@primusclaw/connector 0.0.0-stage → 0.1.0

package/dist/cli.js

@@ -0,0 +1,3972 @@
+#!/usr/bin/env node
+
+// src/commands.ts
+import fs13 from "node:fs";
+import os4 from "node:os";
+import path14 from "node:path";
+import { fileURLToPath } from "node:url";
+import { parseArgs } from "node:util";
+
+// src/audit.ts
+import fs from "node:fs";
+import path from "node:path";
+
+// src/redact.ts
+var MASK = "[hidden]";
+var B64 = "[A-Za-z0-9+/=_-]";
+var RULES = [
+  [/-----BEGIN [A-Z ]*PRIVATE KEY(?: BLOCK)?-----[\s\S]*?(?:-----END [A-Z ]*PRIVATE KEY(?: BLOCK)?-----|$)/g, 0],
+  [/\b(?:gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,})/g, 0],
+  [/\bBearer\s+[A-Za-z0-9._~+/=-]{16,}/gi, 0],
+  [/\bak-[A-Za-z0-9_-]{16,}/g, 0],
+  [/\bsk-[A-Za-z0-9_-]{16,}/g, 0],
+  [/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g, 0],
+  [/\bxox[abposr]-[A-Za-z0-9-]{10,}/g, 0],
+  [/\bglpat-[A-Za-z0-9_-]{16,}/g, 0],
+  [/\bAIza[A-Za-z0-9_-]{30,}/g, 0],
+  [/\bnpm_[A-Za-z0-9]{30,}/g, 0],
+  [/\b[sr]k_(?:live|test)_[A-Za-z0-9]{16,}/g, 0],
+  [/\beyJ[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}/g, 0],
+  // A long opaque value right after a word like token/secret/key/password.
+  [new RegExp(`(?:token|secret|api[_-]?key|password|passwd|\\bkey)[\\w-]*["']?\\s*(?::|=|\\bis\\b)\\s*["']?(?=${B64}*\\d)(?=${B64}*[A-Za-z])(${B64}{32,})`, "gi"), 1]
+];
+function redactText(text) {
+  let masked = false;
+  let out = text;
+  for (const [re, group] of RULES) {
+    out = out.replace(re, (...args) => {
+      masked = true;
+      const match = args[0];
+      if (group === 0) return MASK;
+      const value = args[group];
+      const at = match.lastIndexOf(value);
+      return match.slice(0, at) + MASK + match.slice(at + value.length);
+    });
+  }
+  return { text: out, masked };
+}
+function redactDeep(value) {
+  if (typeof value === "string") return redactText(value).text;
+  if (Array.isArray(value)) return value.map((v) => redactDeep(v));
+  if (value && typeof value === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) out[k] = redactDeep(v);
+    return out;
+  }
+  return value;
+}
+
+// src/audit.ts
+function fileAudit(file, now = Date.now) {
+  fs.mkdirSync(path.dirname(file), { recursive: true, mode: 448 });
+  return {
+    record(kind, detail = {}) {
+      const line = JSON.stringify({ ts: new Date(now()).toISOString(), ...redactDeep(detail), kind });
+      try {
+        fs.appendFileSync(file, line + "\n", { mode: 384 });
+      } catch {
+        process.stderr.write(`audit write failed: ${kind}
+`);
+      }
+    }
+  };
+}
+
+// src/children.ts
+import { execFileSync } from "node:child_process";
+import fs2 from "node:fs";
+import path2 from "node:path";
+
+// src/util.ts
+import { createHash } from "node:crypto";
+var sleep = (ms, signal) => new Promise((resolve) => {
+  if (signal?.aborted) return resolve();
+  const t = setTimeout(done, ms);
+  function done() {
+    signal?.removeEventListener("abort", done);
+    clearTimeout(t);
+    resolve();
+  }
+  signal?.addEventListener("abort", done, { once: true });
+});
+var sha256 = (s) => createHash("sha256").update(s).digest("hex");
+var isObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+var errMessage = (e) => e instanceof Error ? e.message : String(e);
+function truncateBytes(text, max) {
+  const bytes = Buffer.byteLength(text, "utf8");
+  if (bytes <= max) return { text, truncated: false, bytes };
+  let cut = Buffer.from(text, "utf8").subarray(0, max).toString("utf8");
+  if (cut.endsWith("\uFFFD")) cut = cut.slice(0, -1);
+  return { text: `${cut}
+[truncated, ${bytes} bytes in all]`, truncated: true, bytes };
+}
+function backoffMs(attempt, minMs, maxMs, random = Math.random) {
+  const raw = Math.min(maxMs, minMs * 2 ** Math.min(attempt, 30));
+  return Math.round(raw * (0.5 + random() / 2));
+}
+var stderrLogger = (quiet = false) => {
+  const w = (level) => (msg, extra) => {
+    if (quiet && level === "info") return;
+    process.stderr.write(`${(/* @__PURE__ */ new Date()).toISOString()} ${level} ${msg}${extra ? " " + JSON.stringify(extra) : ""}
+`);
+  };
+  return { info: w("info"), warn: w("warn"), error: w("error") };
+};
+var UrlError = class extends Error {
+};
+function secureUrl(raw, what) {
+  let u;
+  try {
+    u = new URL(raw);
+  } catch {
+    throw new UrlError(`${what} is not a valid URL: ${JSON.stringify(raw.slice(0, 80))}`);
+  }
+  const loopback = u.hostname === "localhost" || u.hostname === "[::1]" || /^127(\.\d{1,3}){3}$/.test(u.hostname);
+  if (u.protocol !== "https:" && !(u.protocol === "http:" && loopback)) {
+    throw new UrlError(`${what} must be an https:// URL (http:// is accepted only for localhost), got ${u.protocol}//${u.host}`);
+  }
+  return raw.replace(/\/+$/, "");
+}
+
+// src/children.ts
+function processStart(pid) {
+  try {
+    if (process.platform === "linux") {
+      const stat = fs2.readFileSync(`/proc/${pid}/stat`, "utf8");
+      const rest = stat.slice(stat.lastIndexOf(")") + 2).split(" ");
+      return rest[19] ?? null;
+    }
+    return execFileSync("ps", ["-o", "lstart=", "-p", String(pid)], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim() || null;
+  } catch {
+    return null;
+  }
+}
+var isAlive = (pid) => {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (e) {
+    return e.code === "EPERM";
+  }
+};
+var ChildRegistry = class {
+  constructor(file) {
+    this.file = file;
+    this.recs = new Map(readRecords(file).map((r) => [r.pid, r]));
+  }
+  file;
+  recs = /* @__PURE__ */ new Map();
+  save() {
+    fs2.mkdirSync(path2.dirname(this.file), { recursive: true, mode: 448 });
+    const tmp = `${this.file}.${process.pid}.tmp`;
+    fs2.writeFileSync(tmp, JSON.stringify([...this.recs.values()]), { mode: 384 });
+    fs2.renameSync(tmp, this.file);
+  }
+  add(rec) {
+    const full = { ...rec, start: rec.start ?? processStart(rec.pid) ?? "", started_at: (/* @__PURE__ */ new Date()).toISOString() };
+    this.recs.set(full.pid, full);
+    this.save();
+    return full;
+  }
+  remove(pid) {
+    if (this.recs.delete(pid)) this.save();
+  }
+  list() {
+    return [...this.recs.values()];
+  }
+  /**
+   * True when the recorded process group is ours to signal.
+   *
+   * Either its leader is still the process we started (same pid and start time), or the leader is gone and members
+   * remain: a process group id is a pid that cannot be handed to another process while any member lives, so a
+   * group that is still alive under a recorded id with a dead leader can only be the one we started (an `npx`
+   * wrapper exits and the agent below it stays). A leader pid that now belongs to a different process is a
+   * recycled id and is left alone.
+   */
+  isOurs(rec) {
+    if (rec.start === "") return false;
+    const now = processStart(rec.pid);
+    if (now === rec.start) return true;
+    if (now === null) return groupAlive(rec.pgid);
+    return false;
+  }
+  /**
+   * The leader exited: stop whatever it left behind in its group, then forget it.
+   * Called at the moment of exit, while the group id cannot yet belong to anyone else.
+   */
+  async reap(pid, graceMs = 1e3) {
+    const r = this.recs.get(pid);
+    if (!r) return;
+    if (groupAlive(r.pgid)) {
+      signalGroup(r.pgid, "SIGTERM");
+      const deadline = Date.now() + graceMs;
+      while (Date.now() < deadline && groupAlive(r.pgid)) await sleep(25);
+      if (groupAlive(r.pgid)) signalGroup(r.pgid, "SIGKILL");
+    }
+    this.recs.delete(pid);
+    this.save();
+  }
+  /** Stop one recorded process group (the same way {@link killAll} does), and only that one. */
+  async kill(pid, graceMs = 1500) {
+    const r = this.recs.get(pid);
+    if (!r) return false;
+    if (!this.isOurs(r)) {
+      this.recs.delete(pid);
+      this.save();
+      return false;
+    }
+    signalGroup(r.pgid, "SIGTERM");
+    const deadline = Date.now() + graceMs;
+    while (Date.now() < deadline && groupAlive(r.pgid)) await sleep(25);
+    if (groupAlive(r.pgid)) signalGroup(r.pgid, "SIGKILL");
+    this.recs.delete(pid);
+    this.save();
+    return true;
+  }
+  /**
+   * Stop every recorded process group: SIGTERM, a short grace, then SIGKILL.
+   * Records that are not ours (see {@link isOurs}: a recycled pid, or a group with nobody left in it) are dropped
+   * without signalling anything.
+   */
+  async killAll(graceMs = 2e3) {
+    const killed = [];
+    const skipped = [];
+    const mine = this.list().filter((r) => {
+      if (this.isOurs(r)) return true;
+      skipped.push(r.pid);
+      this.recs.delete(r.pid);
+      return false;
+    });
+    for (const r of mine) signalGroup(r.pgid, "SIGTERM");
+    const deadline = Date.now() + graceMs;
+    while (Date.now() < deadline && mine.some((r) => groupAlive(r.pgid))) await sleep(50);
+    for (const r of mine) {
+      if (groupAlive(r.pgid)) signalGroup(r.pgid, "SIGKILL");
+      killed.push(r.pid);
+      this.recs.delete(r.pid);
+    }
+    this.save();
+    return { killed, skipped };
+  }
+};
+function readRecords(file) {
+  try {
+    const raw = JSON.parse(fs2.readFileSync(file, "utf8"));
+    return Array.isArray(raw) ? raw.filter((r) => Number.isInteger(r?.pid) && Number.isInteger(r?.pgid) && r.pgid > 1) : [];
+  } catch {
+    return [];
+  }
+}
+function signalGroup(pgid, sig) {
+  try {
+    process.kill(-pgid, sig);
+  } catch {
+  }
+}
+function groupAlive(pgid) {
+  try {
+    process.kill(-pgid, 0);
+    return true;
+  } catch (e) {
+    return e.code === "EPERM";
+  }
+}
+
+// src/sse.ts
+var SseParser = class {
+  buf = "";
+  push(chunk) {
+    this.buf += chunk;
+    const out = [];
+    for (; ; ) {
+      const m = /\r\n\r\n|\n\n|\r\r/.exec(this.buf);
+      if (!m) break;
+      const block = this.buf.slice(0, m.index);
+      this.buf = this.buf.slice(m.index + m[0].length);
+      const f = parseBlock(block);
+      if (f) out.push(f);
+    }
+    return out;
+  }
+};
+function parseBlock(block) {
+  const f = {};
+  let any = false;
+  for (const line of block.split(/\r\n|\n|\r/)) {
+    if (line === "") continue;
+    if (line.startsWith(":")) {
+      f.comment = true;
+      any = true;
+      continue;
+    }
+    const i = line.indexOf(":");
+    const key = i < 0 ? line : line.slice(0, i);
+    const val = i < 0 ? "" : line.slice(i + 1).replace(/^ /, "");
+    if (key === "id") f.id = val;
+    else if (key === "event") f.event = val;
+    else if (key === "data") f.data = f.data === void 0 ? val : f.data + "\n" + val;
+    else continue;
+    any = true;
+  }
+  return any ? f : null;
+}
+async function* readSse(body, onBytes = () => {
+}) {
+  const reader = body.getReader();
+  const dec = new TextDecoder();
+  const p = new SseParser();
+  try {
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (done) return;
+      onBytes();
+      for (const f of p.push(dec.decode(value, { stream: true }))) yield f;
+    }
+  } finally {
+    reader.cancel().catch(() => {
+    });
+  }
+}
+
+// src/claw-client.ts
+var RevokedError = class extends Error {
+  constructor() {
+    super("this connector was revoked");
+  }
+};
+var HttpError = class extends Error {
+  constructor(status, code, path15) {
+    super(`${path15} answered ${status} ${code}`);
+    this.status = status;
+    this.code = code;
+    this.path = path15;
+  }
+  status;
+  code;
+  path;
+};
+var TransportError = class extends Error {
+};
+var ClawClient = class {
+  constructor(o) {
+    this.o = o;
+    this.o = { ...o, server: secureUrl(o.server, "the Claw server URL") };
+    this.f = o.fetch ?? fetch;
+  }
+  o;
+  f;
+  async headers(extra = {}) {
+    return {
+      authorization: `Bearer ${await this.o.tokens.bearer()}`,
+      "x-claw-client": this.o.clientLabel ?? "connector",
+      accept: "application/json",
+      ...extra
+    };
+  }
+  async send(method, path15, body, signal) {
+    const url = this.o.server + path15;
+    for (let attempt = 0; ; attempt++) {
+      const headers = await this.headers(body === void 0 ? {} : { "content-type": "application/json" });
+      let res;
+      try {
+        res = await this.f(url, {
+          method,
+          headers,
+          body: body === void 0 ? void 0 : JSON.stringify(body),
+          signal: signal ?? AbortSignal.timeout(this.o.requestTimeoutMs ?? 2e4)
+        });
+      } catch (e) {
+        throw new TransportError(`${method} ${path15}: ${errMessage(e)}`);
+      }
+      if (res.status !== 401) return res;
+      const err = await errorCode(res);
+      if (err === "revoked") throw new RevokedError();
+      if (attempt === 0) {
+        this.o.tokens.invalidate();
+        continue;
+      }
+      throw new HttpError(401, err, path15);
+    }
+  }
+  async json(method, path15, body) {
+    const res = await this.send(method, path15, body);
+    if (!res.ok) throw new HttpError(res.status, await errorCode(res), path15);
+    const parsed = await res.json().catch(() => null);
+    return isObject(parsed) && isObject(parsed.data) ? parsed.data : {};
+  }
+  async register(name, version) {
+    const d = await this.json("POST", "/v1/remote-agents/connectors", { name, version });
+    if (typeof d.connector_id !== "string") throw new HttpError(500, "no_connector_id", "/v1/remote-agents/connectors");
+    return d.connector_id;
+  }
+  async heartbeat(cid, hb) {
+    await this.json("POST", `/v1/remote-agents/connectors/${cid}/heartbeat`, hb);
+  }
+  async postEvents(cid, batchId, events) {
+    const d = await this.json("POST", `/v1/remote-agents/connectors/${cid}/events`, { batch_id: batchId, events });
+    return { acked: isObject(d.acked) ? d.acked : {}, rejected: Array.isArray(d.rejected) ? d.rejected : [] };
+  }
+  /**
+   * Hold the command stream. Yields every frame (a `ping` too, since it is
+   * proof of life). Ends normally when the server closes it; throws
+   * {@link TransportError} when the network fails or nothing arrives for
+   * `watchdogMs`, and {@link RevokedError} on 401 `revoked`.
+   */
+  async *commands(cid, opts) {
+    const stop = new AbortController();
+    const onAbort = () => stop.abort();
+    opts.signal?.addEventListener("abort", onAbort, { once: true });
+    let timedOut = false;
+    let timer;
+    const arm = () => {
+      clearTimeout(timer);
+      timer = setTimeout(() => {
+        timedOut = true;
+        stop.abort();
+      }, opts.watchdogMs);
+      timer.unref?.();
+    };
+    try {
+      arm();
+      const path15 = `/v1/remote-agents/connectors/${cid}/commands`;
+      const headers = await this.headers({ accept: "text/event-stream", ...opts.lastEventId ? { "last-event-id": String(opts.lastEventId) } : {} });
+      let res;
+      try {
+        res = await this.f(this.o.server + path15, { headers, signal: stop.signal });
+      } catch (e) {
+        throw new TransportError(timedOut ? `no response for ${opts.watchdogMs} ms` : `GET ${path15}: ${errMessage(e)}`);
+      }
+      if (res.status === 401) {
+        const err = await errorCode(res);
+        if (err === "revoked") throw new RevokedError();
+        this.o.tokens.invalidate();
+        throw new HttpError(401, err, path15);
+      }
+      if (!res.ok || !res.body) throw new HttpError(res.status, await errorCode(res), path15);
+      try {
+        for await (const frame of readSse(res.body, arm)) yield frame;
+      } catch (e) {
+        throw new TransportError(timedOut ? `no byte for ${opts.watchdogMs} ms` : `command stream: ${errMessage(e)}`);
+      }
+      if (timedOut) throw new TransportError(`no byte for ${opts.watchdogMs} ms`);
+    } finally {
+      clearTimeout(timer);
+      opts.signal?.removeEventListener("abort", onAbort);
+      stop.abort();
+    }
+  }
+};
+async function errorCode(res) {
+  const body = await res.json().catch(() => null);
+  return isObject(body) && typeof body.error === "string" ? body.error : `http_${res.status}`;
+}
+
+// src/config.ts
+import fs4 from "node:fs";
+import os from "node:os";
+import path4 from "node:path";
+import { parse as parseToml } from "smol-toml";
+
+// src/roots.ts
+import fs3 from "node:fs";
+import path3 from "node:path";
+function realRoot(root) {
+  try {
+    return fs3.realpathSync.native(root);
+  } catch {
+    return null;
+  }
+}
+var inside = (child, root) => child === root || child.startsWith(root.endsWith(path3.sep) ? root : root + path3.sep);
+function checkCwd(cwd, roots) {
+  if (typeof cwd !== "string" || cwd === "" || cwd.includes("\0")) return { ok: false, reason: "invalid_cwd" };
+  if (!path3.isAbsolute(cwd)) return { ok: false, reason: "cwd_not_absolute" };
+  let real;
+  try {
+    real = fs3.realpathSync.native(cwd);
+  } catch {
+    return { ok: false, reason: "cwd_not_found" };
+  }
+  try {
+    if (!fs3.statSync(real).isDirectory()) return { ok: false, reason: "cwd_not_directory" };
+  } catch {
+    return { ok: false, reason: "cwd_not_found" };
+  }
+  for (const root of roots) {
+    const r = realRoot(root);
+    if (r && inside(real, r)) return { ok: true, real };
+  }
+  return { ok: false, reason: "cwd_outside_roots" };
+}
+function relativeInside(p, cwd) {
+  const abs = path3.resolve(cwd, p);
+  let real;
+  try {
+    real = fs3.realpathSync.native(abs);
+  } catch {
+    try {
+      real = path3.join(fs3.realpathSync.native(path3.dirname(abs)), path3.basename(abs));
+    } catch {
+      return null;
+    }
+  }
+  if (!inside(real, cwd)) return null;
+  return path3.relative(cwd, real).split(path3.sep).join("/");
+}
+
+// src/config.ts
+var ConfigError = class extends Error {
+  constructor(problems) {
+    super(`agents.toml: ${problems.join("; ")}`);
+    this.problems = problems;
+  }
+  problems;
+};
+var PRESETS = {
+  claude: {
+    kind: "claude",
+    name: "Claude Code",
+    command: "npx",
+    args: ["-y", "@agentclientprotocol/claude-agent-acp@0.99.0"],
+    askMode: "default",
+    safeModes: ["default", "plan"],
+    unattended: { askMode: "bypassPermissions" }
+  },
+  // Existing Claude Code sessions, taken over from the phone. The kind is the opaque label a chat client picks an icon
+  // from; it says what the entry is for, not which product serves it. Same adapter and same ask mode as `claude`.
