@oh-hai/cli 0.2.0 → 0.2.1

package/dist/version.js

@@ -5,11 +5,28 @@ import { fileURLToPath } from "node:url";
 /** The MA2H wire protocol version this CLI targets (docs/specs/cli.md §3). */
 export const MA2H_WIRE_VERSION = "v0.3";
 /**
- * The CLI's own version, read from package.json relative to this module. Works both when
- * run from `dist/version.js` and from `src/version.ts` via tsx — both sit one level under
- * the package root, so `../package.json` resolves to the manifest either way.
+ * The CLI's own version.
+ *
+ * A standalone binary built by `bun build --compile` (issue #344) has no package.json on the
+ * real filesystem to read, so the dist workflow inlines the version at compile time: it sets
+ * OH_HAI_BUILD_VERSION in the build env and passes `--env='OH_HAI_BUILD_*'`, which freezes this
+ * `process.env.OH_HAI_BUILD_VERSION` read into the bundle as a literal. We prefer that value **only
+ * when running as the compiled Bun executable** (`process.versions.bun` is set) — so a stray
+ * OH_HAI_BUILD_VERSION in the environment can NOT hijack `--version` on the npm/Node path, which
+ * stays exactly as before: fall back to reading the manifest relative to this module. That read
+ * works both from `dist/version.js` and `src/version.ts` via tsx — both sit one level under the
+ * package root, so `../package.json` resolves to the manifest either way.
  */
 export function cliVersion() {
+    // Build-time injected version — trusted ONLY under Bun (the compiled binary), never on the
+    // Node/npm path, so an ambient OH_HAI_BUILD_VERSION can't spoof the npm CLI's version. In the
+    // compiled binary `process.env.OH_HAI_BUILD_VERSION` is the frozen `--env` literal, not a live
+    // read. Empty string is not a valid version, so an unset/blank value falls through to the manifest.
+    const runningUnderBun = typeof process.versions.bun === "string";
+    const injected = process.env.OH_HAI_BUILD_VERSION;
+    if (runningUnderBun && typeof injected === "string" && injected.length > 0) {
+        return injected;
+    }
     try {
         const manifestUrl = new URL("../package.json", import.meta.url);
         const raw = readFileSync(fileURLToPath(manifestUrl), "utf8");

package/dist/version.js.map

@@ -1 +1 @@
-{"version":3,"file":"version.js","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,4FAA4F;AAE5F,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,8EAA8E;AAC9E,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAExC;;;;GAIG;AACH,MAAM,UAAU,UAAU;IACxB,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,GAAG,GAAG,YAAY,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA0B,CAAC;QACxD,OAAO,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC"}
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,4FAA4F;AAE5F,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,8EAA8E;AAC9E,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAExC;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,UAAU;IACxB,2FAA2F;IAC3F,8FAA8F;IAC9F,+FAA+F;IAC/F,oGAAoG;IACpG,MAAM,eAAe,GAAG,OAAQ,OAAO,CAAC,QAA6B,CAAC,GAAG,KAAK,QAAQ,CAAC;IACvF,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IAClD,IAAI,eAAe,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3E,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,GAAG,GAAG,YAAY,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA0B,CAAC;QACxD,OAAO,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC"}

package/dist/watch-lock.d.ts

@@ -0,0 +1,85 @@
+/** The injected seam: all disk / clock / pid / host access. Production is `nodeWatchLockIo()`; tests
+ *  pass an in-memory fake (mirrors `ConfigFileIo` in config-file.ts, `TeachFs` in context.ts). */
+export interface WatchLockIo {
+    /** Read a lock file's contents, or undefined when absent/unreadable. */
+    readFile(path: string): string | undefined;
+    /** Atomically create a lock file ONLY if it does not already exist (O_EXCL), creating parent dirs.
