@openagt/dashboard 0.0.0-stage → 0.9.0

package/dist/chrome-extension/driver-plan.js

@@ -0,0 +1,41 @@
+// Which watched sessions the Driver tab visits this cycle (#1332). Shared by the service worker,
+// which decides, and the offline harness, which pins the rule; loaded as a plain script in both.
+//
+// The rule exists because claude.ai's list statuses are sticky: an in-app visit clears neither
+// "Awaiting input" nor "Unread response" (measured 2026-08-25), so visiting every stopped session
+// on every cycle would mean 50 visits every half minute for 50 agents. A session is visited when
+// its status changed to awaiting, unread or idle since the last read; an awaiting one also when it
+// has not been visited for a while — a question asked in prose carries no block, so the list's
+// word is the only signal and a re-read is what catches it (#1707); and any session always when
+// the dashboard queued an answer for it — that is the one thing the list cannot know.
+
+/** How long a session the list keeps calling awaiting waits before being looked at again. */
+const REVISIT_MS = 5 * 60_000
+
+/** The list statuses that mean the session stopped: for its user, after a turn, or for good. */
+const ON_CHANGE = new Set(['awaiting', 'unread', 'idle'])
+
+/** The one status also revisited on age: the session may be asking without a block. */
+const ON_AGE = new Set(['awaiting'])
+
+/**
+ * `statuses`: what the list said, `[{sessionId, status}]`. `answers`: a map of session id to the
+ * queued answer. `seen`: a map of session id to `{status, visitedAt}` from earlier cycles. Returns
+ * the visits in list order, each `{id, status, answer?}`.
+ */
+function planVisits(statuses, answers, seen, now, revisitMs = REVISIT_MS) {
+  const visits = []
+  for (const { sessionId, status } of statuses) {
+    const answer = answers.get(sessionId)
+    const last = seen.get(sessionId)
+    const changed = !last || last.status !== status
+    const stale = !last || now - (last.visitedAt ?? 0) >= revisitMs
+    const due = (ON_CHANGE.has(status) && changed) || (ON_AGE.has(status) && stale)
+    if (answer || due) visits.push({ id: sessionId, status, ...(answer ? { answer } : {}) })
+  }
+  return visits
+}
+
+// The worker loads this with importScripts, where a top-level function is already global; jsdom
+// evaluates it the same way. Nothing else to export.
+if (typeof globalThis !== 'undefined') globalThis.__oaPlanVisits = planVisits

package/dist/chrome-extension/fingerprint.js

@@ -0,0 +1,43 @@
+// Whether the extension's own files changed on disk (#1711). Shared by the service worker, which
+// reloads the extension when they did, and the offline harness, which pins the rule; loaded as a
+// plain script in both.
+//
+// This exists because the extension is unpacked and edited in place, and Chrome re-reads an
+// unpacked extension's files only on a reload — which used to be a human click on
+// chrome://extensions after every change. The worker can read its own files as they are on disk
+// right now (measured 2026-08-26: a fetch of the extension's own URL returns the current file,
+// not a cached copy), so it fingerprints them at start, again every beat, and reloads itself on
+// a difference.
+
+/** Every file Chrome loads for this extension: the manifest, the worker and what it imports, the content script, and the options page and its script. */
+const WATCHED_FILES = ['manifest.json', 'background.js', 'driver-plan.js', 'fingerprint.js', 'content.js', 'options.html', 'options.js']
+
+/** FNV-1a over the text, as eight hex digits. Enough to tell an edit; nobody is attacking it. */
+function hashText(text) {
+  let hash = 0x811c9dc5
+  for (let i = 0; i < text.length; i++) {
+    hash ^= text.charCodeAt(i)
+    hash = Math.imul(hash, 0x01000193) >>> 0
+  }
+  return hash.toString(16).padStart(8, '0')
+}
+
+/**
+ * The hash of each watched file, read through `readText(file)`. A file that cannot be read fails
+ * the whole fingerprint rather than standing in as a change: a reload on a read that merely
+ * failed this once would loop.
+ */
+async function fingerprint(readText) {
+  const hashes = {}
+  for (const file of WATCHED_FILES) hashes[file] = hashText(await readText(file))
+  return hashes
+}
+
+/** The watched files whose hash differs between two fingerprints, in watched order. */
+function changedFiles(before, after) {
+  return WATCHED_FILES.filter(file => before[file] !== after[file])
+}
+
+// The worker loads this with importScripts, where a top-level binding is already global; jsdom
+// evaluates it the same way. Nothing else to export.
+if (typeof globalThis !== 'undefined') globalThis.__oaFingerprint = { WATCHED_FILES, fingerprint, changedFiles }

