@scopebond/agent 0.5.6 → 0.6.0

package/dist/tray-model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tray-model.d.ts","sourceRoot":"","sources":["../src/tray-model.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,iHAAiH;AACjH,MAAM,MAAM,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,cAAc,CAAC;AAEvG,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,UAAU,GAAG,YAAY,GAAG,WAAW,GAAG,QAAQ,GAAG,WAAW,GAAG,gBAAgB,CAAC;IACxF,KAAK,EAAE,MAAM,CAAC;IACd,mDAAmD;IACnD,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,SAAS,CAAC;IACjB,qGAAqG;IACrG,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,uFAAuF;IACvF,IAAI,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9C,wFAAwF;IACxF,GAAG,EAAE,UAAU,GAAG,IAAI,CAAC;IACvB,6CAA6C;IAC7C,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,4DAA4D;IAC5D,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,aAAa,EAAE,WAAW,EAAE,CAAC;CAC9B;AAED,6HAA6H;AAC7H,MAAM,WAAW,WAAW;IAAG,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,SAAS,GAAG,OAAO,GAAG,IAAI,CAAA;CAAE;AAElK,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,2GAA2G;IAC3G,UAAU,EAAE,MAAM,CAAC;IACnB,kFAAkF;IAClF,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,KAAK,EAAE;QAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC9F,KAAK,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC9E,YAAY,CAAC,EAAE,WAAW,EAAE,CAAC;IAC7B,OAAO,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,aAAa,GAAG,MAAM,GAAG,SAAS,CAAC;QAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACtJ,SAAS,EAAE;QAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IACnG,YAAY,EAAE,MAAM,CAAC;IACrB,kGAAkG;IAClG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+GAA+G;IAC/G,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAID,mGAAmG;AACnG,eAAO,MAAM,oBAAoB,QAAW,CAAC;AAC7C,qEAAqE;AACrE,eAAO,MAAM,oBAAoB,QAAW,CAAC;AAC7C,mEAAmE;AACnE,eAAO,MAAM,cAAc,QAAO,CAAC;AAEnC,wGAAwG;AACxG,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAErE;AAED,sGAAsG;AACtG,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAEnE;AAED,kHAAkH;AAClH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAEpE;AAED,wFAAwF;AACxF,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAG7E;AAED,wBAAgB,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAQnD;AAuBD,wBAAgB,SAAS,CAAC,KAAK,EAAE,SAAS,GAAG,SAAS,CAyFrD;AAED,iFAAiF;AACjF,wBAAgB,WAAW,CAAC,SAAS,EAAE;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAI7G"}
+{"version":3,"file":"tray-model.d.ts","sourceRoot":"","sources":["../src/tray-model.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,iHAAiH;AACjH,MAAM,MAAM,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,cAAc,CAAC;AAEvG,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,UAAU,GAAG,YAAY,GAAG,WAAW,GAAG,QAAQ,GAAG,WAAW,GAAG,gBAAgB,CAAC;IACxF,KAAK,EAAE,MAAM,CAAC;IACd,mDAAmD;IACnD,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,SAAS,CAAC;IACjB,qGAAqG;IACrG,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,uFAAuF;IACvF,IAAI,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9C,wFAAwF;IACxF,GAAG,EAAE,UAAU,GAAG,IAAI,CAAC;IACvB,6CAA6C;IAC7C,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,4DAA4D;IAC5D,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,aAAa,EAAE,WAAW,EAAE,CAAC;CAC9B;AAED,6HAA6H;AAC7H,MAAM,WAAW,WAAW;IAAG,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,SAAS,GAAG,OAAO,GAAG,IAAI,CAAA;CAAE;AAElK,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,2GAA2G;IAC3G,UAAU,EAAE,MAAM,CAAC;IACnB,kFAAkF;IAClF,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,KAAK,EAAE;QAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC9F,gHAAgH;IAChH,KAAK,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACvG,YAAY,CAAC,EAAE,WAAW,EAAE,CAAC;IAC7B,OAAO,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,aAAa,GAAG,MAAM,GAAG,SAAS,CAAC;QAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACtJ,SAAS,EAAE;QAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IACnG,YAAY,EAAE,MAAM,CAAC;IACrB,kGAAkG;IAClG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+GAA+G;IAC/G,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAID,mGAAmG;AACnG,eAAO,MAAM,oBAAoB,QAAW,CAAC;AAC7C,qEAAqE;AACrE,eAAO,MAAM,oBAAoB,QAAW,CAAC;AAC7C,mEAAmE;AACnE,eAAO,MAAM,cAAc,QAAO,CAAC;AAEnC,wGAAwG;AACxG,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAErE;AAED,sGAAsG;AACtG,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAEnE;AAED,kHAAkH;AAClH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAEpE;AAED,wFAAwF;AACxF,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAG7E;AAED,wBAAgB,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAQnD;AAuBD,wBAAgB,SAAS,CAAC,KAAK,EAAE,SAAS,GAAG,SAAS,CA0FrD;AAED,iFAAiF;AACjF,wBAAgB,WAAW,CAAC,SAAS,EAAE;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAI7G"}

