@parlor/agent-host 0.2.0 → 0.3.1

package/dist/pairing.js

@@ -1,6 +1,7 @@
 import { createHash, randomBytes, randomInt } from "node:crypto";
 import { createServer } from "node:http";
 import { HOST_PAIRING_FRAGMENT, } from "@parlor/auth";
+import { agentToolsName } from "./agent-tools.js";
 import { hostAssertion } from "./assertion.js";
 import { workspaceOf } from "./naming.js";
 import { printable } from "./prompter.js";
@@ -52,7 +53,10 @@ async function loopback(state) {
         }
         waiting = response;
         const code = url.searchParams.get("code");
-        deliver(code ? { code } : { declined: true });
+        const agentTools = url.searchParams.get("agentTools");
+        deliver(code
+            ? { code, ...(agentTools === null ? {} : { agentTools: agentTools === "on" }) }
+            : { declined: true });
     });
     await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
     const { port } = server.address();
@@ -102,6 +106,11 @@ function timeout(ms) {
     });
     return { expired, clear: () => clearTimeout(timer) };
 }
+/** The pairing secret goes nowhere but the app's own origin; an older app has no landing page. */
+function landingOf(origin, landing) {
+    const url = landing === undefined ? undefined : URL.parse(landing, origin);
+    return url?.origin === origin ? url : new URL("/", origin);
+}
 /**
  * Only the host starts a pairing: it makes the PKCE verifier, `state`, the matching code
  * and the key pair, so nothing from the web side can complete one.
@@ -109,6 +118,7 @@ function timeout(ms) {
 export async function pair(input) {
     const origin = new URL(input.appOrigin).origin;
     const appName = await appNameOf(origin);
+    const toolsName = input.offerAgentTools ? agentToolsName(appName, origin) : undefined;
     const key = await input.keys.create(origin);
     const codeVerifier = base64url(randomBytes(32));
     const pairing = {
@@ -136,6 +146,7 @@ export async function pair(input) {
                 const query = new URLSearchParams({
                     redirectUri: listener.redirectUri,
                     ...pairing,
+                    ...(toolsName ? { agentTools: "offered" } : {}),
                 });
                 await input.channel.open(`${origin}/_parlor/auth/hosts/authorize?${query}`);
                 const callback = await Promise.race([listener.callback, deadline.expired]);
@@ -155,10 +166,21 @@ export async function pair(input) {
                 }
                 await key.keep(granted.grant.id);
                 const pairingSecret = base64url(randomBytes(32));
-                listener.redirect(`${origin}/#${new URLSearchParams({ [HOST_PAIRING_FRAGMENT]: pairingSecret })}`);
+                const landing = landingOf(origin, granted.landing);
+                const agentTools = toolsName && "agentTools" in callback ? callback.agentTools : undefined;
+                if (agentTools && toolsName)
+                    landing.searchParams.set("agentTools", toolsName);
+                landing.hash = new URLSearchParams({
+                    [HOST_PAIRING_FRAGMENT]: pairingSecret,
+                }).toString();
+                listener.redirect(landing.href);
                 return {
                     paired: true,
-                    grant: { ...grantOf(granted), pairingSecret },
+                    grant: {
+                        ...grantOf(granted),
+                        pairingSecret,
+                        ...(agentTools === undefined ? {} : { agentTools: { on: agentTools } }),
+                    },
                     approvedBy: granted.approvedBy,
                 };
             }