+     *  Returns true when this call created it, false when the file already existed. This is what makes a
+     *  same-host cold-start acquire atomic — the loser of a create race sees `false` and re-evaluates
+     *  rather than clobbering the winner. Throws on a real I/O failure (→ acquire degrades to unavailable). */
+    createExclusive(path: string, content: string): boolean;
+    /** Atomically (over)write a lock file, creating parent dirs (0700 dir, 0600 file). Used for the
+     *  heartbeat refresh and to steal a stale/`--force` lock (last-writer-wins). */
+    writeFile(path: string, content: string): void;
+    /** Best-effort delete; must not throw when the file is already gone. */
+    removeFile(path: string): void;
+    /** Is a process with this pid alive ON THIS HOST? (meaningful only same-host — pids are host-local). */
+    pidAlive(pid: number): boolean;
+    /** Epoch milliseconds. */
+    now(): number;
+    hostname: string;
+    pid: number;
+    homedir: string;
+    xdgStateHome: string | undefined;
+}
+/** A live handle over an acquired lock. */
+export interface WatchLock {
+    /** Refresh the heartbeat (call each poll). Best-effort — swallows write errors so a transient disk
+     *  failure never crashes the loop — and RETURNS whether the write succeeded so the caller can warn
+     *  once a heartbeat has been failing long enough that a peer may have reclaimed the lock (a silent
+     *  heartbeat death would otherwise let two watchers drain with no signal). */
+    heartbeat(): boolean;
+    /** Release on exit — deletes the lockfile IFF it is still ours (a reclaimer/`--force` steal may
+     *  own it now). Best-effort. The re-read→delete is itself non-atomic vs. a concurrent `--force`
+     *  steal landing between the two, so a stolen lock could in principle be deleted — a bounded,
+     *  self-healing residual (the stealer just re-acquires), not fixable without a real CAS. */
+    release(): void;
+}
+/** Human-facing (stderr) info about a previous holder — never includes a secret. */
+export interface HolderInfo {
+    pid: number;
+    hostname: string;
+    origin: string;
+    agentId: string;
+    startedAt: number;
+    heartbeatAt: number;
+}
+export type AcquireOutcome = {
+    kind: "acquired";
+    lock: WatchLock;
+    reclaimed: {
+        holder: HolderInfo;
+        wasLive: boolean;
+    } | null;
+} | {
+    kind: "held";
+    holder: HolderInfo | undefined;
+} | {
+    kind: "unavailable";
+    reason: string;
+};
+/** Resolve the lock directory: `$XDG_STATE_HOME/oh-hai/watch`, else `~/.local/state/oh-hai/watch`,
+ *  else undefined (guard unavailable). Mirrors `loadUserConfig`'s absolute-dir gating — a trusted dir
+ *  must be ABSOLUTE, so a relative XDG/home is ignored. `$XDG_RUNTIME_DIR` is deliberately NOT
+ *  consulted: its presence varies per shell/session, which would split one identity across two dirs
+ *  and defeat the guard. A single stable per-user location is the point. */
+export declare function resolveWatchDir(io: WatchLockIo): string | undefined;
+/** The lock filename for an identity. The Hub mailbox is scoped to the AGENT `(accountId, agentId)`,
+ *  so the discriminator is `(origin, agentId)` — NOT the bearer (one agent can hold several tokens).
+ *  sha256 gives a clean fixed-length, filesystem-safe name from an arbitrary agent id. NUL-separated
+ *  so (`ab`, `c`) and (`a`, `bc`) can't collide. */
+export declare function lockFilename(origin: string, agentId: string): string;
+/**
+ * Acquire the per-identity watch lock. Refuses when a LIVE watcher already holds this
+ * `(origin, agentId)` (unless `force`), reclaims a stale/crashed holder, and degrades to
+ * `unavailable` (never throws) when no lock directory can be resolved or the write fails — locking
+ * is a safety net, not a hard dependency.
+ */
+export declare function acquireWatchLock(io: WatchLockIo, params: {
+    origin: string;
+    agentId: string;
+    intervalMs: number;
+    force: boolean;
+}): AcquireOutcome;
+/** Production `WatchLockIo` — real filesystem, clock, process table, and environment. */
+export declare function nodeWatchLockIo(): WatchLockIo;

package/dist/watch-lock.js

@@ -0,0 +1,358 @@
+// Concurrent-watch drain-safety guard for `oh-hai inbox watch` (issue #323).
+//
+// `inbox watch` is a DESTRUCTIVE drain+ack of the agent's mailbox — the Hub hands each directive to
+// whichever watcher polls first, so two watchers sharing one identity race and the losing session
+// silently never sees the message. This module is the local, cross-process guard: a lockfile keyed
+// to the identity, with a pid + heartbeat liveness check, so one identity has at most one live
+// watcher — while a crashed watcher's lock is reclaimed (never a permanent block) and a genuinely
+// different identity is never affected.
+//
+// STRENGTH / LIMITS (this is a best-effort courtesy guard, NOT a kernel mutex): it reliably catches
+// the common case — a second watcher started while one is ALREADY established — and closes the
+// same-host cold-start race with an atomic exclusive create (O_EXCL). Two RESIDUAL windows remain,
+// both bounded and self-healing (never a permanent wedge): (a) two watchers racing to RECLAIM the
+// *same* stale lock in the same instant can both proceed — a write-then-verify re-read shrinks but
+// can't fully close it (a userspace lockfile can't compare-and-swap a replace); (b) watchers on
+// DIFFERENT hosts for one identity can't see each other (no shared state) and will split the mailbox.
+// Both are inherent to a per-user-local lockfile; the server-side race they bound is not eliminable here.
