@opencode/browse 0.0.6-dev.27 → 0.0.6

package/dist/{main-cxrsjs2z.mjs → main-hanwxg2c.mjs}

@@ -2,15 +2,15 @@ import {
   parseTargetSelection2,
   getObject2,
   getString2
-} from "./main-xzc7qp1c.mjs";
+} from "./main-605j7tjk.mjs";
 import {
   isNodeError,
   writeJsonFileAtomically
-} from "./main-bq8az9yr.mjs";
+} from "./main-yv64m9we.mjs";
 import {
   dataRoot,
   cliCommand
-} from "./main-a6mpfd6z.mjs";
+} from "./main-3cza6vx1.mjs";
 
 // src/relay/user-settings.ts
 var settingKeys = ["window", "grouping", "idleMinutes", "cursor", "humanInput", "handoffNotifications", "autoUpdate"];
@@ -306,452 +306,17 @@ function toolResult(options) {
   });
 }
 
-// src/auth/deadbolt.ts
-import { spawn, spawnSync } from "node:child_process";
-import crypto from "node:crypto";
-import fs from "node:fs";
-import net from "node:net";
-import os from "node:os";
-import path from "node:path";
-class DeadboltError extends Error {
-  name = "DeadboltError";
-  code;
-  detail;
-  constructor(code, message, detail = {}) {
-    super(message);
-    this.code = code;
-    this.detail = detail;
-  }
-}
-var clientFileName = "deadbolt-client.json";
-function clientFilePath(root = dataRoot()) {
-  return path.join(root, clientFileName);
-}
-function readClientFile(root = dataRoot()) {
-  let text;
-  try {
-    const file = clientFilePath(root);
-    const stat = fs.statSync(file);
-    if (process.platform !== "win32" && (stat.mode & 63) !== 0)
-      fs.chmodSync(file, 384);
-    text = fs.readFileSync(file, "utf8");
-  } catch {
-    return;
-  }
-  try {
-    const value = JSON.parse(text);
-    if (typeof value.id !== "string" || !value.id || typeof value.token !== "string" || !value.token)
-      return;
-    return {
-      version: 1,
-      id: value.id,
-      token: value.token,
-      connectedAt: typeof value.connectedAt === "string" ? value.connectedAt : ""
-    };
-  } catch {
-    return;
-  }
-}
-function readClient(root = dataRoot()) {
-  const file = readClientFile(root);
-  return file ? { id: file.id, token: file.token } : undefined;
-}
-async function saveClient(client, root = dataRoot()) {
-  const value = { version: 1, id: client.id, token: client.token, connectedAt: new Date().toISOString() };
-  await writeJsonFileAtomically(clientFilePath(root), value, { dirMode: 448 });
-}
-function removeClient(root = dataRoot()) {
-  const file = clientFilePath(root);
-  if (!fs.existsSync(file))
-    return false;
-  fs.rmSync(file, { force: true });
-  return true;
-}
-function computedSocketPath(env = process.env) {
-  const nonEmpty = (name) => env[name] ? env[name] : undefined;
-  const deadboltHome = nonEmpty("DEADBOLT_HOME");
-  const suffix = deadboltHome ? `-${blake3Hex(Buffer.from(deadboltHome, "utf8")).slice(0, 8)}` : "";
-  const uid = typeof process.getuid === "function" ? process.getuid() : 0;
-  const runtime = nonEmpty("XDG_RUNTIME_DIR") ?? userRuntimeDir(uid);
-  const directory = runtime ? path.join(runtime, `deadbolt${suffix}`) : path.join(nonEmpty("TMPDIR") ?? os.tmpdir(), `deadbolt${suffix}-${uid}`);
-  return path.join(directory, "agent.sock");
-}
-function userRuntimeDir(uid) {
-  const directory = `/run/user/${uid}`;
-  try {
-    const stat = fs.statSync(directory);
-    return stat.isDirectory() && stat.uid === uid ? directory : undefined;
-  } catch {
-    return;
-  }
-}
-function socketPath(options = {}) {
-  const env = options.env ?? process.env;
-  return env.OPENCODE_BROWSER_DEADBOLT_SOCKET || computedSocketPath(env);
-}
-var requestTimeoutMs = 15000;
-var maxReplyBytes = 4 * 1024 * 1024;
-function errorCode(code) {
-  const normalized = typeof code === "string" ? code.replace(/-/g, "_") : "";
-  switch (normalized) {
-    case "locked":
-    case "not_granted":
-    case "forbidden":
-    case "rate_limited":
-    case "domain_mismatch":
-    case "not_found":
-    case "choose_passkey":
-      return normalized;
-    case "not_initialized":
-      return "locked";
-    default:
-      return "failed";
-  }
-}
-var errorHints = {
-  locked: "Deadbolt is locked, so agent sign-ins are paused until the user unlocks it.",
-  forbidden: "Deadbolt doesn't know this browse install (its client was removed or revoked). Ask the user to run `opencode-browser deadbolt connect`.",
-  rate_limited: "Deadbolt is rate-limiting this client; wait before trying again."
