@rulemetric/cli 0.7.3 → 0.7.5

package/dist/chunk-6NBS5XFS.js

@@ -1,99 +0,0 @@
-import {
-  agentRuns,
-  getDb,
-  sessions
-} from "./chunk-EI5BHWXA.js";
-import {
-  removeWorktree
-} from "./chunk-Y4BJXXYV.js";
-import {
-  PermanentJobError
-} from "./chunk-DGHWRQXL.js";
-
-// src/lib/handlers/process-run-cleanup.ts
-import { and, eq, isNotNull } from "drizzle-orm";
-async function processRunCleanup(payload, deps = {}) {
-  const db = deps.db ?? getDb();
-  const doRemove = deps.removeWorktreeFn ?? removeWorktree;
-  const log = deps.log ?? ((msg) => process.stderr.write(`[process_run_cleanup] ${msg}
-`));
-  const { runId } = payload;
-  const [run] = await db.select({
-    id: agentRuns.id,
-    userId: agentRuns.userId,
-    projectPath: agentRuns.projectPath
-  }).from(agentRuns).where(eq(agentRuns.id, runId)).limit(1);
-  if (!run) {
-    throw new PermanentJobError(`Run ${runId} not found`);
-  }
-  if (!run.projectPath) {
-    throw new PermanentJobError(
-      `Run ${runId} has no projectPath; cannot resolve a repo root for worktree cleanup`
-    );
-  }
-  const repoRoot = run.projectPath;
-  const endedSessions = await db.select({
-    id: sessions.id,
-    projectPath: sessions.projectPath
-  }).from(sessions).where(
-    and(
-      eq(sessions.runId, runId),
-      eq(sessions.userId, run.userId),
-      isNotNull(sessions.endedAt)
-    )
-  );
-  const worktrees = [];
-  let removed = 0;
-  let skippedDirty = 0;
-  let absent = 0;
-  let errored = 0;
-  const seenPaths = /* @__PURE__ */ new Set();
-  for (const s of endedSessions) {
-    if (!s.projectPath || s.projectPath === repoRoot) continue;
-    if (seenPaths.has(s.projectPath)) continue;
-    seenPaths.add(s.projectPath);
-    try {
-      const result = await doRemove({ repoRoot, worktreePath: s.projectPath });
-      if (result.removed) {
-        removed++;
-        worktrees.push({ sessionId: s.id, worktreePath: s.projectPath, status: "removed" });
-        log(`removed worktree ${s.projectPath} (session ${s.id})`);
-      } else if (result.reason === "dirty") {
-        skippedDirty++;
-        worktrees.push({ sessionId: s.id, worktreePath: s.projectPath, status: "skipped-dirty" });
-        log(`skipped dirty worktree ${s.projectPath} (session ${s.id}) \u2014 uncommitted changes`);
-      } else {
-        absent++;
-        worktrees.push({ sessionId: s.id, worktreePath: s.projectPath, status: "absent" });
-        log(`worktree absent ${s.projectPath} (session ${s.id})`);
-      }
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      errored++;
-      worktrees.push({
-        sessionId: s.id,
-        worktreePath: s.projectPath,
-        status: "error",
-        error: message.slice(0, 1e3)
-      });
-      log(`error removing worktree ${s.projectPath} (session ${s.id}): ${message}`);
-    }
-  }
-  log(
-    `run ${runId} cleanup: removed=${removed} skippedDirty=${skippedDirty} absent=${absent} errored=${errored}`
-  );
-  return {
-    runId,
-    repoRoot,
-    removed,
-    skippedDirty,
-    absent,
-    errored,
-    worktrees
-  };
-}
-
-export {
-  processRunCleanup
-};
-//# sourceMappingURL=chunk-6NBS5XFS.js.map

