@pellux/goodvibes-tui 1.26.0 → 1.27.0

package/src/runtime/services.ts

@@ -55,6 +55,10 @@ import { createWorkstreamServices } from './workstream-services.ts';
 import { wireFleetNeedsInputPush } from './fleet-needs-input-push.ts';
 import { codeIndexDbPath, createCodeIndexServices, createStoreRerooter, isCodeInjectionSettingEnabled } from './code-index-services.ts';
 import { createDaemonHandlerComposition } from './daemon-handler-composition.ts';
+import { createDevicePostureServices } from './device-posture-composition.ts';
+// Re-exported so the shell's bootstrap reaches the install through the same
+// module it already imports the runtime graph from.
+export { installDevicePosture } from './device-posture-composition.ts';
 import { createClusterServices, startClusterServices } from './cluster-group-composition.ts';
 import { WorkspaceTrustManager } from './trust/workspace-trust.ts';
 import { ensureConfiguredModelIsRoutable } from './provider-fallback.ts';
@@ -159,8 +163,24 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     join(surface.sessionsDir, 'task-graph.json'),
   );
   const hookActivityTracker = new HookActivityTracker();
+  // featureFlags is REQUIRED here in practice, even though the SDK types it
+  // optional. isFeatureGateEnabled(null, ...) is permissive by design — a
+  // narrow embed with no manager wired gets the capability rather than a
+  // silent off — so omitting it did not disable the watcher framework when
+  // watchers.enabled is turned off; it made the setting configure nothing.
+  // Threading it preserves current effective behaviour rather than changing
+  // it: watchers.enabled defaults true, the watcher-framework flag's own
+  // defaultState is 'enabled', and the flag declares no notOperable record —
+  // so with nothing configured the gate reads exactly as before, and the
+  // difference is only that turning it OFF now turns it off. This composes
+  // with bootstrap-core.ts's own `if (configManager.get('watchers.enabled'))`
+  // check around the built-in polling watcher registration: that check reads
+  // the same key, so the two never disagree, and this fix only reaches the
+  // watcher registry's OTHER entry points (registerWatcher/startWatcher/etc.)
+  // that bootstrap-core.ts's narrower check does not cover.
   const watcherRegistry = new WatcherRegistry({
     storePath: shellPaths.resolveProjectPath('tui', 'watchers.json'),
+    featureFlags,
   });
   watcherRegistry.attachRuntime({
     runtimeStore: options.runtimeStore,
@@ -223,6 +243,15 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
   // modal): bootstrap.ts activates the wire transport when a compatible
   // external daemon is adopted, same signal as the session spine.
   const memorySpine = new MemorySpineClient({ local: createLocalMemoryAccess(memoryRegistry) });
+  // featureFlags is REQUIRED here in practice, even though the SDK types it
+  // optional. isFeatureGateEnabled(null, ...) is permissive by design, so
+  // omitting it did not disable delivery tracking when
+  // integrations.deliveryTracking is turned off — it made the setting
+  // configure nothing: deliverText/deliverJobRun kept running either way.
+  // Threading it preserves current effective behaviour rather than changing
+  // it: the config default is true, the delivery-engine flag's own
+  // defaultState is 'enabled', and the flag declares no notOperable record —
+  // so with nothing configured the gate reads exactly as before.
   const deliveryManager = new AutomationDeliveryManager({
     configManager,
     // This manager builds the delivery router the daemon actually replies
@@ -236,7 +265,20 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     runtimeStore: options.runtimeStore,
     routeBindings,
     artifactStore,
+    featureFlags,
   });
+  // Same shape as deliveryManager above: automation.enabled defaults true,
+  // the automation-domain flag's own defaultState is 'enabled', so threading
+  // featureFlags here does not change what a default install does — it only
+  // makes turning automation.enabled off actually turn AutomationManager's own
+  // create/update/run/list surface off. This composes with bootstrap.ts's own
+  // `if (configManager.get('automation.enabled'))` gate around scheduling
+  // automationManager.start(): that check reads the same key, and
+  // AutomationManager.start() re-checks the same gate internally (it no-ops
+  // and stops rather than starting when disabled), so the two can never
+  // disagree — this fix only reaches the manager's OTHER entry points
+  // (createJob/updateJob/runNow/etc.) that the bootstrap.ts gate does not
+  // cover, the same way watchers.enabled and the watcher registry above do.
   const automationManager = new AutomationManager({
     configManager,
     defaultSurfaceKind: 'tui',
@@ -248,6 +290,7 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     // Same live registry: a bare model id on an automation job resolves through
     // the shared resolver instead of a format-only rejection.
     providerRegistry,
+    featureFlags,
     spawnTask: (input) => {
       const record = agentManager.spawn({
         mode: 'spawn',
@@ -309,6 +352,16 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     approvalBridge: approvalBroker,
     automationBridge: automationManager,
   });
+  // The paired-phone feature for this host, on the SAME runtime phones pair onto
+  // and the SAME approval broker every other confirmation rides. Every `device.*`
+  // setting is read live through this; see device-posture-composition.ts.
+  const { devicePosture } = createDevicePostureServices({
+    configManager,
+    distributedRuntime,
+    approvals: approvalBroker,
+    stateDirectory: shellPaths.resolveProjectPath('tui', 'devices'),
+    gatewayMethods,
+  });
 