+  "claude-attach": {
+    kind: "attach",
+    name: "Claude Code (existing sessions)",
+    command: "npx",
+    args: ["-y", "@agentclientprotocol/claude-agent-acp@0.99.0"],
+    askMode: "default",
+    safeModes: ["default", "plan"],
+    attach: true,
+    unattended: { askMode: "bypassPermissions" }
+  },
+  codex: {
+    kind: "codex",
+    name: "Codex",
+    command: "npx",
+    args: ["-y", "@agentclientprotocol/codex-acp@2.3.0"],
+    askMode: "read-only",
+    safeModes: ["read-only"],
+    unattended: { askMode: "agent-full-access" }
+  },
+  cursor: {
+    kind: "cursor",
+    name: "Cursor",
+    command: "agent",
+    args: ["acp"],
+    askMode: "ask",
+    safeModes: ["ask", "plan"],
+    unattended: { askMode: "agent", args: ["--force", "acp"] }
+  }
+};
+var ID_RE = /^[A-Za-z0-9._-]{1,64}$/;
+var KIND_RE = /^[A-Za-z0-9._:-]{1,64}$/;
+var BYPASS_ARG_RE = /^--?(?:force|yolo|dangerously[\w-]*|trust|auto-?approve[\w-]*|approve-mcps|full-auto|bypass[\w-]*)$/i;
+var strList = (v, what, problems) => {
+  if (v === void 0) return [];
+  if (!Array.isArray(v) || v.some((x) => typeof x !== "string")) {
+    problems.push(`${what} must be a list of strings`);
+    return [];
+  }
+  return v;
+};
+var expandHome = (p) => p === "~" ? os.homedir() : p.startsWith("~/") ? path4.join(os.homedir(), p.slice(2)) : p;
+function parseConfig(text, defaults = {}) {
+  const problems = [];
+  let doc;
+  try {
+    doc = parseToml(text);
+  } catch (e) {
+    throw new ConfigError([`not valid TOML (${e.message.split("\n")[0]})`]);
+  }
+  const allowUnsafeModes = doc.allow_unsafe_modes === true;
+  if (doc.allow_unsafe_modes !== void 0 && typeof doc.allow_unsafe_modes !== "boolean") problems.push("allow_unsafe_modes must be true or false");
+  const server = typeof doc.server === "string" && doc.server.trim() ? doc.server.trim().replace(/\/+$/, "") : null;
+  const identityUrl = typeof doc.identity_url === "string" && doc.identity_url.trim() ? doc.identity_url.trim().replace(/\/+$/, "") : null;
+  const name = typeof doc.name === "string" && doc.name.trim() ? doc.name.trim().slice(0, 64) : (defaults.hostname ?? os.hostname()).slice(0, 64);
+  const dropMessagePatterns = [];
+  for (const p of strList(doc.drop_message_patterns, "drop_message_patterns", problems)) {
+    try {
+      dropMessagePatterns.push(new RegExp(p));
+    } catch {
+      problems.push(`drop_message_patterns: invalid regular expression ${JSON.stringify(p)}`);
+    }
+  }
+  const globalAllow = parseAutoAllow(doc.auto_allow, "auto_allow", problems);
+  const agents = [];
+  const seen = /* @__PURE__ */ new Set();
+  const rawAgents = doc.agents === void 0 ? [] : doc.agents;
+  if (!Array.isArray(rawAgents)) problems.push("agents must be a list of [[agents]] tables");
+  else rawAgents.forEach((raw, i) => {
+    const at = `agents[${i}]`;
+    if (!isObject(raw)) return void problems.push(`${at} must be a table`);
+    const id = raw.id;
+    if (typeof id !== "string" || !ID_RE.test(id)) return void problems.push(`${at}.id must be 1-64 characters of A-Z a-z 0-9 . _ -`);
+    if (seen.has(id)) return void problems.push(`${at}.id ${id} is used twice`);
+    seen.add(id);
+    const label = `agent ${id}`;
+    const presetName = typeof raw.preset === "string" ? raw.preset : null;
+    const preset = presetName ? PRESETS[presetName] : void 0;
+    if (presetName && !preset) return void problems.push(`${label}: unknown preset ${JSON.stringify(presetName)} (known: ${Object.keys(PRESETS).join(", ")})`);
+    const command = typeof raw.command === "string" && raw.command ? raw.command : preset?.command;
+    if (!command) return void problems.push(`${label}: needs a preset or a command`);
+    if (raw.approval !== void 0 && raw.approval !== "ask" && raw.approval !== "never") return void problems.push(`${label}: approval must be "ask" or "never"`);
+    const approval = raw.approval === "ask" || raw.approval === "never" ? raw.approval : null;
+    const never = approval === "never";
+    const allowUnsafe = approval === null ? allowUnsafeModes : never;
+    const args = raw.args !== void 0 ? strList(raw.args, `${label}.args`, problems) : [...(never ? preset?.unattended.args : void 0) ?? preset?.args ?? []];
+    const kind = typeof raw.kind === "string" ? raw.kind : preset?.kind ?? "custom";
+    if (!KIND_RE.test(kind)) problems.push(`${label}: kind must be 1-64 characters of A-Z a-z 0-9 . _ : -`);
+    const explicitAsk = typeof raw.ask_mode === "string" && raw.ask_mode ? raw.ask_mode : null;
+    const askMode = explicitAsk ?? (never ? preset?.unattended.askMode : preset?.askMode);
+    if (!askMode) return void problems.push(never ? `${label}: approval = "never" needs ask_mode, the mode in which this agent does not ask, for a custom agent` : `${label}: ask_mode is required for a custom agent`);
+    const listed = [...raw.safe_modes !== void 0 ? strList(raw.safe_modes, `${label}.safe_modes`, problems) : preset?.safeModes ?? [askMode]];
+    const asking = new Set(preset ? preset.safeModes : raw.safe_modes !== void 0 ? listed : []);
+    let safeModes = listed;
+    if (preset && !allowUnsafe) {
+      const extra = listed.filter((m) => !asking.has(m));
+      if (extra.length) problems.push(`${label}: safe_modes lists ${extra.join(", ")}, which preset ${presetName} does not know to ask before every step; remove it, set approval = "never" (or allow_unsafe_modes = true), or define the agent without a preset`);
+    }
+    if (never) {
+      if (explicitAsk && asking.has(explicitAsk)) problems.push(`${label}: approval = "never" but ask_mode ${explicitAsk} is a mode that asks before every step; remove ask_mode, or approval`);
+      asking.delete(askMode);
+      safeModes = safeModes.filter((m) => m !== askMode);
+    } else if (!asking.has(askMode)) {
+      if (preset && explicitAsk) {
+        if (!allowUnsafe) problems.push(`${label}: ask_mode ${askMode} is not a mode that asks before every step; set approval = "never" (or allow_unsafe_modes = true) to use it`);
+      } else asking.add(askMode);
+    }
+    if (asking.has(askMode) && !safeModes.includes(askMode)) safeModes.push(askMode);
+    const roots = strList(raw.roots, `${label}.roots`, problems).map((r) => path4.resolve(expandHome(r)));
+    if (roots.length === 0) problems.push(`${label}: roots is required (an agent with no allowed directory is never offered)`);
+    for (const r of roots) {
+      if (r === path4.parse(r).root) problems.push(`${label}: a root may not be the filesystem root`);
+      else if (!realRoot(r)) problems.push(`${label}: root ${r} does not exist`);
+    }
+    const env = {};
+    if (raw.env !== void 0) {
+      if (!isObject(raw.env)) problems.push(`${label}.env must be a table of strings`);
+      else for (const [k, v] of Object.entries(raw.env)) {
+        if (typeof v !== "string") problems.push(`${label}.env.${k} must be a string`);
+        else env[k] = v;
+      }
+    }
+    if (!allowUnsafe) {
+      const bad = args.find((a) => BYPASS_ARG_RE.test(a));
+      if (bad) problems.push(`${label}: ${bad} turns the tool's own approvals off; remove it or set approval = "never" (or allow_unsafe_modes = true)`);
+    }
+    const own = parseAutoAllow(raw.auto_allow, `${label}.auto_allow`, problems);
+    let attach = null;
+    if (preset?.attach) {
+      const cli = raw.attach_cli === void 0 ? "claude" : raw.attach_cli;
+      if (typeof cli !== "string" || !cli.trim()) problems.push(`${label}.attach_cli must be a command name or path`);
+      else attach = { cli: cli.trim() };
+    } else if (raw.attach_cli !== void 0) {
+      problems.push(`${label}: attach_cli only applies to an agent made from the claude-attach preset`);
+    }
+    agents.push({
+      id,
+      kind,
+      name: typeof raw.name === "string" && raw.name.trim() ? raw.name.trim().slice(0, 128) : preset?.name ?? id,
+      command,
+      args,
+      env,
+      roots,
+      askMode,
+      safeModes,
+      askingModes: [...asking],
+      allowUnsafeModes: allowUnsafe,
+      unattended: !asking.has(askMode),
+      autoAllow: [...globalAllow, ...own],
+      attach
+    });
+  });
+  if (problems.length) throw new ConfigError(problems);
+  return { server, identityUrl, name, allowUnsafeModes, dropMessagePatterns, agents };
+}
+function parseAutoAllow(raw, at, problems) {
+  if (raw === void 0) return [];
+  if (!Array.isArray(raw)) {
+    problems.push(`${at} must be a list of { kind, path_glob }`);
+    return [];
+  }
+  const rules = [];
+  raw.forEach((r, i) => {
+    if (!isObject(r) || typeof r.kind !== "string" || typeof r.path_glob !== "string" || !r.kind || !r.path_glob) {
+      return void problems.push(`${at}[${i}] needs a kind and a path_glob`);
+    }
+    if (path4.isAbsolute(r.path_glob) || r.path_glob.split("/").includes("..")) {
+      return void problems.push(`${at}[${i}].path_glob must be relative to the working directory and may not contain ..`);
+    }
+    rules.push({ kind: r.kind, pathGlob: r.path_glob });
+  });
+  return rules;
+}
+function loadConfig(file, defaults = {}) {
+  let text;
+  try {
+    text = fs4.readFileSync(file, "utf8");
+  } catch (e) {
+    if (e.code === "ENOENT") throw new ConfigError([`${file} does not exist; run "claw-connector init" to create one`]);
+    throw e;
+  }
+  return parseConfig(text, defaults);
+}
+var SAMPLE_AGENTS = ["claude", "claude-attach", "codex", "cursor"];
+var SAMPLE_ACTIVE = ["claude"];
+function sampleApprovals(approval) {
+  const never = SAMPLE_AGENTS.filter((id) => approval[id] === "never");
+  return { unattended: never.filter((id) => SAMPLE_ACTIVE.includes(id)), parked: never.filter((id) => !SAMPLE_ACTIVE.includes(id)) };
+}
+var SAMPLE_NOTES = {
+  "claude-attach": "# Take over a Claude Code conversation that already exists on this machine (exit it in the terminal first)."
+};
+var NEVER_NOTE = `# No per-step approval: this agent runs like it does in your terminal. A phone session writes files and runs
+# commands without asking, and the phone shows it as unattended. To go back to asking, set it to "ask".`;
+function sampleConfig(approval = {}) {
+  const agent = (id) => {
+    const lines = [...SAMPLE_NOTES[id] ? [SAMPLE_NOTES[id]] : [], `[[agents]]`, `id = "${id}"`, `preset = "${id}"`, `roots = ["~/work"]`];
+    if (approval[id] === "never") lines.push(...NEVER_NOTE.split("\n"), `approval = "never"`);
+    return lines.map((l) => SAMPLE_ACTIVE.includes(id) || l.startsWith("#") ? l : `# ${l}`).join("\n");
+  };
+  return `# claw-connector: the agents this machine offers, and what they may touch.
+# Policy lives here, on your machine; nothing Claw sends can widen it.
+
+# server = "https://claw.example.com/claw-api"
+# identity_url = "https://identity.example.com"
+# name = "my-laptop"
+
+# By default every agent asks before it writes a file or runs a command, and the phone answers each question.
+# approval = "never" on an agent turns that off for it (a phone session runs like your terminal);
+# approval = "ask" keeps it on. Modes in which an agent does not ask (bypassPermissions, acceptEdits, full access...)
+# are refused for an agent without approval = "never" unless you set this for every agent at once:
+# allow_unsafe_modes = false
+
+${SAMPLE_AGENTS.map(agent).join("\n\n")}
+
+# Let one kind of change through without asking, inside the session's directory.
+# Every automatic approval is written to audit.jsonl and shown on the phone.
+# auto_allow = [{ kind = "edit", path_glob = "docs/**" }]
+`;
+}
+var SAMPLE_CONFIG = sampleConfig();
+
+// src/credentials.ts
+import fs5 from "node:fs";
+import path5 from "node:path";
+var DEFAULT_CLIENT_ID = "claw-connector";
+var CONNECTOR_SCOPE = "claw.connector";
+var CredentialsError = class extends Error {
+};
+var GrantRevokedError = class extends Error {
+  constructor(message = "the sign-in was revoked") {
+    super(message);
+  }
+};
+var TransientAuthError = class extends Error {
+};
+function loadCredentials(file) {
+  let fd;
+  try {
+    fd = fs5.openSync(file, "r");
+  } catch (e) {
+    if (e.code === "ENOENT") return null;
+    throw e;
+  }
+  let text;
+  try {
+    const st = fs5.fstatSync(fd);
+    if (process.platform !== "win32" && (st.mode & 63) !== 0) {
+      throw new CredentialsError(`${file} is readable by other users (mode ${(st.mode & 511).toString(8)}); run: chmod 600 ${file}`);
+    }
+    text = fs5.readFileSync(fd, "utf8");
+  } finally {
+    fs5.closeSync(fd);
+  }
+  let raw;
+  try {
+    raw = JSON.parse(text);
+  } catch (e) {
+    throw new CredentialsError(`${file} is not valid JSON (${errMessage(e)})`);
+  }
+  if (!isObject(raw) || raw.v !== 1 || typeof raw.server !== "string" || raw.kind !== "device" && raw.kind !== "key") {
+    throw new CredentialsError(`${file} is not a sign-in file written by this program; run login again`);
+  }
+  return raw;
+}
+function saveCredentials(file, creds) {
+  fs5.mkdirSync(path5.dirname(file), { recursive: true, mode: 448 });
+  const tmp = `${file}.${process.pid}.tmp`;
+  fs5.writeFileSync(tmp, JSON.stringify(creds, null, 2) + "\n", { mode: 384 });
+  fs5.chmodSync(tmp, 384);
+  fs5.renameSync(tmp, file);
+}
+var KeyTokenProvider = class {
+  constructor(key) {
+    this.key = key;
+  }
+  key;
+  async bearer() {
+    return this.key;
+  }
+  invalidate() {
+  }
+};
+function parseTokenResponse(body) {
+  if (!isObject(body) || typeof body.access_token !== "string" || !body.access_token) return null;
+  const expires = typeof body.expires_in === "number" && body.expires_in > 0 ? body.expires_in : 300;
+  return {
+    access_token: body.access_token,
+    expires_in: expires,
+    refresh_token: typeof body.refresh_token === "string" && body.refresh_token ? body.refresh_token : void 0
+  };
+}
+var DeviceTokenProvider = class {
+  constructor(opts) {
+    this.opts = opts;
+    this.f = opts.fetch ?? fetch;
+    this.now = opts.now ?? Date.now;
+    this.skew = opts.skewMs ?? 6e4;
+    this.creds = opts.creds;
+    if (opts.initial) {
+      this.token = opts.initial.access_token;
+      this.expiresAt = this.now() + opts.initial.expires_in * 1e3;
+    }
+  }
+  opts;
+  token = null;
+  expiresAt = 0;
+  inflight = null;
+  f;
+  now;
+  skew;
+  creds;
+  async bearer() {
+    if (this.token && this.now() < this.expiresAt - this.skew) return this.token;
+    return this.refresh();
+  }
+  invalidate() {
+    this.token = null;
+    this.expiresAt = 0;
+  }
+  /** One refresh at a time; the refresh token rotates, so two in flight would revoke the grant. */
+  refresh() {
+    this.inflight ??= this.doRefresh().finally(() => {
+      this.inflight = null;
+    });
+    return this.inflight;
+  }
+  async doRefresh() {
+    const c = this.creds;
+    if (!c.identity_url || !c.refresh_token) throw new CredentialsError("the sign-in file has no refresh token; run login again");
+    const identity = secureUrl(c.identity_url, "the identity service URL");
+    let res;
+    try {
+      res = await this.f(`${identity}/oauth/token`, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
+        body: new URLSearchParams({ grant_type: "refresh_token", refresh_token: c.refresh_token, client_id: c.client_id ?? DEFAULT_CLIENT_ID, scope: CONNECTOR_SCOPE }),
+        signal: AbortSignal.timeout(15e3)
+      });
+    } catch (e) {
+      throw new TransientAuthError(`could not reach the identity service: ${errMessage(e)}`);
+    }
+    const body = await res.json().catch(() => null);
+    if (res.status === 400 || res.status === 401) {
+      const err = isObject(body) ? body.error : void 0;
+      if (err === "invalid_grant" || err === "invalid_client" || err === "unauthorized_client") throw new GrantRevokedError(`the identity service refused the refresh token (${String(err)})`);
+    }
+    const parsed = res.ok ? parseTokenResponse(body) : null;
+    if (!parsed) throw new TransientAuthError(`the identity service answered ${res.status} to a refresh`);
+    if (parsed.refresh_token) {
+      this.creds = { ...c, refresh_token: parsed.refresh_token, saved_at: new Date(this.now()).toISOString() };
+      this.opts.save(this.creds);
+    }
+    this.token = parsed.access_token;
+    this.expiresAt = this.now() + parsed.expires_in * 1e3;
+    return this.token;
+  }
+};
+function providerFor(creds, save2, extra = {}) {
+  if (creds.kind === "key") {
+    if (!creds.key) throw new CredentialsError("the sign-in file has no key; run login again");
+    return new KeyTokenProvider(creds.key);
+  }
+  return new DeviceTokenProvider({ creds, save: save2, ...extra });
+}
+
+// src/deviceflow.ts
+var DeviceFlowError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+  }
+  code;
+};
+var form = (o) => new URLSearchParams(o);
+async function startDeviceAuthorization(o) {
+  secureUrl(o.identityUrl, "the identity service URL");
+  const f = o.fetch ?? fetch;
+  let res;
+  try {
+    res = await f(`${o.identityUrl}/oauth/device_authorization`, {
+      method: "POST",
+      headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
+      body: form({ client_id: o.clientId ?? DEFAULT_CLIENT_ID, scope: o.scope ?? CONNECTOR_SCOPE, device_name: o.deviceName }),
+      signal: AbortSignal.timeout(15e3)
+    });
+  } catch (e) {
+    throw new DeviceFlowError("unreachable", `could not reach the identity service: ${errMessage(e)}`);
+  }
+  const body = await res.json().catch(() => null);
+  if (!res.ok || !isObject(body) || typeof body.device_code !== "string" || typeof body.user_code !== "string" || typeof body.verification_uri !== "string") {
+    const why = isObject(body) && typeof body.error === "string" ? body.error : `HTTP ${res.status}`;
+    throw new DeviceFlowError("protocol", `the identity service refused the sign-in request (${why})`);
+  }
+  return {
+    device_code: body.device_code,
+    user_code: body.user_code,
+    verification_uri: body.verification_uri,
+    verification_uri_complete: typeof body.verification_uri_complete === "string" ? body.verification_uri_complete : void 0,
+    expires_in: typeof body.expires_in === "number" && body.expires_in > 0 ? body.expires_in : 600,
+    interval: typeof body.interval === "number" && body.interval > 0 ? body.interval : 5
+  };
+}
+async function pollDeviceToken(o, auth) {
+  const f = o.fetch ?? fetch;
+  const wait = o.sleep ?? sleep;
+  const now = o.now ?? Date.now;
+  const deadline = now() + auth.expires_in * 1e3;
+  let interval = auth.interval;
+  let unreachable = 0;
+  for (; ; ) {
+    await wait(interval * 1e3, o.signal);
+    if (o.signal?.aborted) throw new DeviceFlowError("protocol", "sign-in cancelled");
+    if (now() >= deadline) throw new DeviceFlowError("expired_token", "the code expired before it was confirmed; run login again");
+    let res;
+    try {
+      res = await f(`${o.identityUrl}/oauth/token`, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
+        body: form({ grant_type: "urn:ietf:params:oauth:grant-type:device_code", device_code: auth.device_code, client_id: o.clientId ?? DEFAULT_CLIENT_ID }),
+        signal: AbortSignal.timeout(15e3)
+      });
+    } catch (e) {
+      if (++unreachable >= 5) throw new DeviceFlowError("unreachable", `could not reach the identity service: ${errMessage(e)}`);
+      continue;
+    }
+    if (res.status >= 500) {
+      if (++unreachable >= 5) throw new DeviceFlowError("unreachable", `the identity service keeps answering ${res.status}`);
+      continue;
+    }
+    unreachable = 0;
+    const body = await res.json().catch(() => null);
+    if (res.ok) {
+      const tok = parseTokenResponse(body);
+      if (!tok || !tok.refresh_token) throw new DeviceFlowError("protocol", "the identity service answered a confirmed sign-in without a refresh token");
+      return tok;
+    }
+    const err = isObject(body) && typeof body.error === "string" ? body.error : "";
+    if (err === "authorization_pending") continue;
+    if (err === "slow_down") {
+      interval += 5;
+      continue;
+    }
+    if (err === "access_denied") throw new DeviceFlowError("access_denied", "the sign-in was denied in the browser");
+    if (err === "expired_token") throw new DeviceFlowError("expired_token", "the code expired before it was confirmed; run login again");
+    throw new DeviceFlowError("protocol", `the identity service refused the sign-in (${err || `HTTP ${res.status}`})`);
+  }
+}
+async function deviceLogin(o) {
+  const auth = await startDeviceAuthorization(o);
+  const say = o.print ?? (() => {
+  });
+  say(`To connect this machine, open:  ${auth.verification_uri_complete ?? auth.verification_uri}`);
+  if (auth.verification_uri_complete) say(`or open ${auth.verification_uri} and enter the code:  ${auth.user_code}`);
+  else say(`and enter the code:  ${auth.user_code}`);
+  say(`The code works for ${Math.round(auth.expires_in / 60)} minutes. Waiting for you to confirm...`);
+  return pollDeviceToken(o, auth);
+}
+
+// src/hooks.ts
+import fs7 from "node:fs";
+import path7 from "node:path";
+
+// src/terminals.ts
+import fs6 from "node:fs";
