,EACZ,KAAK,gBAAgB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAC7E,OAAO,EACL,wBAAwB,EACxB,UAAU,EACV,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,gBAAgB,EAChB,aAAa,EACb,KAAK,WAAW,EAChB,KAAK,eAAe,GACrB,MAAM,kBAAkB,CAAC;AAE1B,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,cAAc,EAAE,KAAK,CAAC,EAAE,cAAc,GAAG,MAAM,CAW1F;AAQD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,gBAAgB,EAAE,MAyD3B,CAAC;AAuSL,eAAe,gBAAgB,CAAC"}

package/dist/index.js

@@ -0,0 +1,349 @@
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { asPluginId, definePlugin, defineTool, z, } from '@moxxy/sdk';
+import { MAX_FAILED_ATTEMPTS, beginTransaction, diffSnapshot, failedAttemptCount, gcTransactions, listTransactions, readJournal, recordAttempt, resolveTarget, restoreSnapshot, writeJournal, } from './transaction.js';
+import { classify, gatherSignals } from './classify.js';
+import { verifyPluginBuild, verifySkillFile } from './verify.js';
+import { PLUGIN_ID, emitSafe, findSkip, readJsonName } from './deps.js';
+import { coreTools } from './core-tools/index.js';
+export { beginTransaction, restoreSnapshot, listTransactions, gcTransactions, } from './transaction.js';
+export { classify, gatherSignals } from './classify.js';
+export { finalizeStagedCoreUpdate, gcCoreTxns, listCoreTxns, detectCoreInstall, readCoreJournal, restoreOverlay, reconcileOverlay, corePreflight, } from './core-update.js';
+export function buildSelfUpdatePlugin(deps, hooks) {
+    const tools = [
+        classifyTool(deps),
+        beginTool(deps),
+        verifyTool(deps),
+        applyTool(deps),
+        rollbackTool(deps),
+        statusTool(deps),
+    ];
+    if (deps.coreUpdate?.enabled !== false)
+        tools.push(...coreTools(deps, import.meta.url));
+    return definePlugin({ name: PLUGIN_ID, version: '0.0.0', tools, ...(hooks ? { hooks } : {}) });
+}
+/**
+ * Discovery-loadable default export. Resolves the plugin host (`'pluginHost'`),
+ * the registry-name snapshot (`'registrySnapshot'`), the writable event-append
+ * (`'appendEvent'` — the counterpart to the read-only `ctx.log`) and this
+ * plugin's config options (`'getPluginOptions'`) from the inter-plugin service
+ * registry in `onInit`, instead of the host `SelfUpdateDeps` closure.
+ *
+ * The Tier-2 core-update tools are gated at BUILD time on
+ * `MOXXY_NO_CORE_UPDATE` (the env the desktop sets to hide them); the softer
+ * `allowCoreUpdate`/`repoUrl` config prefs are resolved in `onInit` and applied
+ * to `coreUpdate.repoUrlOverride` + the GC retention.
+ */
+export const selfUpdatePlugin = (() => {
+    let host = null;
+    let snapshotFn = null;
+    let appendEvent = null;
+    let options = {};
+    const deps = {
+        moxxyDir: path.join(os.homedir(), '.moxxy'),
+        reload: () => host?.reload() ?? Promise.resolve(),
+        unload: (name) => host?.unload(name) ?? Promise.resolve(),
+        snapshot: () => (snapshotFn ? snapshotFn() : {}),
+        skipped: () => (host?.listSkipped() ?? []).map((s) => ({
+            pluginName: s.pluginName,
+            ...(s.packageName ? { packageName: s.packageName } : {}),
+            message: s.message,
+        })),
+        emit: (e) => appendEvent
+            ? appendEvent({
+                type: 'plugin_event',
+                pluginId: asPluginId(PLUGIN_ID),
+                subtype: e.subtype,
+                payload: e.payload,
+                sessionId: e.sessionId,
+                turnId: e.turnId,
+                source: 'plugin',
+            })
+            : Promise.resolve(),
+        get maxTxnRetained() {
+            return typeof options.maxTxnRetained === 'number' ? options.maxTxnRetained : undefined;
+        },
+        coreUpdate: {
+            // Gated at build on the env (the desktop sets MOXXY_NO_CORE_UPDATE=1 to
+            // hide the tools); the config `allowCoreUpdate` pref can't gate build-time
+            // tool inclusion under discovery-loading, but repoUrl is honored at run.