   // Which machines on this network are "us", and which of them reads the
   // shared inbox. Both inert until startCluster() — no socket, no key material
@@ -334,7 +387,18 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     = createRemoteExecutionServices({
       agentManager, workingDirectory, hookDispatcher, configManager, runtimeBus: options.runtimeBus,
     });
-  const tokenAuditor = new ApiTokenAuditor({ managed: false });
+  // featureFlags is REQUIRED here in practice, even though the SDK types it
+  // optional. isFeatureGateEnabled(null, ...) is permissive by design, so
+  // omitting it did not disable managed blocking when
+  // security.tokenAudit.enabled is turned off. Threading it preserves current
+  // effective behaviour rather than changing it: managed is hardcoded false
+  // here (advisory reporting only; excess-scope/overdue tokens are reported,
+  // never blocked, regardless of this flag — see isBlocked()'s
+  // `this._config.managed && this._managedBlockingEnabled()` guard), the
+  // config default for security.tokenAudit.enabled is true, and the
+  // token-scope-rotation-audit flag's own defaultState is 'enabled' — so with
+  // nothing configured the gate reads exactly as before either way.
+  const tokenAuditor = new ApiTokenAuditor({ managed: false, featureFlags });
   const componentHealthMonitor = new ComponentHealthMonitor();
   const worktreeRegistry = new WorktreeRegistry(workingDirectory);
   const webhookNotifier = new WebhookNotifier();
@@ -386,7 +450,15 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     runtimeBus: options.runtimeBus,
     observeExternalAgents: options.observeExternalAgents, providerRegistry, // observeExternalAgents is daemon-side only
   });
-  const modeManager = new ModeManager(); const fileUndoManager = new FileUndoManager();
+  // featureFlags is REQUIRED here in practice, even though the SDK types it
+  // optional. isFeatureGateEnabled(null, ...) is permissive by design, so
+  // omitting it did not disable the HITL UX mode system when
+  // behavior.hitlMode is set to 'off' — setHITLMode/setDomainVerbosity kept
+  // accepting writes either way. Threading it preserves current effective
+  // behaviour rather than changing it: behavior.hitlMode defaults to
+  // 'balanced' (not 'off'), and the hitl-ux-modes flag's own defaultState is
+  // 'enabled' — so with nothing configured the gate reads exactly as before.
+  const modeManager = new ModeManager({ featureFlags }); const fileUndoManager = new FileUndoManager();
   const workspaceCheckpointManager = createWorkspaceCheckpointing({ workspaceRoot: workingDirectory, surface, runtimeBus: options.runtimeBus, configManager });
   // memory-consolidation honors governor backpressure: it ticks only when idle
   // AND the 'memory-consolidation' job is not paused AND expensive work is
@@ -414,7 +486,11 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
 