package/dist/chrome-extension/manifest.json

@@ -0,0 +1,31 @@
+{
+  "manifest_version": 3,
+  "name": "OpenAgent: Claude web bridge",
+  "version": "0.13.0",
+  "description": "Drives one pinned claude.ai tab through your Claude Code cloud sessions: the question a session is parked on shows up in your local OpenAgent dashboard, and the answer you pick there is typed back into the session.",
+  "permissions": [
+    "storage",
+    "tabs",
+    "alarms"
+  ],
+  "host_permissions": [
+    "http://localhost/*",
+    "http://127.0.0.1/*"
+  ],
+  "background": {
+    "service_worker": "background.js"
+  },
+  "options_page": "options.html",
+  "content_scripts": [
+    {
+      "matches": [
+        "https://claude.ai/*"
+      ],
+      "js": [
+        "content.js"
+      ],
+      "run_at": "document_idle",
+      "all_frames": true
+    }
+  ]
+}

package/dist/chrome-extension/options.html

@@ -0,0 +1,48 @@
+<!doctype html>
+<html>
+  <head>
+    <meta charset="utf-8" />
+    <title>OpenAgent bridge</title>
+    <style>
+      body { font: 14px/1.5 ui-sans-serif, system-ui, sans-serif; margin: 24px; max-width: 560px; color: #1f2430; }
+      h1 { font-size: 17px; margin: 0 0 4px; }
+      p { color: #5b6472; margin: 0 0 16px; }
+      label { display: block; font-weight: 600; margin: 14px 0 4px; }
+      input { width: 100%; padding: 7px 9px; border: 1px solid #c9cfd8; border-radius: 6px; font: inherit; box-sizing: border-box; }
+      button { margin-top: 16px; padding: 7px 14px; border: 0; border-radius: 6px; background: #2d3441; color: #fff; font: inherit; cursor: pointer; }
+      code { background: #eef1f5; padding: 1px 5px; border-radius: 4px; }
+      #status { margin-top: 12px; min-height: 20px; color: #2f7a3f; }
+      #status.error { color: #b3261e; }
+    </style>
+  </head>
+  <body>
+    <h1>OpenAgent bridge</h1>
+    <p>
+      Reports the question a Claude Code cloud session is parked on to your local dashboard. Turn the
+      bridge on in OpenAgent first, then paste its token here.
+    </p>
+
+    <label for="daemon">Dashboard URL</label>
+    <input id="daemon" type="url" placeholder="http://localhost:4200" />
+
+    <label for="token">Bridge token</label>
+    <input id="token" type="password" placeholder="paste the token from OpenAgent" autocomplete="off" />
+
+    <label style="font-weight:600;margin-top:18px;display:flex;align-items:center;gap:8px">
+      <input id="autoOpen" type="checkbox" style="width:auto" />
+      Run the Driver tab
+    </label>
+    <p style="margin:4px 0 0;font-size:12px">
+      One pinned background tab that reads claude.ai's session list, visits the cloud sessions
+      waiting on you, and types your answers. Without it the bridge does nothing. Closing the tab
+      pauses it; the button below reopens it.
+    </p>
+
+    <button id="save">Save and test</button>
+    <button id="openNow" style="background:#4a5566;margin-left:8px">Open the Driver tab now</button>
+    <div id="status" role="status"></div>
+    <p id="lastCycle" style="margin:10px 0 0;font-size:12px"></p>
+
+    <script src="options.js"></script>
+  </body>
+</html>