package/dist/pairing.js.map

@@ -1 +1 @@
-{"version":3,"file":"pairing.js","sourceRoot":"","sources":["../src/pairing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,YAAY,EAAoC,MAAM,WAAW,CAAC;AAG3E,OAAO,EAEL,qBAAqB,GAEtB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,GAAG,MAAM,CAAC;AA2C9C,MAAM,OAAO,cAAe,SAAQ,KAAK;IAG5B,KAAK;IAFE,IAAI,GAAG,gBAAgB,CAAC;IAC1C,YACW,KAAe,EACxB,KAAY;QAEZ,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;qBAHvB,KAAK;IAIhB,CAAC;CACF;AAED,MAAM,iBAAiB,GAAG,kCAAkC,CAAC;AAE7D,MAAM,SAAS,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAEjE,SAAS,YAAY;IACnB,MAAM,IAAI,GAAG,GAAG,EAAE,CAChB,KAAK,CAAC,IAAI,CACR,EAAE,MAAM,EAAE,CAAC,EAAE,EACb,GAAG,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAC7D,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACb,OAAO,GAAG,IAAI,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;AAC/B,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,MAAc;IACrC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,mBAAmB,CAAC,CAAC;IAC3D,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,kBAAkB,QAAQ,CAAC,MAAM,uBAAuB,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAEtC,CAAC;IACF,OAAO,OAAO,QAAQ,CAAC,GAAG,EAAE,IAAI,KAAK,QAAQ;QAC3C,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI;QACnB,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;AAC3B,CAAC;AAID,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,EAAE,CAClC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AAE5E,MAAM,YAAY,GAAG,qmBAAqmB,CAAC;AAE3nB,SAAS,UAAU,CAAC,OAAe,EAAE,MAAc;IACjD,OAAO,yIAAyI,UAAU,CAAC,OAAO,CAAC,kBAAkB,YAAY,kCAAkC,UAAU,CAAC,OAAO,CAAC,WAAW,UAAU,CAAC,MAAM,CAAC,2BAA2B,CAAC;AACjT,CAAC;AAED,6FAA6F;AAC7F,KAAK,UAAU,QAAQ,CAAC,KAAa;IAOnC,IAAI,OAAO,GAAiC,GAAG,EAAE,CAAC,SAAS,CAAC;IAC5D,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAW,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IACzE,IAAI,OAAmC,CAAC;IACxC,MAAM,MAAM,GAAW,YAAY,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;QACxD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;QAC5D,IACE,OAAO;YACP,GAAG,CAAC,QAAQ,KAAK,WAAW;YAC5B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,EACvC,CAAC;YACD,QAAQ;iBACL,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC;iBAChD,GAAG,CAAC,sBAAsB,CAAC,CAAC;YAC/B,OAAO;QACT,CAAC;QACD,OAAO,GAAG,QAAQ,CAAC;QACnB,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7E,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,OAAO,EAAiB,CAAC;IACjD,MAAM,MAAM,GAAG,CAAC,OAAe,EAAE,MAAc,EAAE,EAAE;QACjD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,WAAW;YAAE,OAAO;QAC5C,OAAO;aACJ,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC;aAC9D,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;IACtC,CAAC,CAAC;IACF,OAAO;QACL,WAAW,EAAE,oBAAoB,IAAI,WAAW;QAChD,QAAQ;QACR,MAAM;QACN,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE;YAChB,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,WAAW;gBAAE,OAAO;YAC5C,OAAO,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;QAC/E,CAAC;QACD,KAAK,EAAE,GAAG,EAAE;YACV,MAAM,CAAC,qBAAqB,EAAE,2BAA2B,CAAC,CAAC;YAC3D,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,MAAc,EACd,GAAgB,EAChB,IAAY,EACZ,YAAoB;IAEpB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,2BAA2B,EAAE;QACjE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,IAAI;YACJ,YAAY;YACZ,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,KAAK,EAAE,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;SACtD,CAAC;KACH,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAE7C,CAAC;IACd,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,IAAI,yBAAyB,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,OAAO,CAAC,EAAU;IAIzB,IAAI,KAAiC,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAY,CAAC,OAAO,EAAE,EAAE;QACjD,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;AACvD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,KAAgB;IACzC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;IAC/C,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,YAAY,GAAG,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IAChD,MAAM,OAAO,GAAgB;QAC3B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,aAAa,EAAE,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC;QAC5E,KAAK,EAAE,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACjC,YAAY,EAAE,YAAY,EAAE;QAC5B,aAAa,EAAE,GAAG,CAAC,UAAU;KAC9B,CAAC;IACF,MAAM,OAAO,GAAG,CAAC,OAA0B,EAAY,EAAE,CAAC,CAAC;QACzD,SAAS,EAAE,MAAM;QACjB,OAAO;QACP,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE;QACzB,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM;QAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,SAAS,EAAE,WAAW,CAAC,KAAK,CAAC,aAAa,EAAE,MAAM,CAAC;QACnD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACtB,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC7C,IAAI,CAAC;QACH,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACrC,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC/C,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC;oBAChC,WAAW,EAAE,QAAQ,CAAC,WAAW;oBACjC,GAAG,OAAO;iBACX,CAAC,CAAC;gBACH,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,iCAAiC,KAAK,EAAE,CAAC,CAAC;gBAC5E,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC3E,IAAI,QAAQ,KAAK,SAAS;oBAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;gBACxE,IAAI,CAAC,CAAC,MAAM,IAAI,QAAQ,CAAC,EAAE,CAAC;oBAC1B,QAAQ,CAAC,MAAM,CAAC,eAAe,EAAE,+BAA+B,CAAC,CAAC;oBAClE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;gBACtD,CAAC;gBACD,IAAI,OAA0B,CAAC;gBAC/B,IAAI,CAAC;oBACH,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;gBACrE,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,QAAQ,CAAC,MAAM,CAAC,eAAe,EAAG,KAAe,CAAC,OAAO,CAAC,CAAC;oBAC3D,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBACjC,MAAM,aAAa,GAAG,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;gBACjD,QAAQ,CAAC,QAAQ,CACf,GAAG,MAAM,KAAK,IAAI,eAAe,CAAC,EAAE,CAAC,qBAAqB,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,CAChF,CAAC;gBACF,OAAO;oBACL,MAAM,EAAE,IAAI;oBACZ,KAAK,EAAE,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE;oBAC7C,UAAU,EAAE,OAAO,CAAC,UAAU;iBAC/B,CAAC;YACJ,CAAC;oBAAS,CAAC;gBACT,QAAQ,CAAC,KAAK,EAAE,CAAC;YACnB,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YAClC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3D,QAAQ,CAAC,OAAO;SACjB,CAAC,CAAC;QACH,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACxE,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QACzE,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAC/B,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YACnC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;gBACpB,OAAO;gBACP,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,YAAY,EAAE,OAAO,CAAC,YAAY;aACnC,CAAC;YACF,QAAQ,CAAC,OAAO;SACjB,CAAC,CAAC;QACH,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,MAAM,WAAW,CAAC;gBAChB,SAAS,EAAE,MAAM;gBACjB,OAAO;gBACP,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,CAClB,aAAa,CACX,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,EAC9B,EAAE,GAAG,EAAE,GAAG,CAAC,UAAU,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EAC/C,OAAO,CACR;aACJ,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,KAAY,EAAE,EAAE;gBAC9B,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC9B,MAAM,IAAI,cAAc,CAAC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;YAChE,CAAC,CAAC,CAAC;YACH,OAAO;gBACL,MAAM,EAAE,KAAK;gBACb,MAAM,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB;aACjE,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9B,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;IACjE,CAAC;YAAS,CAAC;QACT,QAAQ,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAQD,SAAS,QAAQ;IACf,IAAI,OAA4B,CAAC;IACjC,IAAI,MAAiC,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAI,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;QAC5C,OAAO,GAAG,IAAI,CAAC;QACf,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC/B,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AACtC,CAAC;AAmBD,MAAM,UAAU,iBAAiB,CAAC,KAAiC;IACjE,MAAM,KAAK,GAAG,QAAQ,EAAe,CAAC;IACtC,MAAM,IAAI,GAAG,QAAQ,EAAU,CAAC;IAChC,MAAM,MAAM,GAAG,QAAQ,EAAsB,CAAC;IAC9C,MAAM,QAAQ,GAAG,QAAQ,EAAW,CAAC;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC;QACnB,GAAG,KAAK;QACR,OAAO,EAAE;YACP,IAAI,EAAE,KAAK;YACX,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE;gBACrB,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;gBACvB,OAAO,IAAI,CAAC,OAAO,CAAC;YACtB,CAAC;YACD,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBACjB,MAAM,CAAC,OAAO,CAAC;oBACb,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;oBAC7D,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC;oBACjC,YAAY,EAAE,KAAK,CAAC,YAAY;iBACjC,CAAC,CAAC;gBACH,OAAO,QAAQ,CAAC,OAAO,CAAC;YAC1B,CAAC;SACF;KACF,CAAC,CAAC;IACH,OAAO,CAAC,IAAI,CACV,CAAC,MAAM,EAAE,EAAE;QACT,IAAI,MAAM,CAAC,MAAM;YAAE,OAAO;QAC1B,MAAM,OAAO,GAAG,IAAI,KAAK,CAAC,sBAAsB,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;QAClE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACtB,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC,EACD,CAAC,KAAc,EAAE,EAAE;QACjB,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACpB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC,CACF,CAAC;IACF,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC/B,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YAChB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,MAAM,CAAC,OAAO,CAAC;QACxB,CAAC;QACD,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE;YACnB,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC1B,OAAO,OAAO,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,KAAc,EAAmB,EAAE,CACjD,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC;AAI5C,MAAM,OAAO,GAAG,CAAC,KAAc,EAAkB,EAAE;IACjD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,OAAO,GAAG,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,GAAG,KAAK,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACnF,CAAC,CAAC;AAEF,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAClE,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9C,MAAM,SAAS,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;IACtF,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU,IAAI,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9E,OAAO;YACL,MAAM,EAAE,UAAU;YAClB,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,SAAS;SACV,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC;IAC9D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAClE,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;QAAE,OAAO,SAAS,CAAC;IAClD,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,UAAU,EAAE;YACV,GAAG,EAAE,IAAI;YACT,GAAG,EAAE,OAAO;YACZ,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;YACtB,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;SACvB;QACD,WAAW,EAAE,aAAa,CAAC,MAAM,CAAC,WAAW,CAAC;KAC/C,CAAC;AACJ,CAAC","sourcesContent":["import { createHash, randomBytes, randomInt } from \"node:crypto\";\nimport { createServer, type Server, type ServerResponse } from \"node:http\";\nimport type { AddressInfo } from \"node:net\";\n\nimport {\n  type AccountSummary,\n  HOST_PAIRING_FRAGMENT,\n  type HostGrantResponse,\n} from \"@parlor/auth\";\nimport type { HostPairing, PairingDevice } from \"@parlor/capabilities\";\n\nimport { hostAssertion } from \"./assertion.js\";\nimport type { AppGrant, HostKeyPair, HostKeys } from \"./grants.js\";\nimport { workspaceOf } from \"./naming.js\";\nimport { printable } from \"./prompter.js\";\nimport { revokeGrant } from \"./revoke.js\";\n\nexport const PAIRING_TIMEOUT_MS = 10 * 60_000;\n\nexport interface PairingReview {\n  readonly appName: string;\n  readonly appOrigin: string;\n  readonly account: AccountSummary;\n  readonly matchingCode: string;\n}\n\n/**\n * `browser`: a one-shot 127.0.0.1 listener (RFC 8252) accepting exactly this attempt's\n * `state`; the consent page is the one decision. `ipc`: the desktop shell's signed-in\n * webview gets the code from the backend and hands it over Tauri IPC, with no consent page,\n * so the shell's native dialog confirms the account the host got back.\n */\nexport type PairingChannel =\n  | { readonly kind: \"browser\"; open(url: string): Promise<void> }\n  | {\n      readonly kind: \"ipc\";\n      authorize(pairing: HostPairing): Promise<string>;\n      confirm(review: PairingReview): Promise<boolean>;\n    };\n\nexport interface PairInput {\n  readonly appOrigin: string;\n  readonly hostName: string;\n  readonly platform: string;\n  readonly channel: PairingChannel;\n  readonly keys: HostKeys;\n  readonly workspaceRoot: string;\n}\n\nexport type PairOutcome =\n  | {\n      readonly paired: true;\n      readonly grant: AppGrant;\n      readonly approvedBy: HostGrantResponse[\"approvedBy\"];\n    }\n  | {\n      readonly paired: false;\n      readonly reason: \"declined_locally\" | \"declined_in_app\" | \"timeout\";\n    };\n\nexport class UnrevokedGrant extends Error {\n  override readonly name = \"UnrevokedGrant\";\n  constructor(\n    readonly grant: AppGrant,\n    cause: Error,\n  ) {\n    super(cause.message, { cause });\n  }\n}\n\nconst MATCHING_ALPHABET = \"ABCDEFGHJKLMNPQRSTUVWXYZ23456789\";\n\nconst base64url = (bytes: Buffer) => bytes.toString(\"base64url\");\n\nfunction matchingCode(): string {\n  const part = () =>\n    Array.from(\n      { length: 3 },\n      () => MATCHING_ALPHABET[randomInt(MATCHING_ALPHABET.length)],\n    ).join(\"\");\n  return `${part()}-${part()}`;\n}\n\nasync function appNameOf(origin: string): Promise<string> {\n  const response = await fetch(`${origin}/_parlor/manifest`);\n  if (!response.ok) {\n    throw new Error(`${origin} answered HTTP ${response.status}; is it a Parlor app?`);\n  }\n  const manifest = (await response.json()) as {\n    readonly app?: { readonly name?: unknown };\n  };\n  return typeof manifest.app?.name === \"string\"\n    ? manifest.app.name\n    : new URL(origin).host;\n}\n\ntype Callback = { readonly code: string } | { readonly declined: true };\n\nconst escapeHtml = (text: string) =>\n  printable(text).replace(/[&<>\"']/g, (char) => `&#${char.charCodeAt(0)};`);\n\nconst RESULT_STYLE = `:root{color-scheme:light dark;--bg:#f6f6f4;--card:#fff;--text:#1d1d1b;--muted:#5f5f5a;--line:#e2e2dc}@media (prefers-color-scheme:dark){:root{--bg:#151514;--card:#1f1f1d;--text:#ededea;--muted:#a3a39d;--line:#34342f}}*{box-sizing:border-box}body{margin:0;min-height:100vh;display:grid;place-items:center;padding:16px;background:var(--bg);color:var(--text);font:15px/1.5 system-ui,-apple-system,\"Segoe UI\",sans-serif}main{width:100%;max-width:420px;background:var(--card);border:1px solid var(--line);border-radius:12px;padding:28px}h1{font-size:20px;line-height:1.3;margin:0 0 8px}p{margin:0;color:var(--muted)}`;\n\nfunction resultPage(heading: string, detail: string): string {\n  return `<!doctype html><html lang=\"en\"><head><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"><title>${escapeHtml(heading)}</title><style>${RESULT_STYLE}</style></head><body><main><h1>${escapeHtml(heading)}</h1><p>${escapeHtml(detail)}</p></main></body></html>`;\n}\n\n/** Holds the browser's request until the exchange settles, so the tab says what happened. */\nasync function loopback(state: string): Promise<{\n  readonly redirectUri: string;\n  readonly callback: Promise<Callback>;\n  readonly answer: (heading: string, detail: string) => void;\n  readonly redirect: (url: string) => void;\n  readonly close: () => void;\n}> {\n  let deliver: (callback: Callback) => void = () => undefined;\n  const callback = new Promise<Callback>((resolve) => (deliver = resolve));\n  let waiting: ServerResponse | undefined;\n  const server: Server = createServer((request, response) => {\n    const url = new URL(request.url ?? \"/\", \"http://127.0.0.1\");\n    if (\n      waiting ||\n      url.pathname !== \"/callback\" ||\n      url.searchParams.get(\"state\") !== state\n    ) {\n      response\n        .writeHead(404, { \"content-type\": \"text/plain\" })\n        .end(\"Not this connection.\");\n      return;\n    }\n    waiting = response;\n    const code = url.searchParams.get(\"code\");\n    deliver(code ? { code } : { declined: true });\n  });\n  await new Promise<void>((resolve) => server.listen(0, \"127.0.0.1\", resolve));\n  const { port } = server.address() as AddressInfo;\n  const answer = (heading: string, detail: string) => {\n    if (!waiting || waiting.headersSent) return;\n    waiting\n      .writeHead(200, { \"content-type\": \"text/html; charset=utf-8\" })\n      .end(resultPage(heading, detail));\n  };\n  return {\n    redirectUri: `http://127.0.0.1:${port}/callback`,\n    callback,\n    answer,\n    redirect: (url) => {\n      if (!waiting || waiting.headersSent) return;\n      waiting.writeHead(303, { location: url, \"cache-control\": \"no-store\" }).end();\n    },\n    close: () => {\n      answer(\"Parlor Host stopped\", \"Go back to your terminal.\");\n      server.close();\n    },\n  };\n}\n\nasync function exchange(\n  origin: string,\n  key: HostKeyPair,\n  code: string,\n  codeVerifier: string,\n): Promise<HostGrantResponse> {\n  const response = await fetch(`${origin}/_parlor/auth/hosts/token`, {\n    method: \"POST\",\n    headers: { \"content-type\": \"application/json\" },\n    body: JSON.stringify({\n      code,\n      codeVerifier,\n      publicKey: key.publicKey,\n      proof: await key.sign(new TextEncoder().encode(code)),\n    }),\n  });\n  const body = (await response.json().catch(() => undefined)) as\n    | (HostGrantResponse & { readonly error?: { readonly message?: string } })\n    | undefined;\n  if (!response.ok || !body?.grant) {\n    throw new Error(body?.error?.message ?? `The app answered HTTP ${response.status}.`);\n  }\n  return body;\n}\n\nfunction timeout(ms: number): {\n  readonly expired: Promise<\"timeout\">;\n  readonly clear: () => void;\n} {\n  let timer: NodeJS.Timeout | undefined;\n  const expired = new Promise<\"timeout\">((resolve) => {\n    timer = setTimeout(() => resolve(\"timeout\"), ms);\n  });\n  return { expired, clear: () => clearTimeout(timer) };\n}\n\n/**\n * Only the host starts a pairing: it makes the PKCE verifier, `state`, the matching code\n * and the key pair, so nothing from the web side can complete one.