+//
+// IDENTITY: the Hub mailbox is scoped to the AGENT — `(accountId, agentId)` (server drainInbox/
+// ackDirectives) — and one agent can hold several active bearers at once (token rotation, env vs
+// keychain). Keying on the token would give two watchers for the SAME agent different locks and miss
+// the race, so the key is the resolved AGENT ID, not the bearer — which also means the token never
+// enters this module at all (§5.4). The lock FILENAME is a sha256 of `(origin, agentId)` for a clean
+// fixed-length name; the BODY carries pid / host / timestamps / origin / agentId / interval — no secret.
+// All disk / clock / pid / host access goes through an injected `WatchLockIo` so the logic is
+// unit-tested against an in-memory map with zero disk (mirrors `ConfigFileIo` and `TeachFs`).
+import { createHash } from "node:crypto";
+import { linkSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { homedir as osHomedir, hostname as osHostname } from "node:os";
+import { dirname, isAbsolute, join } from "node:path";
+import { writeSecureFile } from "./auth/secure-write.js";
+import { safeOsValue } from "./os.js";
+/** Freshness floor: a lock whose heartbeat is younger than this is fresh regardless of the holder's
+ *  interval. Comfortably above the default 5s poll so a normal watcher between polls is never stale. */
+const STALE_FLOOR_MS = 30_000;
+/** A lock is stale once its heartbeat is older than `intervalMs * this` (or the floor, whichever is
+ *  larger) — sized from the holder's OWN cadence (recorded in the lock) so a deliberately slow poller
+ *  (`--interval 120000`) isn't falsely declared dead. Three missed heartbeats of slack. */
+const STALE_MULTIPLIER = 3;
+/** Window-sizing fallback for a record whose `intervalMs` is missing/absurd. Distinct from the poll
+ *  default in inbox.ts (that one is the flag default handed to the loop) — this one is ONLY the stale
+ *  window basis when a record's interval can't be trusted. The two are intentionally NOT coupled. */
+const DEFAULT_INTERVAL_MS = 5000;
+/** Ceiling on the interval used for stale-window sizing. Caps the window at `this * STALE_MULTIPLIER`
+ *  (30 min) so a corrupt/hostile record with a huge `intervalMs` can't push a CROSS-host lock's
+ *  freshness window out to weeks. Well above any realistic presence-poll cadence (default 5s), so a
+ *  legitimate slow poller is unaffected; same-host liveness is governed by `pidAlive` regardless. */
+const MAX_WINDOW_INTERVAL_MS = 600_000;
+/** Bytes of the sha256 hex digest kept for the filename — 128 bits is collision-safe and one-way. */
+const KEY_HEX_CHARS = 32;
+/** The max epoch-ms `Date` can represent (`Date#toISOString` throws `RangeError` beyond ±this). A
+ *  record whose timestamps fall outside [0, this] is treated as malformed, so a corrupt/hostile lock
+ *  can't make a later `new Date(ts).toISOString()` throw. */
+const MAX_TIMESTAMP_MS = 8_640_000_000_000_000;
+/** The max pid `process.kill` accepts (a 32-bit signed positive int). A larger value throws
+ *  `ERR_INVALID_ARG_TYPE` (NOT `ESRCH`), which `pidAlive` would otherwise read as "alive" and wedge the
+ *  lock — so a record whose pid exceeds this is treated as malformed → reclaimable. */
+const MAX_PID = 2_147_483_647;
+/** Resolve the lock directory: `$XDG_STATE_HOME/oh-hai/watch`, else `~/.local/state/oh-hai/watch`,
+ *  else undefined (guard unavailable). Mirrors `loadUserConfig`'s absolute-dir gating — a trusted dir
+ *  must be ABSOLUTE, so a relative XDG/home is ignored. `$XDG_RUNTIME_DIR` is deliberately NOT
+ *  consulted: its presence varies per shell/session, which would split one identity across two dirs
+ *  and defeat the guard. A single stable per-user location is the point. */
+export function resolveWatchDir(io) {
+    const xdg = io.xdgStateHome?.trim();
+    const home = io.homedir.trim();
+    const base = xdg !== undefined && xdg !== "" && isAbsolute(xdg)
+        ? xdg
+        : home !== "" && isAbsolute(home)
+            ? join(home, ".local", "state")
+            : undefined;
+    return base === undefined ? undefined : join(base, "oh-hai", "watch");
+}
+/** The lock filename for an identity. The Hub mailbox is scoped to the AGENT `(accountId, agentId)`,
+ *  so the discriminator is `(origin, agentId)` — NOT the bearer (one agent can hold several tokens).