-};
-function rawRequest(socket, request, timeoutMs = requestTimeoutMs) {
-  return new Promise((resolve, reject) => {
-    const connection = net.createConnection(socket);
-    let buffer = "";
-    let settled = false;
-    const finish = (error, value) => {
-      if (settled)
-        return;
-      settled = true;
-      clearTimeout(timer);
-      connection.destroy();
-      if (error)
-        reject(error);
-      else
-        resolve(value);
-    };
-    const timer = setTimeout(() => finish(new DeadboltError("unavailable", `Deadbolt did not answer ${String(request.cmd)} within ${timeoutMs} ms`)), timeoutMs);
-    connection.setEncoding("utf8");
-    connection.on("connect", () => connection.write(`${JSON.stringify(request)}
-`));
-    connection.on("error", (cause) => {
-      const missing = cause.code === "ENOENT" || cause.code === "ECONNREFUSED";
-      finish(new DeadboltError("unavailable", missing ? "Deadbolt isn't running (no agent socket). Ask the user to start or unlock Deadbolt." : `Could not reach Deadbolt: ${cause.message}`));
-    });
-    connection.on("data", (chunk) => {
-      buffer += chunk;
-      if (buffer.length > maxReplyBytes)
-        return finish(new DeadboltError("failed", "Deadbolt's reply was too large"));
-      let newline;
-      while ((newline = buffer.indexOf(`
-`)) !== -1) {
-        const line = buffer.slice(0, newline).trim();
-        buffer = buffer.slice(newline + 1);
-        if (!line)
-          continue;
-        let message;
-        try {
-          message = JSON.parse(line);
-        } catch {
-          return finish(new DeadboltError("failed", "Deadbolt sent a reply that isn't JSON"));
-        }
-        if (message.type === "ok")
-          return finish(undefined, message.reply ?? {});
-        if (message.type === "error") {
-          const code = errorCode(message.code);
-          const text = typeof message.message === "string" ? message.message : String(message.code);
-          const detail = message.grant ?? {};
-          const choices = passkeyList(message.choices ?? message.passkeys);
-          return finish(new DeadboltError(code, errorHints[code] ? `${text.replace(/[\s.]*$/, ".")} ${errorHints[code]}` : text, {
-            ...typeof detail.site === "string" ? { site: detail.site } : {},
-            ...typeof detail.login === "string" ? { login: detail.login } : {},
-            ...choices.length > 0 ? { choices } : {}
-          }));
-        }
-      }
-    });
-    connection.on("end", () => finish(new DeadboltError("failed", "Deadbolt closed the connection without a reply")));
-  });
-}
-var str = (value) => typeof value === "string" ? value : undefined;
-function passkeyList(value) {
-  if (!Array.isArray(value))
-    return [];
-  return value.filter((entry) => entry !== null && typeof entry === "object").map((entry) => {
-    const username = str(entry.username);
-    const displayName = str(entry.display_name) ?? str(entry.displayName);
-    return { ref: entry.ref ?? entry.login, ...username ? { username } : {}, ...displayName ? { displayName } : {}, granted: entry.granted !== false };
-  });
-}
-function toLogin(raw) {
-  const signIn = raw.sign_in;
-  const fields = Array.isArray(raw.fields) ? raw.fields.filter((field) => typeof field === "string") : undefined;
-  const username = str(raw.username);
-  return {
-    ref: raw.ref ?? raw.login,
-    title: str(raw.title) ?? "",
-    ...username ? { username } : {},
-    hasPassword: raw.has_password === true,
-    hasTotp: raw.has_totp === true || raw.has_otp === true,
-    hasPasskey: raw.has_passkey === true,
-    granted: fields !== undefined && fields.length > 0 || raw.passkeys === true,
-    passkeys: raw.passkeys === true,
-    ...fields ? { fields } : {},
-    ...signIn && typeof signIn.provider === "string" ? { signIn: { provider: signIn.provider, ...str(signIn.account) ? { account: str(signIn.account) } : {} } } : {}
-  };
-}
-function connect(options = {}) {
-  const client = options.client ?? readClient(options.root);
-  if (!client) {
-    throw new DeadboltError("not_connected", "browse isn't connected to Deadbolt. Ask the user to run `opencode-browser deadbolt connect` and to allow the logins agents may use with `deadbolt agents allow <site>`.");
-  }
-  const socket = options.socket ?? socketPath();