+import path6 from "node:path";
+var SESSION_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var TERMINALS_DIR = "claw-connector-terminals";
+var terminalsDir = (configDir) => path6.join(configDir, TERMINALS_DIR);
+var UNREADABLE_GRACE_MS = 6e4;
+var MAX_STDIN = 1 << 20;
+function localPidDomain() {
+  if (process.platform !== "linux") return null;
+  try {
+    return `linux:${fs6.readFileSync("/etc/machine-id", "utf8").trim()}:${fs6.readlinkSync("/proc/self/ns/pid")}`;
+  } catch {
+    return null;
+  }
+}
+var isObject2 = (x) => typeof x === "object" && x !== null && !Array.isArray(x);
+function holdsStill(row, localDomain) {
+  const foreign = row.pidDomain !== null && localDomain !== null && row.pidDomain !== localDomain;
+  if (foreign) return { open: true, foreign };
+  if (!isAlive(row.pid)) return { open: false, foreign };
+  if (row.procStart !== null && processStart(row.pid) !== row.procStart) return { open: false, foreign };
+  return { open: true, foreign };
+}
+function parseRow(doc) {
+  if (!isObject2(doc) || doc.v !== 1) return null;
+  if (typeof doc.pid !== "number" || !Number.isInteger(doc.pid) || doc.pid <= 1) return null;
+  if (typeof doc.sessionId !== "string" || !SESSION_ID_RE.test(doc.sessionId)) return null;
+  return {
+    v: 1,
+    pid: doc.pid,
+    sessionId: doc.sessionId.toLowerCase(),
+    procStart: typeof doc.procStart === "string" && doc.procStart ? doc.procStart : null,
+    cwd: typeof doc.cwd === "string" ? doc.cwd : "",
+    at: typeof doc.at === "number" ? doc.at : 0,
+    pidDomain: typeof doc.pidDomain === "string" ? doc.pidDomain : null
+  };
+}
+function readTerminals(configDir, localDomain, now = Date.now()) {
+  const dir = terminalsDir(configDir);
+  let names;
+  try {
+    names = fs6.readdirSync(dir);
+  } catch (e) {
+    if (e.code === "ENOENT") return [];
+    throw e;
+  }
+  const out = [];
+  for (const name of names) {
+    if (!name.endsWith(".json")) continue;
+    const file = path6.join(dir, name);
+    let doc;
+    try {
+      doc = JSON.parse(fs6.readFileSync(file, "utf8"));
+    } catch (e) {
+      if (e.code === "ENOENT") continue;
+      let age = Infinity;
+      try {
+        age = now - fs6.statSync(file).mtimeMs;
+      } catch {
+      }
+      if (age < UNREADABLE_GRACE_MS) throw new Error(`${file} is unreadable (${e.message.split("\n")[0]})`);
+      continue;
+    }
+    const row = parseRow(doc);
+    if (!row) continue;
+    const still = holdsStill(row, localDomain);
+    if (still.open) out.push({ pid: row.pid, sessionId: row.sessionId, status: null, foreign: still.foreign, via: "hook" });
+  }
+  return out;
+}
+
+// src/hooks.ts
+var HooksError = class extends Error {
+};
+var HOOKED = [
+  { event: "SessionStart", arg: "start", timeout: 2 },
+  { event: "SessionEnd", arg: "end", timeout: 1 }
+];
+var MANAGED_MARK = "--managed-by claw-connector";
+var OURS_RE = /terminal-hook\.(?:js|ts)["']?\s+(?:start|end)\s/;
+var shellQuote = (s) => `'${s.replace(/'/g, `'\\''`)}'`;
+function hookCommand(node, script, arg, configDir) {
+  return `${shellQuote(node)} ${shellQuote(script)} ${arg} --dir ${shellQuote(configDir)} ${MANAGED_MARK}`;
+}
+var settingsFile = (configDir) => path7.join(configDir, "settings.json");
+var isObject3 = (x) => typeof x === "object" && x !== null && !Array.isArray(x);
+var isOurs = (h) => isObject3(h) && h.type === "command" && typeof h.command === "string" && h.command.endsWith(` ${MANAGED_MARK}`) && OURS_RE.test(h.command);
+function load(configDir) {
+  const given = settingsFile(configDir);
+  let file = given;
+  try {
+    file = fs7.realpathSync(given);
+  } catch {
+  }
+  let text;
+  try {
+    text = fs7.readFileSync(file, "utf8");
+  } catch (e) {
+    if (e.code === "ENOENT") return { doc: {}, text: null, file };
+    throw new HooksError(`cannot read ${given}: ${e.message}`);
+  }
+  if (text.trim() === "") return { doc: {}, text, file };
+  let doc;
+  try {
+    doc = JSON.parse(text);
+  } catch (e) {
+    throw new HooksError(`${given} is not valid JSON (${e.message.split("\n")[0]}); left untouched`);
+  }
+  if (!isObject3(doc)) throw new HooksError(`${given} is not a JSON object; left untouched`);
+  return { doc, text, file };
+}
+function save(l, doc) {
+  const indent = l.text?.match(/^([ \t]+)"/m)?.[1] ?? "  ";
+  const body = JSON.stringify(doc, null, indent) + "\n";
+  fs7.mkdirSync(path7.dirname(l.file), { recursive: true, mode: 448 });
+  let mode = 384;
+  try {
+    mode = fs7.statSync(l.file).mode & 511;
+  } catch {
+  }
+  const tmp = `${l.file}.claw-connector.${process.pid}.tmp`;
+  fs7.writeFileSync(tmp, body, { mode });
+  try {
+    fs7.renameSync(tmp, l.file);
+  } catch (e) {
+    fs7.rmSync(tmp, { force: true });
+    throw e;
+  }
+}
+function hooksOf(doc, where) {
+  if (doc.hooks === void 0) return null;
+  if (!isObject3(doc.hooks)) throw new HooksError(`${where}: "hooks" is not an object; left untouched`);
+  return doc.hooks;
+}
+function groupsOf(hooks, event, where) {
+  const g = hooks[event];
+  if (g === void 0) return null;
+  if (!Array.isArray(g)) throw new HooksError(`${where}: hooks.${event} is not a list; left untouched`);
+  return g;
+}
+function installHooks(configDir, node, script) {
+  const l = load(configDir);
+  const where = settingsFile(configDir);
+  const before = JSON.stringify(l.doc);
+  const doc = JSON.parse(before);
+  const hooks = hooksOf(doc, where) ?? (doc.hooks = {});
+  for (const h of HOOKED) {
+    const entry = { type: "command", command: hookCommand(node, script, h.arg, configDir), timeout: h.timeout };
+    const groups = groupsOf(hooks, h.event, where) ?? (hooks[h.event] = []);
+    let seen = false;
+    for (let i = 0; i < groups.length; i++) {
+      const g = groups[i];
+      if (!isObject3(g) || !Array.isArray(g.hooks)) continue;
+      const kept = [];
+      let dropped = false;
+      for (const x of g.hooks) {
+        if (!isOurs(x)) {
+          kept.push(x);
+          continue;
+        }
+        if (seen) {
+          dropped = true;
+          continue;
+        }
+        seen = true;
+        kept.push({ ...x, ...entry });
+      }
+      g.hooks = kept;
+      if (dropped && kept.length === 0) {
+        groups.splice(i, 1);
+        i--;
+      }
+    }
+    if (!seen) groups.push({ hooks: [entry] });
+  }
+  const changed = JSON.stringify(doc) !== before || l.text === null;
+  if (changed) save(l, doc);
+  return { changed, file: l.file };
+}
+function uninstallHooks(configDir) {
+  const l = load(configDir);
+  const where = settingsFile(configDir);
+  const doc = JSON.parse(JSON.stringify(l.doc));
+  const hooks = hooksOf(doc, where);
+  let touchedAny = false;
+  if (hooks) {
+    for (const h of HOOKED) {
+      const groups = groupsOf(hooks, h.event, where);
+      if (!groups) continue;
+      let touched = false;
+      for (let i = groups.length - 1; i >= 0; i--) {
+        const g = groups[i];
+        if (!isObject3(g) || !Array.isArray(g.hooks)) continue;
+        const rest = g.hooks.filter((x) => !isOurs(x));
+        if (rest.length === g.hooks.length) continue;
+        touched = true;
+        g.hooks = rest;
+        if (rest.length === 0) groups.splice(i, 1);
+      }
+      if (touched && groups.length === 0) delete hooks[h.event];
+      touchedAny ||= touched;
+    }
+    if (touchedAny && Object.keys(hooks).length === 0) delete doc.hooks;
+  }
+  if (touchedAny) save(l, doc);
+  fs7.rmSync(terminalsDir(configDir), { recursive: true, force: true });
+  return { changed: touchedAny, file: l.file };
+}
+function hooksStatus(configDir) {
+  let l;
+  try {
+    l = load(configDir);
+  } catch (e) {
+    return { installed: false, events: [], healthy: false, problem: e.message };
+  }
+  const events = [];
+  let healthy = true;
+  let problem = null;
+  const hooks = isObject3(l.doc.hooks) ? l.doc.hooks : {};
+  for (const h of HOOKED) {
+    const groups = Array.isArray(hooks[h.event]) ? hooks[h.event] : [];
+    const mine = groups.flatMap((g) => isObject3(g) && Array.isArray(g.hooks) ? g.hooks.filter(isOurs) : []);
+    if (mine.length === 0) continue;
+    events.push(h.event);
+    for (const x of mine) {
+      const m = /^'((?:[^']|'\\'')*)' '((?:[^']|'\\'')*)' /.exec(String(x.command));
+      if (!m) continue;
+      for (const f of [m[1], m[2]].map((s) => s.replace(/'\\''/g, "'"))) {
+        if (!fs7.existsSync(f)) {
+          healthy = false;
+          problem ??= `${f} (named by the ${h.event} hook) does not exist; run: claw-connector hooks install`;
+        }
+      }
+    }
+  }
+  return { installed: events.length === HOOKED.length, events, healthy, problem };
+}
+
+// src/connector.ts
+import fs12 from "node:fs";
+import { randomUUID as randomUUID2 } from "node:crypto";
+
+// src/attach.ts
+import { execFile, execFileSync as execFileSync2 } from "node:child_process";
+import fs9 from "node:fs";
+import os2 from "node:os";
+import path9 from "node:path";
+
+// src/adapter.ts
+import { spawn } from "node:child_process";
+import fs8 from "node:fs";
+import path8 from "node:path";
+import { Readable, Writable } from "node:stream";
+import * as acp from "@agentclientprotocol/sdk";
+var AdapterProcess = class _AdapterProcess {
+  constructor(child, pid, registry) {
+    this.child = child;
+    this.pid = pid;
+    this.registry = registry;
+  }
+  child;
+  pid;
+  registry;
+  caps = {};
+  exited = false;
+  conn;
+  static async start(o) {
+    fs8.mkdirSync(path8.dirname(o.logFile), { recursive: true, mode: 448 });
+    const log = fs8.openSync(o.logFile, "a", 384);
+    const child = spawn(o.cfg.command, o.cfg.args, {
+      cwd: o.cwd,
+      env: { ...process.env, ...o.cfg.env },
+      stdio: ["pipe", "pipe", "pipe"],
+      // Its own process group, so the whole tree (an npx wrapper and the agent below it) can be stopped as one.
+      detached: true
+    });
+    await new Promise((resolve, reject) => {
+      child.once("spawn", () => resolve());
+      child.once("error", (e) => reject(new Error(`could not start ${o.cfg.command}: ${errMessage(e)}`)));
+    }).catch((e) => {
+      fs8.closeSync(log);
+      throw e;
+    });
+    const pid = child.pid;
+    o.registry.add({ pid, pgid: pid, agent_id: o.cfg.id, session_id: o.sessionId });
+    const a = new _AdapterProcess(child, pid, o.registry);
+    let tail = "";
+    const flushLine = (line) => {
+      const text = redactText(line).text;
+      try {
+        fs8.writeSync(log, text + "\n");
+      } catch {
+      }
+      try {
+        o.hooks.onStderr(text);
+      } catch {
+      }
+    };
+    child.stderr.on("data", (d) => {
+      tail += d.toString("utf8");
+      let nl;
+      while ((nl = tail.indexOf("\n")) >= 0) {
+        flushLine(tail.slice(0, nl));
+        tail = tail.slice(nl + 1);
+      }
+      if (tail.length > 64 * 1024) {
+        flushLine(tail);
+        tail = "";
+      }
+    });
+    child.stderr.once("close", () => {
+      if (tail) {
+        flushLine(tail);
+        tail = "";
+      }
+      try {
+        fs8.closeSync(log);
+      } catch {
+      }
+    });
+    child.stdin.on("error", () => {
+    });
+    child.once("exit", (code, signal) => {
+      a.exited = true;
+      void o.registry.reap(pid).catch(() => void 0);
+      o.hooks.onExit({ code, signal });
+    });
+    const app = acp.client({ name: "claw-connector" }).onRequest(acp.methods.client.session.requestPermission, async ({ params }) => await o.hooks.onPermission(params)).onNotification(acp.methods.client.session.update, async ({ params }) => {
+      const p = params;
+      o.hooks.onUpdate(p.update, p);
+    }).onRequest("*", async (ctx) => {
+      if (ctx.method.startsWith("cursor/")) return await o.hooks.onExtension(ctx.method, ctx.params ?? {});
+      throw acp.RequestError.methodNotFound(ctx.method);
+    }).onNotification("*", async (ctx) => {
+      o.hooks.onNotification(ctx.method, ctx.params ?? {});
+    });
+    a.conn = app.connect(acp.ndJsonStream(Writable.toWeb(child.stdin), Readable.toWeb(child.stdout)));
+    try {
+      const init = await withTimeout(
+        a.conn.agent.request("initialize", { protocolVersion: 1, clientCapabilities: {}, clientInfo: { name: "claw-connector", title: "Claw connector", version: o.version } }),
+        o.initTimeoutMs ?? 12e4,
+        "initialize"
+      );
+      a.caps = init.agentCapabilities ?? {};
+    } catch (e) {
+      await a.kill();
+      throw e;
+    }
+    return a;
+  }
+  request(method, params, timeoutMs = 6e4) {
+    return withTimeout(this.conn.agent.request(method, params), timeoutMs, method);
+  }
+  /** A request with no deadline: a prompt runs as long as the turn does. */
+  requestUnbounded(method, params) {
+    return this.conn.agent.request(method, params);
+  }
+  async notify(method, params) {
+    await this.conn.agent.notify(method, params);
+  }
+  /** Stop the adapter and everything it started: its whole process group. */
+  async kill() {
+    try {
+      this.conn?.close();
+    } catch {
+    }
+    try {
+      this.child.stdin?.end();
+    } catch {
+    }
+    await this.registry.kill(this.pid, 1500).catch(() => void 0);
+  }
+};
+function withTimeout(p, ms, what) {
+  let timer;
+  const t = new Promise((_, reject) => {
+    timer = setTimeout(() => reject(new Error(`${what} timed out after ${ms} ms`)), ms);
+    timer.unref?.();
+  });
+  return Promise.race([p, t]).finally(() => clearTimeout(timer));
+}
+
+// ../claw/packages/protocol/src/remote-agents.ts
+var REMOTE_AGENT_LIMITS = {
+  /** Connectors one user may keep (revoked ones do not count). */
+  maxConnectorsPerUser: 5,
+  /** Sessions one user may have open at once. */
+  maxActiveSessionsPerUser: 10,
+  /** Bytes of one event's `data`, as JSON. */
+  maxEventBytes: 64 * 1024,
+  maxEventsPerBatch: 200,
+  maxAgentsPerConnector: 20,
+  /** Bytes of the capabilities object one agent reports. */
+  maxCapabilitiesBytes: 4 * 1024,
+  /** Bytes of one prompt. */
+  maxPromptBytes: 64 * 1024,
+  /** Commands one user may issue per minute, across all connectors. */
+  commandsPerMinute: 60
+};
+var REMOTE_AGENT_TIMING = {
+  /** The server sends an `event: ping` frame this often on every stream. */
+  pingMs: 25e3,
+  /** A connector posts a heartbeat this often. */
+  heartbeatMs: 3e4,
+  /**
+   * A connector is online while its command stream is open and its last
+   * heartbeat is at most this old. Three missed heartbeats.
+   */
+  onlineWindowMs: 9e4,
+  /**
+   * How long a `prompt`, `set_mode` or `resume` (the commands with `needsOnline`) stays
+   * deliverable once queued. They are accepted only while the connector is online, so one
+   * still uncollected after this was sent into a connection that had died unnoticed, and
+   * nobody is waiting on it: it is dropped, not replayed when the machine wakes hours later.
+   * Longer than the connector's watchdog plus a reconnect, so an ordinary blip loses nothing.
+   */
+  liveCommandTtlMs: 5 * 6e4,
+  /** A connector that sees no byte for this long drops the stream and reconnects. */
+  watchdogMs: 75e3
+};
+var REMOTE_COMMAND_TYPES = ["prompt", "cancel", "set_mode", "resume", "close", "decision"];
+function isRemoteCommandType(v) {
+  return typeof v === "string" && REMOTE_COMMAND_TYPES.includes(v);
+}
+
+// src/attach.ts
+var TwinCheckError = class extends Error {
+};
+var SESSION_REF_RE = SESSION_ID_RE;
+var MAX_REPORTED = 12;
+var MAX_LIST_PAGES = 8;
+var MAX_TITLE = 80;
+var MAX_SCANNED_PROJECT_DIRS = 2e3;
+var UNREADABLE_GRACE_MS2 = 6e4;
+var NO_HOOKS = {
+  onUpdate() {
+  },
+  onPermission: async () => ({ outcome: { outcome: "cancelled" } }),
+  onExtension: async (method) => {
+    throw new Error(`unsupported extension ${method}`);
+  },
+  onNotification() {
+  },
+  onStderr() {
+  },
+  onExit() {
+  }
+};
+var AttachSupport = class {
+  constructor(agent, d) {
+    this.agent = agent;
+    this.d = d;
+    this.configDir = path9.resolve(agent.env.CLAUDE_CONFIG_DIR ?? d.env.CLAUDE_CONFIG_DIR ?? path9.join(os2.homedir(), ".claude"));
+  }
+  agent;
+  d;
+  configDir;
+  listed = [];
+  listedAt = 0;
+  listError = null;
+  refreshing = null;
+  waitedOnce = false;
+  /** Where each conversation's transcript was found, so that it is not searched for again on every prompt. */
+  transcripts = /* @__PURE__ */ new Map();
+  localDomain = localPidDomain();
+  now() {
+    return this.d.now ? this.d.now() : Date.now();
+  }
+  hookNote = false;
+  lastHookError = "";
+  /** Once: say whether the terminal hooks are in this agent's Claude config, so a missing one is not a mystery. */
+  noteHooks() {
+    if (this.hookNote) return;
+    this.hookNote = true;
+    const st = hooksStatus(this.configDir);
+    if (!st.installed) this.d.log.info("the terminal hooks are not installed in this Claude config directory; sessions open in a terminal are found by listing processes only (claw-connector hooks install)", { agent: this.agent.id, dir: this.configDir });
+    else if (!st.healthy) this.d.log.warn("an installed terminal hook points at a file that is gone", { agent: this.agent.id, problem: st.problem });
+  }
+  /**
+   * The sessions the terminal hooks say are open. This source only ever adds: when it cannot be read it answers
+   * nothing (and says so once), because the sources behind it decide everything it does not know.
+   */
+  terminalRows() {
+    try {
+      this.lastHookError = "";
+      return readTerminals(this.configDir, this.localDomain, this.now());
+    } catch (e) {
+      const msg = errMessage(e);
+      if (msg !== this.lastHookError) this.d.log.warn("the terminal hook rows could not be read; the other checks decide", { agent: this.agent.id, error: msg });
+      this.lastHookError = msg;
+      return [];
+    }
+  }
+  // --- what exists -------------------------------------------------------------------
+  /** Ask the adapter for the sessions on this machine and keep those whose directory is inside the roots. One adapter process, started and stopped here. */
+  refreshCatalog() {
+    this.refreshing ??= this.doRefresh().finally(() => {
+      this.refreshing = null;
+    });
+    return this.refreshing;
+  }
+  async doRefresh() {
+    let adapter = null;
+    this.noteHooks();
+    try {
+      adapter = await AdapterProcess.start({
+        cfg: this.agent,
+        registry: this.d.registry,
+        sessionId: `list-${this.agent.id}`,
+        cwd: this.agent.roots[0] ?? os2.homedir(),
+        hooks: NO_HOOKS,
+        logFile: path9.join(this.d.logDir, `adapter-${this.agent.id}.log`),
+        version: this.d.version,
+        initTimeoutMs: 3e4
+      });
+      const caps = adapter.caps.sessionCapabilities;
+      if (!caps?.list) throw new Error("the adapter cannot list sessions");
+      const found = /* @__PURE__ */ new Map();
+      let cursor;
+      for (let page = 0; page < MAX_LIST_PAGES; page++) {
+        const res = await adapter.request("session/list", cursor ? { cursor } : {}, 3e4);
+        for (const s of Array.isArray(res.sessions) ? res.sessions : []) {
+          if (!isObject(s) || typeof s.sessionId !== "string" || !SESSION_REF_RE.test(s.sessionId) || typeof s.cwd !== "string") continue;
+          const where = checkCwd(s.cwd, this.agent.roots);
+          if (!where.ok) continue;
+          const at = typeof s.updatedAt === "string" ? Date.parse(s.updatedAt) : NaN;
+          found.set(s.sessionId.toLowerCase(), {
+            ref: s.sessionId.toLowerCase(),
+            cwd: where.real,
+            updatedAt: Number.isFinite(at) ? at : 0,
+            title: cleanTitle(typeof s.title === "string" ? s.title : "")
+          });
+        }
+        cursor = typeof res.nextCursor === "string" && res.nextCursor ? res.nextCursor : void 0;
+        if (!cursor) break;
+      }
+      this.listed = [...found.values()].sort((a, b) => b.updatedAt - a.updatedAt);
+      this.listedAt = this.now();
+      this.listError = null;
+    } catch (e) {
+      this.listError = errMessage(e);
+      this.d.log.warn("listing the sessions on this machine failed", { agent: this.agent.id, error: this.listError });
+    } finally {
+      if (adapter) await adapter.kill();
+    }
+  }
+  /** The session `ref` names, from a fresh enough list; the directory it records is the one it will be resumed in. */
+  async resolve(ref) {
+    const want = ref.toLowerCase();
+    const have = () => this.listed.find((l) => l.ref === want);
+    let hit = have();
+    if (!hit || this.now() - this.listedAt > this.d.catalogMs) {
+      await this.refreshCatalog();
+      hit = have();
+    }
+    if (hit) return { ok: true, item: hit };
+    return { ok: false, reason: this.listedAt === 0 || this.listError ? "catalog_unavailable" : "unknown_session" };
+  }
+  /**
+   * What the heartbeat reports: the newest sessions with their state now. The list itself comes from the last
+   * refresh (a new one starts in the background when it is old); the state is read fresh, but never holds the
+   * heartbeat for more than `capMs`.