+ *  sha256 gives a clean fixed-length, filesystem-safe name from an arbitrary agent id. NUL-separated
+ *  so (`ab`, `c`) and (`a`, `bc`) can't collide. */
+export function lockFilename(origin, agentId) {
+    const digest = createHash("sha256").update(`${origin}\u0000${agentId}`).digest("hex");
+    return `${digest.slice(0, KEY_HEX_CHARS)}.lock`;
+}
+/** Parse a lock file, tolerating anything malformed as "no valid lock" (→ reclaimable). */
+function parseRecord(raw) {
+    if (raw === undefined)
+        return undefined;
+    let obj;
+    try {
+        obj = JSON.parse(raw);
+    }
+    catch {
+        return undefined;
+    }
+    if (typeof obj !== "object" || obj === null)
+        return undefined;
+    const r = obj;
+    const num = (v) => (typeof v === "number" && Number.isFinite(v) ? v : undefined);
+    // Timestamps must be within the range Date can format — a corrupt `heartbeatAt: 1e20` would otherwise
+    // survive parsing and later throw RangeError from `new Date(ts).toISOString()` in a warning. Treat
+    // out-of-range as malformed → reclaimable.
+    const ts = (v) => {
+        const n = num(v);
+        return n !== undefined && n >= 0 && n <= MAX_TIMESTAMP_MS ? n : undefined;
+    };
+    // The pid must be a POSITIVE integer within `process.kill`'s valid range. A corrupt `pid: 0` / `-1`
+    // / `1.5` would reach `process.kill(pid, 0)` — where 0 targets our process group and -1 every process
+    // — and a pid above MAX_PID throws `ERR_INVALID_ARG_TYPE` that `pidAlive` reads as "alive"; all of
+    // these could wedge the lock. Reject them as malformed → reclaimable.
+    const pidVal = num(r.pid);
+    const pid = pidVal !== undefined && Number.isInteger(pidVal) && pidVal >= 1 && pidVal <= MAX_PID ? pidVal : undefined;
+    const startedAt = ts(r.startedAt);
+    const heartbeatAt = ts(r.heartbeatAt);
+    if (pid === undefined || startedAt === undefined || heartbeatAt === undefined)
+        return undefined;
+    if (typeof r.hostname !== "string" || typeof r.origin !== "string" || typeof r.agentId !== "string")
+        return undefined;
+    const intervalMs = num(r.intervalMs);
+    return {
+        v: 1,
+        pid,
+        hostname: r.hostname,
+        startedAt,
+        heartbeatAt,
+        origin: r.origin,
+        agentId: r.agentId,
+        // A missing/absurd interval falls back to the default window sizing rather than making the
+        // holder look permanently fresh (a huge interval) or instantly stale (zero/negative).
+        intervalMs: intervalMs !== undefined && intervalMs > 0 ? intervalMs : DEFAULT_INTERVAL_MS,
+    };
+}
+/** Is this holder still live (→ a second watcher must refuse)?
+ *
+ *  SAME-HOST: trust the pid, NOT the heartbeat. A live pid means the watcher is running, even if it's
+ *  been stuck for a while in a long drain/ack/flush (`--timeout 60000`, a blocked stdout pipe) without
+ *  refreshing its heartbeat — reclaiming it on heartbeat-age would let a second process drain the same
+ *  mailbox concurrently, the exact double-drain the guard exists to prevent. A crashed watcher's pid is
+ *  gone, so `!pidAlive` still reclaims it; our own leftover pid is never live. (The residual: a dead
+ *  watcher's pid recycled by an UNRELATED live process reads as live until that process exits or a
+ *  `--force`; heartbeat age is not consulted same-host, so this is bounded by `--force`, not weeks.)
+ *
+ *  CROSS-HOST: pids are host-local and unverifiable, so fall back to heartbeat freshness alone. */
+function isLive(rec, io) {
+    if (rec.hostname === io.hostname) {
+        if (rec.pid === io.pid)
+            return false; // our own stale leftover → reclaim
+        return io.pidAlive(rec.pid); // alive → live (regardless of heartbeat age); dead → reclaim
+    }
+    // Clamp the sizing interval so a corrupt/hostile record can't inflate the window to weeks (adversarial).
+    const sizingInterval = Math.min(rec.intervalMs, MAX_WINDOW_INTERVAL_MS);
+    const window = Math.max(STALE_FLOOR_MS, sizingInterval * STALE_MULTIPLIER);
+    const age = io.now() - rec.heartbeatAt;
+    // cross-host: fresh iff the heartbeat is within ±window of now. A small clock skew (either sign) is
+    // tolerated, but a heartbeat FAR in the future is as implausible as one far in the past — a corrupt or
+    // wildly-skewed-clock lock must NOT read as "live for years" and block crash self-healing (bound the
+    // future skew, don't let a negative age be unconditionally fresh).