-  let protocol;
-  const version = async () => {
-    if (protocol === undefined) {
-      const status = await rawRequest(socket, { v: 0, cmd: "status" });
-      protocol = typeof status.protocol === "number" ? status.protocol : 0;
-    }
-    return protocol;
-  };
-  const send = async (cmd, fields) => rawRequest(socket, { v: await version(), cmd, client: { id: client.id, token: client.token }, ...fields });
-  const site = async (origin) => {
-    const reply = await send("agent-logins", { origin });
-    const raw = (Array.isArray(reply.logins) ? reply.logins : []).filter((login) => login !== null && typeof login === "object");
-    const logins = raw.map(toLogin);
-    let passkeys = passkeyList(reply.passkeys);
-    if (!Array.isArray(reply.passkeys)) {
-      passkeys = logins.filter((login) => login.hasPasskey).map((login) => ({ ref: login.ref, ...login.username ? { username: login.username } : {}, granted: login.passkeys }));
-    }
-    return { logins, passkeys };
-  };
-  return {
-    socket,
-    client,
-    status: async () => {
-      const status = await rawRequest(socket, { v: 0, cmd: "status" });
-      protocol = typeof status.protocol === "number" ? status.protocol : 0;
-      return { protocol, unlocked: status.unlocked === true, ...str(status.version) ? { version: str(status.version) } : {} };
-    },
-    logins: async (origin) => (await site(origin)).logins,
-    site: (origin) => site(origin),
-    fill: async (origin, login, want) => {
-      const reply = await send("agent-fill", { origin, login: login.ref, want: [...want] });
-      const values = reply.values ?? reply;
-      return {
-        ...str(values.username) !== undefined ? { username: str(values.username) } : {},
-        ...str(values.password) !== undefined ? { password: str(values.password) } : {},
-        ...str(values.totp) !== undefined ? { totp: str(values.totp) } : {}
-      };
-    },
-    passkeyGet: async (request) => {
-      const reply = await send("agent-passkey-get", {
-        origin: request.origin,
-        ...request.rpId ? { rp_id: request.rpId } : {},
-        challenge: request.challenge,
-        allow_credentials: [...request.allowCredentials],
-        user_verification: request.userVerification,
-        ...request.login !== undefined ? { login: request.login } : {}
-      });
-      if (reply.reply === "choose-passkey") {
-        throw new DeadboltError("choose_passkey", "Several passkeys could sign in here; name one by its username.", { choices: passkeyList(reply.choices ?? reply.passkeys) });
-      }
-      const credentialId = str(reply.credential_id);
-      const clientDataJson = str(reply.client_data_json);
-      const authenticatorData = str(reply.authenticator_data);
-      const signature = str(reply.signature);
-      if (!credentialId || !clientDataJson || !authenticatorData || !signature)
-        throw new DeadboltError("failed", "Deadbolt's passkey assertion is incomplete");
-      return { credentialId, clientDataJson, authenticatorData, signature, ...str(reply.user_handle) ? { userHandle: str(reply.user_handle) } : {} };
-    }
-  };
-}
-var deadboltNamePrefix = "deadbolt:";
-function parseDeadboltName(name) {
-  if (!name.startsWith(deadboltNamePrefix))
-    return;
-  const rest = name.slice(deadboltNamePrefix.length).trim();
-  const origin = /^https?:\/\/[^/]+/i.exec(rest);
-  const site = origin ? origin[0] : rest.split("/")[0];
-  const username = rest.slice(site.length + 1);
-  if (!site)
-    return;
-  return { site: site.toLowerCase(), ...username ? { username } : {} };
-}
-function originOnSite(origin, site) {
-  let url;
-  try {
-    url = new URL(origin);
-  } catch {
-    return false;
-  }
-  if (/^https?:\/\//i.test(site)) {
-    try {
-      return new URL(site).origin === url.origin;
-    } catch {
-      return false;
-    }
-  }
-  const host = url.hostname.toLowerCase();
-  const bare = site.replace(/^\*\./, "").replace(/:\d+$/, "").toLowerCase();
-  const local = host === "localhost" || host === "127.0.0.1" || host === "[::1]" || host.endsWith(".localhost");
-  if (url.protocol !== "https:" && !(url.protocol === "http:" && local))
-    return false;
-  return host === bare || host.endsWith(`.${bare}`);
-}
-function pickLogin(logins, site, username, field) {
