@pixelzx/genesis 2026.6.13-beta.3 → 2026.6.13

package/dist/register.message-CficlkIg.js

@@ -0,0 +1,329 @@
+import { a as normalizeLowercaseStringOrEmpty, c as normalizeOptionalString } from "./string-coerce-DPP_aYVc.js";
+import { w as setVerbose } from "./logger-BRmjL88V.js";
+import { n as defaultRuntime, r as writeRuntimeJson } from "./runtime-DDkDH9fa.js";
+import { t as formatDocsLink } from "./links-C1-jbHJx.js";
+import { r as theme } from "./theme-DD6pQv2_.js";
+import { t as danger } from "./globals-wYf9_gv5.js";
+import { a as loadConfig } from "./io-lNN4Levs.js";
+import { t as getChannelPlugin } from "./registry-BHSrOwSF.js";
+import { x as resolveDefaultAgentId } from "./agent-scope-Duyu_T59.js";
+import "./config-DzozJ_v4.js";
+import { i as GATEWAY_CLIENT_NAMES, r as GATEWAY_CLIENT_MODES } from "./client-info-DeQMz3zN.js";
+import { n as CHANNEL_TARGET_DESCRIPTION, t as CHANNEL_TARGETS_DESCRIPTION } from "./channel-target-DhwB2ooW.js";
+import "./plugins-vNuCzel8.js";
+import { o as runGlobalGatewayStopSafely } from "./hook-runner-global-KWJ-vVaB.js";
+import { n as CHANNEL_MESSAGE_ACTION_NAMES, t as resolveMessageSecretScope } from "./message-secret-scope-BmZJslJs.js";
+import { o as getScopedChannelsCommandSecretTargets } from "./command-secret-targets-Ce_y5C5q.js";
+import { n as runMessageAction } from "./message-action-runner-D66_Fo-V.js";
+import { n as withProgress } from "./progress-z1FWoV8k.js";
+import { n as runCommandWithRuntime } from "./cli-utils-C80mOHVm.js";
+import { t as formatHelpExamples } from "./help-format-DziqFQ8a.js";
+import { t as createDefaultDeps } from "./deps-CkoVuEVy.js";
+import { t as createOutboundSendDeps } from "./outbound-send-deps-C2G-u3mZ.js";
+import { t as resolveCommandConfigWithSecrets } from "./command-config-resolution-Dkkd_zz7.js";
+import { t as collectOption } from "./helpers-DvwwE5lo.js";
+import { n as ensurePluginRegistryLoaded } from "./runtime-registry-loader-JvZFeEu5.js";
+import "./plugin-registry-CwO-BBjS.js";
+//#region src/commands/message.ts
+function buildMessageCliJson(result) {
+	return {
+		action: result.action,
+		channel: result.channel,
+		dryRun: result.dryRun,
+		handledBy: result.handledBy,
+		payload: result.payload
+	};
+}
+async function messageCommand(opts, deps, runtime) {
+	const loadedRaw = loadConfig();
+	const scope = resolveMessageSecretScope({
+		channel: opts.channel,
+		target: opts.target,
+		targets: opts.targets,
+		accountId: opts.accountId
+	});
+	const scopedTargets = getScopedChannelsCommandSecretTargets({
+		config: loadedRaw,
+		channel: scope.channel,
+		accountId: scope.accountId
+	});
+	const { effectiveConfig: cfg } = await resolveCommandConfigWithSecrets({
+		config: loadedRaw,
+		commandName: "message",
+		targetIds: scopedTargets.targetIds,
+		...scopedTargets.allowedPaths ? { allowedPaths: scopedTargets.allowedPaths } : {},
+		runtime,
+		autoEnable: true
+	});
+	const actionInput = (normalizeOptionalString(opts.action) ?? "") || "send";
+	const normalizedActionInput = normalizeLowercaseStringOrEmpty(actionInput);
+	const actionMatch = CHANNEL_MESSAGE_ACTION_NAMES.find((name) => normalizeLowercaseStringOrEmpty(name) === normalizedActionInput);
+	if (!actionMatch) throw new Error(`Unknown message action: ${actionInput}`);
+	const action = actionMatch;
+	const outboundDeps = createOutboundSendDeps(deps);
+	const senderIsOwner = typeof opts.senderIsOwner === "boolean" ? opts.senderIsOwner : true;
+	const run = async () => await runMessageAction({
+		cfg,
+		action,
+		params: opts,
+		deps: outboundDeps,
+		agentId: resolveDefaultAgentId(cfg),
+		senderIsOwner,
+		gateway: {
+			clientName: GATEWAY_CLIENT_NAMES.CLI,
+			mode: GATEWAY_CLIENT_MODES.CLI
+		}
+	});
+	const json = opts.json === true;
+	const dryRun = opts.dryRun === true;
+	const result = !json && !dryRun && (action === "send" || action === "poll") ? await withProgress({
+		label: action === "poll" ? "Sending poll..." : "Sending...",
+		indeterminate: true,
+		enabled: true
+	}, run) : await run();
+	if (json) {
+		writeRuntimeJson(runtime, buildMessageCliJson(result));
+		return;
+	}
+	const { formatMessageCliText } = await import("./message-format-8w_EAz4f.js");
+	for (const line of formatMessageCliText(result)) runtime.log(line);
+}
+//#endregion
+//#region src/cli/program/message/helpers.ts