   // Managed local-voice provisioning (voice.local.status/install) — single-flight
   // one-act install + no-network status; see voice-setup-services.ts.
-  const { voiceSetup } = wireVoiceSetup({ configManager, shellPaths, voiceProviders, admitExpensiveWork });
+  const { voiceSetup, stopWakeHousekeeping } = wireVoiceSetup({ configManager, shellPaths, voiceProviders, admitExpensiveWork,
+    // Boot provisioning of the wake-word model + its recovery sweep, opted into
+    // by the real entrypoints only (same treatment as powerSeam) so a one-shot
+    // CLI command and a test composing this graph fetch nothing and start no timer.
+    provisionWakeModelsAtBoot: options.provisionWakeModelsAtBoot === true });
 
   // Terminal-shell wrapper over the SDK registerGatewayVerbGroups (gateway-verbs.ts); checkin.*/fleet-needs-input/pairing.* register only when their deps are present. memoryGovernor lights up ops.memory.get; voiceSetup lights up voice.local.status/install.
   // calendar.*/email.* are platform-served; these two let it register (mail-composition.ts).
@@ -552,6 +628,7 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     providerRegistry,
     toolLLM,
     distributedRuntime,
+    devicePosture,
     daemonHandlers,
     clusterCoordinator,
     clusterGroup,
@@ -577,7 +654,7 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     workstreamCommands,
     codeIndexStore,
     codeIndexReindexScheduler,
-    storeSnapshotScheduler, appendOnlyRetentionScheduler, stopDurabilityHousekeeping,
+    storeSnapshotScheduler, appendOnlyRetentionScheduler, stopDurabilityHousekeeping, stopWakeHousekeeping,
     memoryConsolidationScheduler,
     powerManager,
     memoryGovernor,

package/src/runtime/voice-setup-services.ts

@@ -23,30 +23,76 @@ import {
   createVoiceSetupService,
   type VoiceSetupService,
 } from '@pellux/goodvibes-sdk/platform/runtime/voice-setup';
-import type { VoiceProviderRegistry } from '@pellux/goodvibes-sdk/platform/voice';
+import {
+  startWakeBootProvisioning,
+  type VoiceProviderRegistry,
+} from '@pellux/goodvibes-sdk/platform/voice';
 import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
+import { logger } from '@pellux/goodvibes-sdk/platform/utils';
 import type { ShellPathService } from '@/runtime/index.ts';
 
 export type { VoiceSetupService };
 
+/**
+ * The recovery act this surface names when a boot provision degrades. The SDK
+ * would otherwise name the control-plane verb, which is correct everywhere and
+ * useless to someone sitting in a terminal.
+ */
+export const WAKE_RECOVERY_COMMAND = '/voice wake setup';
+
 export interface VoiceSetupServicesDeps {
   readonly configManager: ConfigManager;
   readonly shellPaths: Pick<ShellPathService, 'resolveUserPath'>;
   readonly voiceProviders: VoiceProviderRegistry;
   /** Critical-tier admission gate — a provision run allocates archive + model buffers. */
   readonly admitExpensiveWork: (label: string) => { allowed: boolean; reason?: string | undefined };
+  /**
+   * Opt into boot-time wake-model provisioning and the recovery sweeper.
+   *
+   * Off unless a real entrypoint asks for it, matching how this graph treats the
+   * host power seam: `daemon/cli.ts` and `runtime/bootstrap-core.ts` opt in, the
+   * one-shot CLI commands do not, and a test composing the graph gets neither a
+   * network fetch nor a repeating timer it did not ask for.
+   */
+  readonly provisionWakeModelsAtBoot?: boolean | undefined;
+  /** Injected in tests: the boot starter, so no sweeper and no fetch are real. */
+  readonly startBootProvisioning?: typeof startWakeBootProvisioning | undefined;
+}
+
+export interface VoiceSetupServices {
+  readonly voiceSetup: VoiceSetupService;
+  /**
+   * Stop the wake-word recovery sweeper and cancel a pending boot provision.
+   * A no-op when boot provisioning was not opted into. Registered on the
+   * disposal scope (disposal-wiring.ts) — an hourly timer nothing stops is a
+   * poller this surface leaked, which is exactly what that scope exists for.
+   */
+  readonly stopWakeHousekeeping: () => void;
 }
 
