@prismer/runtime 1.9.0-hotfix.1

package/README.md

@@ -0,0 +1,288 @@
+# @prismer/runtime
+
+Prismer Cloud v1.9.0 daemon runtime and `prismer` CLI.
+
+This package hosts the local Prismer daemon, the HTTP control plane on port 3210, the multi-path transport to Cloud Relay (WebSocket), the agent supervisor and PARA adapter registry, and the `prismer` command-line interface. It is one of the three core v1.9.0 tracks — see [`docs/version190/02-architecture.md`](https://github.com/Prismer-AI/PrismerCloud/blob/main/docs/version190/02-architecture.md) for the full design.
+
+## Install
+
+### Bootstrap installer (recommended)
+
+```
+curl -fsSL https://prismer.cloud/install.sh | sh
+```
+
+Auto-detects Node via `fnm`, installs `@prismer/sdk` and `@prismer/runtime` globally, launches the daemon, and runs first-time setup. macOS and Linux, no sudo, no Homebrew required.
+
+### Manual (npm)
+
+```
+npm install -g @prismer/runtime @prismer/sdk
+prismer setup
+```
+
+Requires Node.js 20+. `@prismer/sdk` is required — the runtime mounts the SDK's `register / config / token / send / load / search / parse / recall / discover` commands via `@prismer/sdk/cli`.
+
+## Quick start
+
+```
+# 1. Provide an API key (persists to ~/.prismer/config.toml)
+prismer setup sk-prismer-live-...
+
+# 2. Start the daemon (HTTP on 127.0.0.1:3210 + Cloud Relay WS)
+prismer daemon start
+
+# 3. Check health
+prismer status
+
+# 4. Wire an agent
+prismer agent install claude-code --install-agent   # also installs the upstream CLI if missing
+prismer agent list
+
+# 5. Pair a mobile device
+prismer pair show
+```
+
+`PRISMER_API_KEY=sk-prismer-... prismer setup` works equivalently for Docker and CI — no browser OAuth round-trip is required when the key is supplied out-of-band.
+
+## CLI surface
+
+### Lifecycle
+
+| Command | Purpose |
+|---|---|
+| `prismer setup [api-key]` | First-run setup: write API key, start daemon, scan for agents, print next steps. `--postinstall` for npm lifecycle hooks, `--no-daemon` to skip startup, `--skip-agent-scan` to skip detection. |
+| `prismer status` | Daemon + agent + system health overview. `--json` for machine-readable. |
+| `prismer daemon start` | Start detached background daemon on port 3210. `--foreground` for Docker/systemd. `--port <n>` to override. |
+| `prismer daemon stop` | Graceful SIGTERM with 10s timeout, then SIGKILL. |
+| `prismer daemon restart` | Stop then start. Preserves port. |
+| `prismer daemon status` | PID file + port binding state. |
+| `prismer daemon logs [--tail N] [--follow]` | Tail `~/.prismer/logs/daemon.log`. |
+| `prismer daemon reprobe` | Force a transport reprobe pass without restarting. |
+
+The daemon writes its PID to `~/.prismer/daemon.pid` atomically with `O_CREAT | O_EXCL`. A crash-loop guard in `daemon.starts.json` blocks rapid restart storms (3 failures in 10 minutes → 5-minute cooldown).
+
+### Agent control
+
+| Command | Purpose |
+|---|---|
+| `prismer agent list` | All installed agents with tier + hook status. |
+| `prismer agent install <name>` | Install an adapter pack. Two-tier fetch: signed release manifest (GitHub Release) → npm registry. Ed25519 signature verified before hook wiring unless `--skip-verify`. `--install-agent` also installs the upstream CLI (claude-code, codex, …) if missing. `--source cdn\|mirror\|npm`, `--force`, `--non-interactive`, `--accept-defaults`. |
+| `prismer agent doctor <name>` | Diagnose binary path, hook config, daemon registration, PARA event emission for a given agent. |
+| `prismer agent remove <name>` | Rollback hook config to the pre-install backup and remove the sandbox profile. Keychain entries are preserved. `--yes` to skip the confirmation prompt. |
+| `prismer agent update <name>` | Shorthand for `install --force`. |
+| `prismer agent publish <name>` | Publish the locally-installed agent so it appears from mobile. Writes to `~/.prismer/published-agents.toml` and calls cloud. |
+| `prismer agent unpublish <name>` | Reverse of publish. Cloud deletes within 90s even if the DELETE call fails (background sweep). |
+
+Shipped adapters: `claude-code`, `codex`, `openclaw`, `hermes`. Each ships via npm with an Ed25519-signed manifest attached to the matching GitHub Release. See [`docs/version190/15-cli-design.md`](https://github.com/Prismer-AI/PrismerCloud/blob/main/docs/version190/15-cli-design.md) §15.6 for pack schema and signing flow.