package/dist/tray-model.js

@@ -147,6 +147,8 @@ export function trayModel(input) {
     }
     if (input.today) {
         const parts = [`${input.today.actions} action${input.today.actions === 1 ? "" : "s"}`, `${input.today.blocked} blocked`];
+        if (input.today.recorded_after)
+            parts.push(`${input.today.recorded_after} recorded, not prevented`);
         if (input.today.allowed_by_person)
             parts.push(`${input.today.allowed_by_person} allowed by a person`);
         if (input.openReviews)

package/dist/tray-model.js.map

@@ -1 +1 @@
-{"version":3,"file":"tray-model.js","sourceRoot":"","sources":["../src/tray-model.ts"],"names":[],"mappings":"AAAA,6HAA6H;AAC7H,8HAA8H;AAC9H,uGAAuG;AAsDvG,MAAM,GAAG,GAAG,MAAM,CAAC;AACnB,MAAM,IAAI,GAAG,EAAE,GAAG,GAAG,CAAC;AACtB,mGAAmG;AACnG,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,GAAG,GAAG,CAAC;AAC7C,qEAAqE;AACrE,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,GAAG,IAAI,CAAC;AAC7C,mEAAmE;AACnE,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,CAAC;AAEnC,wGAAwG;AACxG,MAAM,UAAU,WAAW,CAAC,KAAgC;IAC1D,OAAO,CAAC,CAAC,KAAK,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,yIAAyI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACvM,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,SAAS,CAAC,KAAgC;IACxD,OAAO,CAAC,CAAC,KAAK,IAAI,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACrD,CAAC;AAED,kHAAkH;AAClH,MAAM,UAAU,UAAU,CAAC,KAAgC;IACzD,OAAO,CAAC,CAAC,KAAK,IAAI,2BAA2B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC5D,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,aAAa,CAAC,KAAgC;IAC5D,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpD,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,EAAU,EAAE,GAAW;IACzC,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IACrD,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,UAAU,CAAC;IAC9B,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,GAAG,CAAC,UAAU,CAAC;IAClC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,GAAG,CAAC,QAAQ,CAAC;IAChC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC;AAC1C,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC;IACvB,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;AAC/F,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,IAAmB,EAAE,IAAY,EAAW,EAAE;IAC3D,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;QAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9F,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,MAAM,OAAO,GAAyC;IACpD,QAAQ,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE,QAAQ,EAAE;IACxE,UAAU,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE;IACvE,SAAS,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE;IACnE,MAAM,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE;IAC3D,SAAS,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE;IACxE,cAAc,EAAE,EAAE,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,iBAAiB,EAAE;CAC5F,CAAC;AAEF,MAAM,UAAU,SAAS,CAAC,KAAgB;IACxC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;IACtC,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC1B,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;IAC1B,MAAM,QAAQ,GAAG,CAAC,CAAC,oBAAoB,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAC9F,oFAAoF;IACpF,MAAM,SAAS,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IACrF,MAAM,OAAO,GAAG,CAAC,CAAC,SAAS,IAAI,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACzD,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,eAAe,IAAI,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzG,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,aAAa,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,