+   */
+  async resumable(capMs = 3e3) {
+    if (!this.waitedOnce) {
+      this.waitedOnce = true;
+      await within(this.refreshCatalog().then(() => true), 5e3, false);
+    } else if (this.now() - this.listedAt > this.d.catalogMs) void this.refreshCatalog();
+    const live = await within(this.liveEntries().catch(() => null), capMs, null);
+    const attached = this.d.attachedRefs();
+    return this.listed.slice(0, MAX_REPORTED).map((l) => ({
+      ref: l.ref,
+      title: l.title,
+      cwd: l.cwd,
+      updated_at: Math.floor(l.updatedAt / 1e3),
+      state: attached.has(l.ref) ? "attached" : live === null ? "unknown" : live.some((e) => e.sessionId.toLowerCase() === l.ref) ? "live" : "idle"
+    }));
+  }
+  // --- the twin check ----------------------------------------------------------------
+  /**
+   * May this session be opened (or prompted) now?
+   * `ownPgid` is the process group of this connector's own adapter for it: that adapter's agent process is listed
+   * too and is not a twin. `transcript` also refuses a session whose transcript was written within the last
+   * moments, which covers a terminal that has only just exited and is still flushing; it is skipped while this
+   * connector's own adapter is the one writing.
+   */
+  async check(ref, o) {
+    if (!SESSION_REF_RE.test(ref)) return { ok: false, reason: "twin_check_failed", detail: "not a session id" };
+    const want = ref.toLowerCase();
+    const inTerminal = this.terminalRows().find((e) => isTwin(e, want, o.ownPgid));
+    if (inTerminal) return { ok: false, reason: "session_live", detail: describeTwin(inTerminal) };
+    let live;
+    try {
+      live = await this.liveEntries();
+    } catch (e) {
+      return { ok: false, reason: "twin_check_failed", detail: errMessage(e) };
+    }
+    const twin = live.find((e) => isTwin(e, want, o.ownPgid));
+    if (twin) {
+      return { ok: false, reason: "session_live", detail: describeTwin(twin) };
+    }
+    if (o.transcript) {
+      const file = this.transcriptFile(want);
+      let age = null;
+      try {
+        if (file) age = this.now() - fs9.statSync(file).mtimeMs;
+      } catch {
+      }
+      if (age !== null && age < this.d.recentWriteMs) return { ok: false, reason: "recently_written", detail: `its transcript was written ${Math.max(0, Math.round(age / 1e3))} s ago` };
+    }
+    return { ok: true };
+  }
+  /** Every live process that holds a session open. Throws {@link TwinCheckError} when neither source can be read. */
+  async liveEntries() {
+    const env = { ...this.d.env, ...this.agent.env, CLAUDE_CONFIG_DIR: this.configDir };
+    let viaCli = null;
+    let cliError = "";
+    try {
+      viaCli = parseAgentsJson(await run(this.agent.attach?.cli ?? "claude", ["agents", "--json"], env, this.d.cliTimeoutMs));
+    } catch (e) {
+      cliError = errMessage(e).split("\n")[0];
+    }
+    let registry = [];
+    let registryError = "";
+    try {
+      registry = readRegistry(this.configDir, this.localDomain);
+    } catch (e) {
+      registryError = errMessage(e);
+    }
+    let out;
+    if (viaCli) {
+      const seen = new Set(viaCli.map((e) => e.pid));
+      out = [...viaCli, ...registry.filter((e) => e.foreign || !seen.has(e.pid))];
+    } else if (!registryError) {
+      out = registry;
+    } else {
+      throw new TwinCheckError(`cannot tell which sessions are open: "${this.agent.attach?.cli ?? "claude"} agents --json" failed (${cliError}) and the session registry could not be read (${registryError})`);
+    }
+    return [...this.terminalRows(), ...out];
+  }
+  /**
+   * A look at the registry alone, with nothing started: is another process listed as holding `ref` open? It is cheap
+   * enough to repeat every second while this connector's own agent is writing to the transcript, which is when a
+   * terminal that opens the conversation and closes it again must not go unseen (see `Session.watchTwins`). Null when
+   * the registry cannot be read; the full {@link check} made when the work ends is the one that has to answer.
+   */
+  peek(ref, ownPgid) {
+    if (!SESSION_REF_RE.test(ref)) return null;
+    const want = ref.toLowerCase();
+    const hook = this.terminalRows().find((e) => isTwin(e, want, ownPgid));
+    try {
+      return { twin: hook ?? readRegistry(this.configDir, this.localDomain, this.now()).find((e) => isTwin(e, want, ownPgid)) ?? null };
+    } catch {
+      return hook ? { twin: hook } : null;
+    }
+  }
+  /** The size of the conversation's transcript now, or null when there is none to look at. */
+  transcriptSize(ref) {
+    const file = SESSION_REF_RE.test(ref) ? this.transcriptFile(ref.toLowerCase()) : null;
+    try {
+      return file ? fs9.statSync(file).size : null;
+    } catch {
+      return null;
+    }
+  }
+  /** `<config dir>/projects/<working directory with every non-alphanumeric turned into "-">/<id>.jsonl`, found by name when that guess misses. */
+  transcriptFile(ref) {
+    const cached = this.transcripts.get(ref);
+    if (cached && fs9.existsSync(cached)) return cached;
+    this.transcripts.delete(ref);
+    const projects = path9.join(this.configDir, "projects");
+    const remember = (f) => {
+      this.transcripts.set(ref, f);
+      return f;
+    };
+    const known = this.listed.find((l) => l.ref === ref);
+    if (known) {
+      const guess = path9.join(projects, known.cwd.replace(/[^A-Za-z0-9]/g, "-"), `${ref}.jsonl`);
+      if (fs9.existsSync(guess)) return remember(guess);
+    }
+    try {
+      let n = 0;
+      for (const dir of fs9.readdirSync(projects)) {
+        if (++n > MAX_SCANNED_PROJECT_DIRS) break;
+        const f = path9.join(projects, dir, `${ref}.jsonl`);
+        if (fs9.existsSync(f)) return remember(f);
+      }
+    } catch {
+    }
+    return null;
+  }
+};
+function describeTwin(e) {
+  if (e.via === "hook") return e.foreign ? `open in a terminal, registered by a process this machine cannot see (pid ${e.pid})` : `open in a terminal (pid ${e.pid}, registered by its session hook)`;
+  return e.foreign ? `registered by a process this machine cannot see (pid ${e.pid})` : `process ${e.pid} has it open (${e.status ?? "running"})`;
+}
+function isTwin(e, want, ownPgid) {
+  if (e.sessionId.toLowerCase() !== want) return false;
+  return e.foreign || !(ownPgid != null && processGroup(e.pid) === ownPgid);
+}
+function within(p, ms, late) {
+  return new Promise((resolve) => {
+    const t = setTimeout(() => resolve(late), ms);
+    t.unref?.();
+    void p.then((v) => {
+      clearTimeout(t);
+      resolve(v);
+    }, () => {
+      clearTimeout(t);
+      resolve(late);
+    });
+  });
+}
+function run(file, args, env, timeoutMs) {
+  return new Promise((resolve, reject) => {
+    const child = execFile(file, args, { env, timeout: timeoutMs, killSignal: "SIGKILL", maxBuffer: 4 * 1024 * 1024, encoding: "utf8", windowsHide: true }, (err, stdout) => err ? reject(err) : resolve(stdout));
+    child.stdin?.end();
+  });
+}
+function parseAgentsJson(text) {
+  const raw = JSON.parse(text);
+  if (!Array.isArray(raw)) throw new Error("the answer is not a list");
+  const out = [];
+  for (const x of raw) {
+    if (isObject(x) && typeof x.pid === "number" && Number.isInteger(x.pid) && typeof x.sessionId === "string") {
+      out.push({ pid: x.pid, sessionId: x.sessionId, status: typeof x.status === "string" ? x.status : null, foreign: false });
+    }
+  }
+  return out;
+}
+function readRegistry(configDir, localDomain, now = Date.now()) {
+  const dir = path9.join(configDir, "sessions");
+  let names;
+  try {
+    names = fs9.readdirSync(dir);
+  } catch (e) {
+    throw new TwinCheckError(`${dir}: ${errMessage(e)}`);
+  }
+  const out = [];
+  for (const name of names) {
+    if (!name.endsWith(".json")) continue;
+    const file = path9.join(dir, name);
+    let doc;
+    try {
+      doc = JSON.parse(fs9.readFileSync(file, "utf8"));
+    } catch (e) {
+      let age = Infinity;
+      try {
+        age = now - fs9.statSync(file).mtimeMs;
+      } catch {
+      }
+      if (age < UNREADABLE_GRACE_MS2) throw new TwinCheckError(`${file} is unreadable (${errMessage(e).split("\n")[0]})`);
+      continue;
+    }
+    if (!isObject(doc) || typeof doc.pid !== "number" || !Number.isInteger(doc.pid) || typeof doc.sessionId !== "string") continue;
+    const domain = typeof doc.pidDomain === "string" ? doc.pidDomain : null;
+    const foreign = domain !== null && localDomain !== null && domain !== localDomain;
+    if (!foreign) {
+      if (!isAlive(doc.pid)) continue;
+      if (process.platform === "linux" && typeof doc.procStart === "string" && processStart(doc.pid) !== doc.procStart) continue;
+    }
+    out.push({ pid: doc.pid, sessionId: doc.sessionId, status: typeof doc.status === "string" ? doc.status : null, foreign });
+  }
+  return out;
+}
+function processGroup(pid) {
+  try {
+    if (process.platform === "linux") {
+      const stat = fs9.readFileSync(`/proc/${pid}/stat`, "utf8");
+      return Number(stat.slice(stat.lastIndexOf(")") + 2).split(" ")[2]) || null;
+    }
+    return Number(execFileSync2("ps", ["-o", "pgid=", "-p", String(pid)], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim()) || null;
+  } catch {
+    return null;
+  }
+}
+function cleanTitle(raw) {
+  const one = redactText(raw).text.replace(/[\u0000-\u001f\u007f]+/g, " ").replace(/\s+/g, " ").trim();
+  return one.length > MAX_TITLE ? `${one.slice(0, MAX_TITLE - 1)}\u2026` : one;
+}
+function fitResumable(base, items, limit = REMOTE_AGENT_LIMITS.maxCapabilitiesBytes) {
+  let n = Math.min(items.length, MAX_REPORTED);
+  const size = (c) => new TextEncoder().encode(JSON.stringify(c)).length;
+  for (; ; ) {
+    const caps = { ...base, resumable: items.slice(0, n) };
+    if (size(caps) <= limit) return caps;
+    if (n === 0) return base;
+    n--;
+  }
+}
+
+// src/session.ts
+import path10 from "node:path";
+
+// src/permissions.ts
+import { randomUUID } from "node:crypto";
+
+// src/glob.ts
+function globToRegExp(glob) {
+  let re = "^";
+  for (let i = 0; i < glob.length; i++) {
+    const c = glob[i];
+    if (c === "*") {
+      if (glob[i + 1] === "*") {
+        i++;
+        if (glob[i + 1] === "/") {
+          i++;
+          re += "(?:.*/)?";
+        } else re += ".*";
+      } else re += "[^/]*";
+    } else if (c === "?") re += "[^/]";
+    else re += c.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+  }
+  return new RegExp(re + "$");
+}
+var globMatches = (glob, relPath) => globToRegExp(glob).test(relPath);
+
+// src/permissions.ts
+function normalizeOptions(raw) {
+  if (!Array.isArray(raw)) return [];
+  const out = [];
+  for (const o of raw.slice(0, 12)) {
+    if (!isObject(o) || typeof o.optionId !== "string" || o.optionId === "") continue;
+    out.push({
+      optionId: o.optionId,
+      name: typeof o.name === "string" ? o.name.slice(0, 200) : o.optionId,
+      kind: typeof o.kind === "string" ? o.kind : "allow_once"
+    });
+  }
+  return out;
+}
+function boundedInput(raw, max = 4096) {
+  if (raw === void 0 || raw === null) return null;
+  const text = typeof raw === "string" ? raw : JSON.stringify(raw);
+  if (Buffer.byteLength(text, "utf8") <= max) return raw;
+  return truncateBytes(text, max).text;
+}
+function toolPaths(toolCall) {
+  const out = [];
+  if (Array.isArray(toolCall.locations)) {
+    for (const l of toolCall.locations) if (isObject(l) && typeof l.path === "string") out.push(l.path);
+  }
+  if (isObject(toolCall.rawInput)) for (const k of ["file_path", "filePath", "path", "target_file"]) {
+    const v = toolCall.rawInput[k];
+    if (typeof v === "string") out.push(v);
+  }
+  return [...new Set(out)];
+}
+function matchAutoAllow(rules, toolCall, cwd) {
+  const kind = typeof toolCall.kind === "string" ? toolCall.kind : "";
+  const paths = toolPaths(toolCall);
+  if (!kind || paths.length === 0) return null;
+  const rel = [];
+  for (const p of paths) {
+    const r = relativeInside(p, cwd);
+    if (r === null) return null;
+    rel.push(r);
+  }
+  return rules.find((rule) => rule.kind === kind && rel.every((r) => globMatches(rule.pathGlob, r))) ?? null;
+}
+var PermissionBook = class {
+  constructor(ttlMs, onExpire) {
+    this.ttlMs = ttlMs;
+    this.onExpire = onExpire;
+  }
+  ttlMs;
+  onExpire;
+  pending = /* @__PURE__ */ new Map();
+  get ttl() {
+    return this.ttlMs;
+  }
+  open(options, payload, settle) {
+    const actionId = randomUUID();
+    const p = {
+      actionId,
+      options,
+      payload: payload(actionId),
+      settle,
+      timer: setTimeout(() => {
+        if (this.pending.delete(actionId)) {
+          clearTimeout(p.timer);
+          settle(null);
+          this.onExpire(actionId);
+        }
+      }, this.ttlMs)
+    };
+    p.timer.unref?.();
+    this.pending.set(actionId, p);
+    return p;
+  }
+  /** Answer with one of the options that were offered; anything else leaves the request pending. */
+  decide(actionId, optionId) {
+    const p = this.pending.get(actionId);
+    if (!p) return { ok: false, reason: "unknown_action" };
+    if (!p.options.some((o) => o.optionId === optionId)) return { ok: false, reason: "option_not_offered" };
+    this.pending.delete(actionId);
+    clearTimeout(p.timer);
+    p.settle(optionId);
+    return { ok: true, optionId };
+  }
+  /** Answer every waiting request `cancelled` (a cancel, a close, an adapter that went away). */
+  cancelAll() {
+    const ids = [...this.pending.keys()];
+    for (const id of ids) {
+      const p = this.pending.get(id);
+      this.pending.delete(id);
+      clearTimeout(p.timer);
+      p.settle(null);
+    }
+    return ids;
+  }
+  list() {
+    return [...this.pending.values()];
+  }
+  get size() {
+    return this.pending.size;
+  }
+};
+
+// src/session.ts
+var DEFAULT_SESSION_TIMING = { idleMs: 30 * 6e4, permissionTtlMs: 10 * 6e4, modeConfirmMs: 3e3, twinWatchMs: 1e3 };
+var SessionRefusal = class extends Error {
+  constructor(reason, message) {
+    super(message ?? reason);
+    this.reason = reason;
+  }
+  reason;
+};
+var MAX_TOOL_OUTPUT_BYTES = 8 * 1024;
+var MAX_QUEUED_PROMPTS = 5;
+var PERMISSION_WARNING_RE = /canUseTool will not be invoked/i;
+var Session = class {
+  constructor(id, agent, cwd, env, acpId = null, mode = null) {
+    this.id = id;
+    this.agent = agent;
+    this.env = env;
+    this.cwd = cwd;
+    this.acpId = acpId;
+    this.announced = acpId !== null;
+    this.targetMode = mode ?? agent.askMode;
+    if (!agent.safeModes.includes(this.targetMode) && !agent.allowUnsafeModes && this.targetMode !== agent.askMode) {
+      this.env.audit.record("mode_reverted", { session_id: id, agent_id: agent.id, from: this.targetMode, to: agent.askMode, reason: "no_longer_allowed" });
+      this.targetMode = agent.askMode;
+    }
+    this.book = new PermissionBook(env.timing.permissionTtlMs, (actionId) => {
+      this.env.audit.record("permission_expired", { session_id: this.id, action_id: actionId });
+      this.emit("permission_resolved", { actionId, optionId: null, outcome: "cancelled", by: "timeout" });
+    });
+  }
+  id;
+  agent;
+  env;
+  cwd;
+  acpId;
+  adapter = null;
+  currentMode = null;
+  modes = [];
+  closed = false;
+  /** The adapter warned that it will not ask for permission and the owner's opt-in accepted that. Per adapter process. */
+  noAskWarning = false;
+  /** The phone already knows this session: a mode change is worth an event. */
+  announced;
+  modeConfigId = null;
+  targetMode;
+  enforcing = false;
+  modeSeen = [];
+  replaying = false;
+  /**
+   * An attached session starts in the mode its transcript last had, which is often one that never asks, and the
+   * adapter says so on stderr while it sets the session up. That warning describes the mode about to be replaced,
+   * so it is set aside until the ask mode is locked and read back; one that comes later closes the session as ever.
+   */
+  inheritedWarningOk = false;
+  /** The transcript's size when this connector last left it (see {@link preflight}). */
+  transcriptMark = null;
+  /**
+   * Another process was seen holding the conversation open while this connector's own agent was running a turn on
+   * it. That agent's memory then lacks whatever the process wrote, and the transcript's size cannot say so (see
+   * {@link watchTwins}): the agent is discarded before the next prompt. Cleared when an agent is started afresh.
+   */
+  twinSeen = false;
+  turnRunning = false;
+  queue = [];
+  launching = null;
+  idle;
+  book;
+  // --- helpers -----------------------------------------------------------------
+  emit(type, data) {
+    this.env.emit(this.id, type, data);
+  }
+  audit(kind, detail = {}) {
+    this.env.audit.record(kind, { session_id: this.id, agent_id: this.agent.id, ...detail });
+  }
+  touch() {
+    clearTimeout(this.idle);
+    if (this.closed) return;
+    this.idle = setTimeout(() => void this.recycle(), this.env.timing.idleMs);
+    this.idle.unref?.();
+  }
+  get pendingCount() {
+    return this.book.size;
+  }
+  get busy() {
+    return this.turnRunning || this.queue.length > 0 || this.book.size > 0;
+  }
+  /** Whether `mode` may be selected from a phone. */
+  modeAllowed(mode) {
+    return this.agent.safeModes.includes(mode) || this.agent.allowUnsafeModes && (this.modes.length === 0 || this.modes.some((m) => m.id === mode));
+  }
+  /** Whether this session runs without asking before every write and command: its mode is not a safe one, or its adapter said it will not ask. */
+  get unattended() {
+    return this.noAskWarning || this.currentMode !== null && !this.agent.askingModes.includes(this.currentMode);
+  }
+  shownModes() {
+    return this.modes.filter((m) => this.modeAllowed(m.id)).map((m) => ({ ...m, unattended: !this.agent.askingModes.includes(m.id) }));
+  }
+  // --- starting ----------------------------------------------------------------
+  /** `session.new`: start the adapter, create the ACP session, lock the mode. A refusal closes the session with a reason. */
+  async create(requestedMode) {
+    if (requestedMode && !this.agent.safeModes.includes(requestedMode) && !this.agent.allowUnsafeModes) {
+      return this.refuse(new SessionRefusal("mode_not_allowed", `mode ${requestedMode} needs approval = "never" for this agent (or allow_unsafe_modes) on this machine`));
+    }
+    if (requestedMode) this.targetMode = requestedMode;
+    try {
+      await this.launch("new");
+    } catch (e) {
+      return this.refuse(e);
+    }
+    if (this.closed) return;
+    this.env.store.put(this.id, { agent_id: this.agent.id, acp_session_id: this.acpId, cwd: this.cwd, status: "active", mode: this.currentMode, created_at: (/* @__PURE__ */ new Date()).toISOString() });
+    this.audit("session_started", { cwd: this.cwd, mode: this.currentMode, unattended: this.unattended, acp_session_id: this.acpId });
+    this.emit("session_started", { acp_session_id: this.acpId, agent_id: this.agent.id, kind: this.agent.kind, cwd: this.cwd, modes: this.shownModes(), currentMode: this.currentMode, unattended: this.unattended });
+    this.announced = true;
+    this.touch();
+  }
+  /**
+   * `session.new` that names a session which already exists: resume it in the ask mode. The twin check runs inside
+   * the launch (so it also runs again whenever a recycled adapter comes back), and a refusal closes the session.