+function normalizeMessageOptions(opts) {
+	const { account, ...rest } = opts;
+	return {
+		...rest,
+		accountId: typeof account === "string" ? account : void 0
+	};
+}
+async function runPluginStopHooks() {
+	await runGlobalGatewayStopSafely({
+		event: { reason: "cli message action complete" },
+		ctx: {},
+		onError: (err) => defaultRuntime.error(danger(`gateway_stop hook failed: ${String(err)}`))
+	});
+}
+function createMessageCliHelpers(message, messageChannelOptions) {
+	const withMessageBase = (command) => command.option("--channel <channel>", `Channel: ${messageChannelOptions}`).option("--account <id>", "Channel account id (accountId)").option("--json", "Output result as JSON", false).option("--dry-run", "Print payload and skip sending", false).option("--verbose", "Verbose logging", false);
+	const withMessageTarget = (command) => command.option("-t, --target <dest>", CHANNEL_TARGET_DESCRIPTION);
+	const withRequiredMessageTarget = (command) => command.requiredOption("-t, --target <dest>", CHANNEL_TARGET_DESCRIPTION);
+	const runMessageAction = async (action, opts) => {
+		setVerbose(Boolean(opts.verbose));
+		ensurePluginRegistryLoaded();
+		const deps = createDefaultDeps();
+		let failed = false;
+		await runCommandWithRuntime(defaultRuntime, async () => {
+			await messageCommand({
+				...normalizeMessageOptions(opts),
+				action
+			}, deps, defaultRuntime);
+		}, (err) => {
+			failed = true;
+			defaultRuntime.error(danger(String(err)));
+		});
+		await runPluginStopHooks();
+		defaultRuntime.exit(failed ? 1 : 0);
+	};
+	return {
+		withMessageBase,
+		withMessageTarget,
+		withRequiredMessageTarget,
+		runMessageAction
+	};
+}
+//#endregion
+//#region src/cli/program/message/register.broadcast.ts
+function registerMessageBroadcastCommand(message, helpers) {
+	helpers.withMessageBase(message.command("broadcast").description("Broadcast a message to multiple targets")).requiredOption("--targets <target...>", CHANNEL_TARGETS_DESCRIPTION).option("--message <text>", "Message to send").option("--media <url>", "Media URL").action(async (options) => {
+		await helpers.runMessageAction("broadcast", options);
+	});
+}
+//#endregion
+//#region src/cli/program/message/register.discord-admin.ts
+function registerMessageDiscordAdminCommands(message, helpers) {
+	const role = message.command("role").description("Role actions");
+	helpers.withMessageBase(role.command("info").description("List roles").requiredOption("--guild-id <id>", "Guild id")).action(async (opts) => {
+		await helpers.runMessageAction("role-info", opts);
+	});
+	helpers.withMessageBase(role.command("add").description("Add role to a member").requiredOption("--guild-id <id>", "Guild id").requiredOption("--user-id <id>", "User id").requiredOption("--role-id <id>", "Role id")).action(async (opts) => {
+		await helpers.runMessageAction("role-add", opts);
+	});
+	helpers.withMessageBase(role.command("remove").description("Remove role from a member").requiredOption("--guild-id <id>", "Guild id").requiredOption("--user-id <id>", "User id").requiredOption("--role-id <id>", "Role id")).action(async (opts) => {
+		await helpers.runMessageAction("role-remove", opts);
+	});
+	const channel = message.command("channel").description("Channel actions");
+	helpers.withMessageBase(helpers.withRequiredMessageTarget(channel.command("info").description("Fetch channel info"))).action(async (opts) => {
+		await helpers.runMessageAction("channel-info", opts);
+	});
+	helpers.withMessageBase(channel.command("list").description("List channels").requiredOption("--guild-id <id>", "Guild id")).action(async (opts) => {
+		await helpers.runMessageAction("channel-list", opts);
+	});
+	const member = message.command("member").description("Member actions");
+	helpers.withMessageBase(member.command("info").description("Fetch member info").requiredOption("--user-id <id>", "User id")).option("--guild-id <id>", "Guild id (Discord)").action(async (opts) => {
+		await helpers.runMessageAction("member-info", opts);
+	});
+	const voice = message.command("voice").description("Voice actions");
+	helpers.withMessageBase(voice.command("status").description("Fetch voice status").requiredOption("--guild-id <id>", "Guild id").requiredOption("--user-id <id>", "User id")).action(async (opts) => {
+		await helpers.runMessageAction("voice-status", opts);