+
+### Pack registry
+
+```
+prismer pack list
+prismer pack search <query>
+prismer pack verify <name> <signature>
+```
+
+Reads the signed pack index from the current GitHub Release — useful to inspect available adapters without installing.
+
+### Device pairing
+
+```
+prismer pair show [--ttl 300]    # generate QR code (5 min TTL, single-use)
+prismer pair list                # list paired devices
+prismer pair revoke <deviceId>   # remove from local registry
+```
+
+Pairing offers use 5-minute TTL tokens exchanged via Cloud Relay. The CLI polls the daemon for pair completion and writes the resulting device record to `~/.prismer/data/paired-devices.json`.
+
+### Domain commands (via SDK)
+
+Mounted at runtime via `@prismer/sdk/cli`:
+
+```
+prismer register <username>         # create a Prismer identity
+prismer config show|set
+prismer token refresh
+
+prismer send / load / search        # IM + context shortcuts
+prismer parse / parse-status / parse-result
+prismer recall / discover           # memory + agent discovery
+```
+
+### Domain commands (native)
+
+```
+prismer task ...         # Task Router (v1.9.0 cross-agent task routing)
+prismer memory ...       # Memory Gateway (hexagonal cloud/local ports)
+prismer memory key-backup / key-recover / key-fingerprint   # Shamir recovery
+prismer evolution ...    # Evolution Gateway
+prismer tier:set <agent-id> <tier>     # 1..7
+prismer tier:get <agent-id>
+prismer session export <sessionId>     # copy ~/.prismer/trace/<id>.jsonl.zst
+prismer events [--agent-id --session-id --family --type]
+prismer events:stats
+prismer permissions:test --tier N      # inspect permission evaluation
+```
+
+### Migration
+
+```
+prismer migrate                          # v1.8 → v1.9 upgrade (api key → keychain, hooks → daemon)
+prismer migrate luminclaw-memory         # import luminclaw local memory to Memory Gateway
+prismer migrate-secrets                  # sweep config.toml plaintext → keychain
+```
+
+`migrate-secrets --dry-run` previews without touching files or the keychain.
+
+## Global flags
+
+Applied before Commander parses the command tree — all subcommands honour them:
+
+| Flag | Effect |
+|---|---|
+| `--json` | Machine-readable single-line JSON output. Mutually exclusive with `--follow` on log streaming. |
+| `--quiet` | Suppress non-error output. |
+| `--color` / `--no-color` | Force colour on / off. `NO_COLOR` env is also honoured. |
+
+All error-path JSON conforms to the Prismer API envelope: `{ success: false, error: { code, message }, ... }`.
+
+## Configuration
+
+Config lives at `~/.prismer/config.toml`:
+
+```toml
+[default]
+api_key      = "sk-prismer-live-..."
+environment  = "production"
+base_url     = "https://prismer.cloud"
+
+[daemon]
+id = "daemon:abc123..."
+
+[user]
+id = "user:abc123..."
+```
+
+Resolution order for any value: **explicit flag > environment variable > config.toml > keychain placeholder > default**. `sk-prismer-...` API keys may also live in the keychain under service `prismer-config/default.api_key` and be referenced from the TOML via `$KEYRING:prismer-config/default.api_key`.
+
+Relevant environment variables:
+
+| Var | Default | Purpose |
+|---|---|---|
+| `PRISMER_API_KEY` | — | Seeds `prismer setup` and daemon identity. |
+| `PRISMER_BASE_URL` | `https://prismer.cloud` | Cloud API base for all daemon + CLI calls. |
+| `PRISMER_API_BASE` | `https://prismer.cloud/api/im` | IM / PARA endpoints. |
+| `PRISMER_MASTER_PASSPHRASE` | — | Enables the encrypted-file keychain backend when no system keychain is available. |
+| `PRISMER_SKIP_POSTINSTALL` | — | Set to `1` to suppress `npm install` postinstall setup. |
+| `PRISMER_FORCE_POSTINSTALL` | — | Set to `1` to run postinstall even on non-global installs. |
+| `NO_COLOR` | — | Disable ANSI colour. |
+
+### Keychain backends
+
+The runtime probes backends in order:
+
+1. **macOS Keychain** (`security` binary). Values written via `-X <hex>` so plaintext never appears in `ps aux`.
+2. **libsecret** via `secret-tool` (Linux GNOME/KDE).
+3. **pass** (`pass` store, optional GPG-backed).
+4. **Encrypted-file fallback** — XChaCha20-Poly1305 with a key derived from `PRISMER_MASTER_PASSPHRASE`. Only enabled when the env var is set.