package/dist/chrome-extension/options.js

@@ -0,0 +1,122 @@
+// Where the token is set. It lives in extension storage rather than in the page, so nothing on
+// claude.ai can read the secret that talks to the daemon.
+
+const DEFAULT_DAEMON = 'http://localhost:4200'
+const daemonEl = document.getElementById('daemon')
+const tokenEl = document.getElementById('token')
+const statusEl = document.getElementById('status')
+const autoOpenEl = document.getElementById('autoOpen')
+const lastCycleEl = document.getElementById('lastCycle')
+
+void chrome.storage.local.get(['daemonUrl', 'token', 'autoOpen']).then(({ daemonUrl, token, autoOpen }) => {
+  daemonEl.value = daemonUrl || DEFAULT_DAEMON
+  tokenEl.value = token || ''
+  // Default on once configured, but stored explicitly so the worker never has to guess.
+  autoOpenEl.checked = autoOpen !== false
+})
+
+/**
+ * What the worker's last cycle did, as it recorded it: this page is the one place to read why
+ * the bridge is doing nothing — or that the worker just reloaded the extension because its files
+ * changed on disk — without opening a service worker console. Kept live while the page is open:
+ * the worker records every cycle, and each record re-renders the line.
+ */
+function showLastCycle(lastCycle) {
+  if (!lastCycle) {
+    lastCycleEl.textContent = 'No cycle has run yet.'
+    return
+  }
+  const at = lastCycle.at ? ` at ${new Date(lastCycle.at).toLocaleTimeString()}` : ''
+  lastCycleEl.textContent = `Last cycle${at}: ${lastCycle.ok ? '' : 'failed — '}${lastCycle.reason ?? 'no reason recorded'}`
+}
+void chrome.storage.local.get('lastCycle').then(({ lastCycle }) => showLastCycle(lastCycle))
+chrome.storage.onChanged.addListener((changes, area) => {
+  if (area === 'local' && changes.lastCycle) showLastCycle(changes.lastCycle.newValue)
+})
+
+function say(message, isError) {
+  statusEl.textContent = message
+  statusEl.className = isError ? 'error' : ''
+}
+
+/**
+ * Are the host permissions actually granted?
+ *
+ * Declaring them in the manifest is not the same as holding them: Chrome lists each site under
+ * "Site access" with its own toggle, and for an unpacked extension they can sit off. The daemon
+ * sends no CORS headers by design, so without the localhost grant the worker's fetch is blocked
+ * before it leaves the browser and the daemon sees nothing at all. That looked like every other
+ * failure and cost an evening, so it is checked first now.
+ */
+async function missingHosts(daemonUrl) {
+  const wanted = [`${daemonUrl}/`, 'https://claude.ai/']
+  const missing = []
+  for (const origin of wanted) {
+    const ok = await chrome.permissions.contains({ origins: [`${origin}*`] }).catch(() => false)
+    if (!ok) missing.push(origin)
+  }
+  return missing
+}
+
+document.getElementById('save').addEventListener('click', async () => {
+  const daemonUrl = (daemonEl.value || DEFAULT_DAEMON).replace(/\/+$/, '')
+  const token = tokenEl.value.trim()
+  if (!token) return say('Paste the bridge token first.', true)
+  await chrome.storage.local.set({ daemonUrl, token, autoOpen: autoOpenEl.checked })
+
+  // Save then prove it: a token that is merely stored tells the user nothing, and the two ways
+  // this goes wrong (bridge off, wrong token) are worth telling apart before they need it.
+  say('Saved. Testing…')
+  const missing = await missingHosts(daemonUrl)
+  if (missing.length) {
+    return say(
+      `Chrome has not granted access to ${missing.join(' and ')}. Open chrome://extensions, find this extension, and switch those on under Site access.`,
+      true,
+    )
+  }
+  try {
+    const version = { 'x-oa-extension-version': chrome.runtime.getManifest().version }
+    const res = await fetch(`${daemonUrl}/_bridge/ping`, { headers: { authorization: `Bearer ${token}`, ...version } })
+    if (res.status === 401) return say('The dashboard is reachable but rejected the token.', true)
+    if (res.status === 404) return say('Reached the dashboard, but the bridge is off. Turn it on in OpenAgent.', true)
+    // The daemon refuses a version-skewed extension on every route (#1519); its answer names
+    // both versions and the way out, so hand it over verbatim.
+    if (res.status === 426) return say(await res.text(), true)
+    if (!res.ok) return say(`The dashboard answered ${res.status}.`, true)
+    // A 200 is not enough. The dashboard serves its single-page app for any path it does not
+    // recognise, so a build with no bridge route answers 200 and a page of HTML, and treating
+    // that as success would report "connected" to someone whose bridge does not exist.
+    const body = (await res.text()).trim()
+    if (body !== 'ok') return say('That dashboard has no bridge route. Update OpenAgent, then try again.', true)
+
+    // Prove the read path too, not just auth. "Connected" on its own leaves the next question
+    // unanswered: does the daemon actually have anything for us to watch?
+    let watching = ''
+    try {
+      const list = await fetch(`${daemonUrl}/_bridge/sessions`, { headers: { authorization: `Bearer ${token}`, ...version } })
+      const sessions = list.ok ? ((await list.json())?.sessions ?? []) : []
+      watching = sessions.length
+        ? ` Watching ${sessions.length} recent cloud session${sessions.length === 1 ? '' : 's'}${autoOpenEl.checked ? ', the Driver tab serves them.' : ' (the Driver tab is off).'}`
+        : ' No recent cloud sessions to watch yet.'
+    } catch {
+      watching = ' Could not list sessions.'
+    }
+    say(`Connected. The bridge is on and the token works.${watching}`)
+  } catch {
+    say(`Could not reach ${daemonUrl}. Is the dashboard running?`, true)
+  }
+})
+
+
+// Run a Driver cycle on demand. The alarm fires twice a minute, which is a long time to sit
+// wondering whether anything is wrong, and every reason it might do nothing is reported. This
+// also resumes a Driver the user paused by closing its tab.
+document.getElementById('openNow').addEventListener('click', () => {
+  say('Driving…')
+  chrome.runtime.sendMessage({ type: 'oa-open-now' }, result => {
+    if (chrome.runtime.lastError) return say(chrome.runtime.lastError.message ?? 'the worker did not answer', true)
+    if (!result) return say('The worker did not answer. Try reloading the extension.', true)
+    if (!result.ok) return say(`Did nothing: ${result.reason}`, true)
+    say(`Driver cycle done: ${result.reason}.`)
+  })
+})