+   */
+  async attach(requestedMode, title) {
+    if (requestedMode && !this.agent.safeModes.includes(requestedMode) && !this.agent.allowUnsafeModes) {
+      return this.refuse(new SessionRefusal("mode_not_allowed", `mode ${requestedMode} needs approval = "never" for this agent (or allow_unsafe_modes) on this machine`));
+    }
+    if (requestedMode) this.targetMode = requestedMode;
+    try {
+      await this.launch("resume");
+    } catch (e) {
+      return this.refuse(e);
+    }
+    if (this.closed) return;
+    this.env.store.put(this.id, { agent_id: this.agent.id, acp_session_id: this.acpId, cwd: this.cwd, status: "active", mode: this.currentMode, created_at: (/* @__PURE__ */ new Date()).toISOString() });
+    this.audit("session_attached", { cwd: this.cwd, mode: this.currentMode, unattended: this.unattended, acp_session_id: this.acpId });
+    this.emit("session_started", { acp_session_id: this.acpId, agent_id: this.agent.id, kind: this.agent.kind, cwd: this.cwd, title, attached: true, modes: this.shownModes(), currentMode: this.currentMode, unattended: this.unattended });
+    this.touch();
+  }
+  /** Start (or restart) the adapter and bring the ACP session up in a verified mode. One at a time. */
+  launch(how) {
+    this.launching ??= this.guardedLaunch(how).finally(() => {
+      this.launching = null;
+    });
+    return this.launching;
+  }
+  /** For an attach agent, nothing is started until no other process holds the session open. */
+  async guardedLaunch(how) {
+    if (!this.agent.attach) return this.doLaunch(how);
+    const support = this.env.attach.get(this.agent.id);
+    if (!support) throw new SessionRefusal("attach_unavailable", "this agent has no takeover support");
+    if (!this.acpId) throw new SessionRefusal("adapter_cannot_resume", "no session to resume");
+    const verdict = await support.check(this.acpId, { transcript: true });
+    if (!verdict.ok) {
+      this.audit("attach_refused", { reason: verdict.reason, detail: verdict.detail.slice(0, 300) });
+      throw new SessionRefusal(verdict.reason, verdict.detail);
+    }
+    this.inheritedWarningOk = true;
+    const watch = this.watchTwins(support, this.acpId);
+    try {
+      await this.doLaunch(how);
+      this.markTranscript();
+      if (await watch.finish()) {
+        await this.dropAdapter();
+        const detail = "another process opened the conversation while it was being resumed";
+        this.audit("attach_refused", { reason: "session_live", detail });
+        throw new SessionRefusal("session_live", detail);
+      }
+      this.twinSeen = false;
+    } finally {
+      watch.stop();
+      this.inheritedWarningOk = false;
+    }
+  }
+  /**
+   * Watch for a second writer while this connector's own agent is working on the conversation (starting, or running a
+   * turn). The check before a prompt is a look at one moment, and the transcript's size cannot stand in for it during
+   * the work: the agent's own writes and a terminal's are the same kind of bytes, so a terminal that opens the
+   * conversation, takes a turn and exits meanwhile would be gone by the next look and its bytes already counted as
+   * the agent's. So the registry is read every `twinWatchMs` for as long as the work lasts (a process that has held the
+   * conversation open for longer than that is seen), and once more, in full (the command too), when it ends.
+   * `finish()` answers whether another process was seen holding the conversation open at any of those moments, or the
+   * last look could not be made.
+   */
+  watchTwins(support, ref) {
+    let seen = false;
+    const own = () => this.adapter && !this.adapter.exited ? this.adapter.pid : null;
+    const look = () => {
+      if (seen) return;
+      const r = support.peek(ref, own());
+      if (r?.twin) {
+        seen = true;
+        this.audit("twin_seen", { pid: r.twin.pid, foreign: r.twin.foreign });
+      }
+    };
+    const timer = setInterval(look, this.env.timing.twinWatchMs);
+    timer.unref?.();
+    const stop = () => clearInterval(timer);
+    return {
+      stop,
+      finish: async () => {
+        stop();
+        look();
+        if (!seen) {
+          const v = await support.check(ref, { ownPgid: own(), transcript: false });
+          if (!v.ok) {
+            seen = true;
+            this.audit("twin_seen", { reason: v.reason, detail: v.detail.slice(0, 300) });
+          }
+        }
+        return seen;
+      }
+    };
+  }
+  async doLaunch(how) {
+    this.noAskWarning = false;
+    const adapter = await AdapterProcess.start({
+      cfg: this.agent,
+      registry: this.env.registry,
+      sessionId: this.id,
+      cwd: this.cwd,
+      hooks: this.hooks(),
+      logFile: path10.join(this.env.logDir, `adapter-${this.agent.id}.log`),
+      version: this.env.version
+    }).catch((e) => {
+      throw new SessionRefusal("adapter_start_failed", errMessage(e));
+    });
+    if (this.closed) {
+      await adapter.kill();
+      throw new SessionRefusal("session_closed");
+    }
+    this.adapter = adapter;
+    this.modeSeen = [];
+    try {
+      if (how === "new") {
+        const res = await adapter.request("session/new", { cwd: this.cwd, mcpServers: [] });
+        if (typeof res.sessionId !== "string") throw new SessionRefusal("adapter_protocol", "session/new returned no session id");
+        this.acpId = res.sessionId;
+        this.absorb(res);
+      } else {
+        if (!this.acpId) throw new SessionRefusal("adapter_cannot_resume", "no adapter session to resume");
+        const caps = adapter.caps.sessionCapabilities;
+        if (caps?.resume) {
+          this.absorb(await adapter.request("session/resume", { sessionId: this.acpId, cwd: this.cwd, mcpServers: [] }));
+        } else if (adapter.caps.loadSession) {
+          this.replaying = true;
+          try {
+            this.absorb(await adapter.requestUnbounded("session/load", { sessionId: this.acpId, cwd: this.cwd, mcpServers: [] }));
+          } finally {
+            this.replaying = false;
+          }
+        } else {
+          throw new SessionRefusal("adapter_cannot_resume", "the adapter can neither resume nor load a session");
+        }
+      }
+      await this.enforceMode(this.targetMode);
+      if (this.closed) throw new SessionRefusal("session_closed");
+    } catch (e) {
+      await this.dropAdapter();
+      throw e instanceof SessionRefusal ? e : mapAdapterError(e);
+    }
+  }
+  /** Take the modes and the mode config option out of a `session/new|resume|load` answer. */
+  absorb(res) {
+    const modes = res.modes;
+    if (modes && Array.isArray(modes.availableModes)) {
+      this.modes = modes.availableModes.filter((m) => isObject(m) && typeof m.id === "string").map((m) => ({ id: m.id, name: m.name, description: m.description }));
+    }
+    const opts = res.configOptions;
+    if (Array.isArray(opts)) {
+      const mode = opts.find((o) => isObject(o) && o.category === "mode" && typeof o.id === "string");
+      if (mode) this.modeConfigId = mode.id;
+    }
+    this.currentMode = typeof modes?.currentModeId === "string" ? modes.currentModeId : this.currentMode;
+  }
+  // --- the mode lock --------------------------------------------------------------
+  /**
+   * Put the session in `mode` and read the adapter's own answer back.
+   *
+   * The read-back is not the answer to `set_mode` (that is empty). It is the
+   * adapter reporting its current mode: the mode option's value in the answer to
+   * `session/set_config_option`, or, for an adapter with no such option, a mode
+   * notification that arrives after the change. If neither confirms `mode`, the
+   * session is not opened.
+   */
+  async enforceMode(mode) {
+    const a = this.adapter;
+    if (!a || !this.acpId) throw new SessionRefusal("adapter_gone");
+    if (this.modes.length && !this.modes.some((m) => m.id === mode)) throw new SessionRefusal("mode_unavailable", `the adapter offers no mode ${mode}`);
+    this.enforcing = true;
+    this.modeSeen = [];
+    try {
+      try {
+        await a.request("session/set_mode", { sessionId: this.acpId, modeId: mode });
+      } catch (e) {
+        throw new SessionRefusal("mode_not_enforced", `set_mode ${mode} failed: ${errMessage(e)}`);
+      }
+      const confirmed = await this.readBackMode(a, mode);
+      if (confirmed === null) throw new SessionRefusal("mode_not_confirmed", `the adapter did not confirm mode ${mode}`);
+      if (confirmed !== mode) throw new SessionRefusal("mode_mismatch", `asked for mode ${mode}, the adapter reports ${confirmed}`);
+      this.currentMode = confirmed;
+      this.targetMode = mode;
+      this.env.store.patch(this.id, { mode: confirmed });
+    } finally {
+      this.enforcing = false;
+    }
+  }
+  async readBackMode(a, mode) {
+    if (this.modeConfigId && this.acpId) {
+      try {
+        const res = await a.request("session/set_config_option", { sessionId: this.acpId, configId: this.modeConfigId, value: mode });
+        const opt = Array.isArray(res.configOptions) ? res.configOptions.find((o) => o?.id === this.modeConfigId) : void 0;
+        if (opt && typeof opt.currentValue === "string") return opt.currentValue;
+      } catch {
+      }
+    }
+    const deadline = Date.now() + this.env.timing.modeConfirmMs;
+    while (Date.now() < deadline) {
+      const last = this.modeSeen[this.modeSeen.length - 1];
+      if (last !== void 0) return last;
+      await sleep(25);
+    }
+    return this.modeSeen[this.modeSeen.length - 1] ?? null;
+  }
+  /** An adapter reported its mode. A mode this machine does not allow is undone at once. */
+  noteMode(mode) {
+    this.modeSeen.push(mode);
+    if (this.enforcing) return;
+    if (mode === this.currentMode) return;
+    const from = this.currentMode;
+    this.currentMode = mode;
+    if (!this.modeAllowed(mode)) {
+      this.audit("mode_reverted", { from, to: mode, back_to: this.agent.askMode });
+      this.emit("mode_update", { currentMode: mode, reverted: true, unattended: this.unattended });
+      void this.enforceMode(this.agent.askMode).then(
+        () => this.emit("mode_update", { currentMode: this.currentMode, unattended: this.unattended }),
+        (e) => this.refuse(e)
+      );
+      return;
+    }
+    this.emit("mode_update", { currentMode: mode, unattended: this.unattended });
+  }
+  /** `set_mode`: a user-chosen mode, only from the allowed list, always read back. */
+  async setMode(modeId, cmdId) {
+    if (!this.adapter) await this.ensureAdapter();
+    if (!this.modeAllowed(modeId)) return this.rejectCommand("set_mode", cmdId, "mode_not_allowed");
+    if (this.modes.length && !this.modes.some((m) => m.id === modeId)) return this.rejectCommand("set_mode", cmdId, "mode_unavailable");
+    const previous = this.targetMode;
+    try {
+      await this.enforceMode(modeId);
+      this.audit("mode_set", { mode: modeId, unattended: this.unattended });
+      this.emit("mode_update", { currentMode: this.currentMode, unattended: this.unattended });
+    } catch (e) {
+      this.audit("mode_set_failed", { mode: modeId, error: errMessage(e) });
+      try {
+        await this.enforceMode(previous);
+      } catch (again) {
+        return this.refuse(again);
+      }
+      this.rejectCommand("set_mode", cmdId, e instanceof SessionRefusal ? e.reason : "set_mode_failed");
+    }
+  }
+  // --- adapter callbacks ------------------------------------------------------------
+  hooks() {
+    return {
+      onUpdate: (update, params) => this.onUpdate(update, params),
+      onPermission: (params) => this.onPermission(params),
+      onExtension: (method, params) => this.onExtension(method, params),
+      onNotification: (method, params) => this.onNotification(method, params),
+      onStderr: (line) => {
+        if (PERMISSION_WARNING_RE.test(line)) this.onUnsafeWarning(line);
+      },
+      onExit: (info) => this.onExit(info)
+    };
+  }
+  /**
+   * The adapter says it will not ask for permission (its own settings start it in a mode that does not, or an allow
+   * rule shadows the callback). With the owner's opt-in for this agent that is accepted: audited, and the session says
+   * it is unattended. Without it the session is closed, as before.
+   */
+  onUnsafeWarning(text) {
+    if (this.inheritedWarningOk) return this.audit("permission_callback_warning_inherited", { text: text.slice(0, 300) });
+    const accepted = this.agent.allowUnsafeModes;
+    this.audit("permission_callback_warning", { text: text.slice(0, 300), accepted });
+    if (!accepted) {
+      void this.refuse(new SessionRefusal("mode_not_enforced", "the adapter warned that it will not ask for permission"));
+      return;
+    }
+    if (this.noAskWarning) return;
+    this.noAskWarning = true;
+    if (this.announced && !this.closed) this.emit("mode_update", { currentMode: this.currentMode, unattended: true });
+  }
+  onExit(info) {
+    this.adapter = null;
+    const hadTurn = this.turnRunning;
+    const cancelled = this.book.cancelAll();
+    for (const actionId of cancelled) this.emit("permission_resolved", { actionId, optionId: null, outcome: "cancelled", by: "adapter_exit" });
+    if (!this.closed) this.audit("adapter_exited", { code: info.code, signal: info.signal, during_turn: hadTurn });
+  }
+  onUpdate(update, params) {
+    this.touch();
+    const type = typeof update?.sessionUpdate === "string" ? update.sessionUpdate : null;
+    if (!type) return;
+    if (type === "current_mode_update" && typeof update.currentModeId === "string") return this.noteMode(update.currentModeId);
+    if (type === "config_option_update" && Array.isArray(update.configOptions)) {
+      const mode = update.configOptions.find((o) => o?.category === "mode");
+      if (mode && typeof mode.currentValue === "string") this.noteMode(mode.currentValue);
+      return;
+    }
+    if (type === "available_commands_update") return;
+    const text = type === "agent_message_chunk" && isObject(update.content) && typeof update.content.text === "string" ? update.content.text : "";
+    if (text) {
+      if (PERMISSION_WARNING_RE.test(text)) return this.onUnsafeWarning(text);
+      if (this.env.config.dropMessagePatterns.some((re) => re.test(text))) return;
+    }
+    const data = limitStrings(redactDeep({ sessionId: params.sessionId, update }), MAX_TOOL_OUTPUT_BYTES);
+    if (this.replaying) {
+      if (type === "user_message_chunk" || type === "agent_message_chunk" || type === "agent_thought_chunk" || type === "tool_call") this.emit(type, { ...data, replay: true });
+      return;
+    }
+    this.emit(type, data);
+  }
+  onNotification(method, params) {
+    this.touch();
+    const type = method.replace(/[^A-Za-z0-9._:-]/g, ".").slice(0, 64);
+    this.emit(type, limitStrings(redactDeep({ method, params }), MAX_TOOL_OUTPUT_BYTES));
+  }
+  // --- permissions ------------------------------------------------------------------
+  onPermission(params) {
+    this.touch();
+    const toolCall = isObject(params.toolCall) ? params.toolCall : {};
+    const options = normalizeOptions(params.options);
+    if (this.closed || options.length === 0) return Promise.resolve({ outcome: { outcome: "cancelled" } });
+    const rule = matchAutoAllow(this.agent.autoAllow, toolCall, this.cwd);
+    const allowOnce = options.find((o) => o.kind === "allow_once");
+    if (rule && allowOnce) {
+      this.audit("auto_allow", { rule: `${rule.kind}:${rule.pathGlob}`, tool: toolCall.title, tool_kind: toolCall.kind, option_id: allowOnce.optionId });
+      this.emit("permission_auto_allowed", { tool: str(toolCall.title, 200), kind: str(toolCall.kind, 64), rule: `${rule.kind}:${rule.pathGlob}`, optionId: allowOnce.optionId });
+      return Promise.resolve({ outcome: { outcome: "selected", optionId: allowOnce.optionId } });
+    }
+    return this.askPerson(options, {
+      tool: str(toolCall.title, 200),
+      kind: str(toolCall.kind, 64),
+      input: boundedInput(toolCall.rawInput),
+      toolCallId: str(toolCall.toolCallId, 128)
+    }, (optionId) => optionId === null ? { outcome: { outcome: "cancelled" } } : { outcome: { outcome: "selected", optionId } });
+  }
+  /** Put a question on the phone and wait for the answer, a cancel or the timeout. `shape` turns the answer into what the adapter expects. */
+  askPerson(options, info, shape) {
+    return new Promise((resolve) => {
+      const p = this.book.open(options, (actionId) => redactDeep({ actionId, ...info, options, timeout_ms: this.book.ttl }), (optionId) => {
+        this.env.store.removePending(this.id, p.actionId);
+        resolve(shape(optionId));
+      });
+      this.env.store.addPending(this.id, p.actionId);
+      this.audit("permission_requested", { action_id: p.actionId, tool: info.tool, tool_kind: info.kind, options: options.map((o) => o.optionId) });
+      this.emit("permissionRequest", p.payload);
+    });
+  }
+  /** A person's answer from the phone. Only an option that was offered is accepted. */
+  decide(actionId, optionId, by, cmdId) {
+    this.touch();
+    const result = this.book.decide(actionId, optionId);
+    if (!result.ok) {
+      this.audit("decision_refused", { action_id: actionId, option_id: optionId, reason: result.reason, cmd_id: cmdId });
+      return;
+    }
+    this.audit("permission_resolved", { action_id: actionId, option_id: optionId, by });
+    this.emit("permission_resolved", { actionId, optionId, by });
+  }
+  /** After a reconnect: the cards that are still waiting, sent again (same `actionId`, so a client treats them as the same card). */
+  resendPending() {
+    for (const p of this.book.list()) this.emit("permissionRequest", { ...p.payload, resent: true });
+  }
+  /** The Cursor extension requests the adapter blocks on. Never left unanswered. */
+  onExtension(method, params) {
+    this.touch();
+    if (method === "cursor/create_plan") {
+      const options = [
+        { optionId: "plan-accept", name: "Accept the plan", kind: "allow_once" },
+        { optionId: "plan-reject", name: "Reject the plan", kind: "reject_once" }
+      ];
+      return this.askPerson(options, {
+        tool: `Plan: ${str(params.name, 150) || "proposed plan"}`,
+        kind: "switch_mode",
+        input: boundedInput({ overview: params.overview, plan: params.plan, todos: params.todos }),
+        toolCallId: str(params.toolCallId, 128)
+      }, (id) => ({ outcome: id === "plan-accept" ? { outcome: "accepted" } : id === "plan-reject" ? { outcome: "rejected", reason: "rejected from the phone" } : { outcome: "cancelled" } }));
+    }
+    if (method === "cursor/ask_question") {
+      const qs = Array.isArray(params.questions) ? params.questions : [];
+      const q = qs.length === 1 && isObject(qs[0]) ? qs[0] : null;
+      const opts = q && Array.isArray(q.options) ? q.options.filter((o) => isObject(o) && typeof o.id === "string" && o.id !== "skip") : [];
+      if (!q || q.allowMultiple === true || opts.length === 0 || opts.length > 8) {
+        this.audit("extension_skipped", { method, questions: qs.length });
+        this.emit("extension_skipped", { method, reason: "unsupported_question_shape", questions: redactDeep(qs) });
+        return Promise.resolve({ outcome: { outcome: "skipped", reason: "this client cannot show that question" } });
+      }
+      const options = [
+        ...opts.map((o) => ({ optionId: String(o.id), name: String(o.label ?? o.id).slice(0, 200), kind: "allow_once" })),
+        { optionId: "skip", name: "Skip the question", kind: "reject_once" }
+      ];
+      return this.askPerson(
+        options,
+        { tool: str(q.prompt, 200) || "Question", kind: "question", input: null, toolCallId: str(params.toolCallId, 128) },
+        (id) => id === null ? { outcome: { outcome: "cancelled" } } : id === "skip" ? { outcome: { outcome: "skipped" } } : { outcome: { outcome: "answered", answers: [{ questionId: String(q.id), selectedOptionIds: [id] }] } }
+      );
+    }
+    return Promise.reject(new Error(`unsupported extension ${method}`));
+  }
+  // --- turns ----------------------------------------------------------------------------
+  /**
+   * `prompt`: queued behind a running turn, run in order. Returns once accepted, not when the turn ends.
+   * `started` is called exactly once, when the prompt reaches the adapter or is dropped (refused, cancelled,
+   * the session closed): only then does the connector count the command as handled, so a restart before that
+   * delivers it again instead of losing it.
+   */
+  enqueuePrompt(text, cmdId, started = () => {
+  }) {
+    if (this.closed) {
+      this.rejectCommand("prompt", cmdId, "session_closed");
+      return started();
+    }
+    if (this.queue.length >= MAX_QUEUED_PROMPTS) {
+      this.rejectCommand("prompt", cmdId, "too_many_queued_prompts");
+      return started();
+    }
+    this.queue.push({ text, cmdId, started });
+    if (!this.turnRunning) void this.pump();
+  }
+  /** Prompts that will now never run (the process is being stopped): they count as handled. */
+  dropQueued() {
+    const q = this.queue;
+    this.queue = [];
+    for (const item of q) item.started();
+  }
+  async pump() {
+    if (this.turnRunning) return;
+    this.turnRunning = true;
+    try {
+      while (this.queue.length && !this.closed) {
+        const next = this.queue.shift();
+        await this.runTurn(next.text, next.started, next.cmdId);
+      }
+    } finally {
+      this.turnRunning = false;
+      this.touch();
+    }
+  }
+  async runTurn(text, started, cmdId) {
+    if (this.agent.attach) {
+      const refused = await this.preflight();
+      if (refused) {
+        started();
+        this.audit("prompt_refused", { reason: refused.reason, detail: refused.detail.slice(0, 300) });
+        this.rejectCommand("prompt", cmdId, refused.reason);
+        this.emit("turn_end", { stopReason: "error", error: refused.reason });
+        return;
+      }
+    }
+    try {
+      await this.ensureAdapter();
+    } catch (e) {
+      started();
+      this.emit("turn_end", { stopReason: "error", error: e instanceof SessionRefusal ? e.reason : "adapter_unavailable" });
+      return this.refuse(e);
+    }
+    const a = this.adapter;
+    this.audit("turn_started", { length: text.length });
+    const support = this.agent.attach && this.acpId ? this.env.attach.get(this.agent.id) : void 0;
+    const watch = support ? this.watchTwins(support, this.acpId) : null;
+    try {
+      const reply = a.requestUnbounded("session/prompt", { sessionId: this.acpId, prompt: [{ type: "text", text }] });
+      started();
+      const res = await reply;
+      const usage = isObject(res.usage) ? res.usage : void 0;
+      this.emit("turn_end", { stopReason: typeof res.stopReason === "string" ? res.stopReason : "end_turn", ...usage ? { usage } : {} });
+    } catch (e) {
+      this.audit("turn_failed", { error: errMessage(e) });
+      this.emit("turn_end", { stopReason: "error", error: errMessage(e).slice(0, 300) });
+    } finally {
+      this.markTranscript();
+      if (watch) {
+        if (this.closed) watch.stop();
+        else if (await watch.finish()) this.twinSeen = true;
+      }
+    }
+  }
+  /**
+   * For an attach agent: may this prompt go to the agent now? Null when it may, else why not (the prompt is
+   * rejected and the session stays, so it goes through once the cause is gone).