+            enabled: process.env.MOXXY_NO_CORE_UPDATE !== '1',
+            fromUrl: import.meta.url,
+            get repoUrlOverride() {
+                return typeof options.repoUrl === 'string' ? options.repoUrl : undefined;
+            },
+        },
+    };
+    const hooks = {
+        onInit: (ctx) => {
+            host = ctx.services.get('pluginHost') ?? null;
+            snapshotFn = ctx.services.get('registrySnapshot') ?? null;
+            appendEvent = ctx.services.get('appendEvent') ?? null;
+            const getOptions = ctx.services.get('getPluginOptions');
+            options = getOptions?.(PLUGIN_ID) ?? {};
+        },
+    };
+    return buildSelfUpdatePlugin(deps, hooks);
+})();
+// ── self_update_classify ────────────────────────────────────────────────────
+function classifyTool(deps) {
+    return defineTool({
+        name: 'self_update_classify',
+        description: 'Read-only. Inspect recent errors / failed tool calls and the registered tool set, then recommend the LOWEST-risk way to satisfy a self-update: a skill (instructions), a plugin (new tool / behavior override), or a core patch (escalate). Advisory only — you make the final call. Call this first when asked to add a capability or to fix a recurring failure.',
+        inputSchema: z.object({
+            trigger: z.enum(['error', 'request']).describe('Whether this follows an error or a user request.'),
+            text: z.string().optional().describe('The user request or a short description of the problem.'),
+        }),
+        permission: { action: 'allow' },
+        handler: (input, ctx) => {
+            const signals = gatherSignals(ctx.log, deps.snapshot().tools ?? []);
+            return classify(input, signals);
+        },
+    });
+}
+// ── self_update_begin ─────────────────────────────────────────────────────────
+function beginTool(deps) {
+    return defineTool({
+        name: 'self_update_begin',
+        description: 'Open a self-update transaction for a target plugin (dir under ~/.moxxy/plugins) or skill (~/.moxxy/skills/<name>.md). Snapshots the current state so the change can be rolled back. Returns a txnId. Make your edits with Write/Edit AFTER this, then call self_update_verify.',
+        inputSchema: z.object({
+            kind: z.enum(['plugin', 'skill']),
+            name: z
+                .string()
+                .min(1)
+                .describe('Plugin directory name or skill slug (no path separators).'),
+        }),
+        permission: { action: 'allow' },
+        handler: async (input, ctx) => {
+            // Single-flight per target (mirrors the Tier-2 core_begin guard): two
+            // concurrent begins on the same plugin/skill snapshot independently, so a
+            // second begin started after the model already overwrote the artifact
+            // captures the BROKEN state into its own `before/`, and a later rollback
+            // of that txn "restores" garbage. Refuse a new begin while a non-terminal
+            // txn for the same target is open. resolveTarget also validates the name.
+            const target = resolveTarget(deps.moxxyDir, input.kind, input.name);
+            const active = (await listTransactions(deps.moxxyDir)).find((j) => j.target.path === target.path && (j.state === 'open' || j.state === 'verified'));
+            if (active) {
+                throw new Error(`a self-update is already in progress for ${input.kind} "${input.name}" ` +
+                    `(txn ${active.txnId}, state "${active.state}"). Finish it (self_update_verify → ` +
+                    `self_update_apply) or discard it with self_update_rollback({ txnId: "${active.txnId}" }) ` +
+                    `before starting another.`);
+            }
+            const journal = await beginTransaction({ moxxyDir: deps.moxxyDir, kind: input.kind, name: input.name });
+            if (input.kind === 'plugin') {
+                journal.registryBefore = deps.snapshot();
+                await writeJournal(deps.moxxyDir, journal);
+            }
+            await emitSafe(deps, ctx, 'begin', {
+                txnId: journal.txnId,
+                target: journal.target,
+                existedBefore: journal.existedBefore,
+            });
+            return {
+                txnId: journal.txnId,
+                target: journal.target,
+                existedBefore: journal.existedBefore,