-  const granted = logins.filter((login) => login.granted && (field === undefined || login.fields === undefined || login.fields.includes(field)));
-  const candidates = username === undefined ? granted : granted.filter((login) => login.username?.toLowerCase() === username.toLowerCase());
-  if (candidates.length === 1)
-    return candidates[0];
-  if (candidates.length === 0) {
-    throw new DeadboltError("not_granted", username === undefined ? `No Deadbolt login is granted to browse for ${site}${field ? ` (${field})` : ""}. Ask the user to allow one with \`deadbolt agents allow ${site}\`.` : `No Deadbolt login for ${username} is granted to browse for ${site}${field ? ` (${field})` : ""}. Ask the user to allow it with \`deadbolt agents allow ${site} --login ${username}\`.`, { site, ...username ? { login: username } : {} });
-  }
-  throw new DeadboltError("failed", `Several Deadbolt logins are granted for ${site}; name one: deadbolt:${site}/<username> (${candidates.map((login) => login.username ?? login.title).join(", ")})`);
-}
-function originsFromPatterns(patterns) {
-  const origins = new Set;
-  for (const pattern of patterns) {
-    const scheme = /^(https?):\/\//i.exec(pattern)?.[1]?.toLowerCase() ?? "https";
-    const host = pattern.replace(/^https?:\/\//i, "").replace(/^\*\./, "").replace(/\/$/, "");
-    try {
-      origins.add(new URL(`${scheme}://${host}`).origin);
-    } catch {}
-  }
-  return [...origins];
-}
-async function listLogins(origins, connection) {
-  let deadbolt;
-  try {
-    deadbolt = connection ?? connect();
-  } catch (error) {
-    return { connected: false, logins: [], passkeys: [], error: { code: error instanceof DeadboltError ? error.code : "failed", message: error instanceof Error ? error.message : String(error) } };
-  }
-  const logins = [];
-  const passkeys = [];
-  for (const origin of origins.slice(0, 20)) {
-    try {
-      const found = await deadbolt.site(origin);
-      for (const { ref: _ref, ...login } of found.logins)
-        logins.push({ ...login, origin });
-      for (const { ref: _ref, ...passkey } of found.passkeys)
-        passkeys.push({ ...passkey, origin });
-    } catch (error) {
-      if (error instanceof DeadboltError && (error.code === "domain_mismatch" || error.code === "not_found" || error.code === "not_granted"))
-        continue;
-      return { connected: true, logins, passkeys, error: { code: error instanceof DeadboltError ? error.code : "failed", message: error instanceof Error ? error.message : String(error) } };
-    }
-  }
-  return { connected: true, logins, passkeys };
-}
-function pickPasskey(passkeys, username) {
-  const wanted = username.toLowerCase();
-  const granted = passkeys.filter((passkey) => passkey.granted);
-  return granted.find((passkey) => passkey.username?.toLowerCase() === wanted) ?? granted.find((passkey) => passkey.displayName?.toLowerCase() === wanted);
-}
-async function pair(options = {}) {
-  const command = options.command ?? (process.env.OPENCODE_BROWSER_DEADBOLT_CLI || "deadbolt");
-  const stdout = await new Promise((resolve, reject) => {
-    const child = spawn(command, ["agents", "add-client", options.name ?? "browse", "--json"], { stdio: ["inherit", "pipe", "inherit"] });
-    let output = "";
-    child.stdout.setEncoding("utf8");
-    child.stdout.on("data", (chunk) => {
-      output += chunk;
-    });
-    child.on("error", (cause) => reject(new DeadboltError("unavailable", cause.code === "ENOENT" ? `${command} isn't installed or on PATH. Install Deadbolt first.` : `Could not run ${command}: ${cause.message}`)));
-    child.on("close", (code) => code === 0 ? resolve(output) : reject(new DeadboltError("failed", `deadbolt agents add-client exited with status ${code}`)));
-  });
-  let parsed;
-  try {
-    const line = stdout.trim().split(`
-`).filter(Boolean).at(-1) ?? "";
-    parsed = JSON.parse(line);
-  } catch {
-    throw new DeadboltError("failed", "deadbolt agents add-client --json didn't print a client");
-  }
-  const client = parsed.client ?? parsed;
-  const id = str(client.id);
-  const token = str(client.token) ?? str(parsed.token);
-  if (!id || !token)
-    throw new DeadboltError("failed", "deadbolt agents add-client --json printed no id and token");
-  await saveClient({ id, token }, options.root);