+	});
+	const event = message.command("event").description("Event actions");
+	helpers.withMessageBase(event.command("list").description("List scheduled events").requiredOption("--guild-id <id>", "Guild id")).action(async (opts) => {
+		await helpers.runMessageAction("event-list", opts);
+	});
+	helpers.withMessageBase(event.command("create").description("Create a scheduled event").requiredOption("--guild-id <id>", "Guild id").requiredOption("--event-name <name>", "Event name").requiredOption("--start-time <iso>", "Event start time")).option("--end-time <iso>", "Event end time").option("--desc <text>", "Event description").option("--channel-id <id>", "Channel id").option("--location <text>", "Event location").option("--event-type <stage|external|voice>", "Event type").option("--image <url>", "Cover image URL or local file path").action(async (opts) => {
+		await helpers.runMessageAction("event-create", opts);
+	});
+	helpers.withMessageBase(message.command("timeout").description("Timeout a member").requiredOption("--guild-id <id>", "Guild id").requiredOption("--user-id <id>", "User id")).option("--duration-min <n>", "Timeout duration minutes").option("--until <iso>", "Timeout until").option("--reason <text>", "Moderation reason").action(async (opts) => {
+		await helpers.runMessageAction("timeout", opts);
+	});
+	helpers.withMessageBase(message.command("kick").description("Kick a member").requiredOption("--guild-id <id>", "Guild id").requiredOption("--user-id <id>", "User id")).option("--reason <text>", "Moderation reason").action(async (opts) => {
+		await helpers.runMessageAction("kick", opts);
+	});
+	helpers.withMessageBase(message.command("ban").description("Ban a member").requiredOption("--guild-id <id>", "Guild id").requiredOption("--user-id <id>", "User id")).option("--reason <text>", "Moderation reason").option("--delete-days <n>", "Ban delete message days").action(async (opts) => {
+		await helpers.runMessageAction("ban", opts);
+	});
+}
+//#endregion
+//#region src/cli/program/message/register.emoji-sticker.ts
+function registerMessageEmojiCommands(message, helpers) {
+	const emoji = message.command("emoji").description("Emoji actions");
+	helpers.withMessageBase(emoji.command("list").description("List emojis")).option("--guild-id <id>", "Guild id (Discord)").action(async (opts) => {
+		await helpers.runMessageAction("emoji-list", opts);
+	});
+	helpers.withMessageBase(emoji.command("upload").description("Upload an emoji").requiredOption("--guild-id <id>", "Guild id")).requiredOption("--emoji-name <name>", "Emoji name").requiredOption("--media <path-or-url>", "Emoji media (path or URL)").option("--role-ids <id>", "Role id (repeat)", collectOption, []).action(async (opts) => {
+		await helpers.runMessageAction("emoji-upload", opts);
+	});
+}
+function registerMessageStickerCommands(message, helpers) {
+	const sticker = message.command("sticker").description("Sticker actions");
+	helpers.withMessageBase(helpers.withRequiredMessageTarget(sticker.command("send").description("Send stickers"))).requiredOption("--sticker-id <id>", "Sticker id (repeat)", collectOption).option("-m, --message <text>", "Optional message body").action(async (opts) => {
+		await helpers.runMessageAction("sticker", opts);
+	});
+	helpers.withMessageBase(sticker.command("upload").description("Upload a sticker").requiredOption("--guild-id <id>", "Guild id")).requiredOption("--sticker-name <name>", "Sticker name").requiredOption("--sticker-desc <text>", "Sticker description").requiredOption("--sticker-tags <tags>", "Sticker tags").requiredOption("--media <path-or-url>", "Sticker media (path or URL)").action(async (opts) => {
+		await helpers.runMessageAction("sticker-upload", opts);
+	});
+}
+//#endregion
+//#region src/cli/program/message/register.permissions-search.ts
+function registerMessagePermissionsCommand(message, helpers) {
+	helpers.withMessageBase(helpers.withRequiredMessageTarget(message.command("permissions").description("Fetch channel permissions"))).action(async (opts) => {
+		await helpers.runMessageAction("permissions", opts);
+	});
+}
+function registerMessageSearchCommand(message, helpers) {