\n */\nexport async function pair(input: PairInput): Promise<PairOutcome> {\n  const origin = new URL(input.appOrigin).origin;\n  const appName = await appNameOf(origin);\n  const key = await input.keys.create(origin);\n  const codeVerifier = base64url(randomBytes(32));\n  const pairing: HostPairing = {\n    hostName: input.hostName,\n    platform: input.platform,\n    codeChallenge: base64url(createHash(\"sha256\").update(codeVerifier).digest()),\n    state: base64url(randomBytes(16)),\n    matchingCode: matchingCode(),\n    keyThumbprint: key.thumbprint,\n  };\n  const grantOf = (granted: HostGrantResponse): AppGrant => ({\n    appOrigin: origin,\n    appName,\n    grantId: granted.grant.id,\n    hostId: granted.grant.hostId,\n    account: granted.account,\n    workspace: workspaceOf(input.workspaceRoot, origin),\n    createdAt: Date.now(),\n  });\n  const deadline = timeout(PAIRING_TIMEOUT_MS);\n  try {\n    if (input.channel.kind === \"browser\") {\n      const listener = await loopback(pairing.state);\n      try {\n        const query = new URLSearchParams({\n          redirectUri: listener.redirectUri,\n          ...pairing,\n        });\n        await input.channel.open(`${origin}/_parlor/auth/hosts/authorize?${query}`);\n        const callback = await Promise.race([listener.callback, deadline.expired]);\n        if (callback === \"timeout\") return { paired: false, reason: \"timeout\" };\n        if (!(\"code\" in callback)) {\n          listener.answer(\"Not connected\", \"You cancelled the connection.\");\n          return { paired: false, reason: \"declined_in_app\" };\n        }\n        let granted: HostGrantResponse;\n        try {\n          granted = await exchange(origin, key, callback.code, codeVerifier);\n        } catch (error) {\n          listener.answer(\"Not connected\", (error as Error).message);\n          throw error;\n        }\n        await key.keep(granted.grant.id);\n        const pairingSecret = base64url(randomBytes(32));\n        listener.redirect(\n          `${origin}/#${new URLSearchParams({ [HOST_PAIRING_FRAGMENT]: pairingSecret })}`,\n        );\n        return {\n          paired: true,\n          grant: { ...grantOf(granted), pairingSecret },\n          approvedBy: granted.approvedBy,\n        };\n      } finally {\n        listener.close();\n      }\n    }\n\n    const callback = await Promise.race([\n      input.channel.authorize(pairing).then((code) => ({ code })),\n      deadline.expired,\n    ]);\n    if (callback === \"timeout\") return { paired: false, reason: \"timeout\" };\n    const granted = await exchange(origin, key, callback.code, codeVerifier);\n    const grant = grantOf(granted);\n    const confirmed = await Promise.race([\n      input.channel.confirm({\n        appName,\n        appOrigin: origin,\n        account: granted.account,\n        matchingCode: pairing.matchingCode,\n      }),\n      deadline.expired,\n    ]);\n    if (confirmed !== true) {\n      await revokeGrant({\n        appOrigin: origin,\n        appName,\n        assert: (request) =>\n          hostAssertion(\n            (payload) => key.sign(payload),\n            { kid: key.thumbprint, grantId: grant.grantId },\n            request,\n          ),\n      }).catch(async (error: Error) => {\n        await key.keep(grant.grantId);\n        throw new UnrevokedGrant({ ...grant, declined: true }, error);\n      });\n      return {\n        paired: false,\n        reason: confirmed === \"timeout\" ? \"timeout\" : \"declined_locally\",\n      };\n    }\n    await key.keep(grant.grantId);\n    return { paired: true, grant, approvedBy: granted.approvedBy };\n  } finally {\n    deadline.clear();\n  }\n}\n\ninterface Deferred<T> {\n  readonly promise: Promise<T>;\n  readonly resolve: (value: T) => void;\n  readonly reject: (error: unknown) => void;\n}\n\nfunction deferred<T>(): Deferred<T> {\n  let resolve!: (value: T) => void;\n  let reject!: (error: unknown) => void;\n  const promise = new Promise<T>((done, fail) => {\n    resolve = done;\n    reject = fail;\n  });\n  promise.catch(() => undefined);\n  return { promise, resolve, reject };\n}\n\nexport interface LocalPairingReview {\n  readonly account: string;\n  readonly appName: string;\n  readonly matchingCode: string;\n}\n\n/**\n * A pairing driven over the control socket by the desktop shell: `pairing` once the host\n * made its key and code, `finish` with the code the signed-in page got from the backend,\n * `confirm` with the user's answer in the native dialog.\n */\nexport interface LocalPairing {\n  readonly pairing: Promise<HostPairing>;\n  finish(code: string): Promise<LocalPairingReview>;\n  confirm(connect: boolean): Promise<PairOutcome>;\n}\n\nexport function startLocalPairing(input: Omit<PairInput, \"channel\">): LocalPairing {\n  const ready = deferred<HostPairing>();\n  const code = deferred<string>();\n  const review = deferred<LocalPairingReview>();\n  const decision = deferred<boolean>();\n  const outcome = pair({\n    ...input,\n    channel: {\n      kind: \"ipc\",\n      authorize: (pairing) => {\n        ready.resolve(pairing);\n        return code.promise;\n      },\n      confirm: (shown) => {\n        review.resolve({\n          account: printable(shown.account.email ?? shown.account.name),\n          appName: printable(shown.appName),\n          matchingCode: shown.matchingCode,\n        });\n        return decision.promise;\n      },\n    },\n  });\n  outcome.then(\n    (result) => {\n      if (result.paired) return;\n      const stopped = new Error(`The pairing ended: ${result.reason}.`);\n      ready.reject(stopped);\n      review.reject(stopped);\n    },\n    (error: unknown) => {\n      ready.reject(error);\n      review.reject(error);\n    },\n  );\n  outcome.catch(() => undefined);\n  return {\n    pairing: ready.promise,\n    finish: (value) => {\n      code.resolve(value);\n      return review.promise;\n    },\n    confirm: (connect) => {\n      decision.resolve(connect);\n      return outcome;\n    },\n  };\n}\n\nconst isText = (value: unknown): value is string =>\n  typeof value === \"string\" && value !== \"\";\n\ntype Point = JsonWebKey & { readonly x: string; readonly y: string };\n\nconst isPoint = (value: unknown): value is Point => {\n  if (typeof value !== \"object\" || value === null) return false;\n  const key = value as Record<string, unknown>;\n  return key.kty === \"EC\" && key.crv === \"P-256\" && isText(key.x) && isText(key.y);\n};\n\nfunction presenceKeyOf(value: unknown): PairingDevice[\"presenceKey\"] {\n  if (typeof value !== \"object\" || value === null) return undefined;\n  const key = value as Record<string, unknown>;\n  if (!isPoint(key.publicKey)) return undefined;\n  const publicKey = { kty: \"EC\", crv: \"P-256\", x: key.publicKey.x, y: key.publicKey.y };\n  if (key.format === \"webauthn\" && isText(key.credentialId) && isText(key.rpId)) {\n    return {\n      format: \"webauthn\",\n      credentialId: key.credentialId,\n      rpId: key.rpId,\n      publicKey,\n    };\n  }\n  if (key.format === \"es256-raw\" && isText(key.keyId)) {\n    return { format: \"es256-raw\", keyId: key.keyId, publicKey };\n  }\n  return undefined;\n}\n\nexport function pairingDeviceOf(value: unknown): PairingDevice | undefined {\n  if (typeof value !== \"object\" || value === null) return undefined;\n  const device = value as Record<string, unknown>;\n  if (!isText(device.deviceId) || !isText(device.name) || !isText(device.platform)) {\n    return undefined;\n  }\n  if (!isPoint(device.signingKey)) return undefined;\n  return {\n    deviceId: device.deviceId,\n    name: device.name,\n    platform: device.platform,\n    signingKey: {\n      kty: \"EC\",\n      crv: \"P-256\",\n      x: device.signingKey.x,\n      y: device.signingKey.y,\n    },\n    presenceKey: presenceKeyOf(device.presenceKey),\n  };\n}\n"]}
+{"version":3,"file":"pairing.js","sourceRoot":"","sources":["../src/pairing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,YAAY,EAAoC,MAAM,WAAW,CAAC;AAG3E,OAAO,EAEL,qBAAqB,GAEtB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,GAAG,MAAM,CAAC;AA6C9C,MAAM,OAAO,cAAe,SAAQ,KAAK;IAG5B,KAAK;IAFE,IAAI,GAAG,gBAAgB,CAAC;IAC1C,YACW,KAAe,EACxB,KAAY;QAEZ,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;qBAHvB,KAAK;IAIhB,CAAC;CACF;AAED,MAAM,iBAAiB,GAAG,kCAAkC,CAAC;AAE7D,MAAM,SAAS,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAEjE,SAAS,YAAY;IACnB,MAAM,IAAI,GAAG,GAAG,EAAE,CAChB,KAAK,CAAC,IAAI,CACR,EAAE,MAAM,EAAE,CAAC,EAAE,EACb,GAAG,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAC7D,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACb,OAAO,GAAG,IAAI,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;AAC/B,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,MAAc;IACrC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,mBAAmB,CAAC,CAAC;IAC3D,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,kBAAkB,QAAQ,CAAC,MAAM,uBAAuB,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAEtC,CAAC;IACF,OAAO,OAAO,QAAQ,CAAC,GAAG,EAAE,IAAI,KAAK,QAAQ;QAC3C,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI;QACnB,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;AAC3B,CAAC;AAMD,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,EAAE,CAClC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AAE5E,MAAM,YAAY,GAAG,qmBAAqmB,CAAC;AAE3nB,SAAS,UAAU,CAAC,OAAe,EAAE,MAAc;IACjD,OAAO,yIAAyI,UAAU,CAAC,OAAO,CAAC,kBAAkB,YAAY,kCAAkC,UAAU,CAAC,OAAO,CAAC,WAAW,UAAU,CAAC,MAAM,CAAC,2BAA2B,CAAC;AACjT,CAAC;AAED,6FAA6F;AAC7F,KAAK,UAAU,QAAQ,CAAC,KAAa;IAOnC,IAAI,OAAO,GAAiC,GAAG,EAAE,CAAC,SAAS,CAAC;IAC5D,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAW,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IACzE,IAAI,OAAmC,CAAC;IACxC,MAAM,MAAM,GAAW,YAAY,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;QACxD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;QAC5D,IACE,OAAO;YACP,GAAG,CAAC,QAAQ,KAAK,WAAW;YAC5B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,EACvC,CAAC;YACD,QAAQ;iBACL,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC;iBAChD,GAAG,CAAC,sBAAsB,CAAC,CAAC;YAC/B,OAAO;QACT,CAAC;QACD,OAAO,GAAG,QAAQ,CAAC;QACnB,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACtD,OAAO,CACL,IAAI;YACF,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,KAAK,IAAI,EAAE,CAAC,EAAE;YAC/E,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CACvB,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7E,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,OAAO,EAAiB,CAAC;IACjD,MAAM,MAAM,GAAG,CAAC,OAAe,EAAE,MAAc,EAAE,EAAE;QACjD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,WAAW;YAAE,OAAO;QAC5C,OAAO;aACJ,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC;aAC9D,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;IACtC,CAAC,CAAC;IACF,OAAO;QACL,WAAW,EAAE,oBAAoB,IAAI,WAAW;QAChD,QAAQ;QACR,MAAM;QACN,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE;YAChB,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,WAAW;gBAAE,OAAO;YAC5C,OAAO,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;QAC/E,CAAC;QACD,KAAK,EAAE,GAAG,EAAE;YACV,MAAM,CAAC,qBAAqB,EAAE,2BAA2B,CAAC,CAAC;YAC3D,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,MAAc,EACd,GAAgB,EAChB,IAAY,EACZ,YAAoB;IAEpB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,2BAA2B,EAAE;QACjE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,IAAI;YACJ,YAAY;YACZ,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,KAAK,EAAE,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;SACtD,CAAC;KACH,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAE7C,CAAC;IACd,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,IAAI,yBAAyB,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,OAAO,CAAC,EAAU;IAIzB,IAAI,KAAiC,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAY,CAAC,OAAO,EAAE,EAAE;QACjD,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;AACvD,CAAC;AAED,kGAAkG;AAClG,SAAS,SAAS,CAAC,MAAc,EAAE,OAA2B;IAC5D,MAAM,GAAG,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC3E,OAAO,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AAC7D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,KAAgB;IACzC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;IAC/C,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,SAAS,GAAG,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACtF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,YAAY,GAAG,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IAChD,MAAM,OAAO,GAAgB;QAC3B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,aAAa,EAAE,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC;QAC5E,KAAK,EAAE,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACjC,YAAY,EAAE,YAAY,EAAE;QAC5B,aAAa,EAAE,GAAG,CAAC,UAAU;KAC9B,CAAC;IACF,MAAM,OAAO,GAAG,CAAC,OAA0B,EAAY,EAAE,CAAC,CAAC;QACzD,SAAS,EAAE,MAAM;QACjB,OAAO;QACP,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE;QACzB,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM;QAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,SAAS,EAAE,WAAW,CAAC,KAAK,CAAC,aAAa,EAAE,MAAM,CAAC;QACnD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACtB,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC7C,IAAI,CAAC;QACH,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACrC,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC/C,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC;oBAChC,WAAW,EAAE,QAAQ,CAAC,WAAW;oBACjC,GAAG,OAAO;oBACV,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAChD,CAAC,CAAC;gBACH,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,iCAAiC,KAAK,EAAE,CAAC,CAAC;gBAC5E,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC3E,IAAI,QAAQ,KAAK,SAAS;oBAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;gBACxE,IAAI,CAAC,CAAC,MAAM,IAAI,QAAQ,CAAC,EAAE,CAAC;oBAC1B,QAAQ,CAAC,MAAM,CAAC,eAAe,EAAE,+BAA+B,CAAC,CAAC;oBAClE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;gBACtD,CAAC;gBACD,IAAI,OAA0B,CAAC;gBAC/B,IAAI,CAAC;oBACH,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;gBACrE,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,QAAQ,CAAC,MAAM,CAAC,eAAe,EAAG,KAAe,CAAC,OAAO,CAAC,CAAC;oBAC3D,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBACjC,MAAM,aAAa,GAAG,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;gBACjD,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;gBACnD,MAAM,UAAU,GACd,SAAS,IAAI,YAAY,IAAI,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC1E,IAAI,UAAU,IAAI,SAAS;oBAAE,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;gBAC/E,OAAO,CAAC,IAAI,GAAG,IAAI,eAAe,CAAC;oBACjC,CAAC,qBAAqB,CAAC,EAAE,aAAa;iBACvC,CAAC,CAAC,QAAQ,EAAE,CAAC;gBACd,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBAChC,OAAO;oBACL,MAAM,EAAE,IAAI;oBACZ,KAAK,EAAE;wBACL,GAAG,OAAO,CAAC,OAAO,CAAC;wBACnB,aAAa;wBACb,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC;qBACxE;oBACD,UAAU,EAAE,OAAO,CAAC,UAAU;iBAC/B,CAAC;YACJ,CAAC;oBAAS,CAAC;gBACT,QAAQ,CAAC,KAAK,EAAE,CAAC;YACnB,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YAClC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3D,QAAQ,CAAC,OAAO;SACjB,CAAC,CAAC;QACH,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACxE,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QACzE,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAC/B,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YACnC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;gBACpB,OAAO;gBACP,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,YAAY,EAAE,OAAO,CAAC,YAAY;aACnC,CAAC;YACF,QAAQ,CAAC,OAAO;SACjB,CAAC,CAAC;QACH,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,MAAM,WAAW,CAAC;gBAChB,SAAS,EAAE,MAAM;gBACjB,OAAO;gBACP,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,CAClB,aAAa,CACX,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,EAC9B,EAAE,GAAG,EAAE,GAAG,CAAC,UAAU,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EAC/C,OAAO,CACR;aACJ,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,KAAY,EAAE,EAAE;gBAC9B,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC9B,MAAM,IAAI,cAAc,CAAC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;YAChE,CAAC,CAAC,CAAC;YACH,OAAO;gBACL,MAAM,EAAE,KAAK;gBACb,MAAM,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB;aACjE,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9B,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;IACjE,CAAC;YAAS,CAAC;QACT,QAAQ,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAQD,SAAS,QAAQ;IACf,IAAI,OAA4B,CAAC;IACjC,IAAI,MAAiC,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAI,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;QAC5C,OAAO,GAAG,IAAI,CAAC;QACf,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC/B,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AACtC,CAAC;AAmBD,MAAM,UAAU,iBAAiB,CAAC,KAAiC;IACjE,MAAM,KAAK,GAAG,QAAQ,EAAe,CAAC;IACtC,MAAM,IAAI,GAAG,QAAQ,EAAU,CAAC;IAChC,MAAM,MAAM,GAAG,QAAQ,EAAsB,CAAC;IAC9C,MAAM,QAAQ,GAAG,QAAQ,EAAW,CAAC;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC;QACnB,GAAG,KAAK;QACR,OAAO,EAAE;YACP,IAAI,EAAE,KAAK;YACX,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE;gBACrB,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;gBACvB,OAAO,IAAI,CAAC,OAAO,CAAC;YACtB,CAAC;YACD,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBACjB,MAAM,CAAC,OAAO,CAAC;oBACb,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;oBAC7D,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC;oBACjC,YAAY,EAAE,KAAK,CAAC,YAAY;iBACjC,CAAC,CAAC;gBACH,OAAO,QAAQ,CAAC,OAAO,CAAC;YAC1B,CAAC;SACF;KACF,CAAC,CAAC;IACH,OAAO,CAAC,IAAI,CACV,CAAC,MAAM,EAAE,EAAE;QACT,IAAI,MAAM,CAAC,MAAM;YAAE,OAAO;QAC1B,MAAM,OAAO,GAAG,IAAI,KAAK,CAAC,sBAAsB,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;QAClE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACtB,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC,EACD,CAAC,KAAc,EAAE,EAAE;QACjB,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACpB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC,CACF,CAAC;IACF,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC/B,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YAChB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,MAAM,CAAC,OAAO,CAAC;QACxB,CAAC;QACD,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE;YACnB,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC1B,OAAO,OAAO,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,KAAc,EAAmB,EAAE,CACjD,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC;AAI5C,MAAM,OAAO,GAAG,CAAC,KAAc,EAAkB,EAAE;IACjD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,OAAO,GAAG,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,GAAG,KAAK,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACnF,CAAC,CAAC;AAEF,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAClE,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9C,MAAM,SAAS,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;IACtF,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU,IAAI,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9E,OAAO;YACL,MAAM,EAAE,UAAU;YAClB,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,SAAS;SACV,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC;IAC9D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAClE,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;QAAE,OAAO,SAAS,CAAC;IAClD,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,UAAU,EAAE;YACV,GAAG,EAAE,IAAI;YACT,GAAG,EAAE,OAAO;YACZ,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;YACtB,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;SACvB;QACD,WAAW,EAAE,aAAa,CAAC,MAAM,CAAC,WAAW,CAAC;KAC/C,CAAC;AACJ,CAAC","sourcesContent":["import { createHash, randomBytes, randomInt } from \"node:crypto\";\nimport { createServer, type Server, type ServerResponse } from \"node:http\";\nimport type { AddressInfo } from \"node:net\";\n\nimport {\n  type AccountSummary,\n  HOST_PAIRING_FRAGMENT,\n  type HostGrantResponse,\n} from \"@parlor/auth\";\nimport type { HostPairing, PairingDevice } from \"@parlor/capabilities\";\n\nimport { agentToolsName } from \"./agent-tools.js\";\nimport { hostAssertion } from \"./assertion.js\";\nimport type { AppGrant, HostKeyPair, HostKeys } from \"./grants.js\";\nimport { workspaceOf } from \"./naming.js\";\nimport { printable } from \"./prompter.js\";\nimport { revokeGrant } from \"./revoke.js\";\n\nexport const PAIRING_TIMEOUT_MS = 10 * 60_000;\n\nexport interface PairingReview {\n  readonly appName: string;\n  readonly appOrigin: string;\n  readonly account: AccountSummary;\n  readonly matchingCode: string;\n}\n\n/**\n * `browser`: a one-shot 127.0.0.1 listener (RFC 8252) accepting exactly this attempt's\n * `state`; the consent page is the one decision. `ipc`: the desktop shell's signed-in\n * webview gets the code from the backend and hands it over Tauri IPC, with no consent page,\n * so the shell's native dialog confirms the account the host got back.\n */\nexport type PairingChannel =\n  | { readonly kind: \"browser\"; open(url: string): Promise<void> }\n  | {\n      readonly kind: \"ipc\";\n      authorize(pairing: HostPairing): Promise<string>;\n      confirm(review: PairingReview): Promise<boolean>;\n    };\n\nexport interface PairInput {\n  readonly appOrigin: string;\n  readonly hostName: string;\n  readonly platform: string;\n  readonly channel: PairingChannel;\n  readonly keys: HostKeys;\n  readonly workspaceRoot: string;\n  /** Offers, on the consent page, to let the coding agents here use the app outside its sidebar. */\n  readonly offerAgentTools?: boolean | undefined;\n}\n\nexport type PairOutcome =\n  | {\n      readonly paired: true;\n      readonly grant: AppGrant;\n      readonly approvedBy: HostGrantResponse[\"approvedBy\"];\n    }\n  | {\n      readonly paired: false;\n      readonly reason: \"declined_locally\" | \"declined_in_app\" | \"timeout\";\n    };\n\nexport class UnrevokedGrant extends Error {\n  override readonly name = \"UnrevokedGrant\";\n  constructor(\n    readonly grant: AppGrant,\n    cause: Error,\n  ) {\n    super(cause.message, { cause });\n  }\n}\n\nconst MATCHING_ALPHABET = \"ABCDEFGHJKLMNPQRSTUVWXYZ23456789\";\n\nconst base64url = (bytes: Buffer) => bytes.toString(\"base64url\");\n\nfunction matchingCode(): string {\n  const part = () =>\n    Array.from(\n      { length: 3 },\n      () => MATCHING_ALPHABET[randomInt(MATCHING_ALPHABET.length)],\n    ).join(\"\");\n  return `${part()}-${part()}`;\n}\n\nasync function appNameOf(origin: string): Promise<string> {\n  const response = await fetch(`${origin}/_parlor/manifest`);\n  if (!response.ok) {\n    throw new Error(`${origin} answered HTTP ${response.status}; is it a Parlor app?`);\n  }\n  const manifest = (await response.json()) as {\n    readonly app?: { readonly name?: unknown };\n  };\n  return typeof manifest.app?.name === \"string\"\n    ? manifest.app.name\n    : new URL(origin).host;\n}\n\ntype Callback =\n  | { readonly code: string; readonly agentTools?: boolean | undefined }\n  | { readonly declined: true };\n\nconst escapeHtml = (text: string) =>\n  printable(text).replace(/[&<>\"']/g, (char) => `&#${char.charCodeAt(0)};`);\n\nconst RESULT_STYLE = `:root{color-scheme:light dark;--bg:#f6f6f4;--card:#fff;--text:#1d1d1b;--muted:#5f5f5a;--line:#e2e2dc}@media (prefers-color-scheme:dark){:root{--bg:#151514;--card:#1f1f1d;--text:#ededea;--muted:#a3a39d;--line:#34342f}}*{box-sizing:border-box}body{margin:0;min-height:100vh;display:grid;place-items:center;padding:16px;background:var(--bg);color:var(--text);font:15px/1.5 system-ui,-apple-system,\"Segoe UI\",sans-serif}main{width:100%;max-width:420px;background:var(--card);border:1px solid var(--line);border-radius:12px;padding:28px}h1{font-size:20px;line-height:1.3;margin:0 0 8px}p{margin:0;color:var(--muted)}`;\n\nfunction resultPage(heading: string, detail: string): string {\n  return `<!doctype html><html lang=\"en\"><head><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"><title>${escapeHtml(heading)}</title><style>${RESULT_STYLE}</style></head><body><main><h1>${escapeHtml(heading)}</h1><p>${escapeHtml(detail)}</p></main></body></html>`;\n}\n\n/** Holds the browser's request until the exchange settles, so the tab says what happened. */\nasync function loopback(state: string): Promise<{\n  readonly redirectUri: string;\n  readonly callback: Promise<Callback>;\n  readonly answer: (heading: string, detail: string) => void;\n  readonly redirect: (url: string) => void;\n  readonly close: () => void;\n}> {\n  let deliver: (callback: Callback) => void = () => undefined;\n  const callback = new Promise<Callback>((resolve) => (deliver = resolve));\n  let waiting: ServerResponse | undefined;\n  const server: Server = createServer((request, response) => {\n    const url = new URL(request.url ?? \"/\", \"http://127.0.0.1\");\n    if (\n      waiting ||\n      url.pathname !== \"/callback\" ||\n      url.searchParams.get(\"state\") !== state\n    ) {\n      response\n        .writeHead(404, { \"content-type\": \"text/plain\" })\n        .end(\"Not this connection.\");\n      return;\n    }\n    waiting = response;\n    const code = url.searchParams.get(\"code\");\n    const agentTools = url.searchParams.get(\"agentTools\");\n    deliver(\n      code\n        ? { code, ...(agentTools === null ? {} : { agentTools: agentTools === \"on\" }) }\n        : { declined: true },\n    );\n  });\n  await new Promise<void>((resolve) => server.listen(0, \"127.0.0.1\", resolve));\n  const { port } = server.address() as AddressInfo;\n  const answer = (heading: string, detail: string) => {\n    if (!waiting || waiting.headersSent) return;\n    waiting\n      .writeHead(200, { \"content-type\": \"text/html; charset=utf-8\" })\n      .end(resultPage(heading, detail));\n  };\n  return {\n    redirectUri: `http://127.0.0.1:${port}/callback`,\n    callback,\n    answer,\n    redirect: (url) => {\n      if (!waiting || waiting.headersSent) return;\n      waiting.writeHead(303, { location: url, \"cache-control\": \"no-store\" }).end();\n    },\n    close: () => {\n      answer(\"Parlor Host stopped\", \"Go back to your terminal.\");\n      server.close();\n    },\n  };\n}\n\nasync function exchange(\n  origin: string,\n  key: HostKeyPair,\n  code: string,\n  codeVerifier: string,\n): Promise<HostGrantResponse> {\n  const response = await fetch(`${origin}/_parlor/auth/hosts/token`, {\n    method: \"POST\",\n    headers: { \"content-type\": \"application/json\" },\n    body: JSON.stringify({\n      code,\n      codeVerifier,\n      publicKey: key.publicKey,\n      proof: await key.sign(new TextEncoder().encode(code)),\n    }),\n  });\n  const body = (await response.json().catch(() => undefined)) as\n    | (HostGrantResponse & { readonly error?: { readonly message?: string } })\n    | undefined;\n  if (!response.ok || !body?.grant) {\n    throw new Error(body?.error?.message ?? `The app answered HTTP ${response.status}.`);\n  }\n  return body;\n}\n\nfunction timeout(ms: number): {\n  readonly expired: Promise<\"timeout\">;\n  readonly clear: () => void;\n} {\n  let timer: NodeJS.Timeout | undefined;\n  const expired = new Promise<\"timeout\">((resolve) => {\n    timer = setTimeout(() => resolve(\"timeout\"), ms);\n  });\n  return { expired, clear: () => clearTimeout(timer) };\n}\n\n/** The pairing secret goes nowhere but the app's own origin; an older app has no landing page. */\nfunction landingOf(origin: string, landing: string | undefined): URL {\n  const url = landing === undefined ? undefined : URL.parse(landing, origin);\n  return url?.origin === origin ? url : new URL(\"/\", origin);\n}\n\n/**\n * Only the host starts a pairing: it makes the PKCE verifier, `state`, the matching code\n * and the key pair, so nothing from the web side can complete one.\n */\nexport async function pair(input: PairInput): Promise<PairOutcome> {\n  const origin = new URL(input.appOrigin).origin;\n  const appName = await appNameOf(origin);\n  const toolsName = input.offerAgentTools ? agentToolsName(appName, origin) : undefined;\n  const key = await input.keys.create(origin);\n  const codeVerifier = base64url(randomBytes(32));\n  const pairing: HostPairing = {\n    hostName: input.hostName,\n    platform: input.platform,\n    codeChallenge: base64url(createHash(\"sha256\").update(codeVerifier).digest()),\n    state: base64url(randomBytes(16)),\n    matchingCode: matchingCode(),\n    keyThumbprint: key.thumbprint,\n  };\n  const grantOf = (granted: HostGrantResponse): AppGrant => ({\n    appOrigin: origin,\n    appName,\n    grantId: granted.grant.id,\n    hostId: granted.grant.hostId,\n    account: granted.account,\n    workspace: workspaceOf(input.workspaceRoot, origin),\n    createdAt: Date.now(),\n  });\n  const deadline = timeout(PAIRING_TIMEOUT_MS);\n  try {\n    if (input.channel.kind === \"browser\") {\n      const listener = await loopback(pairing.state);\n      try {\n        const query = new URLSearchParams({\n          redirectUri: listener.redirectUri,\n          ...pairing,\n          ...(toolsName ? { agentTools: \"offered\" } : {}),\n        });\n        await input.channel.open(`${origin}/_parlor/auth/hosts/authorize?${query}`);\n        const callback = await Promise.race([listener.callback, deadline.expired]);\n        if (callback === \"timeout\") return { paired: false, reason: \"timeout\" };\n        if (!(\"code\" in callback)) {\n          listener.answer(\"Not connected\", \"You cancelled the connection.\");\n          return { paired: false, reason: \"declined_in_app\" };\n        }\n        let granted: HostGrantResponse;\n        try {\n          granted = await exchange(origin, key, callback.code, codeVerifier);\n        } catch (error) {\n          listener.answer(\"Not connected\", (error as Error).message);\n          throw error;\n        }\n        await key.keep(granted.grant.id);\n        const pairingSecret = base64url(randomBytes(32));\n        const landing = landingOf(origin, granted.landing);\n        const agentTools =\n          toolsName && \"agentTools\" in callback ? callback.agentTools : undefined;\n        if (agentTools && toolsName) landing.searchParams.set(\"agentTools\", toolsName);\n        landing.hash = new URLSearchParams({\n          [HOST_PAIRING_FRAGMENT]: pairingSecret,\n        }).toString();\n        listener.redirect(landing.href);\n        return {\n          paired: true,\n          grant: {\n            ...grantOf(granted),\n            pairingSecret,\n            ...(agentTools === undefined ? {} : { agentTools: { on: agentTools } }),\n          },\n          approvedBy: granted.approvedBy,\n        };\n      } finally {\n        listener.close();\n      }\n    }\n\n    const callback = await Promise.race([\n      input.channel.authorize(pairing).then((code) => ({ code })),\n      deadline.expired,\n    ]);\n    if (callback === \"timeout\") return { paired: false, reason: \"timeout\" };\n    const granted = await exchange(origin, key, callback.code, codeVerifier);\n    const grant = grantOf(granted);\n    const confirmed = await Promise.race([\n      input.channel.confirm({\n        appName,\n        appOrigin: origin,\n        account: granted.account,\n        matchingCode: pairing.matchingCode,\n      }),\n      deadline.expired,\n    ]);\n    if (confirmed !== true) {\n      await revokeGrant({\n        appOrigin: origin,\n        appName,\n        assert: (request) =>\n          hostAssertion(\n            (payload) => key.sign(payload),\n            { kid: key.thumbprint, grantId: grant.grantId },\n            request,\n          ),\n      }).catch(async (error: Error) => {\n        await key.keep(grant.grantId);\n        throw new UnrevokedGrant({ ...grant, declined: true }, error);\n      });\n      return {\n        paired: false,\n        reason: confirmed === \"timeout\" ? \"timeout\" : \"declined_locally\",\n      };\n    }\n    await key.keep(grant.grantId);\n    return { paired: true, grant, approvedBy: granted.approvedBy };\n  } finally {\n    deadline.clear();\n  }\n}\n\ninterface Deferred<T> {\n  readonly promise: Promise<T>;\n  readonly resolve: (value: T) => void;\n  readonly reject: (error: unknown) => void;\n}\n\nfunction deferred<T>(): Deferred<T> {\n  let resolve!: (value: T) => void;\n  let reject!: (error: unknown) => void;\n  const promise = new Promise<T>((done, fail) => {\n    resolve = done;\n    reject = fail;\n  });\n  promise.catch(() => undefined);\n  return { promise, resolve, reject };\n}\n\nexport interface LocalPairingReview {\n  readonly account: string;\n  readonly appName: string;\n  readonly matchingCode: string;\n}\n\n/**\n * A pairing driven over the control socket by the desktop shell: `pairing` once the host\n * made its key and code, `finish` with the code the signed-in page got from the backend,\n * `confirm` with the user's answer in the native dialog.\n */\nexport interface LocalPairing {\n  readonly pairing: Promise<HostPairing>;\n  finish(code: string): Promise<LocalPairingReview>;\n  confirm(connect: boolean): Promise<PairOutcome>;\n}\n\nexport function startLocalPairing(input: Omit<PairInput, \"channel\">): LocalPairing {\n  const ready = deferred<HostPairing>();\n  const code = deferred<string>();\n  const review = deferred<LocalPairingReview>();\n  const decision = deferred<boolean>();\n  const outcome = pair({\n    ...input,\n    channel: {\n      kind: \"ipc\",\n      authorize: (pairing) => {\n        ready.resolve(pairing);\n        return code.promise;\n      },\n      confirm: (shown) => {\n        review.resolve({\n          account: printable(shown.account.email ?? shown.account.name),\n          appName: printable(shown.appName),\n          matchingCode: shown.matchingCode,\n        });\n        return decision.promise;\n      },\n    },\n  });\n  outcome.then(\n    (result) => {\n      if (result.paired) return;\n      const stopped = new Error(`The pairing ended: ${result.reason}.`);\n      ready.reject(stopped);\n      review.reject(stopped);\n    },\n    (error: unknown) => {\n      ready.reject(error);\n      review.reject(error);\n    },\n  );\n  outcome.catch(() => undefined);\n  return {\n    pairing: ready.promise,\n    finish: (value) => {\n      code.resolve(value);\n      return review.promise;\n    },\n    confirm: (connect) => {\n      decision.resolve(connect);\n      return outcome;\n    },\n  };\n}\n\nconst isText = (value: unknown): value is string =>\n  typeof value === \"string\" && value !== \"\";\n\ntype Point = JsonWebKey & { readonly x: string; readonly y: string };\n\nconst isPoint = (value: unknown): value is Point => {\n  if (typeof value !== \"object\" || value === null) return false;\n  const key = value as Record<string, unknown>;\n  return key.kty === \"EC\" && key.crv === \"P-256\" && isText(key.x) && isText(key.y);\n};\n\nfunction presenceKeyOf(value: unknown): PairingDevice[\"presenceKey\"] {\n  if (typeof value !== \"object\" || value === null) return undefined;\n  const key = value as Record<string, unknown>;\n  if (!isPoint(key.publicKey)) return undefined;\n  const publicKey = { kty: \"EC\", crv: \"P-256\", x: key.publicKey.x, y: key.publicKey.y };\n  if (key.format === \"webauthn\" && isText(key.credentialId) && isText(key.rpId)) {\n    return {\n      format: \"webauthn\",\n      credentialId: key.credentialId,\n      rpId: key.rpId,\n      publicKey,\n    };\n  }\n  if (key.format === \"es256-raw\" && isText(key.keyId)) {\n    return { format: \"es256-raw\", keyId: key.keyId, publicKey };\n  }\n  return undefined;\n}\n\nexport function pairingDeviceOf(value: unknown): PairingDevice | undefined {\n  if (typeof value !== \"object\" || value === null) return undefined;\n  const device = value as Record<string, unknown>;\n  if (!isText(device.deviceId) || !isText(device.name) || !isText(device.platform)) {\n    return undefined;\n  }\n  if (!isPoint(device.signingKey)) return undefined;\n  return {\n    deviceId: device.deviceId,\n    name: device.name,\n    platform: device.platform,\n    signingKey: {\n      kty: \"EC\",\n      crv: \"P-256\",\n      x: device.signingKey.x,\n      y: device.signingKey.y,\n    },\n    presenceKey: presenceKeyOf(device.presenceKey),\n  };\n}\n"]}