-  return { id };
-}
-function unpair(options = {}) {
-  const client = readClient(options.root);
-  if (!client)
-    return { removed: false, revoked: false };
-  const command = options.command ?? (process.env.OPENCODE_BROWSER_DEADBOLT_CLI || "deadbolt");
-  const result = spawnSync(command, ["agents", "remove-client", client.id], { stdio: ["inherit", "ignore", "inherit"], timeout: 120000 });
-  return { removed: removeClient(options.root), revoked: result.status === 0 };
-}
-function isBase64Url(value, maxLength = 8192) {
-  return typeof value === "string" && value.length <= maxLength && /^[A-Za-z0-9_-]*$/.test(value);
-}
-function randomName(prefix) {
-  return `${prefix}${crypto.randomBytes(12).toString("hex")}`;
-}
-var blake3Iv = [1779033703, 3144134277, 1013904242, 2773480762, 1359893119, 2600822924, 528734635, 1541459225];
-var blake3Permutation = [2, 6, 3, 10, 7, 0, 4, 13, 1, 11, 12, 5, 9, 14, 15, 8];
-function blake3Compress(cv, block, blockLength, flags) {
-  const s = new Uint32Array([...cv, blake3Iv[0], blake3Iv[1], blake3Iv[2], blake3Iv[3], 0, 0, blockLength, flags]);
-  let m = Uint32Array.from(block);
-  const rotr = (x, n) => x >>> n | x << 32 - n;
-  const g = (a, b, c, d, x, y) => {
-    s[a] = s[a] + s[b] + x;
-    s[d] = rotr(s[d] ^ s[a], 16);
-    s[c] = s[c] + s[d];
-    s[b] = rotr(s[b] ^ s[c], 12);
-    s[a] = s[a] + s[b] + y;
-    s[d] = rotr(s[d] ^ s[a], 8);
-    s[c] = s[c] + s[d];
-    s[b] = rotr(s[b] ^ s[c], 7);
-  };
-  for (let round = 0;round < 7; round++) {
-    g(0, 4, 8, 12, m[0], m[1]);
-    g(1, 5, 9, 13, m[2], m[3]);
-    g(2, 6, 10, 14, m[4], m[5]);
-    g(3, 7, 11, 15, m[6], m[7]);
-    g(0, 5, 10, 15, m[8], m[9]);
-    g(1, 6, 11, 12, m[10], m[11]);
-    g(2, 7, 8, 13, m[12], m[13]);
-    g(3, 4, 9, 14, m[14], m[15]);
-    if (round < 6)
-      m = Uint32Array.from(blake3Permutation, (index) => m[index]);
-  }
-  return Array.from({ length: 8 }, (_, index) => (s[index] ^ s[index + 8]) >>> 0);
-}
-function blake3Hex(input) {
-  if (input.length > 1024)
-    throw new Error("blake3Hex handles inputs up to 1024 bytes (DEADBOLT_HOME is longer: set OPENCODE_BROWSER_DEADBOLT_SOCKET)");
-  const blocks = Math.max(1, Math.ceil(input.length / 64));
-  let cv = [...blake3Iv];
-  for (let index = 0;index < blocks; index++) {
-    const bytes = new Uint8Array(64);
-    const chunk = input.subarray(index * 64, index * 64 + 64);
-    bytes.set(chunk);
-    const words = new Uint32Array(16);
-    const view = new DataView(bytes.buffer);
-    for (let word = 0;word < 16; word++)
-      words[word] = view.getUint32(word * 4, true);
-    const flags = (index === 0 ? 1 : 0) | (index === blocks - 1 ? 2 | 8 : 0);
-    cv = blake3Compress(cv, words, chunk.length, flags);
-  }
-  const out = Buffer.alloc(32);
-  cv.forEach((word, index) => out.writeUInt32LE(word, index * 4));
-  return out.toString("hex");
-}
-
 // src/auth/site-secrets.ts
-import crypto2 from "node:crypto";
-import fs3 from "node:fs/promises";
-import path3 from "node:path";
+import crypto from "node:crypto";
+import fs2 from "node:fs/promises";
+import path2 from "node:path";
 import { Effect as Effect3, Schema as Schema2 } from "effect";
 
 // src/auth/profile.ts
 import { Effect as Effect2, Schema, Semaphore } from "effect";
-import { spawn as spawn2 } from "node:child_process";
-import fs2 from "node:fs/promises";
-import path2 from "node:path";
+import { spawn } from "node:child_process";
+import fs from "node:fs/promises";
+import path from "node:path";
 
 // src/update/child-process.ts
 async function terminateChildProcess(options) {
@@ -1253,7 +818,7 @@ class AuthProfileError extends Schema.TaggedError()("AuthProfile.Error", {
   cause: Schema.optionalKey(Schema.Defect())
 }) {
 }
-var defaultBaseDir = () => path2.join(dataRoot(), "secrets");
+var defaultBaseDir = () => path.join(dataRoot(), "secrets");
 var writeLock = Semaphore.makeUnsafe(1);
 var profileLockTimeoutMs = 30000;
 var staleProfileLockMs = 60000;
@@ -1262,7 +827,7 @@ var maximumTimeoutMs = 2147483647;
 var read = Effect2.fn("AuthProfile.read")(function* (name, options = {}) {
   const filePath = yield* profilePath(options.baseDir ?? defaultBaseDir(), name);
   const text = yield* Effect2.tryPromise({
-    try: () => fs2.readFile(filePath, "utf8"),
+    try: () => fs.readFile(filePath, "utf8"),