+
+## Architecture
+
+```
+                        prismer CLI (bin/prismer.ts)
+                                │
+                      HTTP 127.0.0.1:3210
+                                │
+               ┌────────────────▼─────────────────┐
+               │  Daemon (daemon/runner.ts)       │
+               │  ├─ HTTP server (daemon-http.ts) │
+               │  ├─ Multi-path transport         │
+               │  │   ├─ WS to Cloud Relay        │
+               │  │   └─ LAN probe                │
+               │  ├─ Agent supervisor             │
+               │  ├─ Events tailer (PARA → cloud) │
+               │  ├─ Outbox (SQLite WAL)          │
+               │  └─ Memory Gateway (SQLite FTS5) │
+               └────────────────┬─────────────────┘
+                                │
+                    Installed agents (hooks)
+                claude-code, codex, openclaw, hermes
+```
+
+### Data directory layout (`~/.prismer/`)
+
+| Path | Contents |
+|---|---|
+| `config.toml` | User config (see above). |
+| `daemon.pid` | Atomic PID file. Owned by the running daemon. |
+| `daemon.port` | Bound port (default 3210). |
+| `daemon.starts.json` | Start-attempt log for crash-loop detection. |
+| `logs/daemon.log` | Plain-text log output; tailed by `prismer daemon logs`. |
+| `outbox.sqlite` | Ordered event buffer (WAL mode) for Cloud Relay. |
+| `memory.sqlite` | Local Memory Gateway store with FTS5 indices. |
+| `trace/<sessionId>.jsonl.zst` | Per-session PARA traces emitted by L8 adapters. |
+| `para/events.jsonl` | Live PARA event stream tailed by `events-tailer`. |
+| `sandbox/<agent>.sb` | macOS seatbelt sandbox profiles for installed agents. |
+| `data/paired-devices.json` | Local device pairing registry. |
+| `published-agents.toml` | Mirror of cloud-published agents. |
+
+## Security
+
+- **Ed25519 signed packs** — Adapter manifests are attached to the matching GitHub Release and carry detached Ed25519 signatures. `install-agent.ts` verifies before wiring hooks; npm-source fallback is treated as lower trust and signalled to the user. `--skip-verify` is allowed for offline / dev.
+- **API key hygiene** — Keys are passed to child processes via named FDs or keychain reads, not via argv. macOS `security` uses `-X` hex encoding. Config writes should be `chmod 0o600` (see Known Issues).
+- **Sandbox profiles** — macOS seatbelt / Linux AppArmor / bwrap. Generated from adapter manifests during install, removed on uninstall.
+- **Device pairing** — Offer tokens are short-lived (5 min), single-use, exchanged over TLS to Cloud Relay. Revocation currently only prunes the local registry (see Known Issues).
+
+## Known issues
+
+The CLI path is under active hardening. Tracked items:
+
+- `install-agent.ts` catches Ed25519 signature failure in the CDN branch and falls through to the npm tier — a tampered pack can be silently downgraded. **Fixing imminently.**
+- `prismer agent remove` does not prompt for confirmation; `--yes` is declared but unread.
+- `prismer migrate` runs destructive steps on TTYs with no confirmation.
+- `prismer pair revoke` is local-only; the server-side binding is not invalidated.
+- `getAuthToken()` in `migrate-luminclaw-memory.ts` returns empty — the import flow requires authentication to be wired.
+- Version strings in `install-agent.ts` success/already-installed paths are hardcoded to `1.9.0` instead of being read from the pack manifest.
+- libsecret backend collapses "not found" and transient failures into `null` — the macOS backend distinguishes these.
+- `daemon start` poll timeout of 2s can cause false-positive "failed to start" entries on slow machines and trigger the crash-loop guard.
+
+Fixes land in v1.9.1. Open an issue or PR at [github.com/Prismer-AI/PrismerCloud](https://github.com/Prismer-AI/PrismerCloud).
+
+## Development
+
+```
+# Build
+npm run build          # tsup bundle + copy icon/smallicon
+
+# Type check only
+npm run typecheck
+
+# Run the vitest suite
+npm test
+
+# Clean dist
+npm run clean
+```
+
+`@prismer/*` dependencies resolve from the npm registry. Fresh clones of the closed-source repo cannot `npm install` until upstream packages publish — use the monorepo build scripts instead:
+
+```
+sdk/build/pack.sh --scope all --clean    # tarball all SDKs
+sdk/build/verify.sh --scope all          # version parity + compile
+public/install.sh --local-artifacts      # install from local tarballs
+```
+
+Release is driven from the source repo via `sdk/build/release.sh --scope prismer-cloud`, which syncs into the open-source mirror before tagging and publish. Hotfixes use `sdk/build/hotfix.sh @prismer/runtime 1.9.0.N` and do **not** bump the root `/VERSION`.