package/dist/chunk-6NBS5XFS.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../src/lib/handlers/process-run-cleanup.ts"],
-  "sourcesContent": ["import { and, eq, isNotNull } from 'drizzle-orm';\nimport { agentRuns, sessions, getDb } from '@rulemetric/db';\n\nimport { removeWorktree } from '../worktree.js';\nimport { PermanentJobError } from '../permanent-job-error.js';\n\nexport interface ProcessRunCleanupPayload {\n  runId: string;\n}\n\n/** Per-worktree cleanup outcome for the summary returned to the API. */\nexport interface RunCleanupWorktreeOutcome {\n  sessionId: string;\n  worktreePath: string;\n  /** 'removed' | 'skipped-dirty' | 'absent' | 'error' */\n  status: 'removed' | 'skipped-dirty' | 'absent' | 'error';\n  /** Present only when status === 'error'. */\n  error?: string;\n}\n\nexport interface ProcessRunCleanupResult {\n  runId: string;\n  /** Repo root the worktrees were pruned from (the run's projectPath). */\n  repoRoot: string | null;\n  removed: number;\n  skippedDirty: number;\n  absent: number;\n  errored: number;\n  worktrees: RunCleanupWorktreeOutcome[];\n}\n\nexport interface ProcessRunCleanupDeps {\n  db?: any;\n  removeWorktreeFn?: typeof removeWorktree;\n  log?: (msg: string) => void;\n}\n\n/**\n * Worker handler for the `process_run_cleanup` task (Task 5.2).\n *\n * Prunes the git worktrees of a run's ENDED sessions, GUARDING against\n * destroying uncommitted work. Only ENDED sessions are touched \u2014 an active\n * session is still using its worktree, so removing it would break the live\n * agent. Each worktree is removed via `removeWorktree`, which refuses to delete\n * a checkout with uncommitted changes (returns `skipped-dirty`) \u2014 never a\n * silent clobber (research \"merge-review bottleneck\" finding).\n *\n * Repo root = the run's `projectPath`. Each ended session's `projectPath` is\n * its worktree path (the launcher sets `config.projectPath = wt.path` before\n * spawning the session, and capture stamps that cwd onto `sessions.projectPath`\n * \u2014 see process-launch.ts + the linkRunSessions reconcile in runs.ts).\n *\n * Idempotent: a worktree already removed (or never created) reports `absent`,\n * not an error, so a re-run after a partial cleanup is safe. Per-worktree\n * errors are collected, not fatal \u2014 one bad worktree must not abort cleanup of\n * the others. The job only fails terminally on a missing run / missing repo\n * root, where there's nothing actionable to retry.\n *\n * No mirror table \u2014 this is an `agent_jobs` kind (like process_announcement /\n * process_session_goal). The result blob is returned to /api/work/:id/complete\n * and stored on the agent_jobs row for the API/UI to read.\n */\nexport async function processRunCleanup(\n  payload: ProcessRunCleanupPayload,\n  deps: ProcessRunCleanupDeps = {},\n): Promise<ProcessRunCleanupResult> {\n  const db = deps.db ?? getDb();\n  const doRemove = deps.removeWorktreeFn ?? removeWorktree;\n  const log =\n    deps.log ?? ((msg: string) => process.stderr.write(`[process_run_cleanup] ${msg}\\n`));\n\n  const { runId } = payload;\n\n  const [run] = await db\n    .select({\n      id: agentRuns.id,\n      userId: agentRuns.userId,\n      projectPath: agentRuns.projectPath,\n    })\n    .from(agentRuns)\n    .where(eq(agentRuns.id, runId))\n    .limit(1);\n\n  if (!run) {\n    throw new PermanentJobError(`Run ${runId} not found`);\n  }\n  if (!run.projectPath) {\n    // No repo root to prune from \u2014 nothing we can ever do. Don't requeue.\n    throw new PermanentJobError(\n      `Run ${runId} has no projectPath; cannot resolve a repo root for worktree cleanup`,\n    );\n  }\n  const repoRoot = run.projectPath;\n\n  // ENDED sessions only (endedAt IS NOT NULL). Active sessions keep their\n  // worktree \u2014 removing it out from under a running agent would break it.\n  const endedSessions = await db\n    .select({\n      id: sessions.id,\n      projectPath: sessions.projectPath,\n    })\n    .from(sessions)\n    .where(\n      and(\n        eq(sessions.runId, runId),\n        eq(sessions.userId, run.userId),\n        isNotNull(sessions.endedAt),\n      ),\n    );\n\n  const worktrees: RunCleanupWorktreeOutcome[] = [];\n  let removed = 0;\n  let skippedDirty = 0;\n  let absent = 0;\n  let errored = 0;\n\n  // De-dupe by path so we don't double-remove if two ended sessions somehow\n  // share a worktree path (shouldn't happen for autoWorktree runs, but cheap\n  // insurance \u2014 git worktree remove on a gone path would otherwise count as a\n  // spurious second `absent`).\n  const seenPaths = new Set<string>();\n\n  for (const s of endedSessions) {\n    // A session without a cwd (or pointed at the shared repo root for a\n    // non-worktree run) has no per-session worktree to remove \u2014 skip it. We\n    // never remove the repo root itself.\n    if (!s.projectPath || s.projectPath === repoRoot) continue;\n    if (seenPaths.has(s.projectPath)) continue;\n    seenPaths.add(s.projectPath);\n\n    try {\n      const result = await doRemove({ repoRoot, worktreePath: s.projectPath });\n      if (result.removed) {\n        removed++;\n        worktrees.push({ sessionId: s.id, worktreePath: s.projectPath, status: 'removed' });\n        log(`removed worktree ${s.projectPath} (session ${s.id})`);\n      } else if (result.reason === 'dirty') {\n        skippedDirty++;\n        worktrees.push({ sessionId: s.id, worktreePath: s.projectPath, status: 'skipped-dirty' });\n        log(`skipped dirty worktree ${s.projectPath} (session ${s.id}) \u2014 uncommitted changes`);\n      } else {\n        // reason === 'absent' (already removed / never existed)\n        absent++;\n        worktrees.push({ sessionId: s.id, worktreePath: s.projectPath, status: 'absent' });\n        log(`worktree absent ${s.projectPath} (session ${s.id})`);\n      }\n    } catch (err) {\n      // A single bad worktree must not abort cleanup of the rest.\n      const message = err instanceof Error ? err.message : String(err);\n      errored++;\n      worktrees.push({\n        sessionId: s.id,\n        worktreePath: s.projectPath,\n        status: 'error',\n        error: message.slice(0, 1000),\n      });\n      log(`error removing worktree ${s.projectPath} (session ${s.id}): ${message}`);\n    }\n  }\n\n  log(\n    `run ${runId} cleanup: removed=${removed} skippedDirty=${skippedDirty} ` +\n      `absent=${absent} errored=${errored}`,\n  );\n\n  return {\n    runId,\n    repoRoot,\n    removed,\n    skippedDirty,\n    absent,\n    errored,\n    worktrees,\n  };\n}\n"],
-  "mappings": ";;;;;;;;;;;;;AAAA,SAAS,KAAK,IAAI,iBAAiB;AA8DnC,eAAsB,kBACpB,SACA,OAA8B,CAAC,GACG;AAClC,QAAM,KAAK,KAAK,MAAM,MAAM;AAC5B,QAAM,WAAW,KAAK,oBAAoB;AAC1C,QAAM,MACJ,KAAK,QAAQ,CAAC,QAAgB,QAAQ,OAAO,MAAM,yBAAyB,GAAG;AAAA,CAAI;AAErF,QAAM,EAAE,MAAM,IAAI;AAElB,QAAM,CAAC,GAAG,IAAI,MAAM,GACjB,OAAO;AAAA,IACN,IAAI,UAAU;AAAA,IACd,QAAQ,UAAU;AAAA,IAClB,aAAa,UAAU;AAAA,EACzB,CAAC,EACA,KAAK,SAAS,EACd,MAAM,GAAG,UAAU,IAAI,KAAK,CAAC,EAC7B,MAAM,CAAC;AAEV,MAAI,CAAC,KAAK;AACR,UAAM,IAAI,kBAAkB,OAAO,KAAK,YAAY;AAAA,EACtD;AACA,MAAI,CAAC,IAAI,aAAa;AAEpB,UAAM,IAAI;AAAA,MACR,OAAO,KAAK;AAAA,IACd;AAAA,EACF;AACA,QAAM,WAAW,IAAI;AAIrB,QAAM,gBAAgB,MAAM,GACzB,OAAO;AAAA,IACN,IAAI,SAAS;AAAA,IACb,aAAa,SAAS;AAAA,EACxB,CAAC,EACA,KAAK,QAAQ,EACb;AAAA,IACC;AAAA,MACE,GAAG,SAAS,OAAO,KAAK;AAAA,MACxB,GAAG,SAAS,QAAQ,IAAI,MAAM;AAAA,MAC9B,UAAU,SAAS,OAAO;AAAA,IAC5B;AAAA,EACF;AAEF,QAAM,YAAyC,CAAC;AAChD,MAAI,UAAU;AACd,MAAI,eAAe;AACnB,MAAI,SAAS;AACb,MAAI,UAAU;AAMd,QAAM,YAAY,oBAAI,IAAY;AAElC,aAAW,KAAK,eAAe;AAI7B,QAAI,CAAC,EAAE,eAAe,EAAE,gBAAgB,SAAU;AAClD,QAAI,UAAU,IAAI,EAAE,WAAW,EAAG;AAClC,cAAU,IAAI,EAAE,WAAW;AAE3B,QAAI;AACF,YAAM,SAAS,MAAM,SAAS,EAAE,UAAU,cAAc,EAAE,YAAY,CAAC;AACvE,UAAI,OAAO,SAAS;AAClB;AACA,kBAAU,KAAK,EAAE,WAAW,EAAE,IAAI,cAAc,EAAE,aAAa,QAAQ,UAAU,CAAC;AAClF,YAAI,oBAAoB,EAAE,WAAW,aAAa,EAAE,EAAE,GAAG;AAAA,MAC3D,WAAW,OAAO,WAAW,SAAS;AACpC;AACA,kBAAU,KAAK,EAAE,WAAW,EAAE,IAAI,cAAc,EAAE,aAAa,QAAQ,gBAAgB,CAAC;AACxF,YAAI,0BAA0B,EAAE,WAAW,aAAa,EAAE,EAAE,8BAAyB;AAAA,MACvF,OAAO;AAEL;AACA,kBAAU,KAAK,EAAE,WAAW,EAAE,IAAI,cAAc,EAAE,aAAa,QAAQ,SAAS,CAAC;AACjF,YAAI,mBAAmB,EAAE,WAAW,aAAa,EAAE,EAAE,GAAG;AAAA,MAC1D;AAAA,IACF,SAAS,KAAK;AAEZ,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D;AACA,gBAAU,KAAK;AAAA,QACb,WAAW,EAAE;AAAA,QACb,cAAc,EAAE;AAAA,QAChB,QAAQ;AAAA,QACR,OAAO,QAAQ,MAAM,GAAG,GAAI;AAAA,MAC9B,CAAC;AACD,UAAI,2BAA2B,EAAE,WAAW,aAAa,EAAE,EAAE,MAAM,OAAO,EAAE;AAAA,IAC9E;AAAA,EACF;AAEA;AAAA,IACE,OAAO,KAAK,qBAAqB,OAAO,iBAAiB,YAAY,WACzD,MAAM,YAAY,OAAO;AAAA,EACvC;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;",
-  "names": []
-}

package/dist/chunk-7LVVKQMZ.js

@@ -1,98 +0,0 @@
-// src/lib/gateway-identity.ts
-import { execFileSync } from "node:child_process";
-import * as http from "node:http";
-var GATEWAY_IDENTITY_PATH = "/__rulemetric_gateway__";
-var GATEWAY_IDENTITY_SERVICE = "rulemetric-gateway";
-var MAX_IDENTITY_BODY_BYTES = 4096;
-function probeGatewayIdentity(port, timeoutMs = 1500) {
-  return new Promise((resolve) => {
-    let settled = false;
-    const finish = (result) => {
-      if (settled) return;
-      settled = true;
-      resolve(result);
-    };
-    const req = http.get(
-      { host: "127.0.0.1", port, path: GATEWAY_IDENTITY_PATH, timeout: timeoutMs },
-      (res) => {
-        let body = "";
-        res.setEncoding("utf-8");
-        res.on("data", (chunk) => {
-          body += chunk;
-          if (body.length > MAX_IDENTITY_BODY_BYTES) {
-            req.destroy();
-            finish({ status: "foreign", detail: "oversized identity response" });
-          }
-        });
-        res.on("end", () => {
-          if (res.statusCode === 200) {
-            try {
-              const parsed = JSON.parse(body);
-              if (parsed?.service === GATEWAY_IDENTITY_SERVICE) {
-                finish({
-                  status: "ours-live",
-                  version: typeof parsed.version === "string" ? parsed.version : null,
-                  pid: typeof parsed.pid === "number" ? parsed.pid : null
-                });
-                return;
-              }
-            } catch {
-            }
-          }
-          finish({ status: "foreign", detail: `HTTP ${res.statusCode ?? "?"} without identity marker` });
-        });
-        res.on("error", () => finish({ status: "foreign", detail: "response stream error" }));
-      }
-    );
-    req.on("timeout", () => {
-      req.destroy();
-      finish({ status: "foreign", detail: "accepted TCP but no identity response (timeout)" });
-    });
-    req.on("error", (err) => {
-      const code = err.code;
-      if (code === "ECONNREFUSED") {
-        finish({ status: "dead" });
-      } else {
-        finish({ status: "foreign", detail: `socket error ${code ?? err.message}` });
-      }
-    });
-  });
-}
-async function waitForGatewayIdentity(port, { timeoutMs = 3e3, intervalMs = 150 } = {}) {
-  const deadline = Date.now() + timeoutMs;
-  for (; ; ) {
-    const identity = await probeGatewayIdentity(port, Math.min(1500, timeoutMs));
-    if (identity.status !== "dead") return identity;
-    if (Date.now() >= deadline) return identity;
-    await new Promise((resolve) => setTimeout(resolve, intervalMs));
-  }
-}
-function runLsofDefault(port) {
-  try {
-    return execFileSync("lsof", ["-nP", `-iTCP:${port}`, "-sTCP:LISTEN"], {
-      encoding: "utf-8",
-      stdio: ["ignore", "pipe", "ignore"]
-    });
-  } catch {
-    return null;
-  }
-}
-function describePortOwner(port, opts = {}) {
-  const output = (opts.runLsof ?? runLsofDefault)(port);
-  if (!output) return null;
-  const rows = output.split("\n").filter((line) => line.trim().length > 0);
-  const dataRow = rows.find((line) => !/^COMMAND\s/.test(line));
-  if (!dataRow) return null;
-  const [command, pid] = dataRow.trim().split(/\s+/);
-  if (!command) return null;
-  return pid ? `${command} (PID ${pid})` : command;
-}
-
-export {
-  GATEWAY_IDENTITY_PATH,
-  GATEWAY_IDENTITY_SERVICE,
-  probeGatewayIdentity,
-  waitForGatewayIdentity,
-  describePortOwner
-};
-//# sourceMappingURL=chunk-7LVVKQMZ.js.map