package/dist/paths.d.ts

@@ -5,6 +5,8 @@ export interface HostPaths {
     readonly policy: string;
     readonly sessions: string;
     readonly agents: string;
+    /** What each agent last said about itself: its options and the account's allowance. */
+    readonly learned: string;
     readonly control: string;
     readonly proxy: string;
     readonly versions: string;

package/dist/paths.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../src/paths.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,kGAAkG;IAClG,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,wBAAgB,SAAS,CAAC,IAAI,GAAE,MAA2C,GAAG,SAAS,CAmBtF"}
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../src/paths.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,uFAAuF;IACvF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,kGAAkG;IAClG,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,wBAAgB,SAAS,CAAC,IAAI,GAAE,MAA2C,GAAG,SAAS,CAoBtF"}

package/dist/paths.js

@@ -10,6 +10,7 @@ export function hostPaths(root = join(homedir(), ".parlor", "host")) {
         policy: join(root, "policy.json"),
         sessions: join(root, "sessions.json"),
         agents: join(root, "agents.json"),
+        learned: join(root, "learned.json"),
         control: join(run, "control.sock"),
         proxy: join(run, "proxy.sock"),
         versions: join(root, "versions"),

package/dist/paths.js.map

@@ -1 +1 @@
-{"version":3,"file":"paths.js","sourceRoot":"","sources":["../src/paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAoB1C,MAAM,UAAU,SAAS,CAAC,IAAI,GAAW,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC;IACzE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACpC,OAAO;QACL,IAAI;QACJ,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC;QACjC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC;QAC/B,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC;QACjC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC;QACrC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC;QACjC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC;QAClC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC;QAC9B,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC;QAChC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC;QAC9B,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC;QAChC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;QACxB,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,cAAc,EAAE,uBAAuB,CAAC;QAC3E,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;KACjC,CAAC;AACJ,CAAC","sourcesContent":["import { homedir } from \"node:os\";\nimport { dirname, join } from \"node:path\";\n\nexport interface HostPaths {\n  readonly root: string;\n  readonly grants: string;\n  readonly trust: string;\n  readonly policy: string;\n  readonly sessions: string;\n  readonly agents: string;\n  readonly control: string;\n  readonly proxy: string;\n  readonly versions: string;\n  /** What the login item points at; a link into `versions/<version>/`, never into an app bundle. */\n  readonly current: string;\n  readonly lock: string;\n  readonly logs: string;\n  readonly launchAgent: string;\n  readonly workspaces: string;\n}\n\nexport function hostPaths(root: string = join(homedir(), \".parlor\", \"host\")): HostPaths {\n  const run = join(root, \"run\");\n  const home = dirname(dirname(root));\n  return {\n    root,\n    grants: join(root, \"grants.json\"),\n    trust: join(root, \"trust.json\"),\n    policy: join(root, \"policy.json\"),\n    sessions: join(root, \"sessions.json\"),\n    agents: join(root, \"agents.json\"),\n    control: join(run, \"control.sock\"),\n    proxy: join(run, \"proxy.sock\"),\n    versions: join(root, \"versions\"),\n    current: join(root, \"current\"),\n    lock: join(root, \"service.lock\"),\n    logs: join(root, \"logs\"),\n    launchAgent: join(home, \"Library\", \"LaunchAgents\", \"dev.parlor.host.plist\"),\n    workspaces: join(home, \"Parlor\"),\n  };\n}\n"]}
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../src/paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAsB1C,MAAM,UAAU,SAAS,CAAC,IAAI,GAAW,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC;IACzE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACpC,OAAO;QACL,IAAI;QACJ,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC;QACjC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC;QAC/B,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC;QACjC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC;QACrC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC;QACjC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC;QACnC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC;QAClC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC;QAC9B,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC;QAChC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC;QAC9B,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC;QAChC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;QACxB,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,cAAc,EAAE,uBAAuB,CAAC;QAC3E,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;KACjC,CAAC;AACJ,CAAC","sourcesContent":["import { homedir } from \"node:os\";\nimport { dirname, join } from \"node:path\";\n\nexport interface HostPaths {\n  readonly root: string;\n  readonly grants: string;\n  readonly trust: string;\n  readonly policy: string;\n  readonly sessions: string;\n  readonly agents: string;\n  /** What each agent last said about itself: its options and the account's allowance. */\n  readonly learned: string;\n  readonly control: string;\n  readonly proxy: string;\n  readonly versions: string;\n  /** What the login item points at; a link into `versions/<version>/`, never into an app bundle. */\n  readonly current: string;\n  readonly lock: string;\n  readonly logs: string;\n  readonly launchAgent: string;\n  readonly workspaces: string;\n}\n\nexport function hostPaths(root: string = join(homedir(), \".parlor\", \"host\")): HostPaths {\n  const run = join(root, \"run\");\n  const home = dirname(dirname(root));\n  return {\n    root,\n    grants: join(root, \"grants.json\"),\n    trust: join(root, \"trust.json\"),\n    policy: join(root, \"policy.json\"),\n    sessions: join(root, \"sessions.json\"),\n    agents: join(root, \"agents.json\"),\n    learned: join(root, \"learned.json\"),\n    control: join(run, \"control.sock\"),\n    proxy: join(run, \"proxy.sock\"),\n    versions: join(root, \"versions\"),\n    current: join(root, \"current\"),\n    lock: join(root, \"service.lock\"),\n    logs: join(root, \"logs\"),\n    launchAgent: join(home, \"Library\", \"LaunchAgents\", \"dev.parlor.host.plist\"),\n    workspaces: join(home, \"Parlor\"),\n  };\n}\n"]}

package/dist/policy.d.ts

@@ -19,6 +19,11 @@ export interface RemotePolicy {
     readonly promptPresence?: {
         readonly maxAgeHours: number;
     } | "off" | undefined;
+    /**
+     * `auto`: the agent's own safety review decides, asking only for what it flags, where the
+     * agent has one. `ask`: it asks before every action. Absent: `auto`.
+     */
+    readonly agentMode?: "auto" | "ask" | undefined;
 }
 export declare const DEFAULT_POLICY: RemotePolicy;
 export declare const DEV_POLICY: RemotePolicy;
@@ -29,8 +34,13 @@ export declare function presenceDueAt(policy: RemotePolicy, device: TrustedDevic
  * app's `confirm: true`, and asking twice only teaches users to click through.
  */
 export declare function isAppTool(ask: AgentAsk, appServer: string): boolean;
-/** The ask item's `approval`; `undefined` lets any trusted device answer without presence. */
-export declare function approvalFor(policy: RemotePolicy, ask: AgentAsk): "presence" | "computer" | undefined;
+/**
+ * The ask item's `approval`; `undefined` lets any trusted device answer without presence.
+ * Where presence is wanted, the browser that approved `connect` here answers its own turn's
+ * asks in the chat, since the loopback redirect put it on this computer; any other device
+ * without presence leaves them to this computer.
+ */
+export declare function approvalFor(policy: RemotePolicy, ask: AgentAsk, device?: Pick<TrustedDevice, "presenceKey" | "via">): "presence" | "computer" | "device" | undefined;
 /** `base` with the settings `parlor-host config` wrote to `file`; read afresh on every call. */
 export declare function loadPolicy(file: string, base: RemotePolicy): Promise<RemotePolicy>;
 export declare function changePolicy(file: string, base: RemotePolicy, change: Partial<RemotePolicy>): Promise<RemotePolicy>;

package/dist/policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,8FAA8F;IAC9F,QAAQ,CAAC,cAAc,EAAE,OAAO,GAAG,KAAK,CAAC;IACzC;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,UAAU,GAAG,UAAU,GAAG,KAAK,CAAC;IAClD;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE;QAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;KAAE,GAAG,KAAK,GAAG,SAAS,CAAC;CAChF;AAED,eAAO,MAAM,cAAc,EAAE,YAI5B,CAAC;AAEF,eAAO,MAAM,UAAU,EAAE,YAIxB,CAAC;AAEF,4FAA4F;AAC5F,wBAAgB,aAAa,CAC3B,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,aAAa,GACpB,MAAM,GAAG,SAAS,CAIpB;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAEnE;AAED,8FAA8F;AAC9F,wBAAgB,WAAW,CACzB,MAAM,EAAE,YAAY,EACpB,GAAG,EAAE,QAAQ,GACZ,UAAU,GAAG,UAAU,GAAG,SAAS,CAGrC;AAOD,gGAAgG;AAChG,wBAAsB,UAAU,CAC9B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,YAAY,CAAC,CAYvB;AAaD,wBAAsB,YAAY,CAChC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,YAAY,EAClB,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,GAC5B,OAAO,CAAC,YAAY,CAAC,CAGvB"}
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,8FAA8F;IAC9F,QAAQ,CAAC,cAAc,EAAE,OAAO,GAAG,KAAK,CAAC;IACzC;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,UAAU,GAAG,UAAU,GAAG,KAAK,CAAC;IAClD;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE;QAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;KAAE,GAAG,KAAK,GAAG,SAAS,CAAC;IAC/E;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,SAAS,CAAC;CACjD;AAED,eAAO,MAAM,cAAc,EAAE,YAK5B,CAAC;AAEF,eAAO,MAAM,UAAU,EAAE,YAKxB,CAAC;AAEF,4FAA4F;AAC5F,wBAAgB,aAAa,CAC3B,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,aAAa,GACpB,MAAM,GAAG,SAAS,CAIpB;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAEnE;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CACzB,MAAM,EAAE,YAAY,EACpB,GAAG,EAAE,QAAQ,EACb,MAAM,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,aAAa,GAAG,KAAK,CAAC,GAClD,UAAU,GAAG,UAAU,GAAG,QAAQ,GAAG,SAAS,CAKhD;AAOD,gGAAgG;AAChG,wBAAsB,UAAU,CAC9B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,YAAY,CAAC,CAiBvB;AAaD,wBAAsB,YAAY,CAChC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,YAAY,EAClB,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,GAC5B,OAAO,CAAC,YAAY,CAAC,CAGvB"}

package/dist/policy.js

@@ -3,11 +3,13 @@ export const DEFAULT_POLICY = {
     deviceApproval: "local",
     answers: "presence",
     promptPresence: { maxAgeHours: 18 },
+    agentMode: "auto",
 };
 export const DEV_POLICY = {
     deviceApproval: "off",
     answers: "off",
     promptPresence: "off",
+    agentMode: "auto",
 };
 /** When `device`'s prompts need Face ID or Touch ID again; undefined when they never do. */
 export function presenceDueAt(policy, device) {
@@ -23,11 +25,18 @@ export function presenceDueAt(policy, device) {
 export function isAppTool(ask, appServer) {
     return ask.kind === "permission" && ask.mcp?.server === appServer;
 }
-/** The ask item's `approval`; `undefined` lets any trusted device answer without presence. */
-export function approvalFor(policy, ask) {
+/**
+ * The ask item's `approval`; `undefined` lets any trusted device answer without presence.
+ * Where presence is wanted, the browser that approved `connect` here answers its own turn's
+ * asks in the chat, since the loopback redirect put it on this computer; any other device
+ * without presence leaves them to this computer.
+ */
+export function approvalFor(policy, ask, device) {
     if (ask.kind === "question" || policy.answers === "off")
         return undefined;
-    return policy.answers;
+    if (policy.answers === "computer" || !device || device.presenceKey)
+        return policy.answers;
+    return device.via === "pairing" ? "device" : "computer";
 }
 const choose = (allowed, value, base) => allowed.find((candidate) => candidate === value) ?? base;
 /** `base` with the settings `parlor-host config` wrote to `file`; read afresh on every call. */
@@ -43,6 +52,7 @@ export async function loadPolicy(file, base) {
         deviceApproval: choose(["local", "off"], overlay.deviceApproval, base.deviceApproval),
         answers: choose(["presence", "computer", "off"], overlay.answers, base.answers),
         promptPresence: promptPresenceOf(overlay.promptPresence, base.promptPresence),
+        agentMode: choose(["auto", "ask"], overlay.agentMode, base.agentMode ?? "auto"),
     };
 }
 function promptPresenceOf(value, base) {