 /** Compose the managed-voice single-flight install + no-network status read. */
-export function wireVoiceSetup(deps: VoiceSetupServicesDeps): { voiceSetup: VoiceSetupService } {
+export function wireVoiceSetup(deps: VoiceSetupServicesDeps): VoiceSetupServices {
   const { configManager, voiceProviders } = deps;
+  const managedVoiceRoot = deps.shellPaths.resolveUserPath('voice');
   const voiceSetup = createVoiceSetupService({
-    managedVoiceRoot: deps.shellPaths.resolveUserPath('voice'),
+    managedVoiceRoot,
     getConfig: (key) => String(configManager.get(key as Parameters<typeof configManager.get>[0]) ?? ''),
     setConfig: (key, value) => configManager.setDynamic(key as Parameters<typeof configManager.setDynamic>[0], value),
     // A successful (re-)install clears any tripped local-engine breaker.
     resetLocalEngineFailureState: () => voiceProviders.get('local')?.resetEngineFailureState?.(),
     admitExpensiveWork: deps.admitExpensiveWork,
   });
-  return { voiceSetup };
+  if (deps.provisionWakeModelsAtBoot !== true) {
+    return { voiceSetup, stopWakeHousekeeping: () => {} };
+  }
+  // Sweep the wake tree, then fetch whatever the install could not. The SDK owns
+  // the policy — never throws, one plain message, reaps before it retries — and
+  // routes the attempt through the setup service's single flight so a boot
+  // attempt and a user typing /voice wake setup are one download.
+  const boot = (deps.startBootProvisioning ?? startWakeBootProvisioning)({
+    managedRoot: managedVoiceRoot,
+    ensureProvisioned: () => voiceSetup.wakeEnsureProvisioned({ recoveryHint: WAKE_RECOVERY_COMMAND }),
+    announce: (message) => { logger.info(message); },
+  });
+  return { voiceSetup, stopWakeHousekeeping: () => boot.stop() };
 }

package/src/shell/voice-capture-shell.ts

@@ -0,0 +1,69 @@
+/**
+ * voice-capture-shell.ts — the shell's side of microphone capture.
+ *
+ * Extracted from main() for the same reason the process-lifecycle wiring was:
+ * the entrypoint is a wiring file held under a source-line gate, and new shell
+ * composition gets its own module and a single call there.
+ *
+ * What this owns is only the shell-facing half — where a transcript lands (the
+ * composer draft, through the same public `prompt`/`cursorPos` fields the
+ * external-editor path writes), how a turn is submitted, which keybinding seam
+ * the Alt+V action hangs off, and the teardown registration that guarantees a
+ * live recorder subprocess dies with the process. Everything about audio itself
+ * lives in src/audio/voice-capture-wiring.ts, which must not (and does not)
+ * import shell-UI.
+ */
+
+import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
+import type { CommandContext } from '../input/command-registry.ts';
+import type { ShellPathService } from '@/runtime/index.ts';
+import type { VoiceCaptureIndicatorState } from '../core/voice-capture-status.ts';
+import { wireVoiceCapture } from '../audio/voice-capture-wiring.ts';
+
+export interface VoiceCaptureShellDeps {
+  readonly configManager: ConfigManager;
+  readonly shellPaths: Pick<ShellPathService, 'resolveUserPath'>;
+  readonly homeDirectory: string | (() => string);
+  /** Names retained wake clips so the SDK's sweeper reaps them when this session ends. */
+  readonly sessionId: string;
+  /** The Alt+V seam is hung here (commandContext.toggleVoiceInput). */
+  readonly commandContext: CommandContext;
+  /** The shell's teardown registry; the device release is appended to it. */
+  readonly unsubs: Array<() => void>;
+  /** The live composer buffer — InputHandler exposes public `prompt`/`cursorPos`. */
+  readonly buffer: { prompt: string; cursorPos: number };
+  readonly submitInput: (text: string) => void;
+  readonly notify: (message: string) => void;
+  readonly render: () => void;
+}
+
+/**
+ * Compose voice capture and hand back the footer-row reader.
+ *
+ * Opens no device: wake detection consults `voice.wake.*` and refuses without
+ * touching the capture opener when it is off, and push-to-talk opens one only on
+ * a keypress.
+ */
+export function installVoiceCapture(deps: VoiceCaptureShellDeps): () => VoiceCaptureIndicatorState | null {
+  const capture = wireVoiceCapture({
+    configManager: deps.configManager,
+    // The same managed root `/voice setup` uses; the wake tree is `<root>/wake`.
+    managedVoiceRoot: deps.shellPaths.resolveUserPath('voice'),
+    // Surface-scoped: the extracted onnxruntime assets belong to this surface's
+    // own directory, beside its other managed state.
+    assetDirectory: deps.shellPaths.resolveUserPath('tui', 'onnxruntime'),
+    homeDirectory: deps.homeDirectory,
+    sessionId: deps.sessionId,
+    writeDraft: (text) => {
+      deps.buffer.prompt = text;
+      deps.buffer.cursorPos = text.length;
+      deps.render();
+    },
+    submitTurn: (text) => deps.submitInput(text),
+    notify: deps.notify,
+    render: deps.render,
+  });
+  deps.commandContext.toggleVoiceInput = capture.toggleVoiceInput;
+  deps.unsubs.push(...capture.unsubs);
+  return capture.status;
+}