package/dist/chunk-7LVVKQMZ.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../src/lib/gateway-identity.ts"],
-  "sourcesContent": ["/**\n * Gateway identity handshake \u2014 distinguishes OUR gateway from a foreign\n * process squatting on :8787.\n *\n * A bare TCP-accept probe cannot tell the difference, and pinning Claude\n * Code's HTTPS_PROXY at a port owned by some other app breaks ALL of its\n * HTTPS (the worst client-side failure we have). The gateway serves a JSON\n * marker at GATEWAY_IDENTITY_PATH; this module probes it and classifies the\n * port as ours-live / foreign / dead. HTTPS_PROXY may only be pinned on\n * ours-live.\n *\n * Kept free of oclif so gateway-entry (a standalone Node process) can import it.\n */\nimport { execFileSync } from 'node:child_process';\nimport * as http from 'node:http';\n\nexport const GATEWAY_IDENTITY_PATH = '/__rulemetric_gateway__';\nexport const GATEWAY_IDENTITY_SERVICE = 'rulemetric-gateway';\n// The probe reads at most this much of a response \u2014 a foreign server could\n// stream forever on an unknown path.\nconst MAX_IDENTITY_BODY_BYTES = 4096;\n\nexport type GatewayIdentity =\n  /** The port answered with our JSON marker \u2014 safe to pin HTTPS_PROXY. */\n  | { status: 'ours-live'; version: string | null; pid: number | null }\n  /** Something accepts connections but is NOT our gateway \u2014 never pin. */\n  | { status: 'foreign'; detail: string }\n  /** Nothing is listening \u2014 safe to spawn a gateway, unsafe to pin. */\n  | { status: 'dead' };\n\n/**\n * One-shot identity probe against 127.0.0.1:<port>. Connects directly\n * (node:http ignores HTTPS_PROXY env), requests the identity path, and\n * verifies the marker. Anything that accepts TCP but fails the handshake \u2014\n * wrong body, non-JSON, hang, mid-request reset \u2014 is classified foreign:\n * the conservative direction, since foreign means \"do not pin\".\n */\nexport function probeGatewayIdentity(port: number, timeoutMs = 1500): Promise<GatewayIdentity> {\n  return new Promise((resolve) => {\n    let settled = false;\n    const finish = (result: GatewayIdentity) => {\n      if (settled) return;\n      settled = true;\n      resolve(result);\n    };\n\n    const req = http.get(\n      { host: '127.0.0.1', port, path: GATEWAY_IDENTITY_PATH, timeout: timeoutMs },\n      (res) => {\n        let body = '';\n        res.setEncoding('utf-8');\n        res.on('data', (chunk: string) => {\n          body += chunk;\n          if (body.length > MAX_IDENTITY_BODY_BYTES) {\n            req.destroy();\n            finish({ status: 'foreign', detail: 'oversized identity response' });\n          }\n        });\n        res.on('end', () => {\n          if (res.statusCode === 200) {\n            try {\n              const parsed = JSON.parse(body) as { service?: unknown; version?: unknown; pid?: unknown };\n              if (parsed?.service === GATEWAY_IDENTITY_SERVICE) {\n                finish({\n                  status: 'ours-live',\n                  version: typeof parsed.version === 'string' ? parsed.version : null,\n                  pid: typeof parsed.pid === 'number' ? parsed.pid : null,\n                });\n                return;\n              }\n            } catch {\n              /* not our JSON \u2014 fall through to foreign */\n            }\n          }\n          finish({ status: 'foreign', detail: `HTTP ${res.statusCode ?? '?'} without identity marker` });\n        });\n        res.on('error', () => finish({ status: 'foreign', detail: 'response stream error' }));\n      },\n    );\n\n    req.on('timeout', () => {\n      // The connection was accepted but nothing answered the handshake in\n      // time \u2014 on loopback that is a listener that isn't our gateway.\n      req.destroy();\n      finish({ status: 'foreign', detail: 'accepted TCP but no identity response (timeout)' });\n    });\n    req.on('error', (err) => {\n      const code = (err as NodeJS.ErrnoException).code;\n      if (code === 'ECONNREFUSED') {\n        finish({ status: 'dead' });\n      } else {\n        // Accepted-then-reset (e.g. a TLS-only listener) and anything else\n        // that isn't a clean refusal means SOMETHING owns the port.\n        finish({ status: 'foreign', detail: `socket error ${code ?? err.message}` });\n      }\n    });\n  });\n}\n\n/**\n * Poll probeGatewayIdentity() until it resolves to a terminal state or the\n * window elapses. 'dead' is the only retryable state (a just-spawned gateway\n * needs a moment to bind); 'ours-live' and 'foreign' can't change by waiting.\n */\nexport async function waitForGatewayIdentity(\n  port: number,\n  { timeoutMs = 3000, intervalMs = 150 }: { timeoutMs?: number; intervalMs?: number } = {},\n): Promise<GatewayIdentity> {\n  const deadline = Date.now() + timeoutMs;\n  for (;;) {\n    const identity = await probeGatewayIdentity(port, Math.min(1500, timeoutMs));\n    if (identity.status !== 'dead') return identity;\n    if (Date.now() >= deadline) return identity;\n    await new Promise((resolve) => setTimeout(resolve, intervalMs));\n  }\n}\n\nexport interface DescribePortOwnerOptions {\n  /** Override the `lsof` exec. Return raw lsof output, or null on failure. Used in tests. */\n  runLsof?: (port: number) => string | null;\n}\n\nfunction runLsofDefault(port: number): string | null {\n  try {\n    return execFileSync('lsof', ['-nP', `-iTCP:${port}`, '-sTCP:LISTEN'], {\n      encoding: 'utf-8',\n      stdio: ['ignore', 'pipe', 'ignore'],\n    });\n  } catch {\n    // lsof missing (some Linuxes) or no permission \u2014 the caller degrades to a\n    // generic \"something else holds the port\" message.\n    return null;\n  }\n}\n\n/**\n * Best-effort \"what is holding this port\" description for user-facing\n * messages, e.g. `dev-server (PID 4242)`. Returns null when it can't tell.\n */\nexport function describePortOwner(port: number, opts: DescribePortOwnerOptions = {}): string | null {\n  const output = (opts.runLsof ?? runLsofDefault)(port);\n  if (!output) return null;\n  // lsof output: header line, then `COMMAND PID USER ...` rows.\n  const rows = output.split('\\n').filter((line) => line.trim().length > 0);\n  const dataRow = rows.find((line) => !/^COMMAND\\s/.test(line));\n  if (!dataRow) return null;\n  const [command, pid] = dataRow.trim().split(/\\s+/);\n  if (!command) return null;\n  return pid ? `${command} (PID ${pid})` : command;\n}\n"],
-  "mappings": ";AAaA,SAAS,oBAAoB;AAC7B,YAAY,UAAU;AAEf,IAAM,wBAAwB;AAC9B,IAAM,2BAA2B;AAGxC,IAAM,0BAA0B;AAiBzB,SAAS,qBAAqB,MAAc,YAAY,MAAgC;AAC7F,SAAO,IAAI,QAAQ,CAAC,YAAY;AAC9B,QAAI,UAAU;AACd,UAAM,SAAS,CAAC,WAA4B;AAC1C,UAAI,QAAS;AACb,gBAAU;AACV,cAAQ,MAAM;AAAA,IAChB;AAEA,UAAM,MAAW;AAAA,MACf,EAAE,MAAM,aAAa,MAAM,MAAM,uBAAuB,SAAS,UAAU;AAAA,MAC3E,CAAC,QAAQ;AACP,YAAI,OAAO;AACX,YAAI,YAAY,OAAO;AACvB,YAAI,GAAG,QAAQ,CAAC,UAAkB;AAChC,kBAAQ;AACR,cAAI,KAAK,SAAS,yBAAyB;AACzC,gBAAI,QAAQ;AACZ,mBAAO,EAAE,QAAQ,WAAW,QAAQ,8BAA8B,CAAC;AAAA,UACrE;AAAA,QACF,CAAC;AACD,YAAI,GAAG,OAAO,MAAM;AAClB,cAAI,IAAI,eAAe,KAAK;AAC1B,gBAAI;AACF,oBAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,kBAAI,QAAQ,YAAY,0BAA0B;AAChD,uBAAO;AAAA,kBACL,QAAQ;AAAA,kBACR,SAAS,OAAO,OAAO,YAAY,WAAW,OAAO,UAAU;AAAA,kBAC/D,KAAK,OAAO,OAAO,QAAQ,WAAW,OAAO,MAAM;AAAA,gBACrD,CAAC;AACD;AAAA,cACF;AAAA,YACF,QAAQ;AAAA,YAER;AAAA,UACF;AACA,iBAAO,EAAE,QAAQ,WAAW,QAAQ,QAAQ,IAAI,cAAc,GAAG,2BAA2B,CAAC;AAAA,QAC/F,CAAC;AACD,YAAI,GAAG,SAAS,MAAM,OAAO,EAAE,QAAQ,WAAW,QAAQ,wBAAwB,CAAC,CAAC;AAAA,MACtF;AAAA,IACF;AAEA,QAAI,GAAG,WAAW,MAAM;AAGtB,UAAI,QAAQ;AACZ,aAAO,EAAE,QAAQ,WAAW,QAAQ,kDAAkD,CAAC;AAAA,IACzF,CAAC;AACD,QAAI,GAAG,SAAS,CAAC,QAAQ;AACvB,YAAM,OAAQ,IAA8B;AAC5C,UAAI,SAAS,gBAAgB;AAC3B,eAAO,EAAE,QAAQ,OAAO,CAAC;AAAA,MAC3B,OAAO;AAGL,eAAO,EAAE,QAAQ,WAAW,QAAQ,gBAAgB,QAAQ,IAAI,OAAO,GAAG,CAAC;AAAA,MAC7E;AAAA,IACF,CAAC;AAAA,EACH,CAAC;AACH;AAOA,eAAsB,uBACpB,MACA,EAAE,YAAY,KAAM,aAAa,IAAI,IAAiD,CAAC,GAC7D;AAC1B,QAAM,WAAW,KAAK,IAAI,IAAI;AAC9B,aAAS;AACP,UAAM,WAAW,MAAM,qBAAqB,MAAM,KAAK,IAAI,MAAM,SAAS,CAAC;AAC3E,QAAI,SAAS,WAAW,OAAQ,QAAO;AACvC,QAAI,KAAK,IAAI,KAAK,SAAU,QAAO;AACnC,UAAM,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,UAAU,CAAC;AAAA,EAChE;AACF;AAOA,SAAS,eAAe,MAA6B;AACnD,MAAI;AACF,WAAO,aAAa,QAAQ,CAAC,OAAO,SAAS,IAAI,IAAI,cAAc,GAAG;AAAA,MACpE,UAAU;AAAA,MACV,OAAO,CAAC,UAAU,QAAQ,QAAQ;AAAA,IACpC,CAAC;AAAA,EACH,QAAQ;AAGN,WAAO;AAAA,EACT;AACF;AAMO,SAAS,kBAAkB,MAAc,OAAiC,CAAC,GAAkB;AAClG,QAAM,UAAU,KAAK,WAAW,gBAAgB,IAAI;AACpD,MAAI,CAAC,OAAQ,QAAO;AAEpB,QAAM,OAAO,OAAO,MAAM,IAAI,EAAE,OAAO,CAAC,SAAS,KAAK,KAAK,EAAE,SAAS,CAAC;AACvE,QAAM,UAAU,KAAK,KAAK,CAAC,SAAS,CAAC,aAAa,KAAK,IAAI,CAAC;AAC5D,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,CAAC,SAAS,GAAG,IAAI,QAAQ,KAAK,EAAE,MAAM,KAAK;AACjD,MAAI,CAAC,QAAS,QAAO;AACrB,SAAO,MAAM,GAAG,OAAO,SAAS,GAAG,MAAM;AAC3C;",
-  "names": []
-}