package/dist/policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAsB1C,MAAM,CAAC,MAAM,cAAc,GAAiB;IAC1C,cAAc,EAAE,OAAO;IACvB,OAAO,EAAE,UAAU;IACnB,cAAc,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE;CACpC,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAiB;IACtC,cAAc,EAAE,KAAK;IACrB,OAAO,EAAE,KAAK;IACd,cAAc,EAAE,KAAK;CACtB,CAAC;AAEF,4FAA4F;AAC5F,MAAM,UAAU,aAAa,CAC3B,MAAoB,EACpB,MAAqB;IAErB,MAAM,OAAO,GAAG,MAAM,CAAC,cAAc,CAAC;IACtC,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,IAAI,CAAC,MAAM,CAAC,WAAW;QAAE,OAAO,SAAS,CAAC;IACxF,OAAO,CAAC,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;AACpF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,GAAa,EAAE,SAAiB;IACxD,OAAO,GAAG,CAAC,IAAI,KAAK,YAAY,IAAI,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,SAAS,CAAC;AACpE,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,WAAW,CACzB,MAAoB,EACpB,GAAa;IAEb,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC;IAC1E,OAAO,MAAM,CAAC,OAAO,CAAC;AACxB,CAAC;AAID,MAAM,MAAM,GAAG,CAAmB,OAAqB,EAAE,KAAc,EAAE,IAAO,EAAK,EAAE,CACrF,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC;AAE3D,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAAY,EACZ,IAAkB;IAElB,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,QAAQ,CAAU,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,cAAc,EAAE,MAAM,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC,cAAc,CAAC;QACrF,OAAO,EAAE,MAAM,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC;QAC/E,cAAc,EAAE,gBAAgB,CAAC,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC,cAAc,CAAC;KAC9E,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,KAAc,EACd,IAAoC;IAEpC,IAAI,KAAK,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAClC,MAAM,KAAK,GAAI,KAAmD,EAAE,WAAW,CAAC;IAChF,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;QACrE,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE;QACxB,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAY,EACZ,IAAkB,EAClB,MAA6B;IAE7B,MAAM,QAAQ,CAAU,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;IAClF,OAAO,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAChC,CAAC","sourcesContent":["import type { AgentAsk } from \"./acp.js\";\nimport { jsonFile } from \"./json-file.js\";\nimport type { TrustedDevice } from \"./trust.js\";\n\n/**\n * What this computer enforces on remote turns, whatever the app or its backend says. Set\n * only on this computer (`parlor-host config` or the Mac app's settings).\n */\nexport interface RemotePolicy {\n  /** `local`: an untrusted device is approved in a dialog here before its first prompt runs. */\n  readonly deviceApproval: \"local\" | \"off\";\n  /**\n   * Where an answer to the agent's own permission prompts counts: on any trusted device\n   * with presence, only on this computer, or (`parlor dev` only) anywhere.\n   */\n  readonly answers: \"presence\" | \"computer\" | \"off\";\n  /**\n   * How long a linked device with Face ID or Touch ID sends before its next prompt needs them\n   * again. Absent: never.\n   */\n  readonly promptPresence?: { readonly maxAgeHours: number } | \"off\" | undefined;\n}\n\nexport const DEFAULT_POLICY: RemotePolicy = {\n  deviceApproval: \"local\",\n  answers: \"presence\",\n  promptPresence: { maxAgeHours: 18 },\n};\n\nexport const DEV_POLICY: RemotePolicy = {\n  deviceApproval: \"off\",\n  answers: \"off\",\n  promptPresence: \"off\",\n};\n\n/** When `device`'s prompts need Face ID or Touch ID again; undefined when they never do. */\nexport function presenceDueAt(\n  policy: RemotePolicy,\n  device: TrustedDevice,\n): number | undefined {\n  const setting = policy.promptPresence;\n  if (setting === undefined || setting === \"off\" || !device.presenceKey) return undefined;\n  return (device.presenceAt ?? device.approvedAt) + setting.maxAgeHours * 3_600_000;\n}\n\n/**\n * The app's own tools are allowed once without asking: the server already enforces the\n * app's `confirm: true`, and asking twice only teaches users to click through.\n */\nexport function isAppTool(ask: AgentAsk, appServer: string): boolean {\n  return ask.kind === \"permission\" && ask.mcp?.server === appServer;\n}\n\n/** The ask item's `approval`; `undefined` lets any trusted device answer without presence. */\nexport function approvalFor(\n  policy: RemotePolicy,\n  ask: AgentAsk,\n): \"presence\" | \"computer\" | undefined {\n  if (ask.kind === \"question\" || policy.answers === \"off\") return undefined;\n  return policy.answers;\n}\n\ntype Overlay = { readonly [K in keyof RemotePolicy]?: unknown };\n\nconst choose = <T extends string>(allowed: readonly T[], value: unknown, base: T): T =>\n  allowed.find((candidate) => candidate === value) ?? base;\n\n/** `base` with the settings `parlor-host config` wrote to `file`; read afresh on every call. */\nexport async function loadPolicy(\n  file: string,\n  base: RemotePolicy,\n): Promise<RemotePolicy> {\n  let overlay: Overlay;\n  try {\n    overlay = await jsonFile<Overlay>(file).read();\n  } catch {\n    return base;\n  }\n  return {\n    deviceApproval: choose([\"local\", \"off\"], overlay.deviceApproval, base.deviceApproval),\n    answers: choose([\"presence\", \"computer\", \"off\"], overlay.answers, base.answers),\n    promptPresence: promptPresenceOf(overlay.promptPresence, base.promptPresence),\n  };\n}\n\nfunction promptPresenceOf(\n  value: unknown,\n  base: RemotePolicy[\"promptPresence\"],\n): RemotePolicy[\"promptPresence\"] {\n  if (value === \"off\") return \"off\";\n  const hours = (value as { readonly maxAgeHours?: unknown } | null)?.maxAgeHours;\n  return typeof hours === \"number\" && Number.isFinite(hours) && hours > 0\n    ? { maxAgeHours: hours }\n    : base;\n}\n\nexport async function changePolicy(\n  file: string,\n  base: RemotePolicy,\n  change: Partial<RemotePolicy>,\n): Promise<RemotePolicy> {\n  await jsonFile<Overlay>(file).change((overlay) => Object.assign(overlay, change));\n  return loadPolicy(file, base);\n}\n"]}
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AA2B1C,MAAM,CAAC,MAAM,cAAc,GAAiB;IAC1C,cAAc,EAAE,OAAO;IACvB,OAAO,EAAE,UAAU;IACnB,cAAc,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE;IACnC,SAAS,EAAE,MAAM;CAClB,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAiB;IACtC,cAAc,EAAE,KAAK;IACrB,OAAO,EAAE,KAAK;IACd,cAAc,EAAE,KAAK;IACrB,SAAS,EAAE,MAAM;CAClB,CAAC;AAEF,4FAA4F;AAC5F,MAAM,UAAU,aAAa,CAC3B,MAAoB,EACpB,MAAqB;IAErB,MAAM,OAAO,GAAG,MAAM,CAAC,cAAc,CAAC;IACtC,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,IAAI,CAAC,MAAM,CAAC,WAAW;QAAE,OAAO,SAAS,CAAC;IACxF,OAAO,CAAC,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;AACpF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,GAAa,EAAE,SAAiB;IACxD,OAAO,GAAG,CAAC,IAAI,KAAK,YAAY,IAAI,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,SAAS,CAAC;AACpE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CACzB,MAAoB,EACpB,GAAa,EACb,MAAmD;IAEnD,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC;IAC1E,IAAI,MAAM,CAAC,OAAO,KAAK,UAAU,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,WAAW;QAChE,OAAO,MAAM,CAAC,OAAO,CAAC;IACxB,OAAO,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC;AAC1D,CAAC;AAID,MAAM,MAAM,GAAG,CAAmB,OAAqB,EAAE,KAAc,EAAE,IAAO,EAAK,EAAE,CACrF,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC;AAE3D,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAAY,EACZ,IAAkB;IAElB,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,QAAQ,CAAU,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,cAAc,EAAE,MAAM,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC,cAAc,CAAC;QACrF,OAAO,EAAE,MAAM,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC;QAC/E,cAAc,EAAE,gBAAgB,CAAC,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC,cAAc,CAAC;QAC7E,SAAS,EAAE,MAAM,CACf,CAAC,MAAM,EAAE,KAAK,CAAU,EACxB,OAAO,CAAC,SAAS,EACjB,IAAI,CAAC,SAAS,IAAI,MAAM,CACzB;KACF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,KAAc,EACd,IAAoC;IAEpC,IAAI,KAAK,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAClC,MAAM,KAAK,GAAI,KAAmD,EAAE,WAAW,CAAC;IAChF,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;QACrE,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE;QACxB,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAY,EACZ,IAAkB,EAClB,MAA6B;IAE7B,MAAM,QAAQ,CAAU,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;IAClF,OAAO,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAChC,CAAC","sourcesContent":["import type { AgentAsk } from \"./acp.js\";\nimport { jsonFile } from \"./json-file.js\";\nimport type { TrustedDevice } from \"./trust.js\";\n\n/**\n * What this computer enforces on remote turns, whatever the app or its backend says. Set\n * only on this computer (`parlor-host config` or the Mac app's settings).\n */\nexport interface RemotePolicy {\n  /** `local`: an untrusted device is approved in a dialog here before its first prompt runs. */\n  readonly deviceApproval: \"local\" | \"off\";\n  /**\n   * Where an answer to the agent's own permission prompts counts: on any trusted device\n   * with presence, only on this computer, or (`parlor dev` only) anywhere.\n   */\n  readonly answers: \"presence\" | \"computer\" | \"off\";\n  /**\n   * How long a linked device with Face ID or Touch ID sends before its next prompt needs them\n   * again. Absent: never.\n   */\n  readonly promptPresence?: { readonly maxAgeHours: number } | \"off\" | undefined;\n  /**\n   * `auto`: the agent's own safety review decides, asking only for what it flags, where the\n   * agent has one. `ask`: it asks before every action. Absent: `auto`.\n   */\n  readonly agentMode?: \"auto\" | \"ask\" | undefined;\n}\n\nexport const DEFAULT_POLICY: RemotePolicy = {\n  deviceApproval: \"local\",\n  answers: \"presence\",\n  promptPresence: { maxAgeHours: 18 },\n  agentMode: \"auto\",\n};\n\nexport const DEV_POLICY: RemotePolicy = {\n  deviceApproval: \"off\",\n  answers: \"off\",\n  promptPresence: \"off\",\n  agentMode: \"auto\",\n};\n\n/** When `device`'s prompts need Face ID or Touch ID again; undefined when they never do. */\nexport function presenceDueAt(\n  policy: RemotePolicy,\n  device: TrustedDevice,\n): number | undefined {\n  const setting = policy.promptPresence;\n  if (setting === undefined || setting === \"off\" || !device.presenceKey) return undefined;\n  return (device.presenceAt ?? device.approvedAt) + setting.maxAgeHours * 3_600_000;\n}\n\n/**\n * The app's own tools are allowed once without asking: the server already enforces the\n * app's `confirm: true`, and asking twice only teaches users to click through.\n */\nexport function isAppTool(ask: AgentAsk, appServer: string): boolean {\n  return ask.kind === \"permission\" && ask.mcp?.server === appServer;\n}\n\n/**\n * The ask item's `approval`; `undefined` lets any trusted device answer without presence.\n * Where presence is wanted, the browser that approved `connect` here answers its own turn's\n * asks in the chat, since the loopback redirect put it on this computer; any other device\n * without presence leaves them to this computer.\n */\nexport function approvalFor(\n  policy: RemotePolicy,\n  ask: AgentAsk,\n  device?: Pick<TrustedDevice, \"presenceKey\" | \"via\">,\n): \"presence\" | \"computer\" | \"device\" | undefined {\n  if (ask.kind === \"question\" || policy.answers === \"off\") return undefined;\n  if (policy.answers === \"computer\" || !device || device.presenceKey)\n    return policy.answers;\n  return device.via === \"pairing\" ? \"device\" : \"computer\";\n}\n\ntype Overlay = { readonly [K in keyof RemotePolicy]?: unknown };\n\nconst choose = <T extends string>(allowed: readonly T[], value: unknown, base: T): T =>\n  allowed.find((candidate) => candidate === value) ?? base;\n\n/** `base` with the settings `parlor-host config` wrote to `file`; read afresh on every call. */\nexport async function loadPolicy(\n  file: string,\n  base: RemotePolicy,\n): Promise<RemotePolicy> {\n  let overlay: Overlay;\n  try {\n    overlay = await jsonFile<Overlay>(file).read();\n  } catch {\n    return base;\n  }\n  return {\n    deviceApproval: choose([\"local\", \"off\"], overlay.deviceApproval, base.deviceApproval),\n    answers: choose([\"presence\", \"computer\", \"off\"], overlay.answers, base.answers),\n    promptPresence: promptPresenceOf(overlay.promptPresence, base.promptPresence),\n    agentMode: choose(\n      [\"auto\", \"ask\"] as const,\n      overlay.agentMode,\n      base.agentMode ?? \"auto\",\n    ),\n  };\n}\n\nfunction promptPresenceOf(\n  value: unknown,\n  base: RemotePolicy[\"promptPresence\"],\n): RemotePolicy[\"promptPresence\"] {\n  if (value === \"off\") return \"off\";\n  const hours = (value as { readonly maxAgeHours?: unknown } | null)?.maxAgeHours;\n  return typeof hours === \"number\" && Number.isFinite(hours) && hours > 0\n    ? { maxAgeHours: hours }\n    : base;\n}\n\nexport async function changePolicy(\n  file: string,\n  base: RemotePolicy,\n  change: Partial<RemotePolicy>,\n): Promise<RemotePolicy> {\n  await jsonFile<Overlay>(file).change((overlay) => Object.assign(overlay, change));\n  return loadPolicy(file, base);\n}\n"]}

package/dist/prompter.d.ts

@@ -23,6 +23,11 @@ export interface LocalPrompter {
         readonly appName: string;
         readonly device: string;
     }): void;
+    /** Passive: the app ended this computer's connection, and the agents here lost it too. */
+    disconnected?(input: {
+        readonly appName: string;
+        readonly removedFrom?: string | undefined;
+    }): void;
 }
 export declare const printable: (text: string) => string;
 /** A `[y/N]` question on the terminal that ran a command; only yes is yes. */

package/dist/prompter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prompter.d.ts","sourceRoot":"","sources":["../src/prompter.ts"],"names":[],"mappings":"AAGA,8EAA8E;AAC9E,MAAM,WAAW,aAAa;IAC5B,yDAAyD;IACzD,UAAU,CAAC,KAAK,EAAE;QAChB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,OAAO,EAAE,SAAS;YAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QAC7E,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;KAC3C,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAChC,6FAA6F;IAC7F,WAAW,CAAC,KAAK,EAAE;QACjB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;KAC1B,GAAG,IAAI,CAAC;IACT,uDAAuD;IACvD,YAAY,CAAC,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CACnF;AAID,eAAO,MAAM,SAAS,SAAU,MAAM,WAAkC,CAAC;AAmBzE,8EAA8E;AAC9E,eAAO,MAAM,QAAQ,aAAoB,MAAM,KAAG,OAAO,CAAC,OAAO,CAChB,CAAC;AAElD,0DAA0D;AAC1D,wBAAgB,gBAAgB,IAAI,aAAa,CAsBhD;AAoDD,wBAAgB,iBAAiB,IAAI,aAAa,CAwCjD"}
+{"version":3,"file":"prompter.d.ts","sourceRoot":"","sources":["../src/prompter.ts"],"names":[],"mappings":"AAGA,8EAA8E;AAC9E,MAAM,WAAW,aAAa;IAC5B,yDAAyD;IACzD,UAAU,CAAC,KAAK,EAAE;QAChB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,OAAO,EAAE,SAAS;YAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QAC7E,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;KAC3C,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAChC,6FAA6F;IAC7F,WAAW,CAAC,KAAK,EAAE;QACjB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;KAC1B,GAAG,IAAI,CAAC;IACT,uDAAuD;IACvD,YAAY,CAAC,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAClF,0FAA0F;IAC1F,YAAY,CAAC,CAAC,KAAK,EAAE;QACnB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KAC3C,GAAG,IAAI,CAAC;CACV;AAID,eAAO,MAAM,SAAS,SAAU,MAAM,WAAkC,CAAC;AAmBzE,8EAA8E;AAC9E,eAAO,MAAM,QAAQ,aAAoB,MAAM,KAAG,OAAO,CAAC,OAAO,CAChB,CAAC;AAElD,0DAA0D;AAC1D,wBAAgB,gBAAgB,IAAI,aAAa,CA2BhD;AAoDD,wBAAgB,iBAAiB,IAAI,aAAa,CAyDjD"}

package/dist/prompter.js

@@ -30,6 +30,9 @@ export function terminalPrompter() {
             const answer = await ask(`${printable(agent)} for ${printable(appName)} asks: ${printable(question)}\n${menu}\nChoice: `);
             return choices[Number(answer?.trim()) - 1]?.id;
         },
+        disconnected: ({ appName, removedFrom }) => {
+            process.stdout.write(`${printable(appName)} disconnected this computer.${removedFrom ? ` Removed it from ${printable(removedFrom)}.` : ""}\n`);
+        },
         deviceLinked: ({ appName, device }) => {
             process.stdout.write(`${printable(device)} was linked to your agents for ${printable(appName)}.\n`);
         },
@@ -82,6 +85,18 @@ export function macDialogPrompter() {
                 clipped(`It can use your agents for ${appName}. Not you? Remove it under Devices in the app's Agent sidebar.`),
             ]);
         },
+        disconnected: ({ appName, removedFrom }) => {
+            void osascript([
+                "on run argv",
+                `display notification (item 2 of argv) with title "${DIALOG_TITLE}" subtitle (item 1 of argv)`,
+                "end run",
+            ], [
+                clipped(`${appName} disconnected this computer`),
+                clipped(removedFrom
+                    ? `Its sidebar and ${removedFrom} here can no longer use it.`
+                    : "Its sidebar can no longer use your agents here."),
+            ]);
+        },
         turnStarted: ({ appName, device, agent, preview }) => {
             void osascript([
                 "on run argv",