+
+## Links
+
+- Design: [`docs/version190/02-architecture.md`](https://github.com/Prismer-AI/PrismerCloud/blob/main/docs/version190/02-architecture.md), [`docs/version190/15-cli-design.md`](https://github.com/Prismer-AI/PrismerCloud/blob/main/docs/version190/15-cli-design.md)
+- Cloud dashboard: https://prismer.cloud
+- Issues: https://github.com/Prismer-AI/PrismerCloud/issues
+- SDK: [`@prismer/sdk`](https://www.npmjs.com/package/@prismer/sdk)
+- Plugins: [`@prismer/claude-code-plugin`](https://www.npmjs.com/package/@prismer/claude-code-plugin), [`@prismer/openclaw-channel`](https://www.npmjs.com/package/@prismer/openclaw-channel)
+
+## License
+
+MIT

package/dist/adapter-registry-EMZFKFYK.mjs

@@ -0,0 +1,8 @@
+import {
+  AdapterRegistry
+} from "./chunk-VTFKZAUY.mjs";
+import "./chunk-BJTO5JO5.mjs";
+export {
+  AdapterRegistry
+};
+//# sourceMappingURL=adapter-registry-EMZFKFYK.mjs.map

package/dist/adapter-registry-EMZFKFYK.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/artifacts-uploader-N2HNBSTW.mjs

@@ -0,0 +1,159 @@
+import "./chunk-BJTO5JO5.mjs";
+
+// src/artifacts-uploader.ts
+import * as fs from "fs";
+import * as path from "path";
+var MAX_SIMPLE_UPLOAD_BYTES = 10 * 1024 * 1024;
+var ArtifactUploader = class {
+  apiKey;
+  cloudApiBase;
+  fetchImpl;
+  constructor(opts) {
+    if (!opts.apiKey) throw new Error("ArtifactUploader: apiKey required");
+    if (!opts.cloudApiBase) throw new Error("ArtifactUploader: cloudApiBase required");
+    this.apiKey = opts.apiKey;
+    this.cloudApiBase = opts.cloudApiBase.replace(/\/+$/, "");
+    this.fetchImpl = opts.fetchImpl ?? globalThis.fetch;
+    if (typeof this.fetchImpl !== "function") {
+      throw new Error("ArtifactUploader: fetch is not available \u2014 pass fetchImpl");
+    }
+  }
+  /**
+   * Upload one artifact for the given task. Returns:
+   *   - `{ ok:true, uploadId, cdnUrl }` on success.
+   *   - `{ ok:false, error }` on any failure — never throws.
+   */
+  async upload(taskId, artifactPath, options = {}) {
+    if (!taskId) return { ok: false, error: "taskId required" };
+    if (!artifactPath) return { ok: false, error: "artifactPath required" };
+    let buffer;
+    let stat;
+    try {
+      stat = fs.statSync(artifactPath);
+      if (!stat.isFile()) {
+        return { ok: false, error: `artifact is not a file: ${artifactPath}` };
+      }
+      if (stat.size > MAX_SIMPLE_UPLOAD_BYTES) {
+        return { ok: false, error: `artifact_too_large:${stat.size}` };
+      }
+      buffer = await fs.promises.readFile(artifactPath);
+    } catch (err) {
+      return { ok: false, error: `read_failed: ${err.message}` };
+    }
+    const fileName = options.fileName ?? path.basename(artifactPath);
+    const mimeType = options.mimeType ?? guessMime(fileName);
+    let presigned;
+    try {
+      const res = await this.fetchImpl(`${this.cloudApiBase}/api/im/artifacts/presign`, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          Authorization: `Bearer ${this.apiKey}`
+        },
+        body: JSON.stringify({
+          taskId,
+          fileName,
+          fileSize: stat.size,
+          mimeType
+        })
+      });
+      if (!res.ok) {
+        const text = await safeText(res);
+        return { ok: false, error: `presign_${res.status}: ${text}` };
+      }
+      const body = await res.json();
+      if (!body.ok || !body.data) {
+        return { ok: false, error: `presign_invalid_response: ${body.error ?? "no data"}` };
+      }
+      presigned = body.data;
+    } catch (err) {
+      return { ok: false, error: `presign_threw: ${err.message}` };
+    }
+    try {
+      const form = new FormData();
+      for (const [k, v] of Object.entries(presigned.fields ?? {})) {
+        form.append(k, v);
+      }
+      const uploadUrl = presigned.url.startsWith("http") ? presigned.url : `${this.cloudApiBase}${presigned.url}`;