package/dist/cli.d.ts

@@ -0,0 +1,43 @@
+import { type VersionFetcher } from './update-check.js';
+/** Where the CLI writes. Injectable so tests capture output. */
+export interface CliIO {
+    out: (line: string) => void;
+    err: (line: string) => void;
+}
+export declare function openagentVersion(): string;
+/** What the CLI itself accepts: four options, no verbs (D4). */
+export interface CliArgs {
+    help: boolean;
+    version: boolean;
+    /** `--port <n>`: the port the dashboard binds. Default {@link DEFAULT_DAEMON_PORT}; `0` is ephemeral. */
+    port?: number;
+    /**
+     * `--host <addr>` (#1051): the dashboard's bind address. Default loopback; a non-loopback
+     * address exposes it to the network and gates every route behind the generated shared token.
+     */
+    host?: string;
+    error?: string;
+}
+/**
+ * Parse argv (without the node/script prefix). Pure and testable.
+ *
+ * Four options and nothing else: `--host` and `--port` because they are the two things a browser
+ * cannot be asked and a dashboard cannot serve about itself; `--help` and `--version` because a
+ * command with options owes the user both. The command runs no agent (#1774): a run is started
+ * from the dashboard, by the project's own start hook.
+ */
+export declare function parseArgs(argv: string[]): CliArgs;
+export declare function runCli(argv: string[], io?: CliIO): Promise<number>;
+/**
+ * The startup footer every dashboard path prints (#312): where prompts come from, the version,
+ * and then — once npm answers — whether that version is the latest.
+ *
+ * The update line is deliberately not awaited before the static lines. #312 asks for the static
+ * info first, and the foreground path (bare `openagent`) blocks on the server forever, so a line
+ * printed after the await would never appear there at all. `checkForUpdate` is already forgiving:
+ * offline or slow (2.5s cap) resolves to 'unknown', which prints nothing.
+ */
+export declare function printStartupFooter(io: CliIO, opts?: {
+    fetchLatest?: VersionFetcher;
+}): Promise<void>;
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAGA,OAAO,EAA0D,KAAK,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAK/G,gEAAgE;AAChE,MAAM,WAAW,KAAK;IACpB,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAC3B,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CAC5B;AAcD,wBAAgB,gBAAgB,IAAI,MAAM,CAYzC;AAqBD,gEAAgE;AAChE,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,OAAO,CAAA;IACb,OAAO,EAAE,OAAO,CAAA;IAChB,yGAAyG;IACzG,IAAI,CAAC,EAAE,MAAM,CAAA;IACb;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CA8BjD;AAED,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,GAAE,KAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAiBnF;AAmDD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,GAAE;IAAE,WAAW,CAAC,EAAE,cAAc,CAAA;CAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAaxG"}