     catch: (cause) => isNodeError(cause) && cause.code === "ENOENT" ? new AuthProfileError({ message: `Auth profile not found: ${name}`, operation: "read", reason: "not-found", cause }) : new AuthProfileError({ message: `Could not read auth profile: ${name}`, operation: "read", reason: "read-failed", cause })
   });
   return yield* Schema.decodeUnknownEffect(StoredAuthProfile)(yield* Effect2.try({
@@ -1280,12 +845,12 @@ function withLock(name, options, effect) {
     const lockPath = `${filePath}.lock`;
     yield* Effect2.tryPromise({
       try: async () => {
-        await fs2.mkdir(baseDir, { recursive: true, mode: 448 });
-        await fs2.chmod(baseDir, 448);
+        await fs.mkdir(baseDir, { recursive: true, mode: 448 });
+        await fs.chmod(baseDir, 448);
         const deadline = Date.now() + profileLockTimeoutMs;
         while (true) {
           try {
-            const handle = await fs2.open(lockPath, "wx", 384);
+            const handle = await fs.open(lockPath, "wx", 384);
             let written = false;
             try {
               await handle.writeFile(`${process.pid}
@@ -1294,17 +859,17 @@ function withLock(name, options, effect) {
             } finally {
               await handle.close();
               if (!written)
-                await fs2.unlink(lockPath).catch(() => {});
+                await fs.unlink(lockPath).catch(() => {});
             }
             return;
           } catch (cause) {
             if (!isNodeError(cause) || cause.code !== "EEXIST")
               throw cause;
-            const stat = await fs2.stat(lockPath).catch(() => {
+            const stat = await fs.stat(lockPath).catch(() => {
               return;
             });
             if (stat && Date.now() - stat.mtimeMs > staleProfileLockMs) {
-              await fs2.unlink(lockPath).catch(() => {});
+              await fs.unlink(lockPath).catch(() => {});
               continue;
             }
             if (Date.now() >= deadline)
@@ -1318,7 +883,7 @@ function withLock(name, options, effect) {
     return lockPath;
   });
   return Effect2.acquireUseRelease(acquire, () => effect, (lockPath) => Effect2.tryPromise({
-    try: () => fs2.unlink(lockPath).catch(() => {}).then(() => {}),
+    try: () => fs.unlink(lockPath).catch(() => {}).then(() => {}),
     catch: (cause) => new AuthProfileError({ message: `Could not release auth profile lock: ${name}`, operation: "lock", reason: "write-failed", cause })
   }));
 }
@@ -1405,7 +970,7 @@ function summary(profile) {
 }
 var profileNamePattern = /^[a-z0-9][a-z0-9._-]{0,63}$/i;
 function profilePath(baseDir, name) {
-  return profileNamePattern.test(name) ? Effect2.succeed(path2.join(baseDir, `${name}.json`)) : Effect2.fail(new AuthProfileError({ message: `Invalid auth profile name: ${name}`, operation: "path", reason: "invalid-name" }));
+  return profileNamePattern.test(name) ? Effect2.succeed(path.join(baseDir, `${name}.json`)) : Effect2.fail(new AuthProfileError({ message: `Invalid auth profile name: ${name}`, operation: "path", reason: "invalid-name" }));
 }
 function sameSlots(left, right) {
   return JSON.stringify(left) === JSON.stringify(right);
@@ -1438,7 +1003,7 @@ function redactOutput(text, slots, maxBytes) {
 }
 function runChild(options) {
   return Effect2.callback((resume) => {
-    const child = spawn2(options.command, [...options.args], {
+    const child = spawn(options.command, [...options.args], {
       ...options.cwd ? { cwd: options.cwd } : {},
       env: childEnvironment(options.env),
       detached: process.platform !== "win32",
@@ -1511,7 +1076,7 @@ function childEnvironment(profile) {
 
 // src/auth/domain-policy.ts
 import dns from "node:dns/promises";
-import net2 from "node:net";
+import net from "node:net";
 
 class OriginPatternError extends Error {
   name = "OriginPatternError";
@@ -1547,7 +1112,7 @@ function parseOriginPattern(raw) {
     throw new OriginPatternError(`Origin pattern ${JSON.stringify(raw)} must be a host or origin`);
   }
   const host = unbracket(parsed.hostname.toLowerCase());
-  if (wildcard && net2.isIP(host))
+  if (wildcard && net.isIP(host))
     throw new OriginPatternError(`Origin pattern ${JSON.stringify(raw)}: wildcards don't apply to IP addresses`);
   if (wildcard && !host.includes("."))