+	helpers.withMessageBase(message.command("search").description("Search Discord messages")).requiredOption("--guild-id <id>", "Guild id").requiredOption("--query <text>", "Search query").option("--channel-id <id>", "Channel id").option("--channel-ids <id>", "Channel id (repeat)", collectOption, []).option("--author-id <id>", "Author id").option("--author-ids <id>", "Author id (repeat)", collectOption, []).option("--limit <n>", "Result limit").action(async (opts) => {
+		await helpers.runMessageAction("search", opts);
+	});
+}
+//#endregion
+//#region src/cli/program/message/register.pins.ts
+function registerMessagePinCommands(message, helpers) {
+	helpers.withMessageBase(helpers.withRequiredMessageTarget(message.command("pin").description("Pin a message"))).requiredOption("--message-id <id>", "Message id").action(async (opts) => {
+		await helpers.runMessageAction("pin", opts);
+	}), helpers.withMessageBase(helpers.withRequiredMessageTarget(message.command("unpin").description("Unpin a message"))).requiredOption("--message-id <id>", "Message id (or pinned message resource id for MSTeams)").option("--pinned-message-id <id>", "Pinned message resource id (MSTeams: from pin or list-pins, not the chat message id)").action(async (opts) => {
+		await helpers.runMessageAction("unpin", opts);
+	}), helpers.withMessageBase(helpers.withRequiredMessageTarget(message.command("pins").description("List pinned messages"))).option("--limit <n>", "Result limit").action(async (opts) => {
+		await helpers.runMessageAction("list-pins", opts);
+	});
+}
+//#endregion
+//#region src/cli/program/message/register.poll.ts
+function registerMessagePollCommand(message, helpers) {
+	helpers.withMessageBase(helpers.withRequiredMessageTarget(message.command("poll").description("Send a poll"))).requiredOption("--poll-question <text>", "Poll question").option("--poll-option <choice>", "Poll option (repeat 2-12 times)", collectOption, []).option("--poll-multi", "Allow multiple selections", false).option("--poll-duration-hours <n>", "Poll duration in hours (Discord)").option("--poll-duration-seconds <n>", "Poll duration in seconds (Telegram; 5-600)").option("--poll-anonymous", "Send an anonymous poll (Telegram)", false).option("--poll-public", "Send a non-anonymous poll (Telegram)", false).option("-m, --message <text>", "Optional message body").option("--silent", "Send poll silently without notification (Telegram + Discord where supported)", false).option("--thread-id <id>", "Thread id (Telegram forum topic / Slack thread ts)").action(async (opts) => {
+		await helpers.runMessageAction("poll", opts);
+	});
+}
+//#endregion
+//#region src/cli/program/message/register.reactions.ts
+function registerMessageReactionsCommands(message, helpers) {
+	helpers.withMessageBase(helpers.withRequiredMessageTarget(message.command("react").description("Add or remove a reaction"))).requiredOption("--message-id <id>", "Message id").option("--emoji <emoji>", "Emoji for reactions").option("--remove", "Remove reaction", false).option("--participant <id>", "WhatsApp reaction participant").option("--from-me", "WhatsApp reaction fromMe", false).option("--target-author <id>", "Signal reaction target author (uuid or phone)").option("--target-author-uuid <uuid>", "Signal reaction target author uuid").action(async (opts) => {
+		await helpers.runMessageAction("react", opts);
+	});
+	helpers.withMessageBase(helpers.withRequiredMessageTarget(message.command("reactions").description("List reactions on a message"))).requiredOption("--message-id <id>", "Message id").option("--limit <n>", "Result limit").action(async (opts) => {
+		await helpers.runMessageAction("reactions", opts);
+	});
+}
+//#endregion
+//#region src/cli/program/message/register.read-edit-delete.ts
+function registerMessageReadEditDeleteCommands(message, helpers) {
+	helpers.withMessageBase(helpers.withRequiredMessageTarget(message.command("read").description("Read recent messages"))).option("--limit <n>", "Result limit").option("--before <id>", "Read/search before id").option("--after <id>", "Read/search after id").option("--around <id>", "Read around id").option("--include-thread", "Include thread replies (Discord)", false).action(async (opts) => {
+		await helpers.runMessageAction("read", opts);
+	});
+	helpers.withMessageBase(helpers.withRequiredMessageTarget(message.command("edit").description("Edit a message").requiredOption("--message-id <id>", "Message id").requiredOption("-m, --message <text>", "Message body"))).option("--thread-id <id>", "Thread id (Telegram forum thread)").action(async (opts) => {