package/dist/chunk-7NNFYWKK.js

@@ -1,243 +0,0 @@
-import {
-  MitmproxyRespawnMonitor
-} from "./chunk-ILYDELUE.js";
-import {
-  GATEWAY_IDENTITY_PATH,
-  GATEWAY_IDENTITY_SERVICE
-} from "./chunk-7LVVKQMZ.js";
-
-// src/lib/gateway.ts
-import { spawn } from "node:child_process";
-import * as fs from "node:fs";
-import * as http from "node:http";
-import * as net from "node:net";
-import * as os from "node:os";
-import * as path from "node:path";
-var GATEWAY_PORT = 8787;
-var MITMPROXY_PORT = 8788;
-var HEALTH_INTERVAL = 3e3;
-var HEALTH_TIMEOUT = 500;
-var RESTART_COOLDOWN_MS = 6e4;
-var VERSION_FILE = path.join(os.homedir(), ".config", "rulemetric", "proxy-addon.version");
-var PROXY_PID_FILE = path.join(os.homedir(), ".config", "rulemetric", "proxy.pid");
-var isProxyAlive = false;
-var lastSeenAddonVersion = null;
-var lastRestartAt = 0;
-var identityVersion = "unknown";
-var respawnMonitor = null;
-function log(msg) {
-  const ts = (/* @__PURE__ */ new Date()).toISOString();
-  console.log(`[${ts}] ${msg}`);
-}
-function readAddonVersion() {
-  try {
-    return fs.readFileSync(VERSION_FILE, "utf-8").trim() || null;
-  } catch {
-    return null;
-  }
-}
-function maybeRestartOnDrift(gatewayCliVersion, cliEntry) {
-  if (gatewayCliVersion === "unknown" || !cliEntry) return;
-  const addonVersion = readAddonVersion();
-  if (!addonVersion || addonVersion === "unknown") return;
-  if (addonVersion === lastSeenAddonVersion) return;
-  lastSeenAddonVersion = addonVersion;
-  if (addonVersion === gatewayCliVersion) {
-    log(`addon version matches gateway (${gatewayCliVersion})`);
-    return;
-  }
-  const sinceLast = Date.now() - lastRestartAt;
-  if (sinceLast < RESTART_COOLDOWN_MS) {
-    log(
-      `addon version drift (gateway=${gatewayCliVersion}, addon=${addonVersion}); restart cooldown active (${Math.round((RESTART_COOLDOWN_MS - sinceLast) / 1e3)}s left)`
-    );
-    return;
-  }
-  log(
-    `addon version drift detected (gateway=${gatewayCliVersion}, addon=${addonVersion}). Restarting proxy to pick up latest code.`
-  );
-  lastRestartAt = Date.now();
-  spawnProxyRestart(cliEntry);
-}
-function spawnProxyRestart(cliEntry) {
-  if (!cliEntry) {
-    log("cannot restart proxy: no CLI entry recorded (RULEMETRIC_CLI_ENTRY unset)");
-    return false;
-  }
-  try {
-    const child = spawn(process.execPath, [cliEntry, "proxy", "restart"], {
-      detached: true,
-      stdio: "ignore"
-    });
-    child.unref();
-    return true;
-  } catch (err) {
-    log(`restart spawn failed: ${err.message}`);
-    return false;
-  }
-}
-function proxyCrashEvidence() {
-  try {
-    const content = fs.readFileSync(PROXY_PID_FILE, "utf-8").trim();
-    return /^\d+$/.test(content);
-  } catch {
-    return false;
-  }
-}
-function checkProxyHealth(mitmproxyPort) {
-  const sock = net.connect({ port: mitmproxyPort, timeout: HEALTH_TIMEOUT });
-  sock.on("connect", () => {
-    sock.destroy();
-    if (!isProxyAlive) {
-      isProxyAlive = true;
-      log(`mitmproxy up on :${mitmproxyPort}, routing through proxy`);
-    }
-    respawnMonitor?.onHealthCheck(true);
-  });
-  sock.on("error", () => {
-    if (isProxyAlive) {
-      isProxyAlive = false;
-      log(`mitmproxy down on :${mitmproxyPort}, routing direct`);
-    }
-    respawnMonitor?.onHealthCheck(false);
-  });
-  sock.on("timeout", () => {
-    sock.destroy();
-    if (isProxyAlive) {
-      isProxyAlive = false;
-      log(`mitmproxy timeout on :${mitmproxyPort}, routing direct`);
-    }
-    respawnMonitor?.onHealthCheck(false);
-  });
-}
-function handleConnect(req, clientSocket, head, mitmproxyPort) {
-  const [targetHost, targetPortStr] = (req.url ?? "").split(":");
-  const targetPort = parseInt(targetPortStr, 10) || 443;
-  if (isProxyAlive) {
-    const proxySocket = net.connect({ port: mitmproxyPort, host: "127.0.0.1" });
-    proxySocket.on("connect", () => {
-      proxySocket.write(
-        `CONNECT ${req.url} HTTP/1.1\r
-Host: ${req.url}\r
-\r
-`
-      );
-    });
-    let responseBuffer = Buffer.alloc(0);
-    const onData = (chunk) => {
-      responseBuffer = Buffer.concat([responseBuffer, chunk]);
-      const responseStr = responseBuffer.toString();
-      if (responseStr.includes("\r\n\r\n")) {
-        proxySocket.removeListener("data", onData);
-        clientSocket.write("HTTP/1.1 200 Connection Established\r\n\r\n");
-        if (head.length > 0) proxySocket.write(head);
-        clientSocket.pipe(proxySocket);
-        proxySocket.pipe(clientSocket);
-      }
-    };
-    proxySocket.on("data", onData);
-    proxySocket.on("error", (err) => {
-      log(`proxy socket error for ${req.url}: ${err.message}, falling back to direct`);
-      connectDirect(req, clientSocket, head, targetHost, targetPort);
-    });
-    clientSocket.on("error", () => {
-      proxySocket.destroy();
-    });
-  } else {
-    connectDirect(req, clientSocket, head, targetHost, targetPort);
-  }
-}
-function connectDirect(req, clientSocket, head, targetHost, targetPort) {
-  const upstream = net.connect({ port: targetPort, host: targetHost });
-  upstream.on("connect", () => {
-    clientSocket.write("HTTP/1.1 200 Connection Established\r\n\r\n");
-    if (head.length > 0) upstream.write(head);
-    clientSocket.pipe(upstream);
-    upstream.pipe(clientSocket);
-  });
-  upstream.on("error", (err) => {
-    log(`upstream error for ${req.url}: ${err.message}`);
-    clientSocket.end("HTTP/1.1 502 Bad Gateway\r\n\r\n");
-  });
-  clientSocket.on("error", () => {
-    upstream.destroy();
-  });
-}
-function handleRequest(req, res, mitmproxyPort) {
-  if (req.url === GATEWAY_IDENTITY_PATH) {
-    res.writeHead(200, { "content-type": "application/json" });
-    res.end(JSON.stringify({
-      service: GATEWAY_IDENTITY_SERVICE,
-      version: identityVersion,
-      pid: process.pid,
-      mitmproxyAlive: isProxyAlive
-    }));
-    return;
-  }
-  const targetUrl = req.url ?? "";
-  let parsedUrl;
-  try {
-    parsedUrl = new URL(targetUrl);
-  } catch {
-    res.writeHead(400);
-    res.end("Bad Request");
-    return;
-  }
-  const options = {
-    hostname: isProxyAlive ? "127.0.0.1" : parsedUrl.hostname,
-    port: isProxyAlive ? mitmproxyPort : parseInt(parsedUrl.port, 10) || 80,
-    path: isProxyAlive ? targetUrl : parsedUrl.pathname + parsedUrl.search,
-    method: req.method,
-    headers: req.headers
-  };
-  const proxyReq = http.request(options, (proxyRes) => {
-    res.writeHead(proxyRes.statusCode ?? 502, proxyRes.headers);
-    proxyRes.pipe(res);
-  });
-  proxyReq.on("error", (err) => {
-    log(`HTTP proxy error for ${targetUrl}: ${err.message}`);
-    res.writeHead(502);
-    res.end("Bad Gateway");
-  });
-  req.pipe(proxyReq);
-}
-function startGateway(port = GATEWAY_PORT, mitmproxyPort = MITMPROXY_PORT, options = {}) {
-  const cliVersion = options.cliVersion ?? process.env.RULEMETRIC_CLI_VERSION ?? "unknown";
-  const cliEntry = options.cliEntry ?? process.env.RULEMETRIC_CLI_ENTRY ?? null;
-  identityVersion = cliVersion;
-  respawnMonitor = new MitmproxyRespawnMonitor({
-    hasCrashEvidence: proxyCrashEvidence,
-    respawn: () => spawnProxyRestart(cliEntry),
-    log
-  });
-  const server = http.createServer((req, res) => {
-    handleRequest(req, res, mitmproxyPort);
-  });
-  server.on("connect", (req, clientSocket, head) => {
-    handleConnect(req, clientSocket, head, mitmproxyPort);
-  });
-  server.on("clientError", (_err, socket) => {
-    if (socket.writable) {
-      socket.end("HTTP/1.1 400 Bad Request\r\n\r\n");
-    }
-  });
-  const healthInterval = setInterval(() => {
-    checkProxyHealth(mitmproxyPort);
-    maybeRestartOnDrift(cliVersion, cliEntry);
-  }, HEALTH_INTERVAL);
-  checkProxyHealth(mitmproxyPort);
-  maybeRestartOnDrift(cliVersion, cliEntry);
-  server.listen(port, "127.0.0.1", () => {
-    log(
-      `gateway listening on 127.0.0.1:${port} (mitmproxy target: :${mitmproxyPort}, cli version: ${cliVersion})`
-    );
-  });
-  return { server, healthInterval };
-}
-
-export {
-  GATEWAY_PORT,
-  MITMPROXY_PORT,
-  startGateway
-};
-//# sourceMappingURL=chunk-7NNFYWKK.js.map