+                next: 'Write/Edit the files, then call self_update_verify with this txnId.',
+            };
+        },
+    });
+}
+// ── self_update_verify ──────────────────────────────────────────────────────
+function verifyTool(deps) {
+    return defineTool({
+        name: 'self_update_verify',
+        description: 'Build, test and load-check the change in a transaction, then hot-reload it into the live session. Returns the stage results and what registered. On failure of a modify, the previous working version is automatically restored. Refuses after 2 failed cycles (escalate to the user). Run AFTER your edits; if it passes, call self_update_apply.',
+        inputSchema: z.object({ txnId: z.string().min(1) }),
+        permission: { action: 'prompt' },
+        handler: async (input, ctx) => {
+            const journal = await readJournal(deps.moxxyDir, input.txnId);
+            if (failedAttemptCount(journal) >= MAX_FAILED_ATTEMPTS) {
+                await escalate(deps, ctx, journal, 'too many failed verify cycles');
+                return {
+                    ok: false,
+                    escalate: true,
+                    message: `Already failed ${MAX_FAILED_ATTEMPTS} times — stopping. Rolled back to a clean state; tell the user what you tried and the errors.`,
+                    attempts: journal.attempts,
+                };
+            }
+            const result = journal.target.kind === 'plugin'
+                ? await verifyPlugin(deps, journal)
+                : await verifySkill(journal);
+            if (!result.ok) {
+                recordAttempt(journal, { stage: result.failedStage ?? 'verify', ok: false, message: result.message });
+                let recovered = false;
+                if (journal.existedBefore) {
+                    await restoreSnapshot(deps.moxxyDir, journal);
+                    if (journal.target.kind === 'plugin') {
+                        await deps.unload(journal.target.name).catch(() => undefined);
+                        await deps.reload();
+                    }
+                    recovered = true;
+                }
+                const cap = failedAttemptCount(journal) >= MAX_FAILED_ATTEMPTS;
+                if (cap) {
+                    // We may have just restored the snapshot above. Tell escalate() the
+                    // rollback is done so it doesn't repeat the recursive filesystem copy
+                    // + plugin-host rescan (escalate skips its restore when already
+                    // rolled_back). It still flips state to 'escalated' and persists.
+                    if (recovered)
+                        journal.state = 'rolled_back';
+                    await escalate(deps, ctx, journal, result.message);
+                }
+                else {
+                    await writeJournal(deps.moxxyDir, journal);
+                }
+                await emitSafe(deps, ctx, 'verify_failed', { txnId: journal.txnId, message: result.message });
+                return {
+                    ok: false,
+                    escalate: cap,
+                    recovered,
+                    stages: result.stages,
+                    message: result.message,
+                    remainingAttempts: Math.max(0, MAX_FAILED_ATTEMPTS - failedAttemptCount(journal)),
+                };
+            }
+            recordAttempt(journal, { stage: 'verify', ok: true, message: 'all stages passed' });
+            journal.state = 'verified';
+            await writeJournal(deps.moxxyDir, journal);
+            await emitSafe(deps, ctx, 'verify_ok', { txnId: journal.txnId, registered: result.registered });
+            return {
+                ok: true,
+                stages: result.stages,
+                registered: result.registered,
+                next: 'Looks good — call self_update_apply to keep it, or self_update_rollback to discard.',
+            };
+        },
+    });
+}
+async function verifyPlugin(deps, journal) {
+    const target = journal.target;
+    const stages = [...(await verifyPluginBuild(target))];
+    const failed = stages.find((s) => !s.ok);
+    if (failed) {
+        return { ok: false, failedStage: failed.stage, message: `${failed.stage} failed: ${failed.message}`, stages };
+    }
+    // Activate: drop the old instance (if any) so a modified entry re-imports
+    // fresh, then rescan from disk.