+    return Math.abs(age) <= window;
+}
+function holderInfo(rec) {
+    return {
+        pid: rec.pid,
+        hostname: rec.hostname,
+        origin: rec.origin,
+        agentId: rec.agentId,
+        startedAt: rec.startedAt,
+        heartbeatAt: rec.heartbeatAt,
+    };
+}
+/** Do two records identify the same acquisition? Keyed on pid+host+startedAt — startedAt is our
+ *  immutable acquisition stamp, while heartbeatAt changes each poll and is deliberately excluded. */
+function sameHolder(a, b) {
+    return a.pid === b.pid && a.hostname === b.hostname && a.startedAt === b.startedAt;
+}
+function makeLock(io, path, record) {
+    return {
+        heartbeat() {
+            // Verify we STILL own the lock before refreshing it. If a reclaimer or a `--force` steal took it
+            // over while we ran, an unconditional rewrite would clobber their record with ours — we'd "take
+            // the lock back", then our release() would delete it, leaving them unguarded. A displaced holder
+            // must NOT write; report false so the caller can warn (it has effectively lost the lock).
+            const current = parseRecord(io.readFile(path));
+            if (current === undefined || !sameHolder(current, record))
+                return false;
+            try {
+                io.writeFile(path, JSON.stringify({ ...record, heartbeatAt: io.now() }));
+                return true;
+            }
+            catch {
+                return false; // best-effort — see the interface doc; the caller warns on sustained failure.
+            }
+        },
+        release() {
+            // Delete only if the lock on disk is still OURS. A reclaimer or a `--force` steal may have
+            // overwritten it; deleting theirs would drop their guard.
+            const current = parseRecord(io.readFile(path));
+            if (current !== undefined && sameHolder(current, record)) {
+                try {
+                    io.removeFile(path);
+                }
+                catch {
+                    // best-effort
+                }
+            }
+        },
+    };
+}
+/**
+ * Acquire the per-identity watch lock. Refuses when a LIVE watcher already holds this
+ * `(origin, agentId)` (unless `force`), reclaims a stale/crashed holder, and degrades to
+ * `unavailable` (never throws) when no lock directory can be resolved or the write fails — locking
+ * is a safety net, not a hard dependency.
+ */
+export function acquireWatchLock(io, params) {
+    const dir = resolveWatchDir(io);
+    if (dir === undefined) {
+        return { kind: "unavailable", reason: "no XDG_STATE_HOME or home directory to place the lock file" };
+    }
+    const path = join(dir, lockFilename(params.origin, params.agentId));
+    // Read the RAW bytes so we can tell "absent" (undefined) from "present-but-unparseable" (a corrupt
+    // record) — the two are distinct: an absent slot is claimed via O_EXCL, a corrupt one is stolen.
+    const raw = io.readFile(path);
+    const existing = parseRecord(raw);
+    if (existing !== undefined && !params.force && isLive(existing, io)) {
+        return { kind: "held", holder: holderInfo(existing) };
+    }
+    const now = io.now();
+    const record = {
+        v: 1,
+        pid: io.pid,
+        hostname: io.hostname,
+        startedAt: now,
+        heartbeatAt: now,
+        origin: params.origin,
+        agentId: params.agentId,
+        intervalMs: params.intervalMs,
+    };
+    const content = JSON.stringify(record);
+    const fail = (error) => ({ kind: "unavailable", reason: error instanceof Error ? error.message : String(error) });
+    // Steal an existing lock (stale holder, `--force` takeover, or a corrupt record): overwrite
+    // last-writer-wins, then for a NON-force steal verify we actually won — a concurrent claimer whose
+    // write landed after ours shows a mismatch, so we back off to `held` rather than double-drain. This
+    // shrinks (does not fully close) the two-reclaimers window; `--force` is an explicit takeover so it
+    // skips the verify.
+    const steal = (reclaimed) => {
+        try {
+            io.writeFile(path, content);
+        }
+        catch (error) {
+            return fail(error);
+        }
+        if (!params.force) {
+            const after = parseRecord(io.readFile(path));
+            if (after !== undefined && !sameHolder(after, record)) {
+                return { kind: "held", holder: holderInfo(after) };
+            }
+        }
+        return { kind: "acquired", lock: makeLock(io, path, record), reclaimed };
+    };
+    if (raw === undefined) {
+        // TRULY absent → claim it with an ATOMIC exclusive create, closing the same-host cold-start race.
+        let created;
+        try {
+            created = io.createExclusive(path, content);
+        }
+        catch (error) {
+            return fail(error);
+        }
+        if (created) {
+            return { kind: "acquired", lock: makeLock(io, path, record), reclaimed: null };
+        }
+        // Lost the create race — a peer created the lock between our read and our create. Re-read the winner.
+        const winner = parseRecord(io.readFile(path));
+        if (winner === undefined) {
+            // The winner's record exists (EEXIST) but isn't readable/parseable — a transient read failure, or a
+            // pre-existing UNREADABLE/corrupt lock (bad perms, a manual repair). Back off rather than steal a
+            // possibly-live peer — UNLESS `--force`, the documented escape hatch: a rename-based write clears a
+            // lock even when the read couldn't open it, so `--force` must not dead-end on an unreadable file.