package/dist/prompter.js.map

@@ -1 +1 @@
-{"version":3,"file":"prompter.js","sourceRoot":"","sources":["../src/prompter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAuBhD,MAAM,WAAW,GAAG,wDAAwD,CAAC;AAE7E,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;AAEzE,SAAS,GAAG,CAAC,QAAgB;IAC3B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAChF,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE;YAClC,QAAQ,GAAG,IAAI,CAAC;YAChB,KAAK,CAAC,KAAK,EAAE,CAAC;YACd,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YACvB,IAAI,CAAC,QAAQ;gBAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,GAAG,GAAG,CAAC,MAA0B,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AAEnF,8EAA8E;AAC9E,MAAM,CAAC,MAAM,QAAQ,GAAG,KAAK,EAAE,QAAgB,EAAoB,EAAE,CACnE,GAAG,CAAC,MAAM,GAAG,CAAC,GAAG,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;AAElD,0DAA0D;AAC1D,MAAM,UAAU,gBAAgB;IAC9B,OAAO;QACL,UAAU,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE;YAC1D,MAAM,IAAI,GAAG,OAAO;iBACjB,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;iBAC9D,IAAI,CAAC,IAAI,CAAC,CAAC;YACd,MAAM,MAAM,GAAG,MAAM,GAAG,CACtB,GAAG,SAAS,CAAC,KAAK,CAAC,QAAQ,SAAS,CAAC,OAAO,CAAC,UAAU,SAAS,CAAC,QAAQ,CAAC,KAAK,IAAI,YAAY,CAChG,CAAC;YACF,OAAO,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC;QACjD,CAAC;QACD,YAAY,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE;YACpC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,SAAS,CAAC,MAAM,CAAC,kCAAkC,SAAS,CAAC,OAAO,CAAC,KAAK,CAC9E,CAAC;QACJ,CAAC;QACD,WAAW,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;YACnD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,SAAS,CAAC,KAAK,CAAC,mBAAmB,SAAS,CAAC,OAAO,CAAC,SAAS,SAAS,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC,OAAO,CAAC,IAAI,CAC9G,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,YAAY,GAAG,aAAa,CAAC;AACnC,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAC7B,MAAM,eAAe,GAAG,GAAG,CAAC;AAE5B,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,EAAE,CAC/B,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,eAAe;IACtC,CAAC,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,KAAK;IACnD,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AAEtB,SAAS,SAAS,CAChB,KAAwB,EACxB,IAAuB,EACvB,MAAoB;IAEpB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,QAAQ,CACN,WAAW,EACX,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,EACzD,EAAE,MAAM,EAAE,EACV,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAC9D,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CACb,IAAY,EACZ,MAAyB,EACzB,MAAoB;IAEpB,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACpC,OAAO,SAAS,CACd,MAAM,CAAC,MAAM,IAAI,kBAAkB;QACjC,CAAC,CAAC;YACE,aAAa;YACb,4DAA4D,YAAY,0BAA0B;YAClG,iCAAiC;YACjC,SAAS;SACV;QACH,CAAC,CAAC;YACE,aAAa;YACb,6DAA6D,YAAY,gCAAgC;YACzG,2CAA2C;YAC3C,yBAAyB;YACzB,SAAS;SACV,EACL,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,CAAC,EAC3B,MAAM,CACP,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,OAAO;QACL,UAAU,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE;YAClE,MAAM,KAAK,GAAG,MAAM,MAAM,CACxB,GAAG,KAAK,QAAQ,OAAO,UAAU,QAAQ,EAAE,EAC3C,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EACrC,MAAM,CACP,CAAC;YACF,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,EAAE,EAAE,CAAC;QACvE,CAAC;QACD,YAAY,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE;YACpC,KAAK,SAAS,CACZ;gBACE,aAAa;gBACb,qDAAqD,YAAY,6BAA6B;gBAC9F,SAAS;aACV,EACD;gBACE,OAAO,CAAC,GAAG,MAAM,aAAa,CAAC;gBAC/B,OAAO,CACL,8BAA8B,OAAO,gEAAgE,CACtG;aACF,CACF,CAAC;QACJ,CAAC;QACD,WAAW,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;YACnD,KAAK,SAAS,CACZ;gBACE,aAAa;gBACb,qDAAqD,YAAY,yDAAyD;gBAC1H,SAAS;aACV,EACD;gBACE,OAAO,CAAC,GAAG,KAAK,mBAAmB,OAAO,EAAE,CAAC;gBAC7C,OAAO,CAAC,MAAM,CAAC;gBACf,OAAO,CAAC,OAAO,CAAC;aACjB,CACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { execFile } from \"node:child_process\";\nimport { createInterface } from \"node:readline\";\n\n/** The computer's own surface, which no app, backend or web page can draw. */\nexport interface LocalPrompter {\n  /** The chosen option id, or undefined when dismissed. */\n  answerHere(input: {\n    readonly appName: string;\n    readonly agent: string;\n    readonly question: string;\n    readonly choices: readonly { readonly id: string; readonly label: string }[];\n    readonly signal?: AbortSignal | undefined;\n  }): Promise<string | undefined>;\n  /** Passive: a turn from another device started here; none for a browser on this computer. */\n  turnStarted(input: {\n    readonly appName: string;\n    readonly device: string;\n    readonly agent: string;\n    readonly preview: string;\n  }): void;\n  /** Passive: a device was linked to the agents here. */\n  deviceLinked?(input: { readonly appName: string; readonly device: string }): void;\n}\n\nconst UNPRINTABLE = /[\\p{Cc}\\u061c\\u200e\\u200f\\u202a-\\u202e\\u2066-\\u2069]/gu;\n\nexport const printable = (text: string) => text.replace(UNPRINTABLE, \"\");\n\nfunction ask(question: string): Promise<string | undefined> {\n  return new Promise((resolve) => {\n    const lines = createInterface({ input: process.stdin, output: process.stdout });\n    let answered = false;\n    lines.question(question, (answer) => {\n      answered = true;\n      lines.close();\n      resolve(answer);\n    });\n    lines.once(\"close\", () => {\n      if (!answered) resolve(undefined);\n    });\n  });\n}\n\nconst yes = (answer: string | undefined) => /^y(es)?$/i.test(answer?.trim() ?? \"\");\n\n/** A `[y/N]` question on the terminal that ran a command; only yes is yes. */\nexport const askYesNo = async (question: string): Promise<boolean> =>\n  yes(await ask(`${printable(question)} [y/N] `));\n\n/** Interactive `connect`: asks on the TTY that ran it. */\nexport function terminalPrompter(): LocalPrompter {\n  return {\n    answerHere: async ({ appName, agent, question, choices }) => {\n      const menu = choices\n        .map((choice, at) => `  ${at + 1}. ${printable(choice.label)}`)\n        .join(\"\\n\");\n      const answer = await ask(\n        `${printable(agent)} for ${printable(appName)} asks: ${printable(question)}\\n${menu}\\nChoice: `,\n      );\n      return choices[Number(answer?.trim()) - 1]?.id;\n    },\n    deviceLinked: ({ appName, device }) => {\n      process.stdout.write(\n        `${printable(device)} was linked to your agents for ${printable(appName)}.\\n`,\n      );\n    },\n    turnStarted: ({ appName, device, agent, preview }) => {\n      process.stdout.write(\n        `${printable(agent)} is working for ${printable(appName)} from ${printable(device)}: ${printable(preview)}\\n`,\n      );\n    },\n  };\n}\n\nconst DIALOG_TITLE = \"Parlor Host\";\nconst MAX_DIALOG_BUTTONS = 3;\nconst MAX_DIALOG_TEXT = 600;\n\nconst clipped = (text: string) =>\n  printable(text).length > MAX_DIALOG_TEXT\n    ? `${printable(text).slice(0, MAX_DIALOG_TEXT)}...`\n    : printable(text);\n\nfunction osascript(\n  lines: readonly string[],\n  args: readonly string[],\n  signal?: AbortSignal,\n): Promise<string | undefined> {\n  return new Promise((resolve) => {\n    execFile(\n      \"osascript\",\n      [...lines.flatMap((line) => [\"-e\", line]), \"--\", ...args],\n      { signal },\n      (error, stdout) => resolve(error ? undefined : stdout.trim()),\n    );\n  });\n}\n\nfunction choose(\n  text: string,\n  labels: readonly string[],\n  signal?: AbortSignal,\n): Promise<string | undefined> {\n  const options = labels.map(clipped);\n  return osascript(\n    labels.length <= MAX_DIALOG_BUTTONS\n      ? [\n          \"on run argv\",\n          `set reply to display dialog (item 1 of argv) with title \"${DIALOG_TITLE}\" buttons (rest of argv)`,\n          \"return button returned of reply\",\n          \"end run\",\n        ]\n      : [\n          \"on run argv\",\n          `set picked to choose from list (rest of argv) with title \"${DIALOG_TITLE}\" with prompt (item 1 of argv)`,\n          \"if picked is false then error number -128\",\n          \"return item 1 of picked\",\n          \"end run\",\n        ],\n    [clipped(text), ...options],\n    signal,\n  );\n}\n\nexport function macDialogPrompter(): LocalPrompter {\n  return {\n    answerHere: async ({ appName, agent, question, choices, signal }) => {\n      const label = await choose(\n        `${agent} for ${appName} asks: ${question}`,\n        choices.map((choice) => choice.label),\n        signal,\n      );\n      return choices.find((choice) => clipped(choice.label) === label)?.id;\n    },\n    deviceLinked: ({ appName, device }) => {\n      void osascript(\n        [\n          \"on run argv\",\n          `display notification (item 2 of argv) with title \"${DIALOG_TITLE}\" subtitle (item 1 of argv)`,\n          \"end run\",\n        ],\n        [\n          clipped(`${device} was linked`),\n          clipped(\n            `It can use your agents for ${appName}. Not you? Remove it under Devices in the app's Agent sidebar.`,\n          ),\n        ],\n      );\n    },\n    turnStarted: ({ appName, device, agent, preview }) => {\n      void osascript(\n        [\n          \"on run argv\",\n          `display notification (item 3 of argv) with title \"${DIALOG_TITLE}\" subtitle (item 1 of argv & \" from \" & item 2 of argv)`,\n          \"end run\",\n        ],\n        [\n          clipped(`${agent} is working for ${appName}`),\n          clipped(device),\n          clipped(preview),\n        ],\n      );\n    },\n  };\n}\n"]}
+{"version":3,"file":"prompter.js","sourceRoot":"","sources":["../src/prompter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AA4BhD,MAAM,WAAW,GAAG,wDAAwD,CAAC;AAE7E,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;AAEzE,SAAS,GAAG,CAAC,QAAgB;IAC3B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAChF,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE;YAClC,QAAQ,GAAG,IAAI,CAAC;YAChB,KAAK,CAAC,KAAK,EAAE,CAAC;YACd,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YACvB,IAAI,CAAC,QAAQ;gBAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,GAAG,GAAG,CAAC,MAA0B,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AAEnF,8EAA8E;AAC9E,MAAM,CAAC,MAAM,QAAQ,GAAG,KAAK,EAAE,QAAgB,EAAoB,EAAE,CACnE,GAAG,CAAC,MAAM,GAAG,CAAC,GAAG,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;AAElD,0DAA0D;AAC1D,MAAM,UAAU,gBAAgB;IAC9B,OAAO;QACL,UAAU,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE;YAC1D,MAAM,IAAI,GAAG,OAAO;iBACjB,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;iBAC9D,IAAI,CAAC,IAAI,CAAC,CAAC;YACd,MAAM,MAAM,GAAG,MAAM,GAAG,CACtB,GAAG,SAAS,CAAC,KAAK,CAAC,QAAQ,SAAS,CAAC,OAAO,CAAC,UAAU,SAAS,CAAC,QAAQ,CAAC,KAAK,IAAI,YAAY,CAChG,CAAC;YACF,OAAO,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC;QACjD,CAAC;QACD,YAAY,EAAE,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE;YACzC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,SAAS,CAAC,OAAO,CAAC,+BAA+B,WAAW,CAAC,CAAC,CAAC,oBAAoB,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,CACzH,CAAC;QACJ,CAAC;QACD,YAAY,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE;YACpC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,SAAS,CAAC,MAAM,CAAC,kCAAkC,SAAS,CAAC,OAAO,CAAC,KAAK,CAC9E,CAAC;QACJ,CAAC;QACD,WAAW,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;YACnD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,SAAS,CAAC,KAAK,CAAC,mBAAmB,SAAS,CAAC,OAAO,CAAC,SAAS,SAAS,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC,OAAO,CAAC,IAAI,CAC9G,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,YAAY,GAAG,aAAa,CAAC;AACnC,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAC7B,MAAM,eAAe,GAAG,GAAG,CAAC;AAE5B,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,EAAE,CAC/B,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,eAAe;IACtC,CAAC,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,KAAK;IACnD,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AAEtB,SAAS,SAAS,CAChB,KAAwB,EACxB,IAAuB,EACvB,MAAoB;IAEpB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,QAAQ,CACN,WAAW,EACX,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,EACzD,EAAE,MAAM,EAAE,EACV,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAC9D,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CACb,IAAY,EACZ,MAAyB,EACzB,MAAoB;IAEpB,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACpC,OAAO,SAAS,CACd,MAAM,CAAC,MAAM,IAAI,kBAAkB;QACjC,CAAC,CAAC;YACE,aAAa;YACb,4DAA4D,YAAY,0BAA0B;YAClG,iCAAiC;YACjC,SAAS;SACV;QACH,CAAC,CAAC;YACE,aAAa;YACb,6DAA6D,YAAY,gCAAgC;YACzG,2CAA2C;YAC3C,yBAAyB;YACzB,SAAS;SACV,EACL,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,CAAC,EAC3B,MAAM,CACP,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,OAAO;QACL,UAAU,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE;YAClE,MAAM,KAAK,GAAG,MAAM,MAAM,CACxB,GAAG,KAAK,QAAQ,OAAO,UAAU,QAAQ,EAAE,EAC3C,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EACrC,MAAM,CACP,CAAC;YACF,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,EAAE,EAAE,CAAC;QACvE,CAAC;QACD,YAAY,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE;YACpC,KAAK,SAAS,CACZ;gBACE,aAAa;gBACb,qDAAqD,YAAY,6BAA6B;gBAC9F,SAAS;aACV,EACD;gBACE,OAAO,CAAC,GAAG,MAAM,aAAa,CAAC;gBAC/B,OAAO,CACL,8BAA8B,OAAO,gEAAgE,CACtG;aACF,CACF,CAAC;QACJ,CAAC;QACD,YAAY,EAAE,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE;YACzC,KAAK,SAAS,CACZ;gBACE,aAAa;gBACb,qDAAqD,YAAY,6BAA6B;gBAC9F,SAAS;aACV,EACD;gBACE,OAAO,CAAC,GAAG,OAAO,6BAA6B,CAAC;gBAChD,OAAO,CACL,WAAW;oBACT,CAAC,CAAC,mBAAmB,WAAW,6BAA6B;oBAC7D,CAAC,CAAC,iDAAiD,CACtD;aACF,CACF,CAAC;QACJ,CAAC;QACD,WAAW,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;YACnD,KAAK,SAAS,CACZ;gBACE,aAAa;gBACb,qDAAqD,YAAY,yDAAyD;gBAC1H,SAAS;aACV,EACD;gBACE,OAAO,CAAC,GAAG,KAAK,mBAAmB,OAAO,EAAE,CAAC;gBAC7C,OAAO,CAAC,MAAM,CAAC;gBACf,OAAO,CAAC,OAAO,CAAC;aACjB,CACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { execFile } from \"node:child_process\";\nimport { createInterface } from \"node:readline\";\n\n/** The computer's own surface, which no app, backend or web page can draw. */\nexport interface LocalPrompter {\n  /** The chosen option id, or undefined when dismissed. */\n  answerHere(input: {\n    readonly appName: string;\n    readonly agent: string;\n    readonly question: string;\n    readonly choices: readonly { readonly id: string; readonly label: string }[];\n    readonly signal?: AbortSignal | undefined;\n  }): Promise<string | undefined>;\n  /** Passive: a turn from another device started here; none for a browser on this computer. */\n  turnStarted(input: {\n    readonly appName: string;\n    readonly device: string;\n    readonly agent: string;\n    readonly preview: string;\n  }): void;\n  /** Passive: a device was linked to the agents here. */\n  deviceLinked?(input: { readonly appName: string; readonly device: string }): void;\n  /** Passive: the app ended this computer's connection, and the agents here lost it too. */\n  disconnected?(input: {\n    readonly appName: string;\n    readonly removedFrom?: string | undefined;\n  }): void;\n}\n\nconst UNPRINTABLE = /[\\p{Cc}\\u061c\\u200e\\u200f\\u202a-\\u202e\\u2066-\\u2069]/gu;\n\nexport const printable = (text: string) => text.replace(UNPRINTABLE, \"\");\n\nfunction ask(question: string): Promise<string | undefined> {\n  return new Promise((resolve) => {\n    const lines = createInterface({ input: process.stdin, output: process.stdout });\n    let answered = false;\n    lines.question(question, (answer) => {\n      answered = true;\n      lines.close();\n      resolve(answer);\n    });\n    lines.once(\"close\", () => {\n      if (!answered) resolve(undefined);\n    });\n  });\n}\n\nconst yes = (answer: string | undefined) => /^y(es)?$/i.test(answer?.trim() ?? \"\");\n\n/** A `[y/N]` question on the terminal that ran a command; only yes is yes. */\nexport const askYesNo = async (question: string): Promise<boolean> =>\n  yes(await ask(`${printable(question)} [y/N] `));\n\n/** Interactive `connect`: asks on the TTY that ran it. */\nexport function terminalPrompter(): LocalPrompter {\n  return {\n    answerHere: async ({ appName, agent, question, choices }) => {\n      const menu = choices\n        .map((choice, at) => `  ${at + 1}. ${printable(choice.label)}`)\n        .join(\"\\n\");\n      const answer = await ask(\n        `${printable(agent)} for ${printable(appName)} asks: ${printable(question)}\\n${menu}\\nChoice: `,\n      );\n      return choices[Number(answer?.trim()) - 1]?.id;\n    },\n    disconnected: ({ appName, removedFrom }) => {\n      process.stdout.write(\n        `${printable(appName)} disconnected this computer.${removedFrom ? ` Removed it from ${printable(removedFrom)}.` : \"\"}\\n`,\n      );\n    },\n    deviceLinked: ({ appName, device }) => {\n      process.stdout.write(\n        `${printable(device)} was linked to your agents for ${printable(appName)}.\\n`,\n      );\n    },\n    turnStarted: ({ appName, device, agent, preview }) => {\n      process.stdout.write(\n        `${printable(agent)} is working for ${printable(appName)} from ${printable(device)}: ${printable(preview)}\\n`,\n      );\n    },\n  };\n}\n\nconst DIALOG_TITLE = \"Parlor Host\";\nconst MAX_DIALOG_BUTTONS = 3;\nconst MAX_DIALOG_TEXT = 600;\n\nconst clipped = (text: string) =>\n  printable(text).length > MAX_DIALOG_TEXT\n    ? `${printable(text).slice(0, MAX_DIALOG_TEXT)}...`\n    : printable(text);\n\nfunction osascript(\n  lines: readonly string[],\n  args: readonly string[],\n  signal?: AbortSignal,\n): Promise<string | undefined> {\n  return new Promise((resolve) => {\n    execFile(\n      \"osascript\",\n      [...lines.flatMap((line) => [\"-e\", line]), \"--\", ...args],\n      { signal },\n      (error, stdout) => resolve(error ? undefined : stdout.trim()),\n    );\n  });\n}\n\nfunction choose(\n  text: string,\n  labels: readonly string[],\n  signal?: AbortSignal,\n): Promise<string | undefined> {\n  const options = labels.map(clipped);\n  return osascript(\n    labels.length <= MAX_DIALOG_BUTTONS\n      ? [\n          \"on run argv\",\n          `set reply to display dialog (item 1 of argv) with title \"${DIALOG_TITLE}\" buttons (rest of argv)`,\n          \"return button returned of reply\",\n          \"end run\",\n        ]\n      : [\n          \"on run argv\",\n          `set picked to choose from list (rest of argv) with title \"${DIALOG_TITLE}\" with prompt (item 1 of argv)`,\n          \"if picked is false then error number -128\",\n          \"return item 1 of picked\",\n          \"end run\",\n        ],\n    [clipped(text), ...options],\n    signal,\n  );\n}\n\nexport function macDialogPrompter(): LocalPrompter {\n  return {\n    answerHere: async ({ appName, agent, question, choices, signal }) => {\n      const label = await choose(\n        `${agent} for ${appName} asks: ${question}`,\n        choices.map((choice) => choice.label),\n        signal,\n      );\n      return choices.find((choice) => clipped(choice.label) === label)?.id;\n    },\n    deviceLinked: ({ appName, device }) => {\n      void osascript(\n        [\n          \"on run argv\",\n          `display notification (item 2 of argv) with title \"${DIALOG_TITLE}\" subtitle (item 1 of argv)`,\n          \"end run\",\n        ],\n        [\n          clipped(`${device} was linked`),\n          clipped(\n            `It can use your agents for ${appName}. Not you? Remove it under Devices in the app's Agent sidebar.`,\n          ),\n        ],\n      );\n    },\n    disconnected: ({ appName, removedFrom }) => {\n      void osascript(\n        [\n          \"on run argv\",\n          `display notification (item 2 of argv) with title \"${DIALOG_TITLE}\" subtitle (item 1 of argv)`,\n          \"end run\",\n        ],\n        [\n          clipped(`${appName} disconnected this computer`),\n          clipped(\n            removedFrom\n              ? `Its sidebar and ${removedFrom} here can no longer use it.`\n              : \"Its sidebar can no longer use your agents here.\",\n          ),\n        ],\n      );\n    },\n    turnStarted: ({ appName, device, agent, preview }) => {\n      void osascript(\n        [\n          \"on run argv\",\n          `display notification (item 3 of argv) with title \"${DIALOG_TITLE}\" subtitle (item 1 of argv & \" from \" & item 2 of argv)`,\n          \"end run\",\n        ],\n        [\n          clipped(`${agent} is working for ${appName}`),\n          clipped(device),\n          clipped(preview),\n        ],\n      );\n    },\n  };\n}\n"]}