+    await deps.unload(target.name).catch(() => undefined);
+    const pkgName = await readJsonName(target.path);
+    await deps.reload();
+    const skip = findSkip(deps.skipped(), [target.name, pkgName ?? '']);
+    if (skip) {
+        stages.push({ stage: 'load', ok: false, message: skip.message });
+        return { ok: false, failedStage: 'load', message: `plugin failed to load: ${skip.message}`, stages };
+    }
+    const after = deps.snapshot();
+    const registered = diffSnapshot(journal.registryBefore ?? {}, after);
+    if (!journal.existedBefore && Object.keys(registered).length === 0) {
+        stages.push({
+            stage: 'load',
+            ok: false,
+            message: 'plugin loaded but registered no tools/agents/etc. — check the entry exports a valid plugin',
+        });
+        return {
+            ok: false,
+            failedStage: 'load',
+            message: 'new plugin registered nothing (no valid contributions found)',
+            stages,
+        };
+    }
+    stages.push({ stage: 'load', ok: true, message: 'loaded and registered' });
+    return { ok: true, message: 'ok', stages, registered };
+}
+async function verifySkill(journal) {
+    const r = await verifySkillFile(journal.target);
+    if (!r.ok)
+        return { ok: false, failedStage: r.stage, message: r.message, stages: [r] };
+    return {
+        ok: true,
+        message: 'skill frontmatter valid (activate with reload_skills or on next launch)',
+        stages: [r],
+    };
+}
+// ── self_update_apply ───────────────────────────────────────────────────────
+function applyTool(deps) {
+    return defineTool({
+        name: 'self_update_apply',
+        description: 'Finalize a verified self-update transaction: mark it committed and prune old snapshots. The change is already live (loaded during verify); this is the keep-it confirmation. Requires a prior successful self_update_verify.',
+        inputSchema: z.object({ txnId: z.string().min(1) }),
+        permission: { action: 'prompt' },
+        handler: async (input, ctx) => {
+            const journal = await readJournal(deps.moxxyDir, input.txnId);
+            if (journal.state !== 'verified') {
+                throw new Error(`transaction ${input.txnId} is "${journal.state}", not "verified" — run self_update_verify first`);
+            }
+            journal.state = 'committed';
+            await writeJournal(deps.moxxyDir, journal);
+            await emitSafe(deps, ctx, 'apply', { txnId: journal.txnId, target: journal.target });
+            await gcTransactions(deps.moxxyDir, deps.maxTxnRetained ?? 5).catch(() => undefined);
+            return { ok: true, committed: journal.target };
+        },
+    });
+}
+// ── self_update_rollback ────────────────────────────────────────────────────
+function rollbackTool(deps) {
+    return defineTool({
+        name: 'self_update_rollback',
+        description: 'Undo a self-update transaction: restore the pre-change snapshot (or delete a newly-created artifact) and hot-reload. Use when a change built and loaded cleanly but behaves wrongly at runtime.',
+        inputSchema: z.object({
+            txnId: z.string().min(1),
+            reason: z.string().optional(),
+        }),
+        permission: { action: 'allow' },
+        handler: async (input, ctx) => {
+            const journal = await readJournal(deps.moxxyDir, input.txnId);
+            await restoreSnapshot(deps.moxxyDir, journal);
+            if (journal.target.kind === 'plugin') {
+                await deps.unload(journal.target.name).catch(() => undefined);
+                await deps.reload();
+            }
+            journal.state = 'rolled_back';
+            await writeJournal(deps.moxxyDir, journal);
+            await emitSafe(deps, ctx, 'rollback', { txnId: journal.txnId, reason: input.reason ?? null });
+            return { ok: true, restored: journal.target, existedBefore: journal.existedBefore };
+        },
+    });
+}
+// ── self_update_status ──────────────────────────────────────────────────────
+function statusTool(deps) {
+    return defineTool({
+        name: 'self_update_status',
+        description: 'List self-update transactions and their state (open / verified / committed / rolled_back / escalated).',
+        inputSchema: z.object({ txnId: z.string().optional() }),
+        permission: { action: 'allow' },
+        handler: async (input) => {
+            const all = await listTransactions(deps.moxxyDir);
+            const rows = (input.txnId ? all.filter((j) => j.txnId === input.txnId) : all).map((j) => ({
+                txnId: j.txnId,
+                state: j.state,
+                target: j.target,
+                existedBefore: j.existedBefore,
+                failedAttempts: failedAttemptCount(j),
+                updatedAt: j.updatedAt,
+            }));
+            return { transactions: rows };
+        },
+    });
+}
+async function escalate(deps, ctx, journal, reason) {
+    if (journal.existedBefore && journal.state !== 'rolled_back') {
+        await restoreSnapshot(deps.moxxyDir, journal);
+        if (journal.target.kind === 'plugin') {
+            await deps.unload(journal.target.name).catch(() => undefined);
+            await deps.reload();
+        }
+    }
+    else if (!journal.existedBefore) {
+        // Clean up the failed new artifact so it doesn't linger half-built.
+        await restoreSnapshot(deps.moxxyDir, journal);
+        if (journal.target.kind === 'plugin')
+            await deps.reload();
+    }
+    journal.state = 'escalated';
+    await writeJournal(deps.moxxyDir, journal);
+    await emitSafe(deps, ctx, 'escalated', { txnId: journal.txnId, reason });
+}
+// Discovery entry: `createPluginLoader` requires a default Plugin export.