+      const blob = new Blob([buffer], { type: mimeType });
+      form.append("file", blob, fileName);
+      const headers = {};
+      if (!presigned.url.startsWith("http")) {
+        headers["Authorization"] = `Bearer ${this.apiKey}`;
+      }
+      const res = await this.fetchImpl(uploadUrl, {
+        method: "POST",
+        headers,
+        body: form
+      });
+      if (!res.ok) {
+        const text = await safeText(res);
+        return { ok: false, error: `upload_${res.status}: ${text}` };
+      }
+    } catch (err) {
+      return { ok: false, error: `upload_threw: ${err.message}` };
+    }
+    try {
+      const res = await this.fetchImpl(`${this.cloudApiBase}/api/im/artifacts/confirm`, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          Authorization: `Bearer ${this.apiKey}`
+        },
+        body: JSON.stringify({ uploadId: presigned.uploadId })
+      });
+      if (!res.ok) {
+        const text = await safeText(res);
+        return { ok: false, error: `confirm_${res.status}: ${text}` };
+      }
+      const body = await res.json();
+      if (!body.ok || !body.data) {
+        return { ok: false, error: `confirm_invalid_response: ${body.error ?? "no data"}` };
+      }
+      return { ok: true, uploadId: body.data.uploadId, cdnUrl: body.data.cdnUrl };
+    } catch (err) {
+      return { ok: false, error: `confirm_threw: ${err.message}` };
+    }
+  }
+};
+async function safeText(res) {
+  try {
+    return (await res.text()).slice(0, 500);
+  } catch {
+    return "<no body>";
+  }
+}
+function guessMime(fileName) {
+  const ext = path.extname(fileName).toLowerCase();
+  switch (ext) {
+    case ".png":
+      return "image/png";
+    case ".jpg":
+    case ".jpeg":
+      return "image/jpeg";
+    case ".gif":
+      return "image/gif";
+    case ".webp":
+      return "image/webp";
+    case ".pdf":
+      return "application/pdf";
+    case ".json":
+      return "application/json";
+    case ".txt":
+      return "text/plain";
+    case ".md":
+      return "text/markdown";
+    case ".zip":
+      return "application/zip";
+    case ".html":
+      return "text/html";
+    case ".csv":
+      return "text/csv";
+    default:
+      return "application/octet-stream";
+  }
+}
+export {
+  ArtifactUploader
+};
+//# sourceMappingURL=artifacts-uploader-N2HNBSTW.mjs.map

package/dist/artifacts-uploader-N2HNBSTW.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/artifacts-uploader.ts"],"sourcesContent":["/**\n * Prismer Runtime — Artifact Uploader (v1.9.x Task 2).\n *\n * After an adapter returns from `task.dispatch` with `artifacts: [{path, …}]`,\n * the daemon calls `ArtifactUploader.upload(taskId, path)` for each artifact.\n *\n * The uploader is intentionally defensive — failures at any step return a\n * structured `{ ok:false, error }` rather than throwing, so they never block\n * the rpc.response back to the cloud. The cloud already sees the artifact\n * paths in the dispatch result; the upload is best-effort enrichment that\n * lets iOS Library show downloadable files instead of agent-local paths.\n *\n * Three-step flow:\n *   1. POST /api/im/artifacts/presign  → { uploadId, url, fields }\n *   2. POST <url> (multipart form)     → S3 (or dev-upload) accepts bytes\n *   3. POST /api/im/artifacts/confirm  → { uploadId, cdnUrl, … }\n *\n * The presign envelope includes both a presigned-POST `url` (S3) AND a set\n * of form fields that must be sent verbatim. We post them as multipart/form-data\n * with `file` last (S3 spec requirement).\n */\n\nimport * as fs from 'node:fs';\nimport * as path from 'node:path';\n\n/**\n * Cloud-side simple-upload limit (`FileService.presign` enforces 10 MiB). We\n * mirror it client-side so the daemon doesn't buffer hundreds of MB into\n * memory just to be rejected by presign — a 500MB log dump from an adapter\n * would OOM the daemon long before the cloud got a chance to say no.