package/dist/cli.js

@@ -0,0 +1,186 @@
+import { readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { checkForUpdate, formatUpdateStatus, nodeVersionFetcher } from './update-check.js';
+import { isLoopbackHost, runDaemon, DEFAULT_DAEMON_HOST, DEFAULT_DAEMON_PORT } from './daemon.js';
+import { ensureDaemonToken } from './registry.js';
+import { errorMessage } from './error-message.js';
+const defaultIO = {
+    out: line => process.stdout.write(line + '\n'),
+    err: line => process.stderr.write(line + '\n'),
+};
+/**
+ * The CLI version, read from the package's own `package.json` at runtime (#312).
+ * The compiled entry lives one level under the package root (`dist/` or
+ * `dist-test/`), so its `package.json` is always `../package.json`. Cached after
+ * the first read; falls back to `unknown` if the file is somehow unreadable.
+ */
+let cachedVersion;
+export function openagentVersion() {
+    if (cachedVersion !== undefined)
+        return cachedVersion;
+    try {
+        const pkgPath = join(dirname(fileURLToPath(import.meta.url)), '..', 'package.json');
+        const pkg = JSON.parse(readFileSync(pkgPath, 'utf8'));
+        // `unknown`, not `0.0.0`: the packages are unreleased and legitimately versioned `0.0.0`, so a
+        // numeric fallback would make a failed read indistinguishable from a correct one (#312).
+        cachedVersion = pkg.version ?? 'unknown';
+    }
+    catch {
+        cachedVersion = 'unknown';
+    }
+    return cachedVersion;
+}
+const HELP = `OpenAgent — turnkey AI orchestration that wraps a coding agent (Claude Code or Codex).
+
+Usage:
+  openagent              Serve the dashboard in the foreground. Ctrl+C closes it; the server
+                         logs stream to this terminal.
+
+Options:
+  --port <n>             Dashboard port (default: 4200).
+  --host <addr>          Bind address (default: 127.0.0.1, localhost only). A non-loopback
+                         address (e.g. 0.0.0.0) exposes the dashboard to your network and
+                         generates a shared token; the printed URL carries it, and any request
+                         without it gets 401. Exposing a process spawner to the network is a
+                         security decision (#806).
+  -h, --help             Show this help.
+  -v, --version          Print the version.
+
+Everything else is the dashboard: it shows a project's runs from their files, and starts one
+through the project's own start hook (.openagent/hooks.yml), which names the tool that runs it.`;
+/**
+ * Parse argv (without the node/script prefix). Pure and testable.
+ *
+ * Four options and nothing else: `--host` and `--port` because they are the two things a browser
+ * cannot be asked and a dashboard cannot serve about itself; `--help` and `--version` because a
+ * command with options owes the user both. The command runs no agent (#1774): a run is started
+ * from the dashboard, by the project's own start hook.
+ */
+export function parseArgs(argv) {
+    const opts = { help: false, version: false };
+    for (let i = 0; i < argv.length; i++) {
+        const arg = argv[i];
+        switch (arg) {
+            case '--help':
+            case '-h':
+                opts.help = true;
+                break;
+            case '--version':
+            case '-v':
+                opts.version = true;
+                break;
+            case '--port': {
+                const n = Number(argv[++i]);
+                if (Number.isInteger(n) && n >= 0)
+                    opts.port = n;
+                else
+                    opts.error = 'invalid --port: must be a non-negative integer';
+                break;
+            }
+            case '--host': {
+                const value = argv[++i];
+                if (value === undefined)
+                    opts.error = 'invalid --host: missing address';
+                else
+                    opts.host = value;
+                break;
+            }
+            default:
+                opts.error = arg.startsWith('-') ? `unknown option: ${arg}` : `unknown command: ${arg}`;
+        }
+    }
+    return opts;
+}
+export async function runCli(argv, io = defaultIO) {
+    const args = parseArgs(argv);
+    if (args.error) {
+        io.err(args.error);
+        io.err('Run `openagent --help` for usage.');
+        return 2;
+    }
+    if (args.help) {
+        io.out(HELP);
+        return 0;
+    }
+    if (args.version) {
+        io.out(openagentVersion());
+        return 0;
+    }
+    // Everything else is bare `openagent`: serve the dashboard in the foreground until Ctrl-C.
+    return runForegroundDaemonCmd(args, io);
+}
+/**
+ * Bare `openagent`: run the dashboard server in the foreground (#456), so its logs and any
+ * server-thrown errors are visible and Ctrl+C stops it. Blocks until the server is signalled
+ * (SIGINT/SIGTERM).
+ */
+async function runForegroundDaemonCmd(args, io) {
+    const cwd = process.cwd();
+    const port = args.port ?? DEFAULT_DAEMON_PORT;
+    const host = args.host;
+    // #1051: pre-generate the shared token for a non-loopback bind so onListening (sync) can print
+    // the reachable URL; runDaemon reuses the same persisted token.
+    const token = host !== undefined && !isLoopbackHost(host) ? await ensureDaemonToken() : undefined;
+    try {
+        await runDaemon(cwd, {
+            port,
+            ...(host !== undefined ? { host } : {}),
+            onListening: state => {
+                io.out(`◆ dashboard running: ${state.url}`);
+                if (!isLoopbackHost(state.host ?? DEFAULT_DAEMON_HOST)) {
+                    printNonLoopbackAccess(io, state.host ?? DEFAULT_DAEMON_HOST, state.url, token);
+                }
+                io.out('  Ctrl+C to stop the dashboard. Server logs stream below.');
+                // #312 asks bare `openagent` to print the commands + version too. onListening is sync and
+                // runDaemon then blocks until signalled, so this is fire-and-forget by necessity: the
+                // update line lands a moment later, above the server logs.
+                void printStartupFooter(io);
+            },
+        });
+    }
+    catch (err) {
+        io.err(`could not start the dashboard (${errorMessage(err)}).`);
+        return 1;
+    }
+    return 0;
+}
+/**
+ * The loud one-line warning and the token-bearing URL printed on any non-loopback daemon bind
+ * (#1051). A daemon that spawns processes is code execution for anyone who reaches the port, and