+            return params.force ? steal(null) : { kind: "held", holder: undefined };
+        }
+        if (!params.force && isLive(winner, io)) {
+            return { kind: "held", holder: holderInfo(winner) };
+        }
+        // The winner is already stale (raced then died), or we're forcing → steal it.
+        return steal({ holder: holderInfo(winner), wasLive: isLive(winner, io) });
+    }
+    // `raw` was DEFINED: a stale/force-over live lock (live+!force was handled above), or an unparseable
+    // record → steal it. When `existing === undefined` the on-disk bytes are corrupt — reclaimable, no
+    // holder info. This is safe because every writer creates the lock ATOMICALLY (createExclusive links a
+    // fully-written temp; writeFile is a temp+rename), so a fresh winner is NEVER partially visible — an
+    // unparseable present record is genuine corruption, not a mid-write winner, so reclaiming it can't
+    // clobber a live watcher. (`--force` reaches here too and skips the steal's verify.)
+    return steal(existing !== undefined ? { holder: holderInfo(existing), wasLive: isLive(existing, io) } : null);
+}
+// Per-process counter so two createExclusive temp files from this process never collide.
+let tmpSeq = 0;
+/** Production `WatchLockIo` — real filesystem, clock, process table, and environment. */
+export function nodeWatchLockIo() {
+    return {
+        readFile: (path) => {
+            try {
+                return readFileSync(path, "utf8");
+            }
+            catch {
+                return undefined; // absent / unreadable → "no lock here"
+            }
+        },
+        createExclusive: (path, content) => {
+            mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+            // Write the FULL content to a temp file, then hard-link it into place. `link()` is atomic and
+            // fails with EEXIST if the target exists (the O_EXCL semantics we need) — and, crucially, the
+            // target appears with its COMPLETE content in a single step. So a concurrent reader never sees an
+            // empty/partial fresh lock (the window in which it could be mistaken for a corrupt record and
+            // stolen, letting both watchers drain). A plain `wx` write does NOT give this: it creates the file
+            // empty and then fills it, so a reader can catch it mid-write.
+            const tmp = `${path}.tmp.${process.pid}.${tmpSeq++}`;
+            try {
+                writeFileSync(tmp, content, { mode: 0o600 });
+                linkSync(tmp, path);
+                return true;
+            }
+            catch (error) {
+                if (error.code === "EEXIST")
+                    return false;
+                throw error; // a real I/O error → acquire degrades to unavailable
+            }
+            finally {
+                try {
+                    rmSync(tmp, { force: true }); // drop the temp link; the target keeps the content via its own link
+                }
+                catch {
+                    // best-effort temp cleanup
+                }
+            }
+        },
+        writeFile: (path, content) => writeSecureFile(path, content),
+        removeFile: (path) => rmSync(path, { force: true }),
+        pidAlive: (pid) => {
+            try {
+                // Signal 0 performs the existence/permission check without actually signalling.
+                process.kill(pid, 0);
+                return true;
+            }
+            catch (error) {
+                // Alive ONLY when the error proves the process exists: EPERM (it exists but is owned by another
+                // user). ESRCH (no such process) and every OTHER error — notably `ERR_INVALID_ARG_TYPE`/
+                // `RangeError` for an out-of-range pid — count as NOT alive, so a malformed pid can't wedge the
+                // lock by masquerading as live. (parseRecord already rejects out-of-range pids; this is the
+                // defense-in-depth backstop.) POSIX-oriented: on Windows the distinction is less reliable, so
+                // same-host reclaim degrades toward the safe heartbeat-freshness path — the guard still holds.