\n */\nconst MAX_SIMPLE_UPLOAD_BYTES = 10 * 1024 * 1024;\n\nexport interface ArtifactUploaderOptions {\n  /** Cloud API key (sk-prismer-…) for the calling user/agent. */\n  apiKey: string;\n  /** Cloud API base URL, e.g. \"https://prismer.cloud\" or \"https://cloud.prismer.dev\". */\n  cloudApiBase: string;\n  /** Optional fetch impl override — useful for tests. Defaults to globalThis.fetch. */\n  fetchImpl?: typeof fetch;\n}\n\nexport interface ArtifactUploadOptions {\n  /** Override the file name sent in the presign request. Defaults to basename(path). */\n  fileName?: string;\n  /** Override the MIME type. Defaults to application/octet-stream when unknown. */\n  mimeType?: string;\n}\n\nexport type ArtifactUploadResult =\n  | { ok: true; uploadId: string; cdnUrl: string }\n  | { ok: false; error: string };\n\ninterface PresignResponse {\n  uploadId: string;\n  url: string;\n  fields: Record<string, string>;\n  expiresAt: string;\n  taskId: string;\n}\n\ninterface ConfirmResponse {\n  uploadId: string;\n  cdnUrl: string;\n  fileName: string;\n  fileSize: number;\n  mimeType: string;\n  sha256: string | null;\n  cost: number;\n}\n\nexport class ArtifactUploader {\n  private readonly apiKey: string;\n  private readonly cloudApiBase: string;\n  private readonly fetchImpl: typeof fetch;\n\n  constructor(opts: ArtifactUploaderOptions) {\n    if (!opts.apiKey) throw new Error('ArtifactUploader: apiKey required');\n    if (!opts.cloudApiBase) throw new Error('ArtifactUploader: cloudApiBase required');\n    this.apiKey = opts.apiKey;\n    this.cloudApiBase = opts.cloudApiBase.replace(/\\/+$/, '');\n    this.fetchImpl = opts.fetchImpl ?? (globalThis.fetch as typeof fetch);\n    if (typeof this.fetchImpl !== 'function') {\n      throw new Error('ArtifactUploader: fetch is not available — pass fetchImpl');\n    }\n  }\n\n  /**\n   * Upload one artifact for the given task. Returns:\n   *   - `{ ok:true, uploadId, cdnUrl }` on success.\n   *   - `{ ok:false, error }` on any failure — never throws.\n   */\n  async upload(\n    taskId: string,\n    artifactPath: string,\n    options: ArtifactUploadOptions = {},\n  ): Promise<ArtifactUploadResult> {\n    if (!taskId) return { ok: false, error: 'taskId required' };\n    if (!artifactPath) return { ok: false, error: 'artifactPath required' };\n\n    // 0. Stat the file (and read into memory — artifacts in v1.9 are <= 10MB\n    //    per the simple-upload limit; multipart streaming is Sprint C+).\n    //\n    //    We stat FIRST and refuse oversized files before the read, so a 500MB\n    //    adapter dump can't OOM the daemon. The cloud presign enforces the\n    //    same limit, but only after we've buffered the whole file.\n    let buffer: Buffer;\n    let stat: fs.Stats;\n    try {\n      stat = fs.statSync(artifactPath);\n      if (!stat.isFile()) {\n        return { ok: false, error: `artifact is not a file: ${artifactPath}` };\n      }\n      if (stat.size > MAX_SIMPLE_UPLOAD_BYTES) {\n        return { ok: false, error: `artifact_too_large:${stat.size}` };\n      }\n      // Async read to keep the event loop responsive for other tasks the\n      // daemon is concurrently dispatching.\n      buffer = await fs.promises.readFile(artifactPath);\n    } catch (err) {\n      return { ok: false, error: `read_failed: ${(err as Error).message}` };\n    }\n\n    const fileName = options.fileName ?? path.basename(artifactPath);\n    const mimeType = options.mimeType ?? guessMime(fileName);\n\n    // 1. Presign.