+		await helpers.runMessageAction("edit", opts);
+	});
+	helpers.withMessageBase(helpers.withRequiredMessageTarget(message.command("delete").description("Delete a message").requiredOption("--message-id <id>", "Message id"))).action(async (opts) => {
+		await helpers.runMessageAction("delete", opts);
+	});
+}
+//#endregion
+//#region src/cli/program/message/register.send.ts
+function registerMessageSendCommand(message, helpers) {
+	helpers.withMessageBase(helpers.withRequiredMessageTarget(message.command("send").description("Send a message").option("-m, --message <text>", "Message body (required unless --media is set)")).option("--media <path-or-url>", "Attach media (image/audio/video/document). Accepts local paths or URLs.").option("--presentation <json>", "Shared presentation payload as JSON (text, context, dividers, buttons, selects)").option("--delivery <json>", "Shared delivery preferences as JSON").option("--pin", "Request that the delivered message be pinned when supported", false).option("--reply-to <id>", "Reply-to message id").option("--thread-id <id>", "Thread id (Telegram forum thread)").option("--gif-playback", "Treat video media as GIF playback (WhatsApp only).", false).option("--force-document", "Send media as document to avoid Telegram compression (Telegram only). Applies to images and GIFs.", false).option("--silent", "Send message silently without notification (Telegram + Discord)", false)).action(async (opts) => {
+		await helpers.runMessageAction("send", opts);
+	});
+}
+//#endregion
+//#region src/cli/program/message/register.thread.ts
+function resolveThreadCreateRequest(opts) {
+	const channel = normalizeLowercaseStringOrEmpty(opts.channel);
+	if (channel) {
+		const request = getChannelPlugin(channel)?.actions?.resolveCliActionRequest?.({
+			action: "thread-create",
+			args: opts
+		});
+		if (request) return {
+			action: request.action,
+			params: request.args
+		};
+	}
+	return {
+		action: "thread-create",
+		params: opts
+	};
+}
+function registerMessageThreadCommands(message, helpers) {
+	const thread = message.command("thread").description("Thread actions");
+	helpers.withMessageBase(helpers.withRequiredMessageTarget(thread.command("create").description("Create a thread").requiredOption("--thread-name <name>", "Thread name"))).option("--message-id <id>", "Message id (optional)").option("-m, --message <text>", "Initial thread message text").option("--auto-archive-min <n>", "Thread auto-archive minutes").action(async (opts) => {
+		const request = resolveThreadCreateRequest(opts);
+		await helpers.runMessageAction(request.action, request.params);
+	});
+	helpers.withMessageBase(thread.command("list").description("List threads").requiredOption("--guild-id <id>", "Guild id")).option("--channel-id <id>", "Channel id").option("--include-archived", "Include archived threads", false).option("--before <id>", "Read/search before id").option("--limit <n>", "Result limit").action(async (opts) => {
+		await helpers.runMessageAction("thread-list", opts);
+	});
+	helpers.withMessageBase(helpers.withRequiredMessageTarget(thread.command("reply").description("Reply in a thread").requiredOption("-m, --message <text>", "Message body"))).option("--media <path-or-url>", "Attach media (image/audio/video/document). Accepts local paths or URLs.").option("--reply-to <id>", "Reply-to message id").action(async (opts) => {
+		await helpers.runMessageAction("thread-reply", opts);
+	});
+}
+//#endregion
+//#region src/cli/program/register.message.ts
+function registerMessageCommands(program, ctx) {
+	const message = program.command("message").description("Send, read, and manage messages and channel actions").addHelpText("after", () => `
+${theme.heading("Examples:")}
+${formatHelpExamples([
+		["genesis message send --target +15555550123 --message \"Hi\"", "Send a text message."],
+		["genesis message send --target +15555550123 --message \"Hi\" --media photo.jpg", "Send a message with media."],
+		["genesis message poll --channel discord --target channel:123 --poll-question \"Snack?\" --poll-option Pizza --poll-option Sushi", "Create a Discord poll."],
+		["genesis message react --channel discord --target 123 --message-id 456 --emoji \"✅\"", "React to a message."]