     throw new OriginPatternError(`Origin pattern ${JSON.stringify(raw)}: "*." needs a domain with a dot, like *.example.com`);
@@ -1592,14 +1157,14 @@ var privateIpv4Ranges = [
 ];
 function isPrivateAddress(address) {
   const ip = unbracket(address.toLowerCase()).replace(/%.*$/, "");
-  if (net2.isIPv4(ip)) {
+  if (net.isIPv4(ip)) {
     const value = ipv4ToNumber(ip);
     return privateIpv4Ranges.some(([base, bits]) => {
       const mask = bits === 0 ? 0 : 4294967295 << 32 - bits >>> 0;
       return (value & mask) >>> 0 === (ipv4ToNumber(base) & mask) >>> 0;
     });
   }
-  if (net2.isIPv6(ip)) {
+  if (net.isIPv6(ip)) {
     if (ip === "::" || ip === "::1")
       return true;
     const mapped = /^(?:0*:)*:?ffff:(\d+\.\d+\.\d+\.\d+)$/.exec(ip) ?? /^::(\d+\.\d+\.\d+\.\d+)$/.exec(ip);
@@ -1625,7 +1190,7 @@ function isLocalhostName(host) {
 }
 function isPrivateHost(host) {
   const bare = unbracket(host.toLowerCase());
-  return isLocalhostName(bare) || net2.isIP(bare) !== 0 && isPrivateAddress(bare);
+  return isLocalhostName(bare) || net.isIP(bare) !== 0 && isPrivateAddress(bare);
 }
 function defaultPort(protocol) {
   return protocol === "https:" ? "443" : "80";
@@ -1676,7 +1241,7 @@ function checkUrl(rawUrl, rules, options = {}) {
 }
 async function resolvesToPrivateAddress(host, timeoutMs = 2000) {
   const bare = unbracket(host);
-  if (net2.isIP(bare) || isLocalhostName(bare))
+  if (net.isIP(bare) || isLocalhostName(bare))
     return isPrivateHost(bare) ? bare : undefined;
   let timer;
   try {
@@ -1722,9 +1287,9 @@ class SiteSecretError extends Schema2.TaggedError()("SiteSecret.Error", {
   cause: Schema2.optionalKey(Schema2.Defect())
 }) {
 }
-var defaultSiteSecretsDir = () => path3.join(dataRoot(), "site-secrets");
+var defaultSiteSecretsDir = () => path2.join(dataRoot(), "site-secrets");
 function secretPath(baseDir, name) {
-  return profileNamePattern.test(name) ? Effect3.succeed(path3.join(baseDir, `${name}.json`)) : Effect3.fail(new SiteSecretError({ message: `Invalid secret name: ${name} (letters, digits, ".", "_" and "-", up to 64)`, reason: "invalid-name" }));
+  return profileNamePattern.test(name) ? Effect3.succeed(path2.join(baseDir, `${name}.json`)) : Effect3.fail(new SiteSecretError({ message: `Invalid secret name: ${name} (letters, digits, ".", "_" and "-", up to 64)`, reason: "invalid-name" }));
 }
 function summary2(secret) {
   return { name: secret.name, kind: secret.kind, allowedOrigins: [...secret.allowedOrigins], createdAt: secret.createdAt, updatedAt: secret.updatedAt };
@@ -1732,7 +1297,7 @@ function summary2(secret) {
 var readSecret = Effect3.fn("SiteSecrets.read")(function* (name, options = {}) {
   const filePath = yield* secretPath(options.baseDir ?? defaultSiteSecretsDir(), name);
   const text = yield* Effect3.tryPromise({
-    try: () => fs3.readFile(filePath, "utf8"),
+    try: () => fs2.readFile(filePath, "utf8"),
     catch: (cause) => isNodeError(cause) && cause.code === "ENOENT" ? new SiteSecretError({ message: `Secret not found: ${name}. Ask the user to add it with \`opencode-browser secrets add ${name} --origin <origin>\`.`, reason: "not-found" }) : new SiteSecretError({ message: `Could not read secret ${name}`, reason: "read-failed", cause })
   });
   return yield* Effect3.try({
@@ -1774,7 +1339,7 @@ var addSecret = Effect3.fn("SiteSecrets.add")(function* (options) {
 var listSecrets = Effect3.fn("SiteSecrets.list")(function* (options = {}) {
   const baseDir = options.baseDir ?? defaultSiteSecretsDir();
   const names = yield* Effect3.tryPromise({
-    try: () => fs3.readdir(baseDir).catch((cause) => isNodeError(cause) && cause.code === "ENOENT" ? [] : Promise.reject(cause)),
+    try: () => fs2.readdir(baseDir).catch((cause) => isNodeError(cause) && cause.code === "ENOENT" ? [] : Promise.reject(cause)),
     catch: (cause) => new SiteSecretError({ message: "Could not list secrets", reason: "read-failed", cause })
   });
   const secrets = [];