gBAAgB,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAE3L,IAAI,KAAgB,CAAC;IACrB,IAAI,QAAgB,CAAC;IACrB,IAAI,GAAG,GAAsB,IAAI,CAAC;IAClC,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,KAAK,GAAG,SAAS,CAAC;QAAC,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9C,CAAC;SAAM,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC,wBAAwB,KAAK,IAAI,EAAE,CAAC;QACzE,KAAK,GAAG,cAAc,CAAC;QAAC,QAAQ,GAAG,kEAAkE,CAAC;QACtG,IAAI,KAAK,CAAC,YAAY;YAAE,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC;;YAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IAC3E,CAAC;SAAM,IAAI,OAAO,GAAG,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,GAAG,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;QACrF,sHAAsH;QACtH,KAAK,GAAG,WAAW,CAAC;QAAC,QAAQ,GAAG,4BAA4B,OAAO,UAAU,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC;QAChH,IAAI,GAAG,gJAAgJ,CAAC;QACxJ,GAAG,GAAG,OAAO,CAAC,cAAc,CAAC;IAC/B,CAAC;SAAM,IAAI,OAAO,GAAG,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,GAAG,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;QACtF,gHAAgH;QAChH,KAAK,GAAG,WAAW,CAAC;QAAC,QAAQ,GAAG,oCAAoC,OAAO,UAAU,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC;QACxH,IAAI,GAAG,uNAAuN,CAAC;QAC/N,GAAG,GAAG,OAAO,CAAC,cAAc,CAAC;IAC/B,CAAC;SAAM,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QAClC,KAAK,GAAG,SAAS,CAAC;QAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QAClE,IAAI,MAAM,CAAC,GAAG,EAAE,KAAK,KAAK,SAAS;YAAE,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC;IAC5D,CAAC;SAAM,IAAI,OAAO,EAAE,CAAC;QACnB,KAAK,GAAG,UAAU,GAAG,oBAAoB,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;QACpE,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,0BAA0B,OAAO,UAAU,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,+CAA+C,CAAC;IACvJ,CAAC;SAAM,IAAI,OAAO,GAAG,CAAC,IAAI,SAAS,GAAG,oBAAoB,EAAE,CAAC;QAC3D,KAAK,GAAG,WAAW,CAAC;QAAC,QAAQ,GAAG,GAAG,OAAO,UAAU,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,kBAAkB,CAAC;QAAC,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC;IACzH,CAAC;SAAM,IAAI,MAAM,CAAC,KAAK,KAAK,OAAO,IAAI,MAAM,CAAC,GAAG,EAAE,KAAK,KAAK,WAAW,EAAE,CAAC;QACzE,KAAK,GAAG,WAAW,CAAC;QAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAAC,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC;IAC3E,CAAC;SAAM,IAAI,KAAK,CAAC,KAAK,EAAE,UAAU,IAAI,CAAC,CAAC,SAAS,IAAI,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,GAAG,cAAc,EAAE,CAAC;QACnG,KAAK,GAAG,WAAW,CAAC;QAAC,QAAQ,GAAG,yBAAyB,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;QAAC,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC;IAC3I,CAAC;SAAM,CAAC;QACN,KAAK,GAAG,WAAW,CAAC;QAAC,QAAQ,GAAG,WAAW,CAAC;IAC9C,CAAC;IAED,MAAM,IAAI,GAAsB,EAAE,CAAC;IACnC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,cAAc,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5F,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,iCAAiC,CAAC;QACtF,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;QACnI,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,KAAK,CAAC,UAAU,IAAI,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,GAAG,cAAc,CAAC,CAAC,CAAC,mBAAmB,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,IAAI,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;IACjP,CAAC;IACD,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,OAAO,KAAK,CAAC;YACzB,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC,eAAe,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,qBAAqB,CAAC;YAC3F,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,kBAAkB,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,YAAY;gBAC1F,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,oCAAoC;oBAC1E,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,qCAAqC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG;wBAC7G,CAAC,CAAC,GAAG,OAAO,oBAAoB,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,UAAU,KAAK,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;QACzH,IAAI,KAAK,CAAC,KAAK,CAAC,iBAAiB;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,iBAAiB,sBAAsB,CAAC,CAAC;QACtG,IAAI,KAAK,CAAC,WAAW;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,WAAW,YAAY,CAAC,CAAC;QACpE,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,CAAC,IAAI,CAAC;QACR,KAAK,EAAE,SAAS;QAChB,KAAK,EAAE,eAAe,CAAC,CAAC,CAAC,2BAA2B,KAAK,CAAC,OAAO,CAAC,gBAAgB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,GAAG;YAC1G,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,OAAO,CAAC,KAAK,sCAAsC;gBACtG,CAAC,CAAC,qBAAqB,KAAK,CAAC,OAAO,CAAC,KAAK,GAAG;KAChD,CAAC,CAAC;IAEH,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,IAAI,OAAO,GAAG,CAAC,IAAI,GAAG,EAAE,EAAE,KAAK,UAAU,IAAI,KAAK,KAAK,cAAc;QAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACtG,IAAI,eAAe,IAAI,CAAC,KAAK,CAAC,OAAO;QAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACxE,IAAI,GAAG,EAAE,EAAE,KAAK,WAAW;QAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7D,IAAI,KAAK,CAAC,SAAS,EAAE,YAAY;QAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAExE,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChG,MAAM,KAAK,GAAG,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC1F,MAAM,OAAO,GAAG,eAAe,KAAK,EAAE,CAAC;IACvC,OAAO;QACL,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI;QACzC,OAAO,EAAE,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO;QACnE,aAAa,EAAE,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;KACtD,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,WAAW,CAAC,SAAmD,EAAE,KAAoB;IACnG,IAAI,KAAK;QAAE,OAAO,2BAA2B,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACnE,IAAI,CAAC,SAAS;QAAE,OAAO,2FAA2F,CAAC;IACnH,OAAO,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,0BAA0B,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,YAAY,EAAE,CAAC;AACvH,CAAC","sourcesContent":["// What the tray shows, as data (SB387, SB388). The tray (today a PowerShell script, later a native one) only draws this: one\n// state, one headline, the rows that have data, the one fix when something is wrong, and the actions that apply now. It never\n// works out health itself, so the tray, `status` and the workspace's computer page say the same thing.\n\nimport type { StatusJson } from \"@scopebond/hook\";\nimport type { Health } from \"./health.js\";\n\n/** The six icon states of the \"S\" tile (D143): no badge when protected; a badge with its own glyph otherwise. */\nexport type TrayState = \"protected\" | \"working\" | \"offline\" | \"attention\" | \"problem\" | \"disconnected\";\n\nexport interface TrayAction {\n  id: \"send_now\" | \"update_now\" | \"check_now\" | \"repair\" | \"reconnect\" | \"open_workspace\";\n  label: string;\n  /** The agent's local route that does it (POST). */\n  route: string;\n}\n\nexport interface TrayModel {\n  state: TrayState;\n  /** One line at the top, and the tooltip (Windows allows 63 characters in a classic tray tooltip). */\n  headline: string;\n  tooltip: string;\n  /** Rules, Delivery, Today, Version: each only when there is data (never \"unknown\"). */\n  rows: Array<{ label: string; value: string }>;\n  /** The one fix when something is wrong (shown first, in place of the usual actions). */\n  fix: TrayAction | null;\n  /** Actions that apply now, in menu order. */\n  actions: TrayAction[];\n  /** A sign-in or similar step no button can do, in words. */\n  hint: string | null;\n  recent_blocks: RecentBlock[];\n}\n\n/** A recent block. `can_act`: the person may still allow it or ask an admin from the tray (D144); `acted`: what they did. */\nexport interface RecentBlock { action_id: string | null; summary: string; at: string; rule: string | null; can_act?: boolean; acted?: \"allowed\" | \"asked\" | null }\n\nexport interface TrayInput {\n  status: StatusJson;\n  health: Health;\n  now: number;\n  /** When this computer last came back from sleep or started (the agent sees the gap between its cycles). */\n  awakeSince: number;\n  /** A long step the agent is running (an update, a sign-in, a repair), or null. */\n  working: string | null;\n  rules: { checked_at: number | null; managed: boolean; block: number; monitor: number } | null;\n  today: { actions: number; blocked: number; allowed_by_person: number } | null;\n  recentBlocks?: RecentBlock[];\n  version: { agent: string; hook: string; policy: \"recommended\" | \"hold\" | \"unknown\"; recommendedAgent: string | null; recommendedHook: string | null };\n  workspace: { name: string | null; environment: string | null; computer_url: string | null } | null;\n  computerName: string;\n  /** Items about this computer waiting in the workspace's Review (from the workspace's summary). */\n  openReviews?: number;\n  /** Whether the agent can run the sign-in itself (`POST /reconnect`); until then the tray shows the command. */\n  canReconnect?: boolean;\n}\n\nconst MIN = 60_000;\nconst HOUR = 60 * MIN;\n/** Records waiting this long while the computer is awake and online need attention (D143 §4.1). */\nexport const WAITING_ATTENTION_MS = 15 * MIN;\n/** Offline (the workspace unreachable) this long needs attention. */\nexport const OFFLINE_ATTENTION_MS = 4 * HOUR;\n/** Rules not checked for this long while online need attention. */\nexport const RULES_STALE_MS = HOUR;\n\n/** A delivery error that means the workspace could not be reached (no answer at all), not a refusal. */\nexport function unreachable(error: string | null | undefined): boolean {\n  return !!error && !/HTTP \\d{3}/.test(error) && /fetch failed|ENOTFOUND|ECONNREFUSED|ECONNRESET|ETIMEDOUT|EAI_AGAIN|ENETUNREACH|EHOSTUNREACH|getaddrinfo|network|socket|could not reach/i.test(error);\n}\n\n/** The workspace refused records because it reached its monthly limit (they stay on the computer). */\nexport function overQuota(error: string | null | undefined): boolean {\n  return !!error && /HTTP 429 \\(quota\\)/.test(error);\n}\n\n/** The workspace's plan keeps fewer agents active than it has, and this one is paused (HTTP 402 agent_paused). */\nexport function planPaused(error: string | null | undefined): boolean {\n  return !!error && /HTTP 402 \\(agent_paused\\)/.test(error);\n}\n\n/** The HTTP status of a refusal the workspace answered (not \"unreachable\"), or null. */\nexport function refusedStatus(error: string | null | undefined): number | null {\n  const m = error ? /HTTP (\\d{3})/.exec(error) : null;\n  return m ? Number(m[1]) : null;\n}\n\nexport function ago(at: number, now: number): string {\n  const s = Math.max(0, Math.round((now - at) / 1000));\n  if (s < 60) return \"just now\";\n  const m = Math.round(s / 60);\n  if (m < 60) return `${m} min ago`;\n  const h = Math.round(m / 60);\n  if (h < 36) return `${h} h ago`;\n  return `${Math.round(h / 24)} days ago`;\n}\n\nfunction clock(at: number): string {\n  const d = new Date(at);\n  return `${String(d.getHours()).padStart(2, \"0\")}:${String(d.getMinutes()).padStart(2, \"0\")}`;\n}\n\nconst newer = (want: string | null, have: string): boolean => {\n  if (!want) return false;\n  const a = want.split(\".\").map(Number), b = have.split(\".\").map(Number);\n  for (let i = 0; i < 3; i++) if ((a[i] ?? 0) !== (b[i] ?? 0)) return (a[i] ?? 0) > (b[i] ?? 0);\n  return false;\n};\n\nconst ACTIONS: Record<TrayAction[\"id\"], TrayAction> = {\n  send_now: { id: \"send_now\", label: \"Send records now\", route: \"/flush\" },\n  update_now: { id: \"update_now\", label: \"Update now\", route: \"/update\" },\n  check_now: { id: \"check_now\", label: \"Check now\", route: \"/check\" },\n  repair: { id: \"repair\", label: \"Repair\", route: \"/repair\" },\n  reconnect: { id: \"reconnect\", label: \"Reconnect…\", route: \"/reconnect\" },\n  open_workspace: { id: \"open_workspace\", label: \"Open workspace\", route: \"/open-workspace\" },\n};\n\nexport function trayModel(input: TrayInput): TrayModel {\n  const { status, health, now } = input;\n  const d = status.delivery;\n  const pending = d.pending;\n  const oldestAt = d.oldest_pending_age_s === null ? null : now - d.oldest_pending_age_s * 1000;\n  // Sleep-aware (SB388): time the computer was asleep or off never counts as waiting.\n  const waitingMs = oldestAt === null ? 0 : now - Math.max(oldestAt, input.awakeSince);\n  const offline = d.connected && unreachable(d.last_error);\n  const offlineFor = offline ? now - Math.max(d.last_success_at ?? input.awakeSince, input.awakeSince) : 0;\n  const updateAvailable = input.version.policy === \"recommended\" && (newer(input.version.recommendedAgent, input.version.agent) || newer(input.version.recommendedHook, input.version.hook));\n\n  let state: TrayState;\n  let headline: string;\n  let fix: TrayAction | null = null;\n  let hint: string | null = null;\n  if (input.working) {\n    state = \"working\"; headline = input.working;\n  } else if (health.level === \"red\" && d.connection_refused_since !