+ * the shared token is the only guard, so this says so before the daemon is left running. The bound
+ * host is a bind-all like `0.0.0.0`, so the user swaps it for the machine's actual reachable
+ * address (a Tailscale/LAN hostname); the token rides the URL for the first hop, then the cookie.
+ */
+function printNonLoopbackAccess(io, host, url, token) {
+    io.err(`⚠ SECURITY: bound to ${host} (non-loopback). This exposes code execution to your network; the shared token is the only guard (#1051).`);
+    if (!token)
+        return;
+    io.out(`  Open with the token (swap ${host} for this machine's reachable address, e.g. a Tailscale hostname):`);
+    io.out(`    ${url}/?token=${token}`);
+}
+/**
+ * The startup footer every dashboard path prints (#312): where prompts come from, the version,
+ * and then — once npm answers — whether that version is the latest.
+ *
+ * The update line is deliberately not awaited before the static lines. #312 asks for the static
+ * info first, and the foreground path (bare `openagent`) blocks on the server forever, so a line
+ * printed after the await would never appear there at all. `checkForUpdate` is already forgiving:
+ * offline or slow (2.5s cap) resolves to 'unknown', which prints nothing.
+ */
+export function printStartupFooter(io, opts = {}) {
+    const version = openagentVersion();
+    io.out('');
+    io.out('Type a prompt on the dashboard to start an agent, or use:');
+    io.out('  openagent --help              All options');
+    io.out('');
+    io.out(`OpenAgent v${version}`);
+    return checkForUpdate(version, opts.fetchLatest ?? nodeVersionFetcher())
+        .then(status => {
+        const line = formatUpdateStatus(status);
+        if (line)
+            io.out(line);
+    })
+        .catch(() => { });
+}
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,kBAAkB,EAAuB,MAAM,mBAAmB,CAAA;AAC/G,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AACjG,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAQjD,MAAM,SAAS,GAAU;IACvB,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;IAC9C,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;CAC/C,CAAA;AAED;;;;;GAKG;AACH,IAAI,aAAiC,CAAA;AACrC,MAAM,UAAU,gBAAgB;IAC9B,IAAI,aAAa,KAAK,SAAS;QAAE,OAAO,aAAa,CAAA;IACrD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,CAAA;QACnF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAyB,CAAA;QAC7E,+FAA+F;QAC/F,yFAAyF;QACzF,aAAa,GAAG,GAAG,CAAC,OAAO,IAAI,SAAS,CAAA;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,aAAa,GAAG,SAAS,CAAA;IAC3B,CAAC;IACD,OAAO,aAAa,CAAA;AACtB,CAAC;AAED,MAAM,IAAI,GAAG;;;;;;;;;;;;;;;;;gGAiBmF,CAAA;AAgBhG;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS,CAAC,IAAc;IACtC,MAAM,IAAI,GAAY,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;IACrD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAE,CAAA;QACpB,QAAQ,GAAG,EAAE,CAAC;YACZ,KAAK,QAAQ,CAAC;YACd,KAAK,IAAI;gBACP,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;gBAChB,MAAK;YACP,KAAK,WAAW,CAAC;YACjB,KAAK,IAAI;gBACP,IAAI,CAAC,OAAO,GAAG,IAAI,CAAA;gBACnB,MAAK;YACP,KAAK,QAAQ,EAAE,CAAC;gBACd,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;gBAC3B,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,IAAI,CAAC,IAAI,GAAG,CAAC,CAAA;;oBAC3C,IAAI,CAAC,KAAK,GAAG,gDAAgD,CAAA;gBAClE,MAAK;YACP,CAAC;YACD,KAAK,QAAQ,EAAE,CAAC;gBACd,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;gBACvB,IAAI,KAAK,KAAK,SAAS;oBAAE,IAAI,CAAC,KAAK,GAAG,iCAAiC,CAAA;;oBAClE,IAAI,CAAC,IAAI,GAAG,KAAK,CAAA;gBACtB,MAAK;YACP,CAAC;YACD;gBACE,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,mBAAmB,GAAG,EAAE,CAAC,CAAC,CAAC,oBAAoB,GAAG,EAAE,CAAA;QAC3F,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,IAAc,EAAE,EAAE,GAAU,SAAS;IAChE,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IAC5B,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAClB,EAAE,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAA;QAC3C,OAAO,CAAC,CAAA;IACV,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACZ,OAAO,CAAC,CAAA;IACV,CAAC;IACD,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,EAAE,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAA;QAC1B,OAAO,CAAC,CAAA;IACV,CAAC;IACD,2FAA2F;IAC3F,OAAO,sBAAsB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;AACzC,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,sBAAsB,CAAC,IAAa,EAAE,EAAS;IAC5D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAA;IACzB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,mBAAmB,CAAA;IAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAA;IACtB,+FAA+F;IAC/F,gEAAgE;IAChE,MAAM,KAAK,GAAG,IAAI,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,iBAAiB,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;IACjG,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,GAAG,EAAE;YACnB,IAAI;YACJ,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,WAAW,EAAE,KAAK,CAAC,EAAE;gBACnB,EAAE,CAAC,GAAG,CAAC,wBAAwB,KAAK,CAAC,GAAG,EAAE,CAAC,CAAA;gBAC3C,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,IAAI,mBAAmB,CAAC,EAAE,CAAC;oBACvD,sBAAsB,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,IAAI,mBAAmB,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;gBACjF,CAAC;gBACD,EAAE,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAA;gBACnE,0FAA0F;gBAC1F,sFAAsF;gBACtF,2DAA2D;gBAC3D,KAAK,kBAAkB,CAAC,EAAE,CAAC,CAAA;YAC7B,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,EAAE,CAAC,GAAG,CAAC,kCAAkC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAC/D,OAAO,CAAC,CAAA;IACV,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC;AAED;;;;;;GAMG;AACH,SAAS,sBAAsB,CAAC,EAAS,EAAE,IAAY,EAAE,GAAW,EAAE,KAAyB;IAC7F,EAAE,CAAC,GAAG,CAAC,wBAAwB,IAAI,2GAA2G,CAAC,CAAA;IAC/I,IAAI,CAAC,KAAK;QAAE,OAAM;IAClB,EAAE,CAAC,GAAG,CAAC,+BAA+B,IAAI,oEAAoE,CAAC,CAAA;IAC/G,EAAE,CAAC,GAAG,CAAC,OAAO,GAAG,WAAW,KAAK,EAAE,CAAC,CAAA;AACtC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,EAAS,EAAE,IAAI,GAAqC,EAAE;IACvF,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAA;IAClC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACV,EAAE,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAA;IACnE,EAAE,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAA;IACrD,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACV,EAAE,CAAC,GAAG,CAAC,cAAc,OAAO,EAAE,CAAC,CAAA;IAC/B,OAAO,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,IAAI,kBAAkB,EAAE,CAAC;SACrE,IAAI,CAAC,MAAM,CAAC,EAAE;QACb,MAAM,IAAI,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAA;QACvC,IAAI,IAAI;YAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IACxB,CAAC,CAAC;SACD,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;AACpB,CAAC"}