package/dist/chunk-7NNFYWKK.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../src/lib/gateway.ts"],
-  "sourcesContent": ["/**\n * Resilient HTTP proxy gateway that always accepts connections on GATEWAY_PORT.\n * Routes through mitmproxy when it's alive, direct to upstream when it's not.\n */\nimport { spawn } from 'node:child_process';\nimport * as fs from 'node:fs';\nimport * as http from 'node:http';\nimport * as net from 'node:net';\nimport * as os from 'node:os';\nimport * as path from 'node:path';\nimport { GATEWAY_IDENTITY_PATH, GATEWAY_IDENTITY_SERVICE } from './gateway-identity.js';\nimport { MitmproxyRespawnMonitor } from './proxy-respawn.js';\n\nexport const GATEWAY_PORT = 8787;\nexport const MITMPROXY_PORT = 8788;\nconst HEALTH_INTERVAL = 3000;\nconst HEALTH_TIMEOUT = 500;\n// Floor on auto-restarts so a misconfigured drift can't trigger a restart\n// loop. Plenty long for the user to fix any underlying problem manually.\nconst RESTART_COOLDOWN_MS = 60_000;\nconst VERSION_FILE = path.join(os.homedir(), '.config', 'rulemetric', 'proxy-addon.version');\n// Crash evidence for the mitmproxy auto-restart: `proxy stop` removes this\n// file, a crash leaves it behind.\nconst PROXY_PID_FILE = path.join(os.homedir(), '.config', 'rulemetric', 'proxy.pid');\n\nlet isProxyAlive = false;\nlet lastState: boolean | null = null;\n// Drift state \u2014 tracked across health-check ticks. lastSeenAddonVersion is\n// what the file said last time we read it; lastRestartAt prevents loops.\nlet lastSeenAddonVersion: string | null = null;\nlet lastRestartAt = 0;\n// Set by startGateway; served on the identity endpoint so callers can verify\n// the thing on :8787 is actually us (and which build).\nlet identityVersion = 'unknown';\n// Mid-session mitmproxy crash recovery \u2014 constructed in startGateway.\nlet respawnMonitor: MitmproxyRespawnMonitor | null = null;\n\nfunction log(msg: string): void {\n  const ts = new Date().toISOString();\n  console.log(`[${ts}] ${msg}`);\n}\n\nfunction readAddonVersion(): string | null {\n  try {\n    return fs.readFileSync(VERSION_FILE, 'utf-8').trim() || null;\n  } catch {\n    // File may not exist yet (proxy not started, or older addon that doesn't\n    // write the file). Returning null disables drift checks for this tick.\n    return null;\n  }\n}\n\nfunction maybeRestartOnDrift(gatewayCliVersion: string, cliEntry: string | null): void {\n  // No reference version means we can't compare \u2014 skip.\n  if (gatewayCliVersion === 'unknown' || !cliEntry) return;\n  const addonVersion = readAddonVersion();\n  if (!addonVersion || addonVersion === 'unknown') return;\n  // Same as last tick \u2014 nothing changed, no need to log or act.\n  if (addonVersion === lastSeenAddonVersion) return;\n  lastSeenAddonVersion = addonVersion;\n\n  if (addonVersion === gatewayCliVersion) {\n    // Drift cleared (e.g. proxy was just restarted). Quiet log, no action.\n    log(`addon version matches gateway (${gatewayCliVersion})`);\n    return;\n  }\n\n  const sinceLast = Date.now() - lastRestartAt;\n  if (sinceLast < RESTART_COOLDOWN_MS) {\n    log(\n      `addon version drift (gateway=${gatewayCliVersion}, addon=${addonVersion}); ` +\n      `restart cooldown active (${Math.round((RESTART_COOLDOWN_MS - sinceLast) / 1000)}s left)`,\n    );\n    return;\n  }\n\n  log(\n    `addon version drift detected (gateway=${gatewayCliVersion}, addon=${addonVersion}). ` +\n    `Restarting proxy to pick up latest code.`,\n  );\n  lastRestartAt = Date.now();\n  spawnProxyRestart(cliEntry);\n}\n\n/**\n * Fire one detached `rulemetric proxy restart` via the CLI entry the spawning\n * process recorded. Shared by the version-drift restart and the mid-session\n * crash auto-restart. Output goes to /dev/null; the proxy.log captures the\n * restart events from mitmproxy itself.\n */\nfunction spawnProxyRestart(cliEntry: string | null): boolean {\n  if (!cliEntry) {\n    log('cannot restart proxy: no CLI entry recorded (RULEMETRIC_CLI_ENTRY unset)');\n    return false;\n  }\n  try {\n    const child = spawn(process.execPath, [cliEntry, 'proxy', 'restart'], {\n      detached: true,\n      stdio: 'ignore',\n    });\n    child.unref();\n    return true;\n  } catch (err) {\n    log(`restart spawn failed: ${(err as Error).message}`);\n    return false;\n  }\n}\n\n/**\n * True when the local proxy.pid file says a local-mode mitmproxy SHOULD be\n * running (numeric PID). `proxy stop` deletes the file, so its absence means\n * a deliberate stop \u2014 never auto-restart over that. A `docker:` marker means\n * Docker owns the lifecycle.\n */\nfunction proxyCrashEvidence(): boolean {\n  try {\n    const content = fs.readFileSync(PROXY_PID_FILE, 'utf-8').trim();\n    return /^\\d+$/.test(content);\n  } catch {\n    return false;\n  }\n}\n\nfunction checkProxyHealth(mitmproxyPort: number): void {\n  const sock = net.connect({ port: mitmproxyPort, timeout: HEALTH_TIMEOUT });\n  sock.on('connect', () => {\n    sock.destroy();\n    if (!isProxyAlive) {\n      isProxyAlive = true;\n      log(`mitmproxy up on :${mitmproxyPort}, routing through proxy`);\n    }\n    respawnMonitor?.onHealthCheck(true);\n  });\n  sock.on('error', () => {\n    if (isProxyAlive) {\n      isProxyAlive = false;\n      log(`mitmproxy down on :${mitmproxyPort}, routing direct`);\n    }\n    respawnMonitor?.onHealthCheck(false);\n  });\n  sock.on('timeout', () => {\n    sock.destroy();\n    if (isProxyAlive) {\n      isProxyAlive = false;\n      log(`mitmproxy