+export default selfUpdatePlugin;
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EACL,UAAU,EACV,YAAY,EACZ,UAAU,EACV,CAAC,GAMF,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,YAAY,EACZ,kBAAkB,EAClB,cAAc,EACd,gBAAgB,EAChB,WAAW,EACX,aAAa,EACb,aAAa,EACb,eAAe,EACf,YAAY,GAGb,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAoB,MAAM,aAAa,CAAC;AACnF,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAuB,MAAM,WAAW,CAAC;AAC7F,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAIlD,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,cAAc,GAGf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAuB,MAAM,eAAe,CAAC;AAC7E,OAAO,EACL,wBAAwB,EACxB,UAAU,EACV,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,gBAAgB,EAChB,aAAa,GAGd,MAAM,kBAAkB,CAAC;AAE1B,MAAM,UAAU,qBAAqB,CAAC,IAAoB,EAAE,KAAsB;IAChF,MAAM,KAAK,GAAc;QACvB,YAAY,CAAC,IAAI,CAAC;QAClB,SAAS,CAAC,IAAI,CAAC;QACf,UAAU,CAAC,IAAI,CAAC;QAChB,SAAS,CAAC,IAAI,CAAC;QACf,YAAY,CAAC,IAAI,CAAC;QAClB,UAAU,CAAC,IAAI,CAAC;KACjB,CAAC;IACF,IAAI,IAAI,CAAC,UAAU,EAAE,OAAO,KAAK,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACxF,OAAO,YAAY,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AACjG,CAAC;AAQD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAW,CAAC,GAAG,EAAE;IAC5C,IAAI,IAAI,GAA0B,IAAI,CAAC;IACvC,IAAI,UAAU,GAAoC,IAAI,CAAC;IACvD,IAAI,WAAW,GAAgD,IAAI,CAAC;IACpE,IAAI,OAAO,GAA4B,EAAE,CAAC;IAE1C,MAAM,IAAI,GAAmB;QAC3B,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC;QAC3C,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,OAAO,CAAC,OAAO,EAAE;QACjD,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE;QACzD,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,OAAO,EAAE,GAAG,EAAE,CACZ,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtC,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,OAAO,EAAE,CAAC,CAAC,OAAO;SACnB,CAAC,CAAC;QACL,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CACV,WAAW;YACT,CAAC,CAAC,WAAW,CAAC;gBACV,IAAI,EAAE,cAAc;gBACpB,QAAQ,EAAE,UAAU,CAAC,SAAS,CAAC;gBAC/B,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,MAAM,EAAE,QAAQ;aACjB,CAAC;YACJ,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE;QACvB,IAAI,cAAc;YAChB,OAAO,OAAO,OAAO,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;QACzF,CAAC;QACD,UAAU,EAAE;YACV,wEAAwE;YACxE,2EAA2E;YAC3E,yEAAyE;YACzE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,GAAG;YACjD,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG;YACxB,IAAI,eAAe;gBACjB,OAAO,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;YAC3E,CAAC;SACF;KACF,CAAC;IAEF,MAAM,KAAK,GAAmB;QAC5B,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE;YACd,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAiB,YAAY,CAAC,IAAI,IAAI,CAAC;YAC9D,UAAU,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAyB,kBAAkB,CAAC,IAAI,IAAI,CAAC;YAClF,WAAW,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAqC,aAAa,CAAC,IAAI,IAAI,CAAC;YAC1F,MAAM,UAAU,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CACjC,kBAAkB,CACnB,CAAC;YACF,OAAO,GAAG,UAAU,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QAC1C,CAAC;KACF,CAAC;IAEF,OAAO,qBAAqB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC5C,CAAC,CAAC,EAAE,CAAC;AAEL,+EAA+E;AAC/E,SAAS,YAAY,CAAC,IAAoB;IACxC,OAAO,UAAU,CAAC;QAChB,IAAI,EAAE,sBAAsB;QAC5B,WAAW,EACT,oWAAoW;QACtW,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;YACpB,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,kDAAkD,CAAC;YAClG,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yDAAyD,CAAC;SAChG,CAAC;QACF,UAAU,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;QAC/B,OAAO,EAAE,CAAC,KAAK,EAAE,GAAgB,EAAE,EAAE;YACnC,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;YACpE,OAAO,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAClC,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,iFAAiF;AACjF,SAAS,SAAS,CAAC,IAAoB;IACrC,OAAO,UAAU,CAAC;QAChB,IAAI,EAAE,mBAAmB;QACzB,WAAW,EACT,gRAAgR;QAClR,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;YACpB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACjC,IAAI,EAAE,CAAC;iBACJ,MAAM,EAAE;iBACR,GAAG,CAAC,CAAC,CAAC;iBACN,QAAQ,CAAC,2DAA2D,CAAC;SACzE,CAAC;QACF,UAAU,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;QAC/B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAgB,EAAE,EAAE;YACzC,sEAAsE;YACtE,0EAA0E;YAC1E,sEAAsE;YACtE,yEAAyE;YACzE,0EAA0E;YAC1E,0EAA0E;YAC1E,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACpE,MAAM,MAAM,GAAG,CAAC,MAAM,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CACzD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,IAAI,CAAC,CAAC,KAAK,KAAK,UAAU,CAAC,CACvF,CAAC;YACF,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CACb,4CAA4C,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI;oBACvE,QAAQ,MAAM,CAAC,KAAK,YAAY,MAAM,CAAC,KAAK,sCAAsC;oBAClF,wEAAwE,MAAM,CAAC,KAAK,OAAO;oBAC3F,0BAA0B,CAC7B,CAAC;YACJ,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YACxG,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC5B,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACzC,MAAM,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC7C,CAAC;YACD,MAAM,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE;gBACjC,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,aAAa,EAAE,OAAO,CAAC,aAAa;aACrC,CAAC,CAAC;YACH,OAAO;gBACL,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,IAAI,EAAE,qEAAqE;aAC5E,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,+EAA+E;AAC/E,SAAS,UAAU,CAAC,IAAoB;IACtC,OAAO,UAAU,CAAC;QAChB,IAAI,EAAE,oBAAoB;QAC1B,WAAW,EACT,oVAAoV;QACtV,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,UAAU,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE;QAChC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAgB,EAAE,EAAE;YACzC,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YAE9D,IAAI,kBAAkB,CAAC,OAAO,CAAC,IAAI,mBAAmB,EAAE,CAAC;gBACvD,MAAM,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,+BAA+B,CAAC,CAAC;gBACpE,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,QAAQ,EAAE,IAAI;oBACd,OAAO,EAAE,kBAAkB,mBAAmB,+FAA+F;oBAC7I,QAAQ,EAAE,OAAO,CAAC,QAAQ;iBAC3B,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ;gBAC9B,CAAC,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC;gBACnC,CAAC,CAAC,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;YAEjC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,aAAa,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,WAAW,IAAI,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;gBACtG,IAAI,SAAS,GAAG,KAAK,CAAC;gBACtB,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;oBAC1B,MAAM,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;oBAC9C,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;wBACrC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;wBAC9D,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;oBACtB,CAAC;oBACD,SAAS,GAAG,IAAI,CAAC;gBACnB,CAAC;gBACD,MAAM,GAAG,GAAG,kBAAkB,CAAC,OAAO,CAAC,IAAI,mBAAmB,CAAC;gBAC/D,IAAI,GAAG,EAAE,CAAC;oBACR,oEAAoE;oBACpE,sEAAsE;oBACtE,gEAAgE;oBAChE,kEAAkE;oBAClE,IAAI,SAAS;wBAAE,OAAO,CAAC,KAAK,GAAG,aAAa,CAAC;oBAC7C,MAAM,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;gBACrD,CAAC;qBAAM,CAAC;oBACN,MAAM,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;gBAC7C,CAAC;gBACD,MAAM,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,eAAe,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC9F,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,QAAQ,EAAE,GAAG;oBACb,SAAS;oBACT,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,iBAAiB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,mBAAmB,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;iBAClF,CAAC;YACJ,CAAC;YAED,aAAa,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;YACpF,OAAO,CAAC,KAAK,GAAG,UAAU,CAAC;YAC3B,MAAM,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC3C,MAAM,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;YAChG,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,IAAI,EAAE,qFAAqF;aAC5F,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAUD,KAAK,UAAU,YAAY,CAAC,IAAoB,EAAE,OAAgB;IAChE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACzC,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,KAAK,YAAY,MAAM,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC;IAChH,CAAC;IAED,0EAA0E;IAC1E,gCAAgC;IAChC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;IAEpB,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;IACpE,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QACjE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,0BAA0B,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC;IACvG,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;IAC9B,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;IACrE,IAAI,CAAC,OAAO,CAAC,aAAa,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnE,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,MAAM;YACb,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