+   *
+   * Someone may have opened the conversation in a terminal since the last turn. Sending the prompt would make a
+   * second writer, and even after that terminal has gone the adapter's memory of the conversation predates what
+   * the terminal wrote: continuing from it forks the transcript. So an adapter is dropped when another process
+   * holds the conversation open, when one was seen holding it open during the last turn (see {@link watchTwins}), and
+   * when the transcript is no longer the size this adapter left it (a terminal that came and went between two
+   * prompts); the next start reads the transcript afresh, after the full check.
+   */
+  async preflight() {
+    const support = this.env.attach.get(this.agent.id);
+    const ref = this.acpId;
+    if (!support || !ref) return { reason: "twin_check_failed", detail: "no takeover support" };
+    let live = this.adapter && !this.adapter.exited ? this.adapter : null;
+    if (live && this.twinSeen) {
+      this.audit("adapter_discarded", { why: "another process held the conversation open during the last turn" });
+      await this.dropAdapter();
+      live = null;
+    }
+    const verdict = await support.check(ref, { ownPgid: live?.pid ?? null, transcript: live === null });
+    if (!verdict.ok) {
+      if (live) await this.dropAdapter();
+      return verdict;
+    }
+    if (live && this.transcriptMark !== null) {
+      const now = support.transcriptSize(ref);
+      if (now !== null && now !== this.transcriptMark) {
+        this.audit("transcript_changed", { was: this.transcriptMark, now });
+        await this.dropAdapter();
+        return this.preflight();
+      }
+    }
+    return null;
+  }
+  /** What size the transcript is as this connector leaves it: after it starts the session and after every turn. */
+  markTranscript() {
+    if (this.agent.attach && this.acpId) this.transcriptMark = this.env.attach.get(this.agent.id)?.transcriptSize(this.acpId) ?? null;
+  }
+  /** A recycled (or crashed) adapter comes back on demand. */
+  async ensureAdapter() {
+    if (this.adapter && !this.adapter.exited) return;
+    this.adapter = null;
+    await this.launch("resume");
+    this.audit("session_resumed", { mode: this.currentMode });
+  }
+  /** `resume`: bring the session back. A live adapter is NOT asked to resume (that would reset its mode); the mode is re-asserted instead. */
+  async resume(cmdId) {
+    if (this.closed) return this.rejectCommand("resume", cmdId, "session_closed");
+    try {
+      if (this.adapter && !this.adapter.exited) await this.enforceMode(this.targetMode);
+      else await this.launch("resume");
+    } catch (e) {
+      return this.refuse(e);
+    }
+    this.audit("session_resumed", { mode: this.currentMode, unattended: this.unattended });
+    this.emit("session_resumed", { acp_session_id: this.acpId, modes: this.shownModes(), currentMode: this.currentMode, unattended: this.unattended });
+    this.touch();
+  }
+  /** `cancel`: stop the turn, drop what was queued, answer every waiting permission request `cancelled`. */
+  async cancel() {
+    const queued = this.queue.length;
+    this.dropQueued();
+    const wasRunning = this.turnRunning;
+    if (wasRunning && this.adapter && this.acpId) await this.adapter.notify("session/cancel", { sessionId: this.acpId }).catch(() => void 0);
+    for (const actionId of this.book.cancelAll()) this.emit("permission_resolved", { actionId, optionId: null, outcome: "cancelled", by: "cancel" });
+    this.audit("cancelled", { turn_running: wasRunning, queued_dropped: queued });
+    if (!wasRunning) this.emit("turn_end", { stopReason: "cancelled" });
+  }
+  // --- ending ----------------------------------------------------------------------------
+  /** The adapter's process goes away; the session stays and resumes on demand. */
+  async recycle() {
+    if (this.closed || this.busy || !this.adapter) return;
+    this.audit("adapter_recycled", { idle_ms: this.env.timing.idleMs });
+    await this.dropAdapter();
+  }
+  async dropAdapter() {
+    const a = this.adapter;
+    this.adapter = null;
+    if (a) await a.kill();
+  }
+  /** `close`, and the common end of every refusal. */
+  async close(reason) {
+    if (this.closed) return;
+    this.closed = true;
+    clearTimeout(this.idle);
+    this.dropQueued();
+    for (const actionId of this.book.cancelAll()) this.emit("permission_resolved", { actionId, optionId: null, outcome: "cancelled", by: reason });
+    const a = this.adapter;
+    if (a && this.acpId && a.caps.sessionCapabilities?.close) await a.request("session/close", { sessionId: this.acpId }, 5e3).catch(() => void 0);
+    await this.dropAdapter();
+    this.env.store.patch(this.id, { status: "closed" });
+    this.audit("session_closed", { reason });
+    this.emit("session_closed", { reason });
+  }
+  /** A session that cannot be opened (or kept safe) is closed with the reason, never left half-open. */
+  async refuse(e) {
+    const r = e instanceof SessionRefusal ? e : mapAdapterError(e);
+    this.env.log.warn("session refused", { session: this.id, reason: r.reason, message: r.message });
+    this.audit("session_refused", { reason: r.reason, message: r.message.slice(0, 300) });
+    await this.close(r.reason);
+  }
+  rejectCommand(type, cmdId, reason) {
+    this.audit("command_rejected", { type, cmd_id: cmdId, reason });
+    this.emit("command_rejected", { type, cmd_id: cmdId, reason });
+  }
+};
+function mapAdapterError(e) {
+  const message = errMessage(e);
+  if (/authentication required|auth_required|not logged in|login required/i.test(message) || isObject(e) && e.code === -32e3) {
+    return new SessionRefusal("agent_auth_required", message);
+  }
+  return new SessionRefusal("adapter_error", message);
+}
+function str(v, max) {
+  return typeof v === "string" ? v.slice(0, max) : "";
+}
+function limitStrings(value, max) {
+  if (typeof value === "string") return truncateBytes(value, max).text;
+  if (Array.isArray(value)) return value.map((v) => limitStrings(v, max));
+  if (value && typeof value === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) out[k] = limitStrings(v, max);
+    return out;
+  }
+  return value;
+}
+
+// src/manager.ts
+var MAX_ACTIVE_SESSIONS = 10;
+var SessionManager = class {
+  constructor(env) {
+    this.env = env;
+  }
+  env;
+  sessions = /* @__PURE__ */ new Map();
+  /** Takeovers that have passed the "already attached" check and have not yet registered their session (`agent:ref`). */
+  attaching = /* @__PURE__ */ new Set();
+  chains = /* @__PURE__ */ new Map();
+  agent(id) {
+    return typeof id === "string" ? this.env.config.agents.find((a) => a.id === id) : void 0;
+  }
+  /**
+   * Commands of one session run one after another; sessions run side by side.
+   * `handled` is called exactly once, when the command counts as carried out: for most that is when the
+   * handler returns; for a prompt it is when the prompt reaches the adapter (see Session.enqueuePrompt).
+   */
+  handle(cmd, handled = () => {
+  }) {
+    const sid = cmd.session_id;
+    let done = false;
+    const once = () => {
+      if (!done) {
+        done = true;
+        handled();
+      }
+    };
+    const prev = this.chains.get(sid) ?? Promise.resolve();
+    const next = prev.then(() => this.dispatch(cmd, once)).catch((e) => {
+      this.env.log.error("command failed", { type: cmd.type, session: sid, error: errMessage(e) });
+      this.env.audit.record("command_failed", { type: cmd.type, session_id: sid, cmd_id: cmd.cmd_id, error: errMessage(e).slice(0, 300) });
+      once();
+    });
+    this.chains.set(sid, next);
+    void next.finally(() => {
+      if (this.chains.get(sid) === next) this.chains.delete(sid);
+    });
+    return next;
+  }
+  async dispatch(cmd, handled) {
+    let deferred = false;
+    try {
+      deferred = await this.run(cmd, handled);
+    } finally {
+      if (!deferred) handled();
+    }
+  }
+  /** Returns true when `handled` will be called later by the session itself (a prompt). */
+  async run(cmd, handled) {
+    const { type, session_id: sid, cmd_id: cmdId } = cmd;
+    const detail = type === "prompt" && typeof cmd.text === "string" ? { sha256: sha256(cmd.text), length: cmd.text.length } : {};
+    this.env.audit.record("command", { type, session_id: sid, cmd_id: cmdId, ...detail });
+    if (type === "session.new") {
+      await this.sessionNew(cmd);
+      return false;
+    }
+    if (!isRemoteCommandType(type)) {
+      this.env.audit.record("command_dropped", { type: String(type).slice(0, 64), session_id: sid, cmd_id: cmdId, reason: "not_a_known_command", known: [...REMOTE_COMMAND_TYPES, "session.new"] });
+      return false;
+    }
+    const s = await this.lookup(sid);
+    if (!s) {
+      this.env.emit(sid, "session_closed", { reason: "unknown_session" });
+      return false;
+    }
+    switch (type) {
+      case "prompt":
+        if (typeof cmd.text !== "string" || cmd.text === "") {
+          s.rejectCommand("prompt", cmdId, "text_required");
+          return false;
+        }
+        s.enqueuePrompt(cmd.text, cmdId, handled);
+        return true;
+      case "cancel":
+        await s.cancel();
+        return false;
+      case "set_mode":
+        if (typeof cmd.mode_id !== "string") s.rejectCommand("set_mode", cmdId, "mode_id_required");
+        else await s.setMode(cmd.mode_id, cmdId);
+        return false;
+      case "resume":
+        await s.resume(cmdId);
+        return false;
+      case "close":
+        await s.close("closed");
+        return false;
+      case "decision":
+        if (typeof cmd.action_id !== "string" || typeof cmd.option_id !== "string") s.rejectCommand("decision", cmdId, "action_and_option_required");
+        else s.decide(cmd.action_id, cmd.option_id, typeof cmd.by === "string" ? cmd.by : null, cmdId);
+        return false;
+    }
+    return false;
+  }
+  async sessionNew(cmd) {
+    const sid = cmd.session_id;
+    if (this.sessions.has(sid)) return;
+    const agent = this.agent(cmd.agent_id);
+    if (!agent) {
+      this.env.audit.record("session_refused", { session_id: sid, reason: "unknown_agent", agent_id: String(cmd.agent_id).slice(0, 64) });
+      this.env.emit(sid, "session_closed", { reason: "unknown_agent" });
+      return;
+    }
+    const ref = cmd.resume_ref;
+    if (agent.attach) return this.attachNew(cmd, agent);
+    if (ref !== void 0 && ref !== null) {
+      this.env.audit.record("session_refused", { session_id: sid, agent_id: agent.id, reason: "resume_not_supported" });
+      this.env.emit(sid, "session_closed", { reason: "resume_not_supported" });
+      return;
+    }
+    const verdict = checkCwd(typeof cmd.cwd === "string" ? cmd.cwd : "", agent.roots);
+    if (!verdict.ok) {
+      this.env.audit.record("session_refused", { session_id: sid, agent_id: agent.id, reason: verdict.reason, cwd: String(cmd.cwd).slice(0, 300) });
+      this.env.emit(sid, "session_closed", { reason: verdict.reason });
+      return;
+    }
+    const active = [...this.sessions.values()].filter((s2) => !s2.closed).length;
+    if (active >= MAX_ACTIVE_SESSIONS) {
+      this.env.audit.record("session_refused", { session_id: sid, agent_id: agent.id, reason: "too_many_sessions" });
+      this.env.emit(sid, "session_closed", { reason: "too_many_sessions" });
+      return;
+    }
+    const s = new Session(sid, agent, verdict.real, this.env);
+    this.sessions.set(sid, s);
+    await s.create(typeof cmd.mode === "string" ? cmd.mode : null);
+  }
+  /**
+   * `session.new` for an agent that takes over an existing session: `resume_ref` names it, and it must be one the
+   * adapter lists under this agent's roots. The directory it is resumed in is the one the session itself records;
+   * the one Claw sent has to be the same. Whether another process has it open is checked when it is launched.
+   */
+  async attachNew(cmd, agent) {
+    const sid = cmd.session_id;
+    const refuse = (reason, extra = {}) => {
+      this.env.audit.record("session_refused", { session_id: sid, agent_id: agent.id, reason, ...extra });
+      this.env.emit(sid, "session_closed", { reason });
+    };
+    const ref = typeof cmd.resume_ref === "string" ? cmd.resume_ref : "";
+    if (!ref) return refuse("resume_ref_required");
+    if (!SESSION_REF_RE.test(ref)) return refuse("invalid_resume_ref");
+    const support = this.env.attach.get(agent.id);
+    if (!support) return refuse("attach_unavailable");
+    const want = ref.toLowerCase();
+    const claim = `${agent.id}:${want}`;
+    if (this.attaching.has(claim) || [...this.sessions.values()].some((s) => !s.closed && s.agent.id === agent.id && s.acpId?.toLowerCase() === want)) return refuse("already_attached");
+    if ([...this.sessions.values()].filter((s) => !s.closed).length + this.attaching.size >= MAX_ACTIVE_SESSIONS) return refuse("too_many_sessions");
+    this.attaching.add(claim);
+    try {
+      const found = await support.resolve(want);
+      if (!found.ok) return refuse(found.reason);
+      const asked = checkCwd(typeof cmd.cwd === "string" ? cmd.cwd : "", agent.roots);
+      if (!asked.ok) return refuse(asked.reason, { cwd: String(cmd.cwd).slice(0, 300) });
+      if (asked.real !== found.item.cwd) return refuse("cwd_mismatch", { cwd: String(cmd.cwd).slice(0, 300) });
+      const s = new Session(sid, agent, found.item.cwd, this.env, found.item.ref);
+      this.sessions.set(sid, s);
+      this.attaching.delete(claim);
+      await s.attach(typeof cmd.mode === "string" ? cmd.mode : null, found.item.title);
+    } finally {
+      this.attaching.delete(claim);
+    }
+  }
+  /** The ids of the existing sessions this connector holds open, by agent. */
+  attachedRefs(agentId) {
+    const out = /* @__PURE__ */ new Set();
+    for (const s of this.sessions.values()) if (!s.closed && s.agent.id === agentId && s.acpId) out.add(s.acpId.toLowerCase());
+    return out;
+  }
+  /** A session this process knows, or one it made earlier (before a restart) and can bring back. */
+  async lookup(sid) {
+    const have = this.sessions.get(sid);
+    if (have) return have;
+    const rec = this.env.store.get(sid);
+    if (!rec || rec.status !== "active") return null;
+    const agent = this.agent(rec.agent_id);
+    const verdict = agent ? checkCwd(rec.cwd, agent.roots) : null;
+    if (!agent || !verdict?.ok) {
+      this.env.store.patch(sid, { status: "closed" });
+      this.env.audit.record("session_refused", { session_id: sid, reason: agent ? "cwd_outside_roots" : "unknown_agent" });
+      this.env.emit(sid, "session_closed", { reason: agent ? "cwd_outside_roots" : "unknown_agent" });
+      return null;
+    }
+    const s = new Session(sid, agent, verdict.real, this.env, rec.acp_session_id, rec.mode);
+    this.sessions.set(sid, s);
+    return s;
+  }
+  /** After the command stream reconnects: cards still waiting are shown again. */
+  resendPending() {
+    for (const s of this.sessions.values()) s.resendPending();
+  }
+  get pendingPermissions() {
+    return [...this.sessions.values()].reduce((n, s) => n + s.pendingCount, 0);
+  }
+  /** The kill switch: every adapter process, now. Sessions stay recorded and can be resumed. */
+  async killAll(reason) {
+    for (const s of this.sessions.values()) {
+      this.env.audit.record("session_killed", { session_id: s.id, reason });
+      s.dropQueued();
+    }
+    await this.env.registry.killAll();
+    this.sessions.clear();
+  }
+};
+
+// src/outbox.ts
+import fs10 from "node:fs";
+import path11 from "node:path";
+var DROPPABLE_TYPES = /* @__PURE__ */ new Set([
+  "agent_message_chunk",
+  "agent_thought_chunk",
+  "tool_call_update",
+  "usage_update",
+  "plan"
+]);
+var TOMBSTONE_MS = 30 * 24 * 3600 * 1e3;
+var safeName = (sid) => sid.replace(/[^A-Za-z0-9._-]/g, "_");
+function fitData(data, max = REMOTE_AGENT_LIMITS.maxEventBytes - 1024) {
+  const bytes = Buffer.byteLength(JSON.stringify(data), "utf8");
+  if (bytes <= max) return data;
+  return { truncated: true, original_bytes: bytes };
+}
+var Outbox = class {
+  dir;
+  maxBytes;
+  now;
+  queue = [];
+  meta = /* @__PURE__ */ new Map();
+  bytes = /* @__PURE__ */ new Map();
+  closed = /* @__PURE__ */ new Set();
+  constructor(opts) {
+    this.dir = opts.dir;
+    this.maxBytes = opts.maxBytesPerSession ?? 5 * 1024 * 1024;
+    this.now = opts.now ?? Date.now;
+    fs10.mkdirSync(this.dir, { recursive: true, mode: 448 });
+    this.load();
+  }
+  eventsFile = (sid) => path11.join(this.dir, `${safeName(sid)}.jsonl`);
+  metaFile = (sid) => path11.join(this.dir, `${safeName(sid)}.meta.json`);
+  writeMeta(sid) {
+    const tmp = this.metaFile(sid) + ".tmp";
+    fs10.writeFileSync(tmp, JSON.stringify(this.meta.get(sid)), { mode: 384 });
+    fs10.renameSync(tmp, this.metaFile(sid));
+  }
+  /** Rebuild the queue from disk. The highest sequence number ever used is the larger of the meta file and the log itself. */
+  load() {
+    const loaded = [];
+    const bases = /* @__PURE__ */ new Set();
+    for (const name of fs10.readdirSync(this.dir)) {
+      if (name.endsWith(".meta.json")) bases.add(name.slice(0, -".meta.json".length));
+      else if (name.endsWith(".jsonl")) bases.add(name.slice(0, -".jsonl".length));
+    }
+    for (const base of bases) {
+      let meta = { lastSeq: 0, acked: 0 };
+      try {
+        meta = JSON.parse(fs10.readFileSync(path11.join(this.dir, `${base}.meta.json`), "utf8"));
+      } catch {
+      }
+      let sid = null;
+      const file = path11.join(this.dir, `${base}.jsonl`);
+      let text = "";
+      try {
+        text = fs10.readFileSync(file, "utf8");
+      } catch {
+      }
+      for (const line of text.split("\n")) {
+        if (!line) continue;
+        let ev;
+        try {
+          ev = JSON.parse(line);
+        } catch {
+          continue;
+        }
+        sid = ev.session_id;
+        meta.lastSeq = Math.max(meta.lastSeq, ev.seq);
+        if (ev.seq > meta.acked) loaded.push(ev);
+      }
+      if (sid === null) {
+        sid = base;
+        try {
+          if (this.now() - fs10.statSync(path11.join(this.dir, `${base}.meta.json`)).mtimeMs > TOMBSTONE_MS) {
+            for (const f of [`${base}.meta.json`, `${base}.jsonl`]) fs10.rmSync(path11.join(this.dir, f), { force: true });
+            continue;
+          }
+        } catch {
+        }
+      }
+      this.meta.set(sid, meta);
+    }
+    loaded.sort((a, b) => a.ts - b.ts || a.seq - b.seq);
+    this.queue = loaded;
+    for (const ev of loaded) this.bytes.set(ev.session_id, (this.bytes.get(ev.session_id) ?? 0) + JSON.stringify(ev).length);
+  }
+  lastSeq(sessionId) {
+    return this.meta.get(sessionId)?.lastSeq ?? 0;
+  }
+  /** Assign the next sequence number, persist the event, queue it. */
+  append(sessionId, type, data, ts = this.now()) {
+    const meta = this.meta.get(sessionId) ?? { lastSeq: 0, acked: 0 };
+    const ev = { session_id: sessionId, seq: meta.lastSeq + 1, type, ts, data: fitData(data) };
+    meta.lastSeq = ev.seq;
+    this.meta.set(sessionId, meta);
+    const line = JSON.stringify(ev);
+    fs10.appendFileSync(this.eventsFile(sessionId), line + "\n", { mode: 384 });
+    if (ev.seq === 1) this.writeMeta(sessionId);
+    this.queue.push(ev);
+    this.bytes.set(sessionId, (this.bytes.get(sessionId) ?? 0) + line.length);
+    if ((this.bytes.get(sessionId) ?? 0) > this.maxBytes) this.shed(sessionId);
+    return ev;
+  }
+  /** Drop the oldest droppable events of a session until it is back under its cap. */
+  shed(sessionId) {
+    let total = this.bytes.get(sessionId) ?? 0;
+    const keep = [];
+    let dropped = 0;
+    for (const ev of this.queue) {
+      if (ev.session_id === sessionId && total > this.maxBytes && DROPPABLE_TYPES.has(ev.type)) {
+        total -= JSON.stringify(ev).length;
+        dropped++;
+        continue;
+      }
+      keep.push(ev);
+    }
+    if (!dropped) return;
+    this.queue = keep;
+    this.bytes.set(sessionId, total);
+    this.rewrite(sessionId);
+  }
+  rewrite(sessionId) {
+    this.writeMeta(sessionId);
+    const mine = this.queue.filter((e) => e.session_id === sessionId);
+    const tmp = this.eventsFile(sessionId) + ".tmp";
+    fs10.writeFileSync(tmp, mine.map((e) => JSON.stringify(e) + "\n").join(""), { mode: 384 });
+    fs10.renameSync(tmp, this.eventsFile(sessionId));
+  }
+  /** The oldest events not yet acknowledged, in the order they were appended. */
+  pending(max) {
+    return this.queue.slice(0, max);
+  }
+  get size() {
+    return this.queue.length;
+  }
+  /** The server stored everything up to `acked[session]`. */
+  ack(acked) {
+    const touched = /* @__PURE__ */ new Set();
+    this.queue = this.queue.filter((ev) => {
+      const upTo = acked[ev.session_id];
+      if (typeof upTo === "number" && ev.seq <= upTo) {
+        touched.add(ev.session_id);
+        this.bytes.set(ev.session_id, Math.max(0, (this.bytes.get(ev.session_id) ?? 0) - JSON.stringify(ev).length));
+        return false;
+      }
+      return true;
+    });
+    for (const sid of touched) this.settle(sid, acked[sid]);
+  }
+  /** An event the server refused for good (retrying cannot help): forget it. */
+  drop(sessionId, seq) {
+    const before = this.queue.length;
+    this.queue = this.queue.filter((e) => !(e.session_id === sessionId && e.seq === seq));
+    if (this.queue.length === before) return;
+    this.rewrite(sessionId);
+    this.settle(sessionId, this.meta.get(sessionId)?.acked ?? 0);
+  }
+  settle(sid, ackedUpTo) {
+    const meta = this.meta.get(sid) ?? { lastSeq: 0, acked: 0 };
+    meta.acked = Math.max(meta.acked, ackedUpTo);
+    this.meta.set(sid, meta);
+    this.writeMeta(sid);
+    const left = this.queue.filter((e) => e.session_id === sid);
+    if (left.length === 0) {
+      fs10.writeFileSync(this.eventsFile(sid), "", { mode: 384 });
+      this.bytes.set(sid, 0);
+      if (this.closed.has(sid)) this.forget(sid);
+    } else if (left.length < this.queue.length / 2 || meta.acked > 1e3) {
+      this.rewrite(sid);
+    }
+  }
+  /** A closed session needs no more numbers once its events are acknowledged. */
+  markClosed(sessionId) {
+    this.closed.add(sessionId);
+    if (!this.queue.some((e) => e.session_id === sessionId)) this.forget(sessionId);
+  }
+  /**
+   * A closed session needs no events once they are acknowledged, but its high-water mark must outlive them: a later
+   * event for the same session id (the answer to a stale command, `session_closed {unknown_session}`) must go on
+   * from the last number, because the server keeps the first event it saw for each `(session, seq)` and drops a
+   * repeat. What stays is the small meta file, a tombstone, removed after {@link TOMBSTONE_MS}.