package/dist/client.d.ts

@@ -0,0 +1,16 @@
+export { DRIVERS, DRIVER_LABELS, isDriverName, driverFromImpl, type DriverName } from './driver-names.js';
+export { PUBLISH_LABELS, isPublishPick, offeredPublishPicks, publishPickIn, type PublishPick } from './publish-levels.js';
+export { formatOpenAgentEvent } from './terminal.js';
+export { formatBytes } from './format-bytes.js';
+export { errorMessage } from './error-message.js';
+export { pickedIds } from './events.js';
+export { sessionInfo, agentErrors, type SessionInfo, type AgentError, } from './agent-view.js';
+export { pendingChoices } from './open-choices.js';
+export { interventionKey, activityKey } from './dashboard/keys.js';
+export { SeenTracker } from './dashboard/keyed-watcher.js';
+export type { ProjectionRead } from './dashboard/projects.js';
+export { NOTIFICATION_DEFAULTS, MAX_SPEND_OFFSET, notifies, browserNotifyEnabled, notifyCategoryEnabled, type NotifyCategory } from './preference-defaults.js';
+export { isLoopbackHost } from './loopback-host.js';
+export { bridgeChoiceRequest } from './dashboard/bridge-question.js';
+export { cloudRunState, cloudRunActive, CLOUD_SESSION_WINDOW_MS, type CloudRunState } from './cloud-run-state.js';
+//# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,cAAc,EAAE,KAAK,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACzG,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,mBAAmB,EAAE,aAAa,EAAE,KAAK,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACzH,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAA;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACvC,OAAO,EACL,WAAW,EACX,WAAW,EACX,KAAK,WAAW,EAChB,KAAK,UAAU,GAChB,MAAM,iBAAiB,CAAA;AAExB,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAGlD,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AAIlE,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAA;AAC1D,YAAY,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAC7D,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,QAAQ,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,KAAK,cAAc,EAAE,MAAM,0BAA0B,CAAA;AAI9J,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAEnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAA;AAEpE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,uBAAuB,EAAE,KAAK,aAAa,EAAE,MAAM,sBAAsB,CAAA"}