timeout on :${mitmproxyPort}, routing direct`);\n    }\n    respawnMonitor?.onHealthCheck(false);\n  });\n}\n\nfunction handleConnect(\n  req: http.IncomingMessage,\n  clientSocket: net.Socket,\n  head: Buffer,\n  mitmproxyPort: number,\n): void {\n  const [targetHost, targetPortStr] = (req.url ?? '').split(':');\n  const targetPort = parseInt(targetPortStr, 10) || 443;\n\n  if (isProxyAlive) {\n    // Forward CONNECT to mitmproxy\n    const proxySocket = net.connect({ port: mitmproxyPort, host: '127.0.0.1' });\n\n    proxySocket.on('connect', () => {\n      // Send the CONNECT request to mitmproxy\n      proxySocket.write(\n        `CONNECT ${req.url} HTTP/1.1\\r\\nHost: ${req.url}\\r\\n\\r\\n`,\n      );\n    });\n\n    // Wait for mitmproxy's 200 response before piping\n    let responseBuffer = Buffer.alloc(0);\n    const onData = (chunk: Buffer) => {\n      responseBuffer = Buffer.concat([responseBuffer, chunk]);\n      const responseStr = responseBuffer.toString();\n      if (responseStr.includes('\\r\\n\\r\\n')) {\n        proxySocket.removeListener('data', onData);\n        // Forward the 200 to client\n        clientSocket.write('HTTP/1.1 200 Connection Established\\r\\n\\r\\n');\n        // Pipe remaining data and head\n        if (head.length > 0) proxySocket.write(head);\n        clientSocket.pipe(proxySocket);\n        proxySocket.pipe(clientSocket);\n      }\n    };\n    proxySocket.on('data', onData);\n\n    proxySocket.on('error', (err) => {\n      log(`proxy socket error for ${req.url}: ${err.message}, falling back to direct`);\n      // Mitmproxy failed mid-connect, fall back to direct\n      connectDirect(req, clientSocket, head, targetHost, targetPort);\n    });\n\n    clientSocket.on('error', () => {\n      proxySocket.destroy();\n    });\n  } else {\n    connectDirect(req, clientSocket, head, targetHost, targetPort);\n  }\n}\n\nfunction connectDirect(\n  req: http.IncomingMessage,\n  clientSocket: net.Socket,\n  head: Buffer,\n  targetHost: string,\n  targetPort: number,\n): void {\n  const upstream = net.connect({ port: targetPort, host: targetHost });\n\n  upstream.on('connect', () => {\n    clientSocket.write('HTTP/1.1 200 Connection Established\\r\\n\\r\\n');\n    if (head.length > 0) upstream.write(head);\n    clientSocket.pipe(upstream);\n    upstream.pipe(clientSocket);\n  });\n\n  upstream.on('error', (err) => {\n    log(`upstream error for ${req.url}: ${err.message}`);\n    clientSocket.end('HTTP/1.1 502 Bad Gateway\\r\\n\\r\\n');\n  });\n\n  clientSocket.on('error', () => {\n    upstream.destroy();\n  });\n}\n\nfunction handleRequest(\n  req: http.IncomingMessage,\n  res: http.ServerResponse,\n  mitmproxyPort: number,\n): void {\n  // Identity handshake (origin-form GET, not a proxy request): lets callers\n  // distinguish OUR gateway from a foreign process squatting on the port \u2014\n  // the gate for pinning HTTPS_PROXY and for idempotent double-spawns.\n  if (req.url === GATEWAY_IDENTITY_PATH) {\n    res.writeHead(200, { 'content-type': 'application/json' });\n    res.end(JSON.stringify({\n      service: GATEWAY_IDENTITY_SERVICE,\n      version: identityVersion,\n      pid: process.pid,\n      mitmproxyAlive: isProxyAlive,\n    }));\n    return;\n  }\n\n  // Plain HTTP proxy (non-CONNECT)\n  const targetUrl = req.url ?? '';\n  let parsedUrl: URL;\n  try {\n    parsedUrl = new URL(targetUrl);\n  } catch {\n    res.writeHead(400);\n    res.end('Bad Request');\n    return;\n  }\n\n  const options: http.RequestOptions = {\n    hostname: isProxyAlive ? '127.0.0.1' : parsedUrl.hostname,\n    port: isProxyAlive ? mitmproxyPort : (parseInt(parsedUrl.port, 10) || 80),\n    path: isProxyAlive ? targetUrl : parsedUrl.pathname + parsedUrl.search,\n    method: req.method,\n    headers: req.headers,\n  };\n\n  const proxyReq = http.request(options, (proxyRes) => {\n    res.writeHead(proxyRes.statusCode ?? 502, proxyRes.headers);\n    proxyRes.pipe(res);\n  });\n\n  proxyReq.on('error', (err) => {\n    log(`HTTP proxy error for ${targetUrl}: ${err.message}`);\n    res.writeHead(502);\n    res.end('Bad Gateway');\n  });\n\n  req.pipe(proxyReq);\n}\n\nexport function startGateway(\n  port: number = GATEWAY_PORT,\n  mitmproxyPort: number = MITMPROXY_PORT,\n  options: { cliVersion?: string; cliEntry?: string } = {},\n): { server: http.Server; healthInterval: NodeJS.Timeout } {\n  const cliVersion = options.cliVersion ?? process.env.RULEMETRIC_CLI_VERSION ?? 'unknown';\n  const cliEntry = options.cliEntry ?? process.env.RULEMETRIC_CLI_ENTRY ?? null;\n  identityVersion = cliVersion;\n  // Mid-session crash recovery: when the health check sees mitmproxy stay\n  // dead, attempt a bounded, crash-evidence-gated `proxy restart` (see\n  // proxy-respawn.ts for the guard rails).\n  respawnMonitor = new MitmproxyRespawnMonitor({\n    hasCrashEvidence: proxyCrashEvidence,\n    respawn: () => spawnProxyRestart(cliEntry),\n    log,\n  });\n  const server = http.createServer((req, res) => {\n    handleRequest(req, res, mitmproxyPort);\n  });\n\n  server.on('connect', (req, clientSocket, head) => {\n    handleConnect(req, clientSocket as net.Socket, head as Buffer, mitmproxyPort);\n  });\n\n  // Don't crash on client socket errors\n  server.on('clientError', (_err, socket) => {\n    if (socket.writable) {\n      socket.end('HTTP/1.1 400 Bad Request\\r\\n\\r\\n');\n    }\n  });\n\n  const healthInterval = setInterval(() => {\n    checkProxyHealth(mitmproxyPort);\n    maybeRestartOnDrift(cliVersion, cliEntry);\n  }, HEALTH_INTERVAL);\n\n  // Do an immediate check\n  checkProxyHealth(mitmproxyPort);\n  maybeRestartOnDrift(cliVersion, cliEntry);\n\n  server.listen(port, '127.0.0.1', () => {\n    log(\n      `gateway listening on 127.0.0.1:${port} (mitmproxy target: :${mitmproxyPort}, ` +\n      `cli version: ${cliVersion})`,\n    );\n  });\n\n  return { server, healthInterval };\n}\n"],