package/src/verification/verification-ledger.ts

@@ -209,16 +209,16 @@ export const FEATURE_KNOB_LOCAL_SETTINGS = [
  *   watchers.triggers.onExitMaxDurationMs    persistence · live (on-exit trigger duration cap)
  *   watchers.triggers.onExitStdin            persistence · live (on-exit stdin posture)
  *   watchers.triggers.outputTailBytes        persistence · live (captured output tail)
- *   device.capabilities.allowAlwaysOffer     persistence · settings surface only in this build
- *   device.capabilities.requestTimeoutSeconds persistence · settings surface only in this build
- *   device.location.precision                persistence · settings surface only in this build
- *   device.clipboard.readMode                persistence · settings surface only in this build
- *   device.capture.retentionHours            persistence · settings surface only in this build
- *   device.capture.maxArtifacts              persistence · settings surface only in this build
- *   device.capture.sweepIntervalMinutes      persistence · settings surface only in this build
- *   device.grants.expiryDays                 persistence · settings surface only in this build
- *   device.grants.maxPerNode                 persistence · settings surface only in this build
- *   device.grants.auditRetentionDays         persistence · settings surface only in this build
+ *   device.capabilities.allowAlwaysOffer     persistence · behavior (durable-grant offer by sensitivity)
+ *   device.capabilities.requestTimeoutSeconds persistence · behavior (dispatch, wire payload and prompt deadline)
+ *   device.location.precision                persistence · behavior (precise fix refused / never granted)
+ *   device.clipboard.readMode                persistence · behavior (clipboard read refused / never granted)
+ *   device.capture.retentionHours            persistence · behavior (capture TTL, swept off disk at expiry)
+ *   device.capture.maxArtifacts              persistence · behavior (capture count cap at the sweep)
+ *   device.capture.sweepIntervalMinutes      persistence · behavior (period of the sweep that reaps)
+ *   device.grants.expiryDays                 persistence · behavior (grant TTL, then asks again)
+ *   device.grants.maxPerNode                 persistence · behavior (per-node grant cap at the sweep)
+ *   device.grants.auditRetentionDays         persistence · behavior (grant ledger retention)
  *   device.nodes.maxPaired                   persistence · live (enforced at the pairing path)
  *
  * On `device.nodes.maxPaired`: the SDK enforces it where a device pairs —
@@ -235,17 +235,56 @@ export const FEATURE_KNOB_LOCAL_SETTINGS = [
  * in this column so the "how live is it" audit stays accurate, not to claim
  * coverage this repo did not write.
  *
- * On the other ten `device.*` rows: DeviceCapabilityService carries its own
- * policy struct whose defaults match those keys one for one, and names them in
- * its field comments and refusal messages, but no code path in either tree maps
- * configuration into that struct. Persistence is therefore the whole of what is
- * verified for them, and the settings-workspace description for the `device`
- * category says exactly that to the user rather than implying live knobs.
+ * On the other ten `device.*` rows: they are live now. This app composes the
+ * platform's device posture runtime (src/runtime/device-posture-composition.ts)
+ * on the same distributed runtime phones pair onto and the same approval broker
+ * every other confirmation rides, registers the `phone` tool on it, and binds the
+ * devices.* verbs to it — so each of these keys is read, per request and per
+ * sweep, by the DeviceCapabilityService / DeviceGrantStore /
+ * DeviceCaptureArtifactStore / DeviceHousekeeper that serve them. They were dark
+ * before that: the policy struct carried matching defaults and named the keys in