@@ -1789,7 +1354,7 @@ var removeSecret = Effect3.fn("SiteSecrets.remove")(function* (name, options = {
   const baseDir = options.baseDir ?? defaultSiteSecretsDir();
   const filePath = yield* secretPath(baseDir, name);
   return yield* withLock(name, { baseDir }, Effect3.tryPromise({
-    try: () => fs3.rm(filePath).then(() => true, (cause) => isNodeError(cause) && cause.code === "ENOENT" ? false : Promise.reject(cause)),
+    try: () => fs2.rm(filePath).then(() => true, (cause) => isNodeError(cause) && cause.code === "ENOENT" ? false : Promise.reject(cause)),
     catch: (cause) => new SiteSecretError({ message: `Could not remove secret ${name}`, reason: "write-failed", cause })
   })).pipe(Effect3.mapError((error) => error instanceof SiteSecretError ? error : new SiteSecretError({ message: error.message, reason: "write-failed", cause: error })));
 });
@@ -1831,7 +1396,7 @@ function totpCode(seed, now = Date.now()) {
   const { key, digits, period, algorithm } = totpParameters(seed);
   const counter = Buffer.alloc(8);
   counter.writeBigUInt64BE(BigInt(Math.floor(now / 1000 / period)));
-  const hmac = crypto2.createHmac(algorithm, key).update(counter).digest();
+  const hmac = crypto.createHmac(algorithm, key).update(counter).digest();
   const offset = hmac[hmac.length - 1] & 15;
   const binary = (hmac.readUInt32BE(offset) & 2147483647) % 10 ** digits;
   return String(binary).padStart(digits, "0");
@@ -1840,4 +1405,4 @@ function secretText(secret) {
   return secret.kind === "totp" ? totpCode(secret.value) : secret.value;
 }
 
-export { settingKeys, settingSpecs, securityVariables, SettingsInputError, parseSettingChanges, settingsFromExtension, settingsToExtension, describeSettings, describeChanges, formatSettings, browsersNote2, mcpUpdateNote2, objectSchema, emptyInputSchema, sessionSchemaProperty, sessionAliasSchemaProperty, sessionOnlyInputSchema, ensureSessionExists, parseExecuteArguments, parseAdoptArguments, requiredStringField, optionalStringField, optionalBooleanField, optionalPositiveIntegerField, optionalStringArrayField, requireObject, toolResultForValue2, mcpErrorMessage2, toolResult, DeadboltError, readClient, socketPath, connect, parseDeadboltName, originOnSite, pickLogin, originsFromPatterns, listLogins, pickPasskey, pair, unpair, isBase64Url, randomName, terminateChildProcess, SecretCollector, looksLikeTokenSegment, AuthProfileError, read, readOptional, withLock, write, status, run, OriginPatternError, parseOriginPatterns, normalizeOriginPatterns, isPrivateAddress, explicitlyAllowsHost, checkUrl, checkNavigationUrl, readSecret, addSecret, listSecrets, removeSecret, secretText };
+export { settingKeys, settingSpecs, securityVariables, SettingsInputError, parseSettingChanges, settingsFromExtension, settingsToExtension, describeSettings, describeChanges, formatSettings, browsersNote2, mcpUpdateNote2, objectSchema, emptyInputSchema, sessionSchemaProperty, sessionAliasSchemaProperty, sessionOnlyInputSchema, ensureSessionExists, parseExecuteArguments, parseAdoptArguments, requiredStringField, optionalStringField, optionalBooleanField, optionalPositiveIntegerField, optionalStringArrayField, requireObject, toolResultForValue2, mcpErrorMessage2, toolResult, terminateChildProcess, SecretCollector, looksLikeTokenSegment, AuthProfileError, read, readOptional, withLock, write, status, run, OriginPatternError, parseOriginPatterns, normalizeOriginPatterns, isPrivateAddress, explicitlyAllowsHost, checkUrl, checkNavigationUrl, readSecret, addSecret, listSecrets, removeSecret, secretText };

package/dist/{main-a4yj9bpn.mjs → main-njp635rz.mjs}

@@ -1,12 +1,12 @@
 import {
   isNodeError
-} from "./main-bq8az9yr.mjs";
+} from "./main-yv64m9we.mjs";
 import {
   isValidSessionId2
-} from "./main-xzc7qp1c.mjs";
+} from "./main-605j7tjk.mjs";
 import {
   dataRoot
-} from "./main-a6mpfd6z.mjs";
+} from "./main-3cza6vx1.mjs";
 
 // src/session-manager/journal.ts
 import fs from "node:fs";