-  "mappings": ";;;;;;;;;AAIA,SAAS,aAAa;AACtB,YAAY,QAAQ;AACpB,YAAY,UAAU;AACtB,YAAY,SAAS;AACrB,YAAY,QAAQ;AACpB,YAAY,UAAU;AAIf,IAAM,eAAe;AACrB,IAAM,iBAAiB;AAC9B,IAAM,kBAAkB;AACxB,IAAM,iBAAiB;AAGvB,IAAM,sBAAsB;AAC5B,IAAM,eAAoB,UAAQ,WAAQ,GAAG,WAAW,cAAc,qBAAqB;AAG3F,IAAM,iBAAsB,UAAQ,WAAQ,GAAG,WAAW,cAAc,WAAW;AAEnF,IAAI,eAAe;AAInB,IAAI,uBAAsC;AAC1C,IAAI,gBAAgB;AAGpB,IAAI,kBAAkB;AAEtB,IAAI,iBAAiD;AAErD,SAAS,IAAI,KAAmB;AAC9B,QAAM,MAAK,oBAAI,KAAK,GAAE,YAAY;AAClC,UAAQ,IAAI,IAAI,EAAE,KAAK,GAAG,EAAE;AAC9B;AAEA,SAAS,mBAAkC;AACzC,MAAI;AACF,WAAU,gBAAa,cAAc,OAAO,EAAE,KAAK,KAAK;AAAA,EAC1D,QAAQ;AAGN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,oBAAoB,mBAA2B,UAA+B;AAErF,MAAI,sBAAsB,aAAa,CAAC,SAAU;AAClD,QAAM,eAAe,iBAAiB;AACtC,MAAI,CAAC,gBAAgB,iBAAiB,UAAW;AAEjD,MAAI,iBAAiB,qBAAsB;AAC3C,yBAAuB;AAEvB,MAAI,iBAAiB,mBAAmB;AAEtC,QAAI,kCAAkC,iBAAiB,GAAG;AAC1D;AAAA,EACF;AAEA,QAAM,YAAY,KAAK,IAAI,IAAI;AAC/B,MAAI,YAAY,qBAAqB;AACnC;AAAA,MACE,gCAAgC,iBAAiB,WAAW,YAAY,+BAC5C,KAAK,OAAO,sBAAsB,aAAa,GAAI,CAAC;AAAA,IAClF;AACA;AAAA,EACF;AAEA;AAAA,IACE,yCAAyC,iBAAiB,WAAW,YAAY;AAAA,EAEnF;AACA,kBAAgB,KAAK,IAAI;AACzB,oBAAkB,QAAQ;AAC5B;AAQA,SAAS,kBAAkB,UAAkC;AAC3D,MAAI,CAAC,UAAU;AACb,QAAI,0EAA0E;AAC9E,WAAO;AAAA,EACT;AACA,MAAI;AACF,UAAM,QAAQ,MAAM,QAAQ,UAAU,CAAC,UAAU,SAAS,SAAS,GAAG;AAAA,MACpE,UAAU;AAAA,MACV,OAAO;AAAA,IACT,CAAC;AACD,UAAM,MAAM;AACZ,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,yBAA0B,IAAc,OAAO,EAAE;AACrD,WAAO;AAAA,EACT;AACF;AAQA,SAAS,qBAA8B;AACrC,MAAI;AACF,UAAM,UAAa,gBAAa,gBAAgB,OAAO,EAAE,KAAK;AAC9D,WAAO,QAAQ,KAAK,OAAO;AAAA,EAC7B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,iBAAiB,eAA6B;AACrD,QAAM,OAAW,YAAQ,EAAE,MAAM,eAAe,SAAS,eAAe,CAAC;AACzE,OAAK,GAAG,WAAW,MAAM;AACvB,SAAK,QAAQ;AACb,QAAI,CAAC,cAAc;AACjB,qBAAe;AACf,UAAI,oBAAoB,aAAa,yBAAyB;AAAA,IAChE;AACA,oBAAgB,cAAc,IAAI;AAAA,EACpC,CAAC;AACD,OAAK,GAAG,SAAS,MAAM;AACrB,QAAI,cAAc;AAChB,qBAAe;AACf,UAAI,sBAAsB,aAAa,kBAAkB;AAAA,IAC3D;AACA,oBAAgB,cAAc,KAAK;AAAA,EACrC,CAAC;AACD,OAAK,GAAG,WAAW,MAAM;AACvB,SAAK,QAAQ;AACb,QAAI,cAAc;AAChB,qBAAe;AACf,UAAI,yBAAyB,aAAa,kBAAkB;AAAA,IAC9D;AACA,oBAAgB,cAAc,KAAK;AAAA,EACrC,CAAC;AACH;AAEA,SAAS,cACP,KACA,cACA,MACA,eACM;AACN,QAAM,CAAC,YAAY,aAAa,KAAK,IAAI,OAAO,IAAI,MAAM,GAAG;AAC7D,QAAM,aAAa,SAAS,eAAe,EAAE,KAAK;AAElD,MAAI,cAAc;AAEhB,UAAM,cAAkB,YAAQ,EAAE,MAAM,eAAe,MAAM,YAAY,CAAC;AAE1E,gBAAY,GAAG,WAAW,MAAM;AAE9B,kBAAY;AAAA,QACV,WAAW,IAAI,GAAG;AAAA,QAAsB,IAAI,GAAG;AAAA;AAAA;AAAA,MACjD;AAAA,IACF,CAAC;AAGD,QAAI,iBAAiB,OAAO,MAAM,CAAC;AACnC,UAAM,SAAS,CAAC,UAAkB;AAChC,uBAAiB,OAAO,OAAO,CAAC,gBAAgB,KAAK,CAAC;AACtD,YAAM,cAAc,eAAe,SAAS;AAC5C,UAAI,YAAY,SAAS,UAAU,GAAG;AACpC,oBAAY,eAAe,QAAQ,MAAM;AAEzC,qBAAa,MAAM,6CAA6C;AAEhE,YAAI,KAAK,SAAS,EAAG,aAAY,MAAM,IAAI;AAC3C,qBAAa,KAAK,WAAW;AAC7B,oBAAY,KAAK,YAAY;AAAA,MAC/B;AAAA,IACF;AACA,gBAAY,GAAG,QAAQ,MAAM;AAE7B,gBAAY,GAAG,SAAS,CAAC,QAAQ;AAC/B,UAAI,0BAA0B,IAAI,GAAG,KAAK,IAAI,OAAO,0BAA0B;AAE/E,oBAAc,KAAK,cAAc,MAAM,YAAY,UAAU;AAAA,IAC/D,CAAC;AAED,iBAAa,GAAG,SAAS,MAAM;AAC7B,kBAAY,QAAQ;AAAA,IACtB,CAAC;AAAA,EACH,OAAO;AACL,kBAAc,KAAK,cAAc,MAAM,YAAY,UAAU;AAAA,EAC/D;AACF;AAEA,SAAS,cACP,KACA,cACA,MACA,YACA,YACM;AACN,QAAM,WAAe,YAAQ,EAAE,MAAM,YAAY,MAAM,WAAW,CAAC;AAEnE,WAAS,GAAG,WAAW,MAAM;AAC3B,iBAAa,MAAM,6CAA6C;AAChE,QAAI,KAAK,SAAS,EAAG,UAAS,MAAM,IAAI;AACxC,iBAAa,KAAK,QAAQ;AAC1B,aAAS,KAAK,YAAY;AAAA,EAC5B,CAAC;AAED,WAAS,GAAG,SAAS,CAAC,QAAQ;AAC5B,QAAI,sBAAsB,IAAI,GAAG,KAAK,IAAI,OAAO,EAAE;AACnD,iBAAa,IAAI,kCAAkC;AAAA,EACrD,CAAC;AAED,eAAa,GAAG,SAAS,MAAM;AAC7B,aAAS,QAAQ;AAAA,EACnB,CAAC;AACH;AAEA,SAAS,cACP,KACA,KACA,eACM;AAIN,MAAI,IAAI,QAAQ,uBAAuB;AACrC,QAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,QAAI,IAAI,KAAK,UAAU;AAAA,MACrB,SAAS;AAAA,MACT,SAAS;AAAA,MACT,KAAK,QAAQ;AAAA,MACb,gBAAgB;AAAA,IAClB,CAAC,CAAC;AACF;AAAA,EACF;AAGA,QAAM,YAAY,IAAI,OAAO;AAC7B,MAAI;AACJ,MAAI;AACF,gBAAY,IAAI,IAAI,SAAS;AAAA,EAC/B,QAAQ;AACN,QAAI,UAAU,GAAG;AACjB,QAAI,IAAI,aAAa;AACrB;AAAA,EACF;AAEA,QAAM,UAA+B;AAAA,IACnC,UAAU,eAAe,cAAc,UAAU;AAAA,IACjD,MAAM,eAAe,gBAAiB,SAAS,UAAU,MAAM,EAAE,KAAK;AAAA,IACtE,MAAM,eAAe,YAAY,UAAU,WAAW,UAAU;AAAA,IAChE,QAAQ,IAAI;AAAA,IACZ,SAAS,IAAI;AAAA,EACf;AAEA,QAAM,WAAgB,aAAQ,SAAS,CAAC,aAAa;AACnD,QAAI,UAAU,SAAS,cAAc,KAAK,SAAS,OAAO;AAC1D,aAAS,KAAK,GAAG;AAAA,EACnB,CAAC;AAED,WAAS,GAAG,SAAS,CAAC,QAAQ;AAC5B,QAAI,wBAAwB,SAAS,KAAK,IAAI,OAAO,EAAE;AACvD,QAAI,UAAU,GAAG;AACjB,QAAI,IAAI,aAAa;AAAA,EACvB,CAAC;AAED,MAAI,KAAK,QAAQ;AACnB;AAEO,SAAS,aACd,OAAe,cACf,gBAAwB,gBACxB,UAAsD,CAAC,GACE;AACzD,QAAM,aAAa,QAAQ,cAAc,QAAQ,IAAI,0BAA0B;AAC/E,QAAM,WAAW,QAAQ,YAAY,QAAQ,IAAI,wBAAwB;AACzE,oBAAkB;AAIlB,mBAAiB,IAAI,wBAAwB;AAAA,IAC3C,kBAAkB;AAAA,IAClB,SAAS,MAAM,kBAAkB,QAAQ;AAAA,IACzC;AAAA,EACF,CAAC;AACD,QAAM,SAAc,kBAAa,CAAC,KAAK,QAAQ;AAC7C,kBAAc,KAAK,KAAK,aAAa;AAAA,EACvC,CAAC;AAED,SAAO,GAAG,WAAW,CAAC,KAAK,cAAc,SAAS;AAChD,kBAAc,KAAK,cAA4B,MAAgB,aAAa;AAAA,EAC9E,CAAC;AAGD,SAAO,GAAG,eAAe,CAAC,MAAM,WAAW;AACzC,QAAI,OAAO,UAAU;AACnB,aAAO,IAAI,kCAAkC;AAAA,IAC/C;AAAA,EACF,CAAC;AAED,QAAM,iBAAiB,YAAY,MAAM;AACvC,qBAAiB,aAAa;AAC9B,wBAAoB,YAAY,QAAQ;AAAA,EAC1C,GAAG,eAAe;AAGlB,mBAAiB,aAAa;AAC9B,sBAAoB,YAAY,QAAQ;AAExC,SAAO,OAAO,MAAM,aAAa,MAAM;AACrC;AAAA,MACE,kCAAkC,IAAI,wBAAwB,aAAa,kBAC3D,UAAU;AAAA,IAC5B;AAAA,EACF,CAAC;AAED,SAAO,EAAE,QAAQ,eAAe;AAClC;",
-  "names": []
-}