+ * its refusal messages, but nothing mapped configuration into it in either tree.
+ * The mapping now lives in the SDK, so every daemon host honours it rather than
+ * only whichever consumer had written its own.
  *
- * DELIBERATELY NOT COUNTED: the 24 non-enablement `voice.wake.*` keys from the
- * same release. `wake-word-detection` is declared `notOperable` — no surface
- * captures audio — so its rows stay in `total` and out of the numerator. That is
- * the honest reading, and it is why this list raises coverage by 29 and not 53.
+ * The second column above is upgraded to "behavior" on the strength of
+ * `src/test/verification/device-posture-behavior.test.ts`, which drives THIS
+ * app's composition with a real ConfigManager over a temp home and the platform's
+ * real stores, stubs only the peer transport and the approval bridge, and asserts
+ * per key at two values that the observable outcome differs — refusal code, how
+ * authority was established, what reached the transport, what the prompt was
+ * given, and what survives on disk after a sweep. It also invokes the `phone`
+ * tool and the devices.* verbs off the composed runtime graph, because a mapping
+ * nothing composes is the same defect in a different place.
+ *
+ * STILL NOT COUNTED, FOR A DIFFERENT REASON NOW: the 24 non-enablement
+ * `voice.wake.*` keys from the same release. When this list was written they were
+ * excluded because nothing captured audio at all. That is no longer true — this
+ * terminal opens a recorder subprocess (src/audio/capture.ts), runs the SDK
+ * detector over it through onnxruntime-web (src/audio/wake-inference.ts), and
+ * hands both a confirmed wake's utterance and a push-to-talk recording to the
+ * daemon's `voice.stt` verb. Every one of those rows is read by
+ * resolveWakeRuntimeSettings and reaches this surface's runtime.
+ *
+ * They stay out of the NUMERATOR here because this constant counts exactly one
+ * thing — keys whose four-part PERSISTENCE contract is exercised by
+ * device-and-trigger-settings-persistence.test.ts — and that test does not cover
+ * them. The behaviour they now drive is covered instead by the capture and wake
+ * tests under src/test/audio/, which assert the frame path, the detection
+ * chain, the disabled-means-no-capture rule, the supervisor's restart and latch,
+ * and the recorder argv. Counting them in both places would double-count; adding
+ * them here without writing their persistence round-trip would overclaim. So the
+ * number this list raises coverage by is unchanged, and the reason it excludes
+ * them is recorded above rather than left reading as "the feature does nothing".
+ *
+ * Every wake row is now in force on this surface, with one condition stated at
+ * every surfacing: `voice.wake.vadThreshold` above 0 needs the speech gate's own
+ * pinned artifact provisioned (`/voice wake setup` fetches it with the models),
+ * and until it is, startup BLOCKS with that reason rather than scoring frames
+ * ungated behind a row that says they are screened. `voice.wake.noiseSuppression:
+ * speex` runs here: the filter is a WebAssembly module the SDK carries, applied
+ * by the wrapper the listener and the push-to-talk session put around this
+ * surface's capture opener.
  */
 export const DEVICE_AND_TRIGGER_LOCAL_SETTINGS = [
   'watchers.triggers.backoffLadderMs',

package/src/version.ts

@@ -6,7 +6,7 @@ import { join } from 'node:path';
 // The prebuild script updates the fallback value before compilation.
 // Uses import.meta.dir (Bun) to locate package.json relative to this file,
 // which is correct regardless of the process working directory.
-let _version = '1.26.0';
+let _version = '1.27.0';
 try {
   const pkg = JSON.parse(readFileSync(join(import.meta.dir, '..', 'package.json'), 'utf-8'));
   // Only trust a version read from OUR OWN package.json. A Bun single-file