+	])}
+
+${theme.muted("Docs:")} ${formatDocsLink("/cli/message", "genesis.pixelzx.com/docs/cli/message")}`).action(() => {
+		message.help({ error: true });
+	});
+	const helpers = createMessageCliHelpers(message, ctx.messageChannelOptions);
+	registerMessageSendCommand(message, helpers);
+	registerMessageBroadcastCommand(message, helpers);
+	registerMessagePollCommand(message, helpers);
+	registerMessageReactionsCommands(message, helpers);
+	registerMessageReadEditDeleteCommands(message, helpers);
+	registerMessagePinCommands(message, helpers);
+	registerMessagePermissionsCommand(message, helpers);
+	registerMessageSearchCommand(message, helpers);
+	registerMessageThreadCommands(message, helpers);
+	registerMessageEmojiCommands(message, helpers);
+	registerMessageStickerCommands(message, helpers);
+	registerMessageDiscordAdminCommands(message, helpers);
+}
+//#endregion
+export { registerMessageCommands };

package/dist/register.onboard-1xQPe7tH.js

@@ -0,0 +1,88 @@
+import { n as defaultRuntime } from "./runtime-DDkDH9fa.js";
+import { t as formatDocsLink } from "./links-C1-jbHJx.js";
+import { r as theme } from "./theme-DD6pQv2_.js";
+import { n as runCommandWithRuntime } from "./cli-utils-C80mOHVm.js";
+import { i as resolveManifestProviderOnboardAuthFlags, r as resolveManifestProviderAuthChoices } from "./provider-auth-choices-C2Y3hUbY.js";
+import { n as formatStaticAuthChoiceChoicesForCli } from "./auth-choice-options.static-DVF6rlKh.js";
+import { t as CORE_ONBOARD_AUTH_FLAGS } from "./onboard-core-auth-flags-CeAISL-_.js";
+//#region src/cli/program/register.onboard.ts
+function resolveInstallDaemonFlag(command, opts) {
+	if (!command || typeof command !== "object") return;
+	const getOptionValueSource = "getOptionValueSource" in command ? command.getOptionValueSource : void 0;
+	if (typeof getOptionValueSource !== "function") return;
+	if (getOptionValueSource.call(command, "skipDaemon") === "cli") return false;
+	if (getOptionValueSource.call(command, "installDaemon") === "cli") return Boolean(opts.installDaemon);
+}
+function includesTextInferenceScope(choice) {
+	return choice.onboardingScopes ? choice.onboardingScopes.includes("text-inference") : true;
+}
+function formatOnboardAuthChoiceHelp() {
+	const values = [...formatStaticAuthChoiceChoicesForCli({
+		includeLegacyAliases: true,
+		includeSkip: true
+	}).split("|"), ...resolveManifestProviderAuthChoices({ includeUntrustedWorkspacePlugins: false }).filter(includesTextInferenceScope).map((choice) => choice.choiceId)];
+	return [...new Set(values)].join("|");
+}
+const AUTH_CHOICE_HELP = formatOnboardAuthChoiceHelp();
+const ONBOARD_AUTH_FLAGS = [...CORE_ONBOARD_AUTH_FLAGS, ...resolveManifestProviderOnboardAuthFlags()];
+function pickOnboardProviderAuthOptionValues(opts) {
+	return Object.fromEntries(ONBOARD_AUTH_FLAGS.map((flag) => [flag.optionKey, opts[flag.optionKey]]));
+}
+function registerOnboardCommand(program) {
+	const command = program.command("onboard").description("Interactive onboarding for the gateway, workspace, and skills").addHelpText("after", () => `\n${theme.muted("Docs:")} ${formatDocsLink("/cli/onboard", "genesis.pixelzx.com/docs/cli/onboard")}\n`).option("--workspace <dir>", "Agent workspace directory (default: ~/.genesis/workspace)").option("--reset", "Reset config + credentials + sessions before running onboard (workspace only with --reset-scope full)").option("--reset-scope <scope>", "Reset scope: config|config+creds+sessions|full").option("--non-interactive", "Run without prompts", false).option("--accept-risk", "Acknowledge that agents are powerful and full system access is risky (required for --non-interactive)", false).option("--flow <flow>", "Onboard flow: quickstart|advanced|manual").option("--mode <mode>", "Onboard mode: local|remote|gateway|node").option("--auth-choice <choice>", `Auth: ${AUTH_CHOICE_HELP}`).option("--token-provider <id>", "Token provider id (non-interactive; used with --auth-choice token)").option("--token <token>", "Token value (non-interactive; used with --auth-choice token)").option("--token-profile-id <id>", "Auth profile id (non-interactive; default: <provider>:manual)").option("--token-expires-in <duration>", "Optional token expiry duration (e.g. 365d, 12h)").option("--secret-input-mode <mode>", "API key persistence mode: plaintext|ref (default: plaintext)").option("--cloudflare-ai-gateway-account-id <id>", "Cloudflare Account ID").option("--cloudflare-ai-gateway-gateway-id <id>", "Cloudflare AI Gateway ID");