\n    let presigned: PresignResponse;\n    try {\n      const res = await this.fetchImpl(`${this.cloudApiBase}/api/im/artifacts/presign`, {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/json',\n          Authorization: `Bearer ${this.apiKey}`,\n        },\n        body: JSON.stringify({\n          taskId,\n          fileName,\n          fileSize: stat.size,\n          mimeType,\n        }),\n      });\n      if (!res.ok) {\n        const text = await safeText(res);\n        return { ok: false, error: `presign_${res.status}: ${text}` };\n      }\n      const body = (await res.json()) as { ok?: boolean; data?: PresignResponse; error?: string };\n      if (!body.ok || !body.data) {\n        return { ok: false, error: `presign_invalid_response: ${body.error ?? 'no data'}` };\n      }\n      presigned = body.data;\n    } catch (err) {\n      return { ok: false, error: `presign_threw: ${(err as Error).message}` };\n    }\n\n    // 2. POST the file to the presigned URL. The fields object is sent first\n    //    as form fields, then `file` last (S3 presigned-POST requirement).\n    try {\n      const form = new FormData();\n      for (const [k, v] of Object.entries(presigned.fields ?? {})) {\n        form.append(k, v);\n      }\n      // Resolve the upload URL: presign returns a relative path in dev mode\n      // (e.g. `/api/im/files/dev-upload/<id>`). Make it absolute against\n      // cloudApiBase so the same flow works for dev + S3.\n      const uploadUrl = presigned.url.startsWith('http')\n        ? presigned.url\n        : `${this.cloudApiBase}${presigned.url}`;\n\n      // `Buffer` is BodyInit-compatible via Blob (works on Node 20+).\n      const blob = new Blob([buffer], { type: mimeType });\n      form.append('file', blob, fileName);\n\n      // Dev-upload route requires an Authorization header. S3 presigned POST\n      // does NOT — including it is harmless because S3 ignores unknown\n      // headers, but we omit the auth header for non-relative URLs to avoid\n      // accidental signature interference.\n      const headers: Record<string, string> = {};\n      if (!presigned.url.startsWith('http')) {\n        headers['Authorization'] = `Bearer ${this.apiKey}`;\n      }\n\n      const res = await this.fetchImpl(uploadUrl, {\n        method: 'POST',\n        headers,\n        body: form,\n      });\n      if (!res.ok) {\n        const text = await safeText(res);\n        return { ok: false, error: `upload_${res.status}: ${text}` };\n      }\n    } catch (err) {\n      return { ok: false, error: `upload_threw: ${(err as Error).message}` };\n    }\n\n    // 3. Confirm.\n    try {\n      const res = await this.fetchImpl(`${this.cloudApiBase}/api/im/artifacts/confirm`, {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/json',\n          Authorization: `Bearer ${this.apiKey}`,\n        },\n        body: JSON.stringify({ uploadId: presigned.uploadId }),\n      });\n      if (!res.ok) {\n        const text = await safeText(res);\n        return { ok: false, error: `confirm_${res.status}: ${text}` };\n      }\n      const body = (await res.json()) as { ok?: boolean; data?: ConfirmResponse; error?: string };\n      if (!body.ok || !body.data) {\n        return { ok: false, error: `confirm_invalid_response: ${body.error ?? 'no data'}` };\n      }\n      return { ok: true, uploadId: body.data.uploadId, cdnUrl: body.data.cdnUrl };\n    } catch (err) {\n      return { ok: false, error: `confirm_threw: ${(err as Error).message}` };\n    }\n  }\n}\n\n// ─── Helpers ────────────────────────────────────────────\n\nasync function safeText(res: Response): Promise<string> {\n  try {\n    return (await res.text()).slice(0, 500);\n  } catch {\n    return '<no body>';\n  }\n}\n\n/** Minimal MIME guess — covers the common artifact extensions. */\nfunction guessMime(fileName: string): string {\n  const ext = path.extname(fileName).toLowerCase();\n  switch (ext) {\n    case '.png':\n      return 'image/png';\n    case '.jpg':\n    case '.jpeg':\n      return 'image/jpeg';\n    case '.gif':\n      return 'image/gif';\n    case '.webp':\n      return 'image/webp';\n    case '.pdf':\n      return 