package/dist/chunk-7NYKWN7U.js

@@ -1,12 +0,0 @@
-// src/lib/types.ts
-var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-function validateUuid(value, label = "ID") {
-  if (!UUID_RE.test(value)) {
-    throw new Error(`Invalid ${label}: "${value}" is not a valid UUID`);
-  }
-}
-
-export {
-  validateUuid
-};
-//# sourceMappingURL=chunk-7NYKWN7U.js.map

package/dist/chunk-7NYKWN7U.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../src/lib/types.ts"],
-  "sourcesContent": ["const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\n\nexport function validateUuid(value: string, label = 'ID'): void {\n  if (!UUID_RE.test(value)) {\n    throw new Error(`Invalid ${label}: \"${value}\" is not a valid UUID`);\n  }\n}\n\n/** API response type for an instruction */\nexport interface Instruction {\n  id: string;\n  name: string;\n  description: string;\n  scope: string;\n  version: string;\n  tags: string[];\n  content: string;\n  createdAt: string;\n  updatedAt: string;\n}\n\n/** Subset for list views where not all fields are needed */\nexport type InstructionSummary = Pick<Instruction, 'id' | 'name' | 'scope' | 'version' | 'tags' | 'updatedAt'>;\n\nexport interface InstructionVersion {\n  id: string;\n  versionNumber: number;\n  changeSummary: string | null;\n  createdAt: string;\n}\n\nexport interface ConvertResult {\n  output: string;\n  format: string;\n  outputPath: string;\n  warnings: string[];\n  score?: { overall: number; details: Record<string, number> };\n}\n\nexport interface ConverterEntry {\n  id: string;\n  name: string;\n  description: string;\n  tier: number;\n  outputPath: string;\n  toolUrl: string;\n}\n\nexport interface ImportResult {\n  instruction: { id: string; name: string };\n  sourceFormat: string;\n  parseWarnings: string[];\n}\n"],
-  "mappings": ";AAAA,IAAM,UAAU;AAET,SAAS,aAAa,OAAe,QAAQ,MAAY;AAC9D,MAAI,CAAC,QAAQ,KAAK,KAAK,GAAG;AACxB,UAAM,IAAI,MAAM,WAAW,KAAK,MAAM,KAAK,uBAAuB;AAAA,EACpE;AACF;",
-  "names": []
-}

package/dist/chunk-BO76WKJR.js

@@ -1,42 +0,0 @@
-import {
-  tmuxSpawnEnv
-} from "./chunk-KRBQLMOP.js";
-
-// src/lib/detect-tmux.ts
-import { spawn } from "node:child_process";
-function detectTmux() {
-  return new Promise((resolve) => {
-    let child;
-    try {
-      child = spawn("tmux", ["-V"], { stdio: ["ignore", "pipe", "pipe"], env: tmuxSpawnEnv() });
-    } catch {
-      resolve({ available: false });
-      return;
-    }
-    let stdout = "";
-    child.stdout?.on("data", (chunk) => {
-      stdout += chunk.toString();
-    });
-    child.stderr?.on("data", () => {
-    });
-    child.on("error", () => {
-      resolve({ available: false });
-    });
-    child.on("close", (code) => {
-      if (code !== 0) {
-        resolve({ available: false });
-        return;
-      }
-      const match = stdout.trim().match(/^tmux\s+(\S+)/);
-      resolve({
-        available: true,
-        version: match ? match[1] : void 0
-      });
-    });
-  });
-}
-
-export {
-  detectTmux
-};
-//# sourceMappingURL=chunk-BO76WKJR.js.map

package/dist/chunk-BO76WKJR.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../src/lib/detect-tmux.ts"],
-  "sourcesContent": ["import { spawn } from 'node:child_process';\nimport { tmuxSpawnEnv } from './tmux.js';\n\nexport interface TmuxDetection {\n  available: boolean;\n  version?: string;\n  path?: string;\n}\n\n/**\n * Detect whether `tmux` is installed and runnable.\n *\n * Uses `tmux -V` with stdout/stderr captured so we never block waiting on a\n * TTY. ENOENT (binary missing) and any non-zero exit code both resolve as\n * `{ available: false }`. We never reject \u2014 callers print a one-line user\n * hint and continue; tmux is a soft dependency for live-send.\n */\nexport function detectTmux(): Promise<TmuxDetection> {\n  return new Promise((resolve) => {\n    let child: ReturnType<typeof spawn>;\n    try {\n      child = spawn('tmux', ['-V'], { stdio: ['ignore', 'pipe', 'pipe'], env: tmuxSpawnEnv() });\n    } catch {\n      resolve({ available: false });\n      return;\n    }\n\n    let stdout = '';\n    child.stdout?.on('data', (chunk: Buffer) => {\n      stdout += chunk.toString();\n    });\n    child.stderr?.on('data', () => {\n      // discard\n    });\n    child.on('error', () => {\n      resolve({ available: false });\n    });\n    child.on('close', (code) => {\n      if (code !== 0) {\n        resolve({ available: false });\n        return;\n      }\n      // `tmux -V` prints e.g. \"tmux 3.4\\n\"\n      const match = stdout.trim().match(/^tmux\\s+(\\S+)/);\n      resolve({\n        available: true,\n        version: match ? match[1] : undefined,\n      });\n    });\n  });\n}\n"],
-  "mappings": ";;;;;AAAA,SAAS,aAAa;AAiBf,SAAS,aAAqC;AACnD,SAAO,IAAI,QAAQ,CAAC,YAAY;AAC9B,QAAI;AACJ,QAAI;AACF,cAAQ,MAAM,QAAQ,CAAC,IAAI,GAAG,EAAE,OAAO,CAAC,UAAU,QAAQ,MAAM,GAAG,KAAK,aAAa,EAAE,CAAC;AAAA,IAC1F,QAAQ;AACN,cAAQ,EAAE,WAAW,MAAM,CAAC;AAC5B;AAAA,IACF;AAEA,QAAI,SAAS;AACb,UAAM,QAAQ,GAAG,QAAQ,CAAC,UAAkB;AAC1C,gBAAU,MAAM,SAAS;AAAA,IAC3B,CAAC;AACD,UAAM,QAAQ,GAAG,QAAQ,MAAM;AAAA,IAE/B,CAAC;AACD,UAAM,GAAG,SAAS,MAAM;AACtB,cAAQ,EAAE,WAAW,MAAM,CAAC;AAAA,IAC9B,CAAC;AACD,UAAM,GAAG,SAAS,CAAC,SAAS;AAC1B,UAAI,SAAS,GAAG;AACd,gBAAQ,EAAE,WAAW,MAAM,CAAC;AAC5B;AAAA,MACF;AAEA,YAAM,QAAQ,OAAO,KAAK,EAAE,MAAM,eAAe;AACjD,cAAQ;AAAA,QACN,WAAW;AAAA,QACX,SAAS,QAAQ,MAAM,CAAC,IAAI;AAAA,MAC9B,CAAC;AAAA,IACH,CAAC;AAAA,EACH,CAAC;AACH;",
-  "names": []
-}