package/dist/spec-kit.d.ts

@@ -9,7 +9,8 @@ export declare class Browser {
     readonly origin: string;
     constructor(origin: string);
     fetch(url: string, init?: RequestInit): Promise<Response>;
-    consent(url: string, decision: "connect" | "cancel"): Promise<{
+    /** Answers the consent page as a browser would, sending its checked boxes but `uncheck`. */
+    consent(url: string, decision: "connect" | "cancel", uncheck?: readonly string[]): Promise<{
         readonly page: string;
         readonly answer: Response;
     }>;
@@ -65,6 +66,8 @@ export declare const welcome: {
 export declare function hostRoutes(options: {
     readonly wake: boolean;
     readonly turn?: () => unknown;
+    /** Pushed on the stream's `chat` channel, as a server on host protocol 3 does. */
+    readonly push?: () => unknown;
 }): Route;
 export declare const claimedTurn: (turnId: string, agentId: string, context: string, text: string) => {
     id: string;

package/dist/spec-kit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"spec-kit.d.ts","sourceRoot":"","sources":["../src/spec-kit.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,eAAe,EAEpB,KAAK,cAAc,EACpB,MAAM,WAAW,CAAC;AAYnB,OAAO,EACL,KAAK,YAAY,EAEjB,KAAK,aAAa,EAClB,KAAK,YAAY,EAClB,MAAM,cAAc,CAAC;AAKtB,OAAO,EAEL,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AAQxB,OAAO,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE5D,eAAO,MAAM,QAAQ,iCAAiC,CAAC;AAIvD,qBAAa,OAAO;;IAGN,QAAQ,CAAC,MAAM,EAAE,MAAM;IAAnC,YAAqB,MAAM,EAAE,MAAM,EAAI;IAEjC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,WAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAqBlE;IAEK,OAAO,CACX,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,SAAS,GAAG,QAAQ,GAC7B,OAAO,CAAC;QACT,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;KAC3B,CAAC,CAeD;CACF;AAED,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,wBAAsB,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC,CAsErD;AAED,wBAAgB,cAAc,IAAI,QAAQ,GAAG;IAC3C,QAAQ,CAAC,OAAO,EAAE,MAAM,SAAS,MAAM,EAAE,CAAC;CAC3C,CAyCA;AAED,wBAAgB,WAAW,IAAI,UAAU,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,aAAa,EAAE,CAAA;CAAE,CAuBnF;AAID,qBAAa,UAAU;IAEnB,QAAQ,CAAC,IAAI,EAAE,UAAU;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAH3B,OAAO,eAIH;IAEJ,OAAa,MAAM,CACjB,EAAE,SAAa,EACf,IAAI,SAAoB,EACxB,QAAQ,SAAQ,GACf,OAAO,CAAC,UAAU,CAAC,CA6BrB;IAED,IAAI,EAAE,oCAEL;YAEa,IAAI;IAmBZ,UAAU,CACd,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,YAAY,EACpB,EAAE,EAAE,MAAM,EACV,QAAQ,UAAQ,GACf,OAAO,CAAC,aAAa,CAAC,CAQxB;IAEK,UAAU,CACd,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,YAAY,EACpB,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE,OAAO,GAChB,OAAO,CAAC,aAAa,CAAC,CAQxB;IAED,iGAAiG;IAC3F,QAAQ,CACZ,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,UAAU,EAClB,EAAE,EAAE,MAAM,EACV,OAAO,GAAE;QAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAO,GAC1E,OAAO,CAAC,WAAW,CAAC,CAiBtB;CACF;AAED,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE;QACb,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;KACvB,EAAE,CAAC;IACJ,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,MAAM,MAAM,KAAK,GAAG,CAClB,OAAO,EAAE,eAAe,EACxB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,cAAc,KACrB,OAAO,CAAC;AAEb,wBAAsB,OAAO,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAsB5D;AAED,eAAO,MAAM,IAAI,aAAc,cAAc,SAAS,OAAO,qDAG9B,CAAC;AAEhC,eAAO,MAAM,OAAO;;;;;;CAMnB,CAAC;AAEF,wBAAgB,UAAU,CAAC,OAAO,EAAE;IAClC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,OAAO,CAAC;CAC/B,GAAG,KAAK,CAyER;AAED,eAAO,MAAM,WAAW,WACd,MAAM,WACL,MAAM,WACN,MAAM,QACT,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;QAkBH,KAAK;QAAY,SAAS;;;CAEnC,CAAC;AAEH,eAAO,MAAM,QAAQ,WAAY,MAAM,QAAQ,MAAM,aAAa,MAAM,KAAG,QAQzE,CAAC"}
+{"version":3,"file":"spec-kit.d.ts","sourceRoot":"","sources":["../src/spec-kit.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,eAAe,EAEpB,KAAK,cAAc,EACpB,MAAM,WAAW,CAAC;AAYnB,OAAO,EACL,KAAK,YAAY,EAEjB,KAAK,aAAa,EAClB,KAAK,YAAY,EAClB,MAAM,cAAc,CAAC;AAKtB,OAAO,EAEL,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AAQxB,OAAO,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE5D,eAAO,MAAM,QAAQ,iCAAiC,CAAC;AAIvD,qBAAa,OAAO;;IAGN,QAAQ,CAAC,MAAM,EAAE,MAAM;IAAnC,YAAqB,MAAM,EAAE,MAAM,EAAI;IAEjC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,WAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAqBlE;IAED,4FAA4F;IACtF,OAAO,CACX,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,SAAS,GAAG,QAAQ,EAC9B,OAAO,GAAE,SAAS,MAAM,EAAO,GAC9B,OAAO,CAAC;QACT,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;KAC3B,CAAC,CAoBD;CACF;AAED,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,wBAAsB,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC,CAsErD;AAED,wBAAgB,cAAc,IAAI,QAAQ,GAAG;IAC3C,QAAQ,CAAC,OAAO,EAAE,MAAM,SAAS,MAAM,EAAE,CAAC;CAC3C,CAyCA;AAED,wBAAgB,WAAW,IAAI,UAAU,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,aAAa,EAAE,CAAA;CAAE,CAuBnF;AAID,qBAAa,UAAU;IAEnB,QAAQ,CAAC,IAAI,EAAE,UAAU;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAH3B,OAAO,eAIH;IAEJ,OAAa,MAAM,CACjB,EAAE,SAAa,EACf,IAAI,SAAoB,EACxB,QAAQ,SAAQ,GACf,OAAO,CAAC,UAAU,CAAC,CA6BrB;IAED,IAAI,EAAE,oCAEL;YAEa,IAAI;IAmBZ,UAAU,CACd,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,YAAY,EACpB,EAAE,EAAE,MAAM,EACV,QAAQ,UAAQ,GACf,OAAO,CAAC,aAAa,CAAC,CAQxB;IAEK,UAAU,CACd,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,YAAY,EACpB,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE,OAAO,GAChB,OAAO,CAAC,aAAa,CAAC,CAQxB;IAED,iGAAiG;IAC3F,QAAQ,CACZ,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,UAAU,EAClB,EAAE,EAAE,MAAM,EACV,OAAO,GAAE;QAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAO,GAC1E,OAAO,CAAC,WAAW,CAAC,CAiBtB;CACF;AAED,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE;QACb,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;KACvB,EAAE,CAAC;IACJ,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,MAAM,MAAM,KAAK,GAAG,CAClB,OAAO,EAAE,eAAe,EACxB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,cAAc,KACrB,OAAO,CAAC;AAEb,wBAAsB,OAAO,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAsB5D;AAED,eAAO,MAAM,IAAI,aAAc,cAAc,SAAS,OAAO,qDAG9B,CAAC;AAEhC,eAAO,MAAM,OAAO;;;;;;CAMnB,CAAC;AAEF,wBAAgB,UAAU,CAAC,OAAO,EAAE;IAClC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,OAAO,CAAC;IAC9B,kFAAkF;IAClF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,OAAO,CAAC;CAC/B,GAAG,KAAK,CA8ER;AAED,eAAO,MAAM,WAAW,WACd,MAAM,WACL,MAAM,WACN,MAAM,QACT,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;QAkBH,KAAK;QAAY,SAAS;;;CAEnC,CAAC;AAEH,eAAO,MAAM,QAAQ,WAAY,MAAM,QAAQ,MAAM,aAAa,MAAM,KAAG,QAQzE,CAAC"}

package/dist/spec-kit.js

@@ -40,9 +40,14 @@ export class Browser {
         }
         return response;
     }
-    async consent(url, decision) {
+    /** Answers the consent page as a browser would, sending its checked boxes but `uncheck`. */
+    async consent(url, decision, uncheck = []) {
         const page = await (await this.fetch(url)).text();
         const fields = new URLSearchParams([...page.matchAll(/<input type="hidden" name="([^"]+)" value="([^"]*)">/g)].map((match) => [match[1], match[2].replaceAll("&amp;", "&")]));
+        for (const [, name, value] of page.matchAll(/<input type="checkbox" name="([^"]+)" value="([^"]*)" checked>/g)) {
+            if (!uncheck.includes(name))
+                fields.set(name, value);
+        }
         fields.set("decision", decision);
         const action = /<form method="post" action="([^"]+)"/.exec(page)?.[1] ?? "";
         const answer = await this.fetch(action, {
@@ -315,7 +320,12 @@ export function hostRoutes(options) {
         }
         if (path === "/_parlor/sync/stream") {
             response.writeHead(200, { "content-type": "text/event-stream" });
-            response.write(`event: handshake\ndata: ${JSON.stringify({ capabilities: [], keepAliveMs: 10_000 })}\n\n`);
+            const capabilities = options.push ? ["chat"] : [];
+            response.write(`event: handshake\ndata: ${JSON.stringify({ capabilities, keepAliveMs: 10_000 })}\n\n`);
+            if (options.push) {
+                const frame = { type: "claimed", turn: options.push() };
+                response.write(`event: chat\ndata: ${JSON.stringify(frame)}\n\n`);
+            }
             if (options.wake) {
                 const events = [{ version: 1, id: "e1", tags: [["parlor_chat", "t1"]] }];
                 response.write(`event: message\ndata: ${JSON.stringify({ events, cursor: "1.e1" })}\n\n`);