'application/pdf';\n    case '.json':\n      return 'application/json';\n    case '.txt':\n      return 'text/plain';\n    case '.md':\n      return 'text/markdown';\n    case '.zip':\n      return 'application/zip';\n    case '.html':\n      return 'text/html';\n    case '.csv':\n      return 'text/csv';\n    default:\n      return 'application/octet-stream';\n  }\n}\n"],"mappings":";;;AAsBA,YAAY,QAAQ;AACpB,YAAY,UAAU;AAQtB,IAAM,0BAA0B,KAAK,OAAO;AAwCrC,IAAM,mBAAN,MAAuB;AAAA,EACX;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YAAY,MAA+B;AACzC,QAAI,CAAC,KAAK,OAAQ,OAAM,IAAI,MAAM,mCAAmC;AACrE,QAAI,CAAC,KAAK,aAAc,OAAM,IAAI,MAAM,yCAAyC;AACjF,SAAK,SAAS,KAAK;AACnB,SAAK,eAAe,KAAK,aAAa,QAAQ,QAAQ,EAAE;AACxD,SAAK,YAAY,KAAK,aAAc,WAAW;AAC/C,QAAI,OAAO,KAAK,cAAc,YAAY;AACxC,YAAM,IAAI,MAAM,gEAA2D;AAAA,IAC7E;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,OACJ,QACA,cACA,UAAiC,CAAC,GACH;AAC/B,QAAI,CAAC,OAAQ,QAAO,EAAE,IAAI,OAAO,OAAO,kBAAkB;AAC1D,QAAI,CAAC,aAAc,QAAO,EAAE,IAAI,OAAO,OAAO,wBAAwB;AAQtE,QAAI;AACJ,QAAI;AACJ,QAAI;AACF,aAAU,YAAS,YAAY;AAC/B,UAAI,CAAC,KAAK,OAAO,GAAG;AAClB,eAAO,EAAE,IAAI,OAAO,OAAO,2BAA2B,YAAY,GAAG;AAAA,MACvE;AACA,UAAI,KAAK,OAAO,yBAAyB;AACvC,eAAO,EAAE,IAAI,OAAO,OAAO,sBAAsB,KAAK,IAAI,GAAG;AAAA,MAC/D;AAGA,eAAS,MAAS,YAAS,SAAS,YAAY;AAAA,IAClD,SAAS,KAAK;AACZ,aAAO,EAAE,IAAI,OAAO,OAAO,gBAAiB,IAAc,OAAO,GAAG;AAAA,IACtE;AAEA,UAAM,WAAW,QAAQ,YAAiB,cAAS,YAAY;AAC/D,UAAM,WAAW,QAAQ,YAAY,UAAU,QAAQ;AAGvD,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,MAAM,KAAK,UAAU,GAAG,KAAK,YAAY,6BAA6B;AAAA,QAChF,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,gBAAgB;AAAA,UAChB,eAAe,UAAU,KAAK,MAAM;AAAA,QACtC;AAAA,QACA,MAAM,KAAK,UAAU;AAAA,UACnB;AAAA,UACA;AAAA,UACA,UAAU,KAAK;AAAA,UACf;AAAA,QACF,CAAC;AAAA,MACH,CAAC;AACD,UAAI,CAAC,IAAI,IAAI;AACX,cAAM,OAAO,MAAM,SAAS,GAAG;AAC/B,eAAO,EAAE,IAAI,OAAO,OAAO,WAAW,IAAI,MAAM,KAAK,IAAI,GAAG;AAAA,MAC9D;AACA,YAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,UAAI,CAAC,KAAK,MAAM,CAAC,KAAK,MAAM;AAC1B,eAAO,EAAE,IAAI,OAAO,OAAO,6BAA6B,KAAK,SAAS,SAAS,GAAG;AAAA,MACpF;AACA,kBAAY,KAAK;AAAA,IACnB,SAAS,KAAK;AACZ,aAAO,EAAE,IAAI,OAAO,OAAO,kBAAmB,IAAc,OAAO,GAAG;AAAA,IACxE;AAIA,QAAI;AACF,YAAM,OAAO,IAAI,SAAS;AAC1B,iBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,UAAU,UAAU,CAAC,CAAC,GAAG;AAC3D,aAAK,OAAO,GAAG,CAAC;AAAA,MAClB;AAIA,YAAM,YAAY,UAAU,IAAI,WAAW,MAAM,IAC7C,UAAU,MACV,GAAG,KAAK,YAAY,GAAG,UAAU,GAAG;AAGxC,YAAM,OAAO,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,MAAM,SAAS,CAAC;AAClD,WAAK,OAAO,QAAQ,MAAM,QAAQ;AAMlC,YAAM,UAAkC,CAAC;AACzC,UAAI,CAAC,UAAU,IAAI,WAAW,MAAM,GAAG;AACrC,gBAAQ,eAAe,IAAI,UAAU,KAAK,MAAM;AAAA,MAClD;AAEA,YAAM,MAAM,MAAM,KAAK,UAAU,WAAW;AAAA,QAC1C,QAAQ;AAAA,QACR;AAAA,QACA,MAAM;AAAA,MACR,CAAC;AACD,UAAI,CAAC,IAAI,IAAI;AACX,cAAM,OAAO,MAAM,SAAS,GAAG;AAC/B,eAAO,EAAE,IAAI,OAAO,OAAO,UAAU,IAAI,MAAM,KAAK,IAAI,GAAG;AAAA,MAC7D;AAAA,IACF,SAAS,KAAK;AACZ,aAAO,EAAE,IAAI,OAAO,OAAO,iBAAkB,IAAc,OAAO,GAAG;AAAA,IACvE;AAGA,QAAI;AACF,YAAM,MAAM,MAAM,KAAK,UAAU,GAAG,KAAK,YAAY,6BAA6B;AAAA,QAChF,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,gBAAgB;AAAA,UAChB,eAAe,UAAU,KAAK,MAAM;AAAA,QACtC;AAAA,QACA,MAAM,KAAK,UAAU,EAAE,UAAU,UAAU,SAAS,CAAC;AAAA,MACvD,CAAC;AACD,UAAI,CAAC,IAAI,IAAI;AACX,cAAM,OAAO,MAAM,SAAS,GAAG;AAC/B,eAAO,EAAE,IAAI,OAAO,OAAO,WAAW,IAAI,MAAM,KAAK,IAAI,GAAG;AAAA,MAC9D;AACA,YAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,UAAI,CAAC,KAAK,MAAM,CAAC,KAAK,MAAM;AAC1B,eAAO,EAAE,IAAI,OAAO,OAAO,6BAA6B,KAAK,SAAS,SAAS,GAAG;AAAA,MACpF;AACA,aAAO,EAAE,IAAI,MAAM,UAAU,KAAK,KAAK,UAAU,QAAQ,KAAK,KAAK,OAAO;AAAA,IAC5E,SAAS,KAAK;AACZ,aAAO,EAAE,IAAI,OAAO,OAAO,kBAAmB,IAAc,OAAO,GAAG;AAAA,IACxE;AAAA,EACF;AACF;AAIA,eAAe,SAAS,KAAgC;AACtD,MAAI;AACF,YAAQ,MAAM,IAAI,KAAK,GAAG,MAAM,GAAG,GAAG;AAAA,EACxC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,SAAS,UAAU,UAA0B;AAC3C,QAAM,MAAW,aAAQ,QAAQ,EAAE,YAAY;AAC/C,UAAQ,KAAK;AAAA,IACX,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;","names":[]}