+   */
+  forget(sid) {
+    fs10.rmSync(this.eventsFile(sid), { force: true });
+    if (this.meta.has(sid)) this.writeMeta(sid);
+    this.bytes.delete(sid);
+    this.closed.delete(sid);
+  }
+};
+
+// src/paths.ts
+import os3 from "node:os";
+import path12 from "node:path";
+function resolveDirs(env = process.env, home = os3.homedir()) {
+  const one = env.CLAW_CONNECTOR_HOME?.trim();
+  if (one) return { config: path12.join(one, "config"), state: path12.join(one, "state") };
+  const cfg = env.XDG_CONFIG_HOME?.trim() || path12.join(home, ".config");
+  const st = env.XDG_STATE_HOME?.trim() || path12.join(home, ".local", "state");
+  return { config: path12.join(cfg, "claw-connector"), state: path12.join(st, "claw-connector") };
+}
+var configFile = (d) => path12.join(d.config, "agents.toml");
+var credentialsFile = (d) => path12.join(d.config, "credentials.json");
+var identityFile = (d) => path12.join(d.state, "connector.json");
+var sessionsFile = (d) => path12.join(d.state, "sessions.json");
+var childrenFile = (d) => path12.join(d.state, "children.json");
+var pidFile = (d) => path12.join(d.state, "connector.pid");
+var pauseFile = (d) => path12.join(d.state, "paused");
+var auditFile = (d) => path12.join(d.state, "audit.jsonl");
+var outboxDir = (d) => path12.join(d.state, "outbox");
+var logDir = (d) => path12.join(d.state, "logs");
+
+// src/session-store.ts
+import fs11 from "node:fs";
+import path13 from "node:path";
+var SessionStore = class {
+  constructor(file) {
+    this.file = file;
+    this.pendingFile = `${file}.pending`;
+    try {
+      const raw = JSON.parse(fs11.readFileSync(this.pendingFile, "utf8"));
+      if (Array.isArray(raw)) this.pending = raw.filter((p) => p && typeof p.session_id === "string" && typeof p.action_id === "string");
+    } catch {
+    }
+    try {
+      const raw = JSON.parse(fs11.readFileSync(file, "utf8"));
+      if (raw && typeof raw === "object" && !Array.isArray(raw)) this.recs = raw;
+    } catch {
+    }
+  }
+  file;
+  recs = {};
+  pending = [];
+  pendingFile;
+  get(id) {
+    return this.recs[id];
+  }
+  put(id, rec) {
+    this.recs[id] = rec;
+    this.save();
+  }
+  patch(id, p) {
+    const cur = this.recs[id];
+    if (!cur) return;
+    this.recs[id] = { ...cur, ...p };
+    this.save();
+  }
+  /**
+   * Permission requests a person has not answered. They live in the adapter's memory, so a crash
+   * of the connector ends them; the next run reads this list and closes each card (cancelled).
+   */
+  addPending(sessionId, actionId) {
+    this.pending.push({ session_id: sessionId, action_id: actionId });
+    this.savePending();
+  }
+  removePending(sessionId, actionId) {
+    const before = this.pending.length;
+    this.pending = this.pending.filter((p) => !(p.session_id === sessionId && p.action_id === actionId));
+    if (this.pending.length !== before) this.savePending();
+  }
+  /** Return what was pending and forget it. */
+  takePending() {
+    const out = this.pending;
+    this.pending = [];
+    if (out.length) this.savePending();
+    return out;
+  }
+  savePending() {
+    fs11.mkdirSync(path13.dirname(this.pendingFile), { recursive: true, mode: 448 });
+    const tmp = `${this.pendingFile}.${process.pid}.tmp`;
+    fs11.writeFileSync(tmp, JSON.stringify(this.pending), { mode: 384 });
+    fs11.renameSync(tmp, this.pendingFile);
+  }
+  ids() {
+    return Object.keys(this.recs);
+  }
+  save() {
+    fs11.mkdirSync(path13.dirname(this.file), { recursive: true, mode: 448 });
+    const tmp = `${this.file}.${process.pid}.tmp`;
+    fs11.writeFileSync(tmp, JSON.stringify(this.recs), { mode: 384 });
+    fs11.renameSync(tmp, this.file);
+  }
+};
+
+// src/connector.ts
+var DEFAULT_TIMING = {
+  ...DEFAULT_SESSION_TIMING,
+  heartbeatMs: REMOTE_AGENT_TIMING.heartbeatMs,
+  watchdogMs: REMOTE_AGENT_TIMING.watchdogMs,
+  batchMs: 150,
+  batchMax: 20,
+  backoffMinMs: 1e3,
+  backoffMaxMs: 6e4,
+  pausePollMs: 1e3,
+  catalogMs: 12e4,
+  attachCliMs: 8e3,
+  recentWriteMs: 1e4
+};
+var CommandLedger = class {
+  inflight = /* @__PURE__ */ new Set();
+  inflightIds = /* @__PURE__ */ new Set();
+  ids;
+  highest = 0;
+  floor;
+  constructor(cursor = 0, handled = []) {
+    this.floor = cursor;
+    this.highest = cursor;
+    this.ids = [...handled];
+  }
+  /** Whether this command was already carried out (or is being carried out now). */
+  seen(seq, cmdId) {
+    return seq <= this.floor || this.inflight.has(seq) || this.inflightIds.has(cmdId) || this.ids.includes(cmdId);
+  }
+  begin(seq, cmdId = "") {
+    this.inflight.add(seq);
+    this.inflightIds.add(cmdId);
+    this.highest = Math.max(this.highest, seq);
+  }
+  end(seq, cmdId) {
+    this.inflight.delete(seq);
+    this.inflightIds.delete(cmdId);
+    this.ids.push(cmdId);
+    if (this.ids.length > 500) this.ids.splice(0, this.ids.length - 500);
+    const safe = this.inflight.size ? Math.min(...this.inflight) - 1 : this.highest;
+    this.floor = Math.max(this.floor, safe);
+  }
+  get cursor() {
+    return this.floor;
+  }
+  get recentIds() {
+    return [...this.ids];
+  }
+  get highestSeen() {
+    return this.highest;
+  }
+};
+function isTransient(e) {
+  return e instanceof TransientAuthError || e instanceof TransportError || e instanceof HttpError && (e.status >= 500 || e.status === 429);
+}
+var Connector = class {
+  constructor(d) {
+    this.d = d;
+    this.timing = { ...DEFAULT_TIMING, ...d.timing };
+    this.outbox = new Outbox({ dir: outboxDir(d.dirs) });
+    this.registry = new ChildRegistry(childrenFile(d.dirs));
+    this.store = new SessionStore(sessionsFile(d.dirs));
+    for (const a of d.config.agents) {
+      if (!a.attach) continue;
+      this.attach.set(a.id, new AttachSupport(a, {
+        registry: this.registry,
+        audit: d.audit,
+        log: d.log,
+        logDir: logDir(d.dirs),
+        version: d.version,
+        env: process.env,
+        catalogMs: this.timing.catalogMs,
+        cliTimeoutMs: this.timing.attachCliMs,
+        recentWriteMs: this.timing.recentWriteMs,
+        attachedRefs: () => this.manager.attachedRefs(a.id)
+      }));
+    }
+    const env = {
+      config: d.config,
+      audit: d.audit,
+      registry: this.registry,
+      store: this.store,
+      attach: this.attach,
+      timing: this.timing,
+      logDir: logDir(d.dirs),
+      version: d.version,
+      log: d.log,
+      emit: (sid, type, data) => this.emit(sid, type, data)
+    };
+    this.manager = new SessionManager(env);
+  }
+  d;
+  timing;
+  outbox;
+  registry;
+  manager;
+  store;
+  attach = /* @__PURE__ */ new Map();
+  ledger = new CommandLedger();
+  cid = "";
+  revoked = false;
+  /** The connector row itself was revoked (not just the sign-in): recorded in connector.json for `login`. */
+  rowRevoked = false;
+  paused = false;
+  wakeSender = null;
+  wakeHeartbeat = null;
+  streamCtl = null;
+  ctl = new AbortController();
+  /** Every event leaves through here: scrubbed of credential shapes, numbered, written to disk, then posted. */
+  emit(sessionId, type, data) {
+    this.outbox.append(sessionId, type, redactDeep(data));
+    if (type === "session_closed") this.outbox.markClosed(sessionId);
+    this.wakeSender?.();
+  }
+  get connectorId() {
+    return this.cid;
+  }
+  get isRevoked() {
+    return this.revoked;
+  }
+  /** Ask the loops to end; `run` returns once adapters are stopped. */
+  stop() {
+    this.ctl.abort();
+    this.streamCtl?.abort();
+  }
+  async descriptors() {
+    return Promise.all(this.d.config.agents.map(async (a) => {
+      const base = { ask_mode: a.askMode, modes: a.safeModes, roots: a.roots.slice(0, 8), protocol: 1, unattended: a.unattended, unattended_allowed: a.allowUnsafeModes };
+      const support = this.attach.get(a.id);
+      const capabilities = support ? fitResumable(base, await support.resumable()) : base;
+      return { agent_id: a.id, kind: a.kind, name: a.name, capabilities };
+    }));
+  }
+  // --- identity -------------------------------------------------------------------
+  readIdentity() {
+    try {
+      const raw = JSON.parse(fs12.readFileSync(identityFile(this.d.dirs), "utf8"));
+      if (isObject(raw) && raw.server === this.d.server && typeof raw.connector_id === "string") {
+        return { server: raw.server, connector_id: raw.connector_id, cursor: typeof raw.cursor === "number" ? raw.cursor : 0, handled: Array.isArray(raw.handled) ? raw.handled.filter((x) => typeof x === "string") : [] };
+      }
+    } catch {
+    }
+    return null;
+  }
+  writeIdentity() {
+    const st = { server: this.d.server, connector_id: this.cid, cursor: this.ledger.cursor, handled: this.ledger.recentIds, ...this.rowRevoked ? { revoked: true } : {} };
+    const file = identityFile(this.d.dirs);
+    fs12.mkdirSync(this.d.dirs.state, { recursive: true, mode: 448 });
+    fs12.writeFileSync(`${file}.tmp`, JSON.stringify(st), { mode: 384 });
+    fs12.renameSync(`${file}.tmp`, file);
+  }
+  /** Use the connector id this machine already has, or register a new one. */
+  async identify(forceNew = false) {
+    const have = forceNew ? null : this.readIdentity();
+    if (have) {
+      this.cid = have.connector_id;
+      this.ledger = new CommandLedger(have.cursor, have.handled);
+      return;
+    }
+    this.cid = await this.d.client.register(this.d.config.name, this.d.version);
+    this.ledger = new CommandLedger();
+    this.writeIdentity();
+    this.d.audit.record("connector_registered", { connector_id: this.cid, name: this.d.config.name });
+  }
+  async heartbeat() {
+    await this.d.client.heartbeat(this.cid, {
+      version: this.d.version,
+      agents: await this.descriptors(),
+      cmd_cursor: this.ledger.cursor > 0 ? this.ledger.cursor : null
+    });
+  }
+  /** The first heartbeat, answering "not found" once by registering afresh (the stored id may belong to another account). */
+  async firstHeartbeat() {
+    try {
+      await this.heartbeat();
+    } catch (e) {
+      if (e instanceof HttpError && e.status === 404) {
+        await this.identify(true);
+        await this.heartbeat();
+        return;
+      }
+      throw e;
+    }
+  }
+  /**
+   * Identify to Claw and send the first heartbeat, trying again (with the usual backoff) while the failure is
+   * the kind that passes: no network yet (a laptop that woke before Wi-Fi), the identity service or Claw
+   * answering 5xx or 429. Anything else (a refused credential, a missing scope) is a problem a retry will not
+   * fix and ends the run with its message.
+   */
+  async startup() {
+    for (let attempt = 0; !this.ctl.signal.aborted; attempt++) {
+      try {
+        await this.identify();
+        await this.firstHeartbeat();
+        return "ok";
+      } catch (e) {
+        if (this.isRevocation(e)) {
+          await this.onRevoked(e);
+          return "revoked";
+        }
+        if (!isTransient(e)) throw e;
+        this.d.log.warn("cannot reach Claw yet; will retry", { error: errMessage(e), attempt });
+        await sleep(backoffMs(attempt, this.timing.backoffMinMs, this.timing.backoffMaxMs), this.ctl.signal);
+      }
+    }
+    return "stopped";
+  }
+  // --- revocation and pause ----------------------------------------------------------
+  /**
+   * The owner disconnected this connector (or the identity service ended the sign-in): nothing may keep running.
+   * No retry, no reconnect. A revoked connector row is also marked in connector.json, which is how `login` tells a
+   * stored id that is dead from one a new sign-in should keep using; a revoked sign-in leaves the row alive, so it
+   * is not marked. The id itself stays, so a restart cannot register a new connector with the same sign-in and
+   * undo the owner's kill switch.
+   */
+  async onRevoked(e) {
+    if (this.revoked) return;
+    this.revoked = true;
+    const why = errMessage(e);
+    this.d.log.error("revoked: stopping every agent", { why });
+    this.d.audit.record("revoked", { why });
+    if (e instanceof RevokedError && this.cid) {
+      this.rowRevoked = true;
+      try {
+        this.writeIdentity();
+      } catch (we) {
+        this.d.log.warn("could not record the revocation in connector.json", { error: errMessage(we) });
+      }
+    }
+    this.ctl.abort();
+    this.streamCtl?.abort();
+    await this.manager.killAll("revoked");
+  }
+  isRevocation(e) {
+    return e instanceof RevokedError || e instanceof GrantRevokedError;
+  }
+  async pauseWatcher() {
+    while (!this.ctl.signal.aborted) {
+      const want = fs12.existsSync(pauseFile(this.d.dirs));
+      if (want && !this.paused) {
+        this.paused = true;
+        this.d.audit.record("paused");
+        this.d.log.warn("paused: stopping every agent");
+        this.streamCtl?.abort();
+        await this.manager.killAll("paused");
+      } else if (!want && this.paused) {
+        this.paused = false;
+        this.d.audit.record("resumed");
+        this.d.log.info("resumed");
+      }
+      await sleep(this.timing.pausePollMs, this.ctl.signal);
+    }
+  }
+  // --- the loops -----------------------------------------------------------------------
+  /** Post events in batches, one request at a time and in order, until everything is acknowledged. */
+  async sender() {
+    let failures = 0;
+    while (!this.ctl.signal.aborted) {
+      if (this.outbox.size === 0) {
+        await new Promise((resolve) => {
+          const done = () => {
+            this.wakeSender = null;
+            this.ctl.signal.removeEventListener("abort", done);
+            resolve();
+          };
+          this.wakeSender = done;
+          this.ctl.signal.addEventListener("abort", done, { once: true });
+        });
+        continue;
+      }
+      if (this.outbox.size < this.timing.batchMax) await sleep(this.timing.batchMs, this.ctl.signal);
+      if (this.ctl.signal.aborted) break;
+      const batch = this.outbox.pending(this.timing.batchMax);
+      if (batch.length === 0) continue;
+      try {
+        const ack = await this.d.client.postEvents(this.cid, `b-${Date.now().toString(36)}-${randomUUID2().slice(0, 8)}`, batch);
+        this.outbox.ack(ack.acked);
+        for (const r of ack.rejected) {
+          const ev = batch[r.index];
+          if (!ev) continue;
+          this.outbox.drop(ev.session_id, ev.seq);
+          this.d.audit.record("event_rejected", { session_id: ev.session_id, seq: ev.seq, type: ev.type, reason: r.reason });
+        }
+        failures = 0;
+      } catch (e) {
+        if (this.isRevocation(e)) return void await this.onRevoked(e);
+        failures++;
+        this.d.log.warn("posting events failed; will retry", { error: errMessage(e), pending: this.outbox.size });
+        await sleep(backoffMs(failures - 1, this.timing.backoffMinMs, this.timing.backoffMaxMs), this.ctl.signal);
+      }
+    }
+  }
+  async heartbeater() {
+    while (!this.ctl.signal.aborted) {
+      await new Promise((resolve) => {
+        const done = () => {
+          clearTimeout(t);
+          this.wakeHeartbeat = null;
+          this.ctl.signal.removeEventListener("abort", done);
+          resolve();
+        };
+        const t = setTimeout(done, this.timing.heartbeatMs);
+        this.wakeHeartbeat = done;
+        this.ctl.signal.addEventListener("abort", done, { once: true });
+      });
+      if (this.ctl.signal.aborted) break;
+      if (this.paused) continue;
+      try {
+        await this.heartbeat();
+        this.writeIdentity();
+      } catch (e) {
+        if (this.isRevocation(e)) return void await this.onRevoked(e);
+        this.d.log.warn("heartbeat failed", { error: errMessage(e) });
+      }
+    }
+  }
+  onFrame(f, reconnect) {
+    switch (f.event) {
+      case "ready":
+        if (reconnect) this.manager.resendPending();
+        this.wakeHeartbeat?.();
+        return;
+      case "revoked":
+        throw new RevokedError();
+      case "command":
+        return this.onCommand(f);
+      default:
+        return;
+    }
+  }
+  onCommand(f) {
+    const seq = Number(f.id);
+    let data;
+    try {
+      data = f.data === void 0 ? null : JSON.parse(f.data);
+    } catch {
+      data = null;
+    }
+    if (!Number.isSafeInteger(seq) || !isObject(data) || typeof data.cmd_id !== "string" || typeof data.type !== "string" || typeof data.session_id !== "string") {
+      this.d.audit.record("command_dropped", { reason: "malformed_frame", id: f.id });
+      return;
+    }
+    const cmd = data;
+    if (this.ledger.seen(seq, cmd.cmd_id)) return;
+    this.ledger.begin(seq, cmd.cmd_id);
+    void this.manager.handle(cmd, () => {
+      this.ledger.end(seq, cmd.cmd_id);
+      try {
+        this.writeIdentity();
+      } catch {
+      }
+    });
+  }
+  async streamLoop() {
+    let attempt = 0;
+    let reconnect = false;
+    while (!this.ctl.signal.aborted) {
+      if (this.paused) {
+        await sleep(this.timing.pausePollMs, this.ctl.signal);
+        continue;
+      }
+      this.streamCtl = new AbortController();
+      try {
+        const sig = AbortSignal.any([this.ctl.signal, this.streamCtl.signal]);
+        let got = false;
+        for await (const f of this.d.client.commands(this.cid, { lastEventId: this.ledger.highestSeen || void 0, signal: sig, watchdogMs: this.timing.watchdogMs })) {
+          if (!got) {
+            got = true;
+            attempt = 0;
+          }
+          this.onFrame(f, reconnect);
+          if (f.event === "ready") reconnect = true;
+        }
+      } catch (e) {
+        if (this.isRevocation(e)) return void await this.onRevoked(e);
+        if (this.ctl.signal.aborted) break;
+        if (e instanceof HttpError && e.status === 404) {
+          try {
+            await this.identify(true);
+            await this.firstHeartbeat();
+          } catch (again) {
+            if (this.isRevocation(again)) return void await this.onRevoked(again);
+            this.d.log.warn("could not register again", { error: errMessage(again) });
+          }
+        }
+        this.d.log.warn("command stream lost; reconnecting", { error: errMessage(e), attempt });
+      }
+      if (this.ctl.signal.aborted) break;
+      if (this.paused) continue;
+      await sleep(backoffMs(attempt++, this.timing.backoffMinMs, this.timing.backoffMaxMs), this.ctl.signal);
+    }
+  }
+  /** Run until stopped or revoked. Always leaves no adapter process behind. */
+  async run() {
+    fs12.mkdirSync(this.d.dirs.state, { recursive: true, mode: 448 });
+    await this.registry.killAll();
+    for (const p of this.store.takePending()) {
+      this.d.audit.record("permission_orphaned", { session_id: p.session_id, action_id: p.action_id });
+      this.emit(p.session_id, "permission_resolved", { actionId: p.action_id, optionId: null, outcome: "cancelled", by: "connector_restart" });
+    }
+    const pidf = pidFile(this.d.dirs);
+    fs12.writeFileSync(pidf, JSON.stringify({ pid: process.pid, start: processStart(process.pid) ?? "" }), { mode: 384 });
+    this.paused = fs12.existsSync(pauseFile(this.d.dirs));
+    try {
+      const up = await this.startup();
+      if (up !== "ok") return up;
+      this.d.audit.record("connector_online", {
+        connector_id: this.cid,
+        agents: this.d.config.agents.map((a) => a.id),
+        paused: this.paused,
+        unattended_agents: this.d.config.agents.filter((a) => a.unattended).map((a) => a.id)
+      });
+      await Promise.all([this.sender(), this.heartbeater(), this.streamLoop(), this.pauseWatcher()]);
+    } finally {
+      await this.manager.killAll(this.revoked ? "revoked" : "stopped").catch(() => void 0);
+      fs12.rmSync(pidf, { force: true });
+    }
+    return this.revoked ? "revoked" : "stopped";
+  }
+  /** For tests: wait until every event is acknowledged. */
+  async drained(timeoutMs = 5e3) {
+    const end = Date.now() + timeoutMs;
+    while (Date.now() < end) {
+      if (this.outbox.size === 0) return true;
+      await sleep(20);
+    }
+    return this.outbox.size === 0;
+  }
+};
+
+// src/version.ts
+var VERSION = "0.1.0";
+
+// src/commands.ts
+var EXIT = { ok: 0, failure: 1, usage: 2, revoked: 3 };
+var HELP = `claw-connector ${VERSION}: connect the coding agents on this machine to Claw (outbound HTTPS only).