package/dist/client.js

@@ -0,0 +1,30 @@
+// Browser-safe entry for the dashboard client (#431). Only pure event projections live
+// here — `formatOpenAgentEvent` and the run-view derivations — with no Node imports, so
+// the client can import these at runtime without dragging the server barrel (relay,
+// sandbox, node:fs/http, …) into the browser bundle. Types come from the root entry.
+export { DRIVERS, DRIVER_LABELS, isDriverName, driverFromImpl } from './driver-names.js';
+export { PUBLISH_LABELS, isPublishPick, offeredPublishPicks, publishPickIn } from './publish-levels.js';
+export { formatOpenAgentEvent } from './terminal.js';
+export { formatBytes } from './format-bytes.js';
+export { errorMessage } from './error-message.js';
+export { pickedIds } from './events.js';
+export { sessionInfo, agentErrors, } from './agent-view.js';
+// Which questions a run still waits on: one rule for the run page and the daemon's own reads.
+export { pendingChoices } from './open-choices.js';
+// The identity of a notification feed's item (#627). Pure, so the dashboard shares it with the
+// item types rather than keeping a copy that drifts silently.
+export { interventionKey, activityKey } from './dashboard/keys.js';
+// The baseline half of the same engine (#1625): what counts as "already there" when a feed is first
+// seen. The dashboard used to decide that by counting observations, which made a page loaded with no
+// git host reach take an empty backlog for a real one. Pure, and its only import is a type.
+export { SeenTracker } from './dashboard/keyed-watcher.js';
+export { NOTIFICATION_DEFAULTS, MAX_SPEND_OFFSET, notifies, browserNotifyEnabled, notifyCategoryEnabled } from './preference-defaults.js';
+// Whether an address is truly local (#1051). The daemon decides the token gate with it and the
+// dashboard labels the connection with it, so they must agree on what "local" means — the browser
+// kept its own looser copy, which answered `false` for every 127.0.0.0/8 address but the first.
+export { isLoopbackHost } from './loopback-host.js';
+// A bridged question as the gate panel renders it (#1554): pure, so the client projects it itself.
+export { bridgeChoiceRequest } from './dashboard/bridge-question.js';
+// What a web run's cloud side is doing, from its record (#1668): pure, so every surface derives the same word.
+export { cloudRunState, cloudRunActive, CLOUD_SESSION_WINDOW_MS } from './cloud-run-state.js';
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,wFAAwF;AACxF,oFAAoF;AACpF,qFAAqF;AACrF,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,cAAc,EAAmB,MAAM,mBAAmB,CAAA;AACzG,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,mBAAmB,EAAE,aAAa,EAAoB,MAAM,qBAAqB,CAAA;AACzH,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAA;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACvC,OAAO,EACL,WAAW,EACX,WAAW,GAGZ,MAAM,iBAAiB,CAAA;AACxB,8FAA8F;AAC9F,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAClD,+FAA+F;AAC/F,8DAA8D;AAC9D,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AAClE,oGAAoG;AACpG,qGAAqG;AACrG,4FAA4F;AAC5F,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAA;AAE1D,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,QAAQ,EAAE,oBAAoB,EAAE,qBAAqB,EAAuB,MAAM,0BAA0B,CAAA;AAC9J,+FAA+F;AAC/F,kGAAkG;AAClG,gGAAgG;AAChG,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnD,mGAAmG;AACnG,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAA;AACpE,+GAA+G;AAC/G,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,uBAAuB,EAAsB,MAAM,sBAAsB,CAAA"}

package/dist/cloud-run-state.d.ts

@@ -0,0 +1,27 @@
+import type { AgentMeta } from './store/agent-store.js';
+/**
+ * How long after its start a run's cloud session is still assumed to be alive. The same window
+ * the browser bridge watches a session for (`bridge-sessions`): past it nothing could learn the
+ * session is parked, so "in cloud" would be a guess nobody can correct — hence "done".
+ */
+export declare const CLOUD_SESSION_WINDOW_MS: number;
+/**
+ * What the cloud side of a web run is doing.
+ *
+ * - `waiting`: the browser bridge holds a question the session is parked on
+ * - `merged`: the session's work was adopted (#1601) and its pull request merged by OpenAgent
+ * - `in-cloud`: no pull request yet and the run is inside the session window, so it may still be working
+ * - `done`: its pull request exists — the work landed, and the PR badge carries its live state — or the
+ *   window passed with nothing adopted: the session finished or never pushed
+ */
+export type CloudRunState = 'waiting' | 'merged' | 'in-cloud' | 'done';
+/** The fields of a run's record the projection reads. */
+export type CloudRunFacts = Pick<AgentMeta, 'target' | 'status' | 'startedAt' | 'pr' | 'mergeOutcome' | 'cloudWaiting'>;
+/**
+ * The cloud state of a web run whose local half is over, or undefined for any other run — a
+ * local run, or a web run still handing off, stopped or failed — whose stored status is the word.
+ */
+export declare function cloudRunState(meta: CloudRunFacts, now: number): CloudRunState | undefined;
+/** Whether the cloud side still counts as an agent at work: in its session, or waiting on a human. */
+export declare function cloudRunActive(state: CloudRunState | undefined): boolean;
+//# sourceMappingURL=cloud-run-state.d.ts.map

package/dist/cloud-run-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-run-state.d.ts","sourceRoot":"","sources":["../src/cloud-run-state.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAA;AAUvD;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,QAAsB,CAAA;AAE1D;;;;;;;;GAQG;AACH,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,CAAA;AAEtE,yDAAyD;AACzD,MAAM,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,EAAE,QAAQ,GAAG,QAAQ,GAAG,WAAW,GAAG,IAAI,GAAG,cAAc,GAAG,cAAc,CAAC,CAAA;AAEvH;;;GAGG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CASzF;AAED,sGAAsG;AACtG,wBAAgB,cAAc,CAAC,KAAK,EAAE,aAAa,GAAG,SAAS,GAAG,OAAO,CAExE"}