+	for (const providerFlag of ONBOARD_AUTH_FLAGS) command.option(providerFlag.cliOption, providerFlag.description);
+	command.option("--custom-base-url <url>", "Custom provider base URL").option("--custom-api-key <key>", "Custom provider API key (optional)").option("--custom-model-id <id>", "Custom provider model ID").option("--custom-provider-id <id>", "Custom provider ID (optional; auto-derived by default)").option("--custom-compatibility <mode>", "Custom provider API compatibility: openai|anthropic (default: openai)").option("--gateway-port <port>", "Gateway port").option("--gateway-bind <mode>", "Gateway bind: loopback|tailnet|lan|auto|custom").option("--gateway-auth <mode>", "Gateway auth: token|password").option("--gateway-token <token>", "Gateway token (token auth)").option("--gateway-token-ref-env <name>", "Gateway token SecretRef env var name (token auth; e.g. GENESIS_GATEWAY_TOKEN)").option("--gateway-password <password>", "Gateway password (password auth)").option("--remote-url <url>", "Remote Gateway WebSocket URL").option("--remote-token <token>", "Remote Gateway token (optional)").option("--tailscale <mode>", "Tailscale: off|serve|funnel").option("--tailscale-reset-on-exit", "Reset tailscale serve/funnel on exit").option("--install-daemon", "Install gateway service").option("--no-install-daemon", "Skip gateway service install").option("--skip-daemon", "Skip gateway service install").option("--daemon-runtime <runtime>", "Daemon runtime: node|bun").option("--skip-channels", "Skip channel setup").option("--skip-skills", "Skip skills setup").option("--skip-bootstrap", "Skip creating default agent workspace files").option("--skip-search", "Skip search provider setup").option("--skip-health", "Skip health check").option("--skip-ui", "Skip Control UI/TUI prompts").option("--node-manager <name>", "Node manager for skills: npm|pnpm|bun").option("--json", "Output JSON summary", false);
+	command.action(async (opts, commandRuntime) => {
+		await runCommandWithRuntime(defaultRuntime, async () => {
+			const { setupWizardCommand } = await import("./onboard-WRT3rbQo.js");
+			const installDaemon = resolveInstallDaemonFlag(commandRuntime, { installDaemon: Boolean(opts.installDaemon) });
+			const gatewayPort = typeof opts.gatewayPort === "string" ? Number.parseInt(opts.gatewayPort, 10) : void 0;
+			const providerAuthOptionValues = pickOnboardProviderAuthOptionValues(opts);
+			await setupWizardCommand({
+				workspace: opts.workspace,
+				nonInteractive: Boolean(opts.nonInteractive),
+				acceptRisk: Boolean(opts.acceptRisk),
+				flow: opts.flow,
+				mode: opts.mode,
+				authChoice: opts.authChoice,
+				tokenProvider: opts.tokenProvider,
+				token: opts.token,
+				tokenProfileId: opts.tokenProfileId,
+				tokenExpiresIn: opts.tokenExpiresIn,
+				secretInputMode: opts.secretInputMode,
+				...providerAuthOptionValues,
+				cloudflareAiGatewayAccountId: opts.cloudflareAiGatewayAccountId,
+				cloudflareAiGatewayGatewayId: opts.cloudflareAiGatewayGatewayId,
+				customBaseUrl: opts.customBaseUrl,
+				customApiKey: opts.customApiKey,
+				customModelId: opts.customModelId,
+				customProviderId: opts.customProviderId,
+				customCompatibility: opts.customCompatibility,
+				gatewayPort: typeof gatewayPort === "number" && Number.isFinite(gatewayPort) ? gatewayPort : void 0,
+				gatewayBind: opts.gatewayBind,
+				gatewayAuth: opts.gatewayAuth,
+				gatewayToken: opts.gatewayToken,
+				gatewayTokenRefEnv: opts.gatewayTokenRefEnv,
+				gatewayPassword: opts.gatewayPassword,
+				remoteUrl: opts.remoteUrl,
+				remoteToken: opts.remoteToken,
+				tailscale: opts.tailscale,
+				tailscaleResetOnExit: Boolean(opts.tailscaleResetOnExit),
+				reset: Boolean(opts.reset),
+				resetScope: opts.resetScope,
+				installDaemon,
+				daemonRuntime: opts.daemonRuntime,
+				skipChannels: Boolean(opts.skipChannels),
+				skipSkills: Boolean(opts.skipSkills),
+				skipBootstrap: Boolean(opts.skipBootstrap),
+				skipSearch: Boolean(opts.skipSearch),
+				skipHealth: Boolean(opts.skipHealth),
+				skipUi: Boolean(opts.skipUi),
+				nodeManager: opts.nodeManager,
+				json: Boolean(opts.json)
+			}, defaultRuntime);
+		});
+	});
+}
+//#endregion
+export { registerOnboardCommand };

package/dist/register.runtime-CCeTiEB_.js

@@ -0,0 +1,81 @@
+import { a as normalizeLowercaseStringOrEmpty } from "./string-coerce-DPP_aYVc.js";
+import { t as formatCliCommand } from "./command-format-B3Q5KD9o.js";