+
+Usage: claw-connector <command> [options]
+
+  init [--approval ask|never | --approval AGENT=ask|never ...] [--no-hooks]
+                           write a sample agents.toml, and install the Claude Code session hooks (see "hooks"; --no-hooks
+                           skips that). Agents ask before every write and command by default;
+                           "--approval never" (or "--approval claude=never") lets phone sessions run like your
+                           terminal, with no per-step approval. Agents are: ${SAMPLE_AGENTS.join(", ")}.
+  hooks install|uninstall|status [--config-dir DIR]
+                           the SessionStart/SessionEnd hooks that tell this connector which Claude Code sessions are open
+                           in a terminal; merged into DIR/settings.json (default: the claude-attach agents' config
+                           directories, else $CLAUDE_CONFIG_DIR or ~/.claude); only its own entries are ever changed
+  login                    sign in (device flow); --server URL --identity-url URL [--name HOST]
+                           development only: --key <api key>  (or CLAW_CONNECTOR_KEY)
+  run                      connect and serve (Ctrl-C or SIGTERM stops it and every agent it started)
+  status [--json]          what is running, signed in, paused
+  pause                    stop every agent now and stay offline until "resume"
+  resume                   undo "pause"
+  stop                     stop the running connector and every agent it started
+  logout                   stop, revoke the sign-in and delete it
+  --version, --help
+
+Files: ${"$"}XDG_CONFIG_HOME/claw-connector (agents.toml, credentials.json) and ${"$"}XDG_STATE_HOME/claw-connector
+(audit.jsonl, logs, outbox); set CLAW_CONNECTOR_HOME to keep everything under one directory.
+`;
+function loadCfg(ctx) {
+  return loadConfig(configFile(ctx.dirs), { hostname: ctx.hostname ?? os4.hostname() });
+}
+function serverUrl(ctx, flag, cfg, creds) {
+  const v = flag ?? ctx.env.CLAW_URL ?? cfg?.server ?? creds?.server ?? null;
+  return v ? secureUrl(v.trim(), "the Claw server URL") : null;
+}
+async function main(argv, ctx) {
+  const [cmd, ...rest] = argv;
+  try {
+    switch (cmd) {
+      case void 0:
+      case "help":
+      case "--help":
+      case "-h":
+        ctx.out(HELP);
+        return cmd ? EXIT.ok : EXIT.usage;
+      case "--version":
+      case "-v":
+      case "version":
+        ctx.out(VERSION);
+        return EXIT.ok;
+      case "init":
+        return await cmdInit(rest, ctx);
+      case "hooks":
+        return cmdHooks(rest, ctx);
+      case "login":
+        return await cmdLogin(rest, ctx);
+      case "run":
+        return await cmdRun(rest, ctx);
+      case "status":
+        return cmdStatus(rest, ctx);
+      case "pause":
+        return await cmdPause(ctx);
+      case "resume":
+        return cmdResume(ctx);
+      case "stop":
+        return await cmdStop(ctx);
+      case "logout":
+        return await cmdLogout(ctx);
+      default:
+        ctx.err(`unknown command ${JSON.stringify(cmd)}
+
+${HELP}`);
+        return EXIT.usage;
+    }
+  } catch (e) {
+    if (e instanceof ConfigError || e instanceof CredentialsError || e instanceof DeviceFlowError || e instanceof UrlError) {
+      ctx.err(e.message);
+      return EXIT.failure;
+    }
+    ctx.err(`error: ${errMessage(e)}`);
+    return EXIT.failure;
+  }
+}
+function parseApproval(values) {
+  const out = {};
+  for (const v of values) {
+    const eq = v.indexOf("=");
+    const who = eq < 0 ? null : v.slice(0, eq);
+    const how = eq < 0 ? v : v.slice(eq + 1);
+    if (how !== "ask" && how !== "never") return `--approval takes ask or never (or AGENT=ask|never), not ${JSON.stringify(v)}`;
+    const targets = who === null ? [...SAMPLE_AGENTS] : [who];
+    for (const t of targets) {
+      if (!SAMPLE_AGENTS.includes(t)) return `--approval: no sample agent ${JSON.stringify(t)} (agents are: ${SAMPLE_AGENTS.join(", ")})`;
+      out[t] = how;
+    }
+  }
+  return out;
+}
+async function cmdInit(args, ctx) {
+  const { values } = parseArgs({ args, strict: true, options: { approval: { type: "string", multiple: true }, "no-hooks": { type: "boolean" } } });
+  const approval = parseApproval(values.approval ?? []);
+  if (typeof approval === "string") {
+    ctx.err(approval);
+    return EXIT.usage;
+  }
+  const file = configFile(ctx.dirs);
+  fs13.mkdirSync(path14.dirname(file), { recursive: true, mode: 448 });
+  try {
+    fs13.writeFileSync(file, sampleConfig(approval), { mode: 384, flag: "wx" });
+    ctx.out(`wrote ${file}: edit the roots (the directories an agent may work in), then run: claw-connector login`);
+    const { unattended, parked } = sampleApprovals(approval);
+    ctx.out(unattended.length ? `no per-step approval for: ${unattended.join(", ")}. Those agents write files and run commands without asking; the phone shows such a session as unattended. To go back, set approval = "ask" on the agent.` : `every agent in this file asks before it writes a file or runs a command. To let phone sessions run like your terminal instead: claw-connector init --approval never (on a new file), or set approval = "never" on an agent.`);
+    if (parked.length) ctx.out(`${parked.join(", ")}: not enabled in this file (the block is commented out), so approval = "never" does nothing there until you uncomment the block.`);
+  } catch (e) {
+    if (e.code !== "EEXIST") throw e;
+    ctx.out(`${file} already exists; left alone${values.approval?.length ? ` (to change an agent's approval, set approval = "ask" or "never" in its [[agents]] table)` : ""}`);
+  }
+  if (!values["no-hooks"]) {
+    const dir = defaultClaudeDir(ctx);
+    if (!fs13.existsSync(dir)) ctx.out(`no Claude Code directory at ${dir}; once you use Claude Code, run: claw-connector hooks install`);
+    else installForInit(ctx, dir);
+  }
+  return EXIT.ok;
+}
+function installForInit(ctx, dir) {
+  try {
+    ctx.out(describeInstall(dir, installOne(ctx, dir).changed));
+  } catch (e) {
+    ctx.err(`hooks: ${errMessage(e)} (everything else is set up; fix it and run: claw-connector hooks install)`);
+  }
+}
+var defaultClaudeDir = (ctx) => path14.resolve(ctx.env.CLAUDE_CONFIG_DIR?.trim() || path14.join(os4.homedir(), ".claude"));
+function claudeDirs(ctx, flag) {
+  if (flag !== void 0) return [path14.resolve(flag)];
+  let dirs = [];
+  try {
+    dirs = loadCfg(ctx).agents.filter((a) => a.attach).map((a) => path14.resolve(a.env.CLAUDE_CONFIG_DIR ?? ctx.env.CLAUDE_CONFIG_DIR?.trim() ?? path14.join(os4.homedir(), ".claude")));
+  } catch {
+  }
+  return dirs.length ? [...new Set(dirs)] : [defaultClaudeDir(ctx)];
+}
+function hookScript(ctx) {
+  const script = ctx.hookScript ?? fileURLToPath(new URL("./terminal-hook.js", import.meta.url));
+  if (!fs13.existsSync(script)) throw new HooksError(`${script} does not exist (a source checkout needs "npm run build" first)`);
+  return script;
+}
+function installOne(ctx, dir) {
+  return installHooks(dir, ctx.node ?? process.execPath, hookScript(ctx));
+}
+var describeInstall = (dir, changed) => changed ? `installed the Claude Code session hooks in ${settingsFile(dir)}` : `the Claude Code session hooks are already in ${settingsFile(dir)}`;
+function cmdHooks(args, ctx) {
+  const [sub, ...rest] = args;
+  if (sub !== "install" && sub !== "uninstall" && sub !== "status") {
+    ctx.err("usage: claw-connector hooks install|uninstall|status [--config-dir DIR]");
+    return EXIT.usage;
+  }
+  const { values } = parseArgs({ args: rest, strict: true, options: { "config-dir": { type: "string" }, json: { type: "boolean" } } });
+  const dirs = claudeDirs(ctx, values["config-dir"]);
+  let code = EXIT.ok;
+  const report = [];
+  for (const dir of dirs) {
+    try {
+      if (sub === "install") {
+        if (values["config-dir"] === void 0 && !fs13.existsSync(dir)) {
+          ctx.err(`no Claude Code directory at ${dir}; pass --config-dir to name one`);
+          code = EXIT.failure;
+          continue;
+        }
+        ctx.out(describeInstall(dir, installOne(ctx, dir).changed));
+      } else if (sub === "uninstall") {
+        ctx.out(uninstallHooks(dir).changed ? `removed the Claude Code session hooks from ${settingsFile(dir)}` : `no session hooks of ours in ${settingsFile(dir)}`);
+      } else {
+        const st = hooksStatus(dir);
+        report.push({ dir, ...st });
+        if (!values.json) ctx.out(`${dir}: ${st.installed ? st.healthy ? "installed" : "installed, but broken" : st.events.length ? `partly installed (${st.events.join(", ")})` : "not installed"}${st.problem ? `; ${st.problem}` : ""}`);
+      }
+    } catch (e) {
+      ctx.err(e instanceof HooksError ? e.message : `error: ${errMessage(e)}`);
+      code = EXIT.failure;
+    }
+  }
+  if (sub === "status" && values.json) ctx.out(JSON.stringify(report, null, 2));
+  return code;
+}
+function forgetRevokedIdentity(ctx) {
+  const file = identityFile(ctx.dirs);
+  let revoked = false;
+  try {
+    const raw = JSON.parse(fs13.readFileSync(file, "utf8"));
+    revoked = isObject(raw) && raw.revoked === true;
+  } catch {
+  }
+  if (revoked) fs13.rmSync(file, { force: true });
+}
+async function cmdLogin(args, ctx) {
+  const { values } = parseArgs({
+    args,
+    strict: true,
+    options: { server: { type: "string" }, "identity-url": { type: "string" }, key: { type: "string" }, name: { type: "string" } }
+  });
+  let cfg = null;
+  try {
+    cfg = loadCfg(ctx);
+  } catch (e) {
+    if (!(e instanceof ConfigError)) throw e;
+  }
+  const server = serverUrl(ctx, values.server, cfg, null);
+  if (!server) {
+    ctx.err("login needs --server <Claw API URL> (or CLAW_URL, or server = in agents.toml)");
+    return EXIT.usage;
+  }
+  const file = credentialsFile(ctx.dirs);
+  const key = values.key ?? ctx.env.CLAW_CONNECTOR_KEY;
+  if (key) {
+    saveCredentials(file, { v: 1, server, kind: "key", key, saved_at: (/* @__PURE__ */ new Date()).toISOString() });
+    forgetRevokedIdentity(ctx);
+    ctx.out("saved a development key. This is for trying things out: a device sign-in is the normal way (omit --key).");
+    return EXIT.ok;
+  }
+  const identityRaw = (values["identity-url"] ?? ctx.env.CLAW_IDENTITY_URL ?? cfg?.identityUrl ?? "").trim();
+  const identityUrl = identityRaw ? secureUrl(identityRaw, "the identity service URL") : "";
+  if (!identityUrl) {
+    ctx.err("login needs --identity-url <identity service URL> (or CLAW_IDENTITY_URL, or identity_url = in agents.toml)");
+    return EXIT.usage;
+  }
+  const deviceName = values.name ?? cfg?.name ?? ctx.hostname ?? os4.hostname();
+  const tok = await deviceLogin({ identityUrl, deviceName, fetch: ctx.fetch, print: ctx.out });
+  saveCredentials(file, {
+    v: 1,
+    server,
+    kind: "device",
+    identity_url: identityUrl,
+    client_id: DEFAULT_CLIENT_ID,
+    refresh_token: tok.refresh_token,
+    device_name: deviceName,
+    saved_at: (/* @__PURE__ */ new Date()).toISOString()
+  });
+  forgetRevokedIdentity(ctx);
+  ctx.out(`signed in as ${deviceName}. Next: claw-connector run`);
+  return EXIT.ok;
+}
+function runningPid(ctx) {
+  try {
+    const raw = JSON.parse(fs13.readFileSync(pidFile(ctx.dirs), "utf8"));
+    if (isObject(raw) && typeof raw.pid === "number" && typeof raw.start === "string" && raw.start !== "" && processStart(raw.pid) === raw.start) return raw.pid;
+  } catch {
+  }
+  return null;
+}
+async function cmdRun(_args, ctx) {
+  const cfg = loadCfg(ctx);
+  if (cfg.agents.length === 0) {
+    ctx.err("agents.toml defines no agents; add an [[agents]] table");
+    return EXIT.failure;
+  }
+  const creds = loadCredentials(credentialsFile(ctx.dirs));
+  if (!creds) {
+    ctx.err("not signed in: run  claw-connector login");
+    return EXIT.failure;
+  }
+  const running = runningPid(ctx);
+  if (running !== null) {
+    ctx.err(`already running (pid ${running}); use "claw-connector stop" first`);
+    return EXIT.failure;
+  }
+  const server = serverUrl(ctx, void 0, cfg, creds);
+  const tokens = providerFor(creds, (c) => saveCredentials(credentialsFile(ctx.dirs), c), { fetch: ctx.fetch });
+  const client2 = new ClawClient({ server, tokens, fetch: ctx.fetch });
+  const log = stderrLogger();
+  const audit = fileAudit(auditFile(ctx.dirs));
+  const connector2 = new Connector({ config: cfg, dirs: ctx.dirs, client: client2, server, audit, log, version: VERSION, timing: ctx.timing });
+  ctx.onConnector?.(connector2);
+  ctx.out(`connecting ${cfg.agents.map((a) => a.unattended ? `${a.id} (no per-step approval)` : a.id).join(", ")} to ${server} as "${cfg.name}"`);
+  try {
+    const result = await connector2.run();
+    if (result === "revoked") {
+      ctx.err("this connector was revoked: every agent was stopped. Run login again to connect it anew.");
+      return EXIT.revoked;
+    }
+    return EXIT.ok;
+  } catch (e) {
+    if (e instanceof HttpError || e instanceof TransportError || e instanceof RevokedError || e instanceof GrantRevokedError) {
+      ctx.err(`error: ${e.message}`);
+      return EXIT.failure;
+    }
+    throw e;
+  }
+}
+function cmdStatus(args, ctx) {
+  const { values } = parseArgs({ args, strict: true, options: { json: { type: "boolean" } } });
+  let creds = null;
+  let credsProblem = null;
+  try {
+    creds = loadCredentials(credentialsFile(ctx.dirs));
+  } catch (e) {
+    credsProblem = errMessage(e);
+  }
+  let agents = [];
+  let unattended = [];
+  let configProblem = null;
+  try {
+    const cfg = loadCfg(ctx);
+    agents = cfg.agents.map((a) => a.id);
+    unattended = cfg.agents.filter((a) => a.unattended).map((a) => a.id);
+  } catch (e) {
+    configProblem = errMessage(e);
+  }
+  let connectorId = null;
+  try {
+    const raw = JSON.parse(fs13.readFileSync(identityFile(ctx.dirs), "utf8"));
+    if (isObject(raw) && typeof raw.connector_id === "string") connectorId = raw.connector_id;
+  } catch {
+  }
+  const reg = new ChildRegistry(childrenFile(ctx.dirs));
+  const status = {
+    version: VERSION,
+    running: runningPid(ctx),
+    paused: fs13.existsSync(pauseFile(ctx.dirs)),
+    signed_in: creds ? { kind: creds.kind, server: creds.server, device_name: creds.device_name ?? null } : null,
+    connector_id: connectorId,
+    agents,
+    /** Agents whose sessions start without asking before a write or a command. */
+    unattended,
+    adapters: reg.list().filter((r) => reg.isOurs(r)).map((r) => ({ pid: r.pid, agent: r.agent_id, session: r.session_id })),
+    problems: [credsProblem, configProblem].filter((x) => !!x)
+  };
+  if (values.json) {
+    ctx.out(JSON.stringify(status, null, 2));
+    return EXIT.ok;
+  }
+  ctx.out(`connector:  ${status.running ? `running (pid ${status.running})` : "not running"}${status.paused ? ", PAUSED" : ""}`);
+  ctx.out(`signed in:  ${creds ? `${creds.kind} to ${creds.server}` : "no"}`);
+  ctx.out(`agents:     ${agents.map((a) => unattended.includes(a) ? `${a} (no per-step approval)` : a).join(", ") || "none configured"}`);
+  ctx.out(`adapters:   ${status.adapters.length ? status.adapters.map((a) => `${a.agent} pid ${a.pid}`).join(", ") : "none running"}`);
+  for (const p of status.problems) ctx.out(`problem:    ${p}`);
+  return EXIT.ok;
+}
+async function cmdPause(ctx) {
+  fs13.mkdirSync(ctx.dirs.state, { recursive: true, mode: 448 });
+  fs13.writeFileSync(pauseFile(ctx.dirs), (/* @__PURE__ */ new Date()).toISOString() + "\n", { mode: 384 });
+  if (runningPid(ctx) === null) {
+    const left = await new ChildRegistry(childrenFile(ctx.dirs)).killAll();
+    ctx.out(`paused (the connector is not running${left.killed.length ? `; stopped ${left.killed.length} leftover agent process group(s)` : ""})`);
+  } else {
+    ctx.out("paused: the running connector stops every agent within a second and stays offline until: claw-connector resume");
+  }
+  return EXIT.ok;
+}
+function cmdResume(ctx) {
+  fs13.rmSync(pauseFile(ctx.dirs), { force: true });
+  ctx.out(runningPid(ctx) === null ? "resumed; start it with: claw-connector run" : "resumed: the running connector reconnects now");
+  return EXIT.ok;
+}
+async function cmdStop(ctx, quiet = false) {
+  const pid = runningPid(ctx);
+  if (pid !== null) {
+    process.kill(pid, "SIGTERM");
+    const deadline = Date.now() + 15e3;
+    while (Date.now() < deadline && isAlive(pid) && processStart(pid) !== null) await sleep(100);
+    if (isAlive(pid) && runningPid(ctx) === pid) {
+      process.kill(pid, "SIGKILL");
+      if (!quiet) ctx.out(`the connector (pid ${pid}) did not stop in 15 s and was killed`);
+    }
+  }
+  const left = await new ChildRegistry(childrenFile(ctx.dirs)).killAll();
+  if (!quiet) ctx.out(pid === null ? `no connector running${left.killed.length ? `; stopped ${left.killed.length} leftover agent process group(s)` : ""}` : `stopped the connector${left.killed.length ? ` and ${left.killed.length} leftover agent process group(s)` : ""}`);
+  return EXIT.ok;
+}
+async function cmdLogout(ctx) {
+  await cmdStop(ctx, true);
+  const file = credentialsFile(ctx.dirs);
+  let creds = null;
+  try {
+    creds = loadCredentials(file);
+  } catch {
+  }
+  if (creds?.kind === "device" && creds.identity_url && creds.refresh_token) {
+    try {
+      const f = ctx.fetch ?? fetch;
+      await f(`${creds.identity_url}/oauth/revoke`, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({ token: creds.refresh_token, token_type_hint: "refresh_token", client_id: creds.client_id ?? DEFAULT_CLIENT_ID }),
+        signal: AbortSignal.timeout(1e4)
+      });
+    } catch (e) {
+      ctx.err(`could not revoke the sign-in at the identity service (${errMessage(e)}); it was removed from this machine`);
+    }
+  }
+  fs13.rmSync(file, { force: true });
+  forgetRevokedIdentity(ctx);
+  ctx.out("signed out");
+  return EXIT.ok;
+}
+
+// src/cli.ts
+var connector = null;
+var stopping = false;
+var onSignal = () => {
+  if (stopping) process.exit(130);
+  stopping = true;
+  connector?.stop();
+};
+main(process.argv.slice(2), {
+  dirs: resolveDirs(),
+  env: process.env,
+  out: (l) => process.stdout.write(l + "\n"),
+  err: (l) => process.stderr.write(l + "\n"),
+  onConnector: (c) => {
+    connector = c;
+    for (const sig of ["SIGTERM", "SIGINT", "SIGHUP"]) process.on(sig, onSignal);
+  }
+}).then((code) => process.exit(code), (e) => {
+  process.stderr.write(`fatal: ${e instanceof Error ? e.stack : String(e)}
+`);
+  process.exit(1);
+});