,4FAA4F;SACtG,CAAC,CAAC;QACH,OAAO;YACL,EAAE,EAAE,KAAK;YACT,WAAW,EAAE,MAAM;YACnB,OAAO,EAAE,8DAA8D;YACvE,MAAM;SACP,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;IAC3E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AACzD,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,OAAgB;IACzC,MAAM,CAAC,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACvF,OAAO;QACL,EAAE,EAAE,IAAI;QACR,OAAO,EAAE,yEAAyE;QAClF,MAAM,EAAE,CAAC,CAAC,CAAC;KACZ,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,SAAS,SAAS,CAAC,IAAoB;IACrC,OAAO,UAAU,CAAC;QAChB,IAAI,EAAE,mBAAmB;QACzB,WAAW,EACT,8NAA8N;QAChO,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,UAAU,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE;QAChC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAgB,EAAE,EAAE;YACzC,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YAC9D,IAAI,OAAO,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CACb,eAAe,KAAK,CAAC,KAAK,QAAQ,OAAO,CAAC,KAAK,kDAAkD,CAClG,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,KAAK,GAAG,WAAW,CAAC;YAC5B,MAAM,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC3C,MAAM,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YACrF,MAAM,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,cAAc,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACrF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;QACjD,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,+EAA+E;AAC/E,SAAS,YAAY,CAAC,IAAoB;IACxC,OAAO,UAAU,CAAC;QAChB,IAAI,EAAE,sBAAsB;QAC5B,WAAW,EACT,iMAAiM;QACnM,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;YACpB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACxB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SAC9B,CAAC;QACF,UAAU,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;QAC/B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAgB,EAAE,EAAE;YACzC,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YAC9D,MAAM,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC9C,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACrC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAC9D,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;YACtB,CAAC;YACD,OAAO,CAAC,KAAK,GAAG,aAAa,CAAC;YAC9B,MAAM,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC3C,MAAM,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;YAC9F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;QACtF,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,+EAA+E;AAC/E,SAAS,UAAU,CAAC,IAAoB;IACtC,OAAO,UAAU,CAAC;QAChB,IAAI,EAAE,oBAAoB;QAC1B,WAAW,EAAE,wGAAwG;QACrH,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;QACvD,UAAU,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;QAC/B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YACvB,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAClD,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACxF,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,aAAa,EAAE,CAAC,CAAC,aAAa;gBAC9B,cAAc,EAAE,kBAAkB,CAAC,CAAC,CAAC;gBACrC,SAAS,EAAE,CAAC,CAAC,SAAS;aACvB,CAAC,CAAC,CAAC;YACJ,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;QAChC,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAoB,EAAE,GAAgB,EAAE,OAAgB,EAAE,MAAc;IAC9F,IAAI,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,KAAK,KAAK,aAAa,EAAE,CAAC;QAC7D,MAAM,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC9C,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC9D,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACtB,CAAC;IACH,CAAC;SAAM,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QAClC,oEAAoE;QACpE,MAAM,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC9C,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;IAC5D,CAAC;IACD,OAAO,CAAC,KAAK,GAAG,WAAW,CAAC;IAC5B,MAAM,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC3C,MAAM,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,0EAA0E;AAC1E,eAAe,gBAAgB,CAAC"}

package/dist/transaction.d.ts

@@ -0,0 +1,80 @@
+/**
+ * Transactional bookkeeping for self-update. Every change to a user-scope
+ * artifact (a plugin directory or a skill file) is bracketed by a transaction:
+ * the target is snapshotted before edits, a persisted journal tracks state and
+ * failed attempts, and a rollback restores the snapshot (or deletes a freshly
+ * created artifact). This module is filesystem-only and imports no moxxy core,
+ * so it is trivially unit-testable against a temp directory.