+import { o as hasConfiguredSecretInput } from "./types.secrets-BbgGt42I.js";
+import { u as isPrivateIpAddress } from "./ssrf-FLmnjVdI.js";
+import "./text-runtime-CFgLIdKf.js";
+import "./secret-input-sz5hyJkX.js";
+import "./setup-tools-B3kHWu80.js";
+import { o as isPrivateNetworkOptInEnabled } from "./ssrf-policy-klk3nkr1.js";
+import "./plugin-service-c09KhFRA.js";
+import { n as resolveBrowserControlAuth } from "./control-auth-D6O4ILiF.js";
+import "./browser-runtime-DirlsYmK.js";
+import { n as resolveProfile, t as resolveBrowserConfig } from "./config-Cs1RBMvI.js";
+import { f as redactCdpUrl } from "./cdp.helpers-Ch0SX_4B.js";
+import { t as hasNonEmptyString } from "./record-shared-CwIBuAhK.js";
+//#region extensions/browser/src/security-audit.ts
+const BLOCKED_HOSTNAMES = new Set([
+	"localhost",
+	"localhost.localdomain",
+	"metadata.google.internal"
+]);
+function isTrustedPrivateHostname(hostname) {
+	const normalized = normalizeLowercaseStringOrEmpty(hostname);
+	return normalized.length > 0 && BLOCKED_HOSTNAMES.has(normalized);
+}
+function collectBrowserSecurityAuditFindings(ctx) {
+	const findings = [];
+	let resolved;
+	try {
+		resolved = resolveBrowserConfig(ctx.config.browser, ctx.config);
+	} catch (err) {
+		findings.push({
+			checkId: "browser.control_invalid_config",
+			severity: "warn",
+			title: "Browser control config looks invalid",
+			detail: String(err),
+			remediation: `Fix browser.cdpUrl in ${ctx.configPath} and re-run "${formatCliCommand("genesis security audit --deep")}".`
+		});
+		return findings;
+	}
+	if (!resolved.enabled) return findings;
+	const browserAuth = resolveBrowserControlAuth(ctx.config, ctx.env);
+	const explicitAuthMode = ctx.config.gateway?.auth?.mode;
+	const tokenConfigured = Boolean(browserAuth.token) || hasNonEmptyString(ctx.env.GENESIS_GATEWAY_TOKEN) || hasConfiguredSecretInput(ctx.config.gateway?.auth?.token, ctx.config.secrets?.defaults);
+	const passwordCanWin = explicitAuthMode === "password" || explicitAuthMode !== "token" && explicitAuthMode !== "none" && explicitAuthMode !== "trusted-proxy" && !tokenConfigured;
+	const passwordConfigured = Boolean(browserAuth.password) || passwordCanWin && (hasNonEmptyString(ctx.env.GENESIS_GATEWAY_PASSWORD) || hasConfiguredSecretInput(ctx.config.gateway?.auth?.password, ctx.config.secrets?.defaults));
+	if (!tokenConfigured && !passwordConfigured) findings.push({
+		checkId: "browser.control_no_auth",
+		severity: "critical",
+		title: "Browser control has no auth",
+		detail: "Browser control HTTP routes are enabled but no gateway.auth token/password is configured. Any local process (or SSRF to loopback) can call browser control endpoints.",
+		remediation: "Set gateway.auth.token (recommended) or gateway.auth.password so browser control HTTP routes require authentication. Restarting the gateway will auto-generate gateway.auth.token when browser control is enabled."
+	});
+	for (const name of Object.keys(resolved.profiles)) {
+		const profile = resolveProfile(resolved, name);
+		if (!profile || profile.cdpIsLoopback) continue;
+		let url;
+		try {
+			url = new URL(profile.cdpUrl);
+		} catch {
+			continue;
+		}
+		const redactedCdpUrl = redactCdpUrl(profile.cdpUrl) ?? profile.cdpUrl;
+		if (url.protocol === "http:") findings.push({
+			checkId: "browser.remote_cdp_http",
+			severity: "warn",
+			title: "Remote CDP uses HTTP",
+			detail: `browser profile "${name}" uses http CDP (${redactedCdpUrl}); this is OK only if it's tailnet-only or behind an encrypted tunnel.`,
+			remediation: "Prefer HTTPS/TLS or a tailnet-only endpoint for remote CDP."
+		});
+		if (isPrivateNetworkOptInEnabled(resolved.ssrfPolicy) && (isTrustedPrivateHostname(url.hostname) || isPrivateIpAddress(url.hostname))) findings.push({
+			checkId: "browser.remote_cdp_private_host",
+			severity: "warn",
+			title: "Remote CDP targets a private/internal host",
+			detail: `browser profile "${name}" points at a private/internal CDP host (${redactedCdpUrl}). This is expected for LAN/tailnet/WSL-style setups, but treat it as a trusted-network endpoint.`,
+			remediation: "Prefer a tailnet or tunnel for remote CDP. If you want strict blocking, set browser.ssrfPolicy.dangerouslyAllowPrivateNetwork=false and allow only explicit hosts."
+		});
+	}
+	return findings;
+}
+//#endregion
+export { collectBrowserSecurityAuditFindings as t };

package/dist/register.runtime.js

@@ -1 +1 @@
-export * from "./register.runtime-DDACHKw5.js";
+export * from "./register.runtime-CCeTiEB_.js";