+                return error.code === "EPERM";
+            }
+        },
+        now: () => Date.now(),
+        hostname: safeOsValue(osHostname),
+        pid: process.pid,
+        homedir: safeOsValue(osHomedir),
+        xdgStateHome: process.env.XDG_STATE_HOME,
+    };
+}
+//# sourceMappingURL=watch-lock.js.map

package/dist/watch-lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"watch-lock.js","sourceRoot":"","sources":["../src/watch-lock.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,EAAE;AACF,oGAAoG;AACpG,kGAAkG;AAClG,mGAAmG;AACnG,+FAA+F;AAC/F,kGAAkG;AAClG,wCAAwC;AACxC,EAAE;AACF,oGAAoG;AACpG,+FAA+F;AAC/F,mGAAmG;AACnG,kGAAkG;AAClG,mGAAmG;AACnG,gGAAgG;AAChG,sGAAsG;AACtG,0GAA0G;AAC1G,EAAE;AACF,gGAAgG;AAChG,iGAAiG;AACjG,qGAAqG;AACrG,mGAAmG;AACnG,qGAAqG;AACrG,yGAAyG;AACzG,8FAA8F;AAC9F,8FAA8F;AAE9F,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACnF,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,QAAQ,IAAI,UAAU,EAAE,MAAM,SAAS,CAAC;AACvE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEtD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAEtC;wGACwG;AACxG,MAAM,cAAc,GAAG,MAAM,CAAC;AAC9B;;2FAE2F;AAC3F,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAC3B;;qGAEqG;AACrG,MAAM,mBAAmB,GAAG,IAAI,CAAC;AACjC;;;qGAGqG;AACrG,MAAM,sBAAsB,GAAG,OAAO,CAAC;AACvC,qGAAqG;AACrG,MAAM,aAAa,GAAG,EAAE,CAAC;AACzB;;6DAE6D;AAC7D,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;AAC/C;;uFAEuF;AACvF,MAAM,OAAO,GAAG,aAAa,CAAC;AAuE9B;;;;4EAI4E;AAC5E,MAAM,UAAU,eAAe,CAAC,EAAe;IAC7C,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IAC/B,MAAM,IAAI,GACR,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE,IAAI,UAAU,CAAC,GAAG,CAAC;QAChD,CAAC,CAAC,GAAG;QACL,CAAC,CAAC,IAAI,KAAK,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC;YAC/B,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC;YAC/B,CAAC,CAAC,SAAS,CAAC;IAClB,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;AACxE,CAAC;AAED;;;oDAGoD;AACpD,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,OAAe;IAC1D,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,SAAS,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACtF,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,OAAO,CAAC;AAClD,CAAC;AAED,2FAA2F;AAC3F,SAAS,WAAW,CAAC,GAAuB;IAC1C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC9D,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,MAAM,GAAG,GAAG,CAAC,CAAU,EAAsB,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC9G,sGAAsG;IACtG,mGAAmG;IACnG,2CAA2C;IAC3C,MAAM,EAAE,GAAG,CAAC,CAAU,EAAsB,EAAE;QAC5C,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACjB,OAAO,CAAC,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5E,CAAC,CAAC;IACF,oGAAoG;IACpG,sGAAsG;IACtG,mGAAmG;IACnG,sEAAsE;IACtE,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC1B,MAAM,GAAG,GAAG,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,IAAI,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACtH,MAAM,SAAS,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,WAAW,GAAG,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IACtC,IAAI,GAAG,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAChG,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACtH,MAAM,UAAU,GAAG,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACrC,OAAO;QACL,CAAC,EAAE,CAAC;QACJ,GAAG;QACH,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,SAAS;QACT,WAAW;QACX,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,2FAA2F;QAC3F,sFAAsF;QACtF,UAAU,EAAE,UAAU,KAAK,SAAS,IAAI,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,mBAAmB;KAC1F,CAAC;AACJ,CAAC;AAED;;;;;;;;;;mGAUmG;AACnG,SAAS,MAAM,CAAC,GAAe,EAAE,EAAe;IAC9C,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,CAAC,QAAQ,EAAE,CAAC;QACjC,IAAI,GAAG,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG;YAAE,OAAO,KAAK,CAAC,CAAC,mCAAmC;QACzE,OAAO,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,6DAA6D;IAC5F,CAAC;IACD,yGAAyG;IACzG,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,sBAAsB,CAAC,CAAC;IACxE,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,cAAc,GAAG,gBAAgB,CAAC,CAAC;IAC3E,MAAM,GAAG,GAAG,EAAE,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,WAAW,CAAC;IACvC,oGAAoG;IACpG,uGAAuG;IACvG,qGAAqG;IACrG,mEAAmE;IACnE,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC;AACjC,CAAC;AAED,SAAS,UAAU,CAAC,GAAe;IACjC,OAAO;QACL,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,WAAW,EAAE,GAAG,CAAC,WAAW;KAC7B,CAAC;AACJ,CAAC;AAED;qGACqG;AACrG,SAAS,UAAU,CAAC,CAAa,EAAE,CAAa;IAC9C,OAAO,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS,CAAC;AACrF,CAAC;AAED,SAAS,QAAQ,CAAC,EAAe,EAAE,IAAY,EAAE,MAAkB;IACjE,OAAO;QACL,SAAS;YACP,iGAAiG;YACjG,gGAAgG;YAChG,iGAAiG;YACjG,0FAA0F;YAC1F,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;YAC/C,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC;gBAAE,OAAO,KAAK,CAAC;YACxE,IAAI,CAAC;gBACH,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;gBACzE,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC,CAAC,8EAA8E;YAC9F,CAAC;QACH,CAAC;QACD,OAAO;YACL,2FAA2F;YAC3F,0DAA0D;YAC1D,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;YAC/C,IAAI,OAAO,KAAK,SAAS,IAAI,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;gBACzD,IAAI,CAAC;oBACH,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;gBACtB,CAAC;gBAAC,MAAM,CAAC;oBACP,cAAc;gBAChB,CAAC;YACH,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,EAAe,EACf,MAA+E;IAE/E,MAAM,GAAG,GAAG,eAAe,CAAC,EAAE,CAAC,CAAC;IAChC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,4DAA4D,EAAE,CAAC;IACvG,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAEpE,mGAAmG;IACnG,iGAAiG;IACjG,MAAM,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC;QACpE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;IACxD,CAAC;IAED,MAAM,GAAG,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC;IACrB,MAAM,MAAM,GAAe;QACzB,CAAC,EAAE,CAAC;QACJ,GAAG,EAAE,EAAE,CAAC,GAAG;QACX,QAAQ,EAAE,EAAE,CAAC,QAAQ;QACrB,SAAS,EAAE,GAAG;QACd,WAAW,EAAE,GAAG;QAChB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,UAAU,EAAE,MAAM,CAAC,UAAU;KAC9B,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,CAAC,KAAc,EAAkB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAE3I,4FAA4F;IAC5F,mGAAmG;IACnG,oGAAoG;IACpG,oGAAoG;IACpG,oBAAoB;IACpB,MAAM,KAAK,GAAG,CAAC,SAA0D,EAAkB,EAAE;QAC3F,IAAI,CAAC;YACH,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAClB,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;YAC7C,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;gBACtD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YACrD,CAAC;QACH,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC;IAC3E,CAAC,CAAC;IAEF,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,kGAAkG;QAClG,IAAI,OAAgB,CAAC;QACrB,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACjF,CAAC;QACD,sGAAsG;QACtG,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,oGAAoG;YACpG,kGAAkG;YAClG,oGAAoG;YACpG,kGAAkG;YAClG,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC1E,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;YACxC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACtD,CAAC;QACD,8EAA8E;QAC9E,OAAO,KAAK,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,qGAAqG;IACrG,mGAAmG;IACnG,sGAAsG;IACtG,qGAAqG;IACrG,mGAAmG;IACnG,qFAAqF;IACrF,OAAO,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAChH,CAAC;AAED,yFAAyF;AACzF,IAAI,MAAM,GAAG,CAAC,CAAC;AAEf,yFAAyF;AACzF,MAAM,UAAU,eAAe;IAC7B,OAAO;QACL,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE;YACjB,IAAI,CAAC;gBACH,OAAO,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACpC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,SAAS,CAAC,CAAC,uCAAuC;YAC3D,CAAC;QACH,CAAC;QACD,eAAe,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE;YACjC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC3D,8FAA8F;YAC9F,8FAA8F;YAC9F,kGAAkG;YAClG,8FAA8F;YAC9F,mGAAmG;YACnG,+DAA+D;YAC/D,MAAM,GAAG,GAAG,GAAG,IAAI,QAAQ,OAAO,CAAC,GAAG,IAAI,MAAM,EAAE,EAAE,CAAC;YACrD,IAAI,CAAC;gBACH,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC7C,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBACpB,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;oBAAE,OAAO,KAAK,CAAC;gBACrE,MAAM,KAAK,CAAC,CAAC,qDAAqD;YACpE,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC;oBACH,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,oEAAoE;gBACpG,CAAC;gBAAC,MAAM,CAAC;oBACP,2BAA2B;gBAC7B,CAAC;YACH,CAAC;QACH,CAAC;QACD,SAAS,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC;QAC5D,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACnD,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE;YAChB,IAAI,CAAC;gBACH,gFAAgF;gBAChF,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;gBACrB,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,gGAAgG;gBAChG,yFAAyF;gBACzF,gGAAgG;gBAChG,4FAA4F;gBAC5F,8FAA8F;gBAC9F,+FAA+F;gBAC/F,OAAQ,KAA+B,CAAC,IAAI,KAAK,OAAO,CAAC;YAC3D,CAAC;QACH,CAAC;QACD,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;QACrB,QAAQ,EAAE,WAAW,CAAC,UAAU,CAAC;QACjC,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,OAAO,EAAE,WAAW,CAAC,SAAS,CAAC;QAC/B,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc;KACzC,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oh-hai/cli",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "OH HAI — the `oh-hai` CLI: reach a human from your agent through an MA2H Hub (notify / ask / task). Placement + machine contract; command bodies land in #106–#108.",
   "license": "UNLICENSED",
   "type": "module",
@@ -26,7 +26,7 @@
   },
   "devDependencies": {
     "@types/node": "^26.1.0",
-    "tsx": "^4.19.2",
+    "tsx": "^4.23.0",
     "typescript": "^6.0.3"
   },
   "scripts": {