+ */
+export type TargetKind = 'plugin' | 'skill';
+export type TxnState = 'open' | 'verified' | 'committed' | 'rolled_back' | 'escalated';
+export interface TxnTarget {
+    readonly kind: TargetKind;
+    readonly name: string;
+    /** Absolute path to the artifact (a directory for plugins, a file for skills). */
+    readonly path: string;
+}
+export interface TxnAttempt {
+    readonly at: string;
+    readonly stage: string;
+    readonly ok: boolean;
+    readonly message: string;
+}
+/** Registered contribution names per kind — used to diff what a change added. */
+export type RegistrySnapshot = Record<string, ReadonlyArray<string>>;
+export interface Journal {
+    readonly txnId: string;
+    readonly createdAt: string;
+    updatedAt: string;
+    readonly target: TxnTarget;
+    /** Whether the artifact existed before this transaction. false ⇒ rollback deletes it. */
+    readonly existedBefore: boolean;
+    state: TxnState;
+    attempts: TxnAttempt[];
+    /** Registry contributions captured at begin time, for an added-since diff. */
+    registryBefore?: RegistrySnapshot;
+}
+/** Names present in `after` but not in `before`, per kind. Empty keys dropped. */
+export declare function diffSnapshot(before: RegistrySnapshot, after: RegistrySnapshot): RegistrySnapshot;
+/** Max failed verify cycles for one transaction before we force escalation. */
+export declare const MAX_FAILED_ATTEMPTS = 2;
+export declare function selfUpdateRoot(moxxyDir: string): string;
+export declare function txnDir(moxxyDir: string, txnId: string): string;
+/**
+ * Resolve the on-disk target for a (kind, name). Throws on unsafe names so a
+ * model-supplied name can never escape the user artifact directories.
+ */
+export declare function resolveTarget(moxxyDir: string, kind: TargetKind, name: string): TxnTarget;
+export declare function newTxnId(now?: Date): string;
+/**
+ * Open a transaction: snapshot the current target (if any) into the txn dir
+ * and write the initial journal. Safe to call for a not-yet-existing target.
+ */
+export declare function beginTransaction(opts: {
+    readonly moxxyDir: string;
+    readonly kind: TargetKind;
+    readonly name: string;
+    readonly now?: Date;
+}): Promise<Journal>;
+export declare function writeJournal(moxxyDir: string, journal: Journal): Promise<void>;
+export declare function readJournal(moxxyDir: string, txnId: string): Promise<Journal>;
+export declare function listTransactions(moxxyDir: string): Promise<ReadonlyArray<Journal>>;
+export declare function recordAttempt(journal: Journal, attempt: Omit<TxnAttempt, 'at'>): void;
+export declare function failedAttemptCount(journal: Journal): number;
+/**
+ * Restore the target to its pre-transaction state: copy the snapshot back, or
+ * delete the artifact if it was newly created. Idempotent.
+ *
+ * The snapshot is source-only (SNAPSHOT_EXCLUDE drops node_modules/.git/dist),
+ * so a blanket `rm -rf` of the target before copying would wipe the installed
+ * runtime deps — and nothing re-installs them, leaving a plugin that fails to
+ * load on the very next deps.reload(). To keep the working `node_modules` (and
+ * the other reproducible-but-uncaptured dirs) across a MODIFICATION rollback, we
+ * remove only the captured source entries and overlay the snapshot back on top,
+ * never touching the excluded dirs. A newly-created target (no snapshot) is still
+ * deleted wholesale.
+ */
+export declare function restoreSnapshot(moxxyDir: string, journal: Journal): Promise<void>;
+/** Keep the most recent `keep` terminal transactions; delete older ones. */
+export declare function gcTransactions(moxxyDir: string, keep: number): Promise<void>;
+//# sourceMappingURL=transaction.d.ts.map

package/dist/transaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transaction.d.ts","sourceRoot":"","sources":["../src/transaction.ts"],"names":[],"mappings":"AAKA;;;;;;;GAOG;AAEH,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE5C,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,UAAU,GAAG,WAAW,GAAG,aAAa,GAAG,WAAW,CAAC;AAEvF,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kFAAkF;IAClF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,iFAAiF;AACjF,MAAM,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;AAErE,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,yFAAyF;IACzF,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,KAAK,EAAE,QAAQ,CAAC;IAChB,QAAQ,EAAE,UAAU,EAAE,CAAC;IACvB,8EAA8E;IAC9E,cAAc,CAAC,EAAE,gBAAgB,CAAC;CACnC;AAED,kFAAkF;AAClF,wBAAgB,YAAY,CAAC,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,gBAAgB,GAAG,gBAAgB,CAQhG;AAED,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAsBrC,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,wBAAgB,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,CAWzF;AAED,wBAAgB,QAAQ,CAAC,GAAG,GAAE,IAAiB,GAAG,MAAM,CAOvD;AAWD;;;GAGG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE;IAC3C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC;CACrB,GAAG,OAAO,CAAC,OAAO,CAAC,CAwBnB;AAED,wBAAsB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAIpF;AAED,wBAAsB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAInF;AAED,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAmBxF;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,IAAI,CAErF;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAE3D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CA4BvF;AAED,4EAA4E;AAC5E,wBAAsB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQlF"}