== null) {\n    state = \"disconnected\"; headline = \"Not connected to your workspace: using this computer's own rules\";\n    if (input.canReconnect) fix = ACTIONS.reconnect; else hint = health.hint;\n  } else if (pending > 0 && overQuota(d.last_error) && health.fix?.route !== \"/repair\") {\n    // Not \"sending\": the workspace refuses them until its limit allows. Nothing is lost; say so, and where it is changed.\n    state = \"attention\"; headline = `Workspace limit reached: ${pending} record${pending === 1 ? \"\" : \"s\"} waiting`;\n    hint = \"Your workspace reached its monthly limit. Records stay on this computer and send once the limit allows; a workspace owner can change the plan.\";\n    fix = ACTIONS.open_workspace;\n  } else if (pending > 0 && planPaused(d.last_error) && health.fix?.route !== \"/repair\") {\n    // Not a delivery problem to retry: the plan paused this agent. Sending again changes nothing; an owner decides.\n    state = \"attention\"; headline = `Paused by your workspace's plan: ${pending} record${pending === 1 ? \"\" : \"s\"} waiting`;\n    hint = \"Your workspace's plan keeps fewer agents active than it has, and this one is paused. This computer keeps checking actions and keeps its records; they send once an owner keeps this agent active or changes the plan.\";\n    fix = ACTIONS.open_workspace;\n  } else if (health.level === \"red\") {\n    state = \"problem\"; headline = health.headline; hint = health.hint;\n    if (health.fix?.route === \"/repair\") fix = ACTIONS.repair;\n  } else if (offline) {\n    state = offlineFor > OFFLINE_ATTENTION_MS ? \"attention\" : \"offline\";\n    headline = pending ? `Workspace unreachable: ${pending} record${pending === 1 ? \"\" : \"s\"} waiting` : \"Workspace unreachable: still checking actions\";\n  } else if (pending > 0 && waitingMs > WAITING_ATTENTION_MS) {\n    state = \"attention\"; headline = `${pending} record${pending === 1 ? \"\" : \"s\"} waiting to send`; fix = ACTIONS.send_now;\n  } else if (health.level === \"amber\" && health.fix?.route === \"/maintain\") {\n    state = \"attention\"; headline = health.headline; fix = ACTIONS.check_now;\n  } else if (input.rules?.checked_at && d.connected && now - input.rules.checked_at > RULES_STALE_MS) {\n    state = \"attention\"; headline = `Rules not checked for ${ago(input.rules.checked_at, now).replace(\" ago\", \"\")}`; fix = ACTIONS.check_now;\n  } else {\n    state = \"protected\"; headline = \"Protected\";\n  }\n\n  const rows: TrayModel[\"rows\"] = [];\n  if (input.rules) {\n    const when = input.rules.checked_at ? ` · checked ${ago(input.rules.checked_at, now)}` : \"\";\n    const source = input.rules.managed ? \"Up to date\" : \"Using this computer's own rules\";\n    const counts = input.rules.block + input.rules.monitor > 0 ? ` · ${input.rules.block} block · ${input.rules.monitor} monitor` : \"\";\n    rows.push({ label: \"Rules\", value: `${input.rules.managed && input.rules.checked_at && now - input.rules.checked_at > RULES_STALE_MS ? `Not checked for ${ago(input.rules.checked_at, now).replace(\" ago\", \"\")}` : source}${when}${counts}` });\n  }\n  if (d.connected) {\n    const value = pending === 0\n      ? (d.last_success_at ? `All sent · ${ago(d.last_success_at, now)}` : \"Nothing to send yet\")\n      : offline ? `${pending} waiting since ${oldestAt ? clock(oldestAt) : \"earlier\"} · offline`\n      : overQuota(d.last_error) ? `${pending} waiting · workspace limit reached`\n      : refusedStatus(d.last_error) ? `${pending} waiting · last try refused (HTTP ${refusedStatus(d.last_error)})`\n      : `${pending} waiting · sending`;\n    rows.push({ label: \"Delivery\", value });\n  }\n  if (input.today) {\n    const parts = [`${input.today.actions} action${input.today.actions === 1 ? \"\" : \"s\"}`, `${input.today.blocked} blocked`];\n    if (input.today.allowed_by_person) parts.push(`${input.today.allowed_by_person} allowed by a person`);\n    if (input.openReviews) parts.push(`${input.openReviews} in Review`);\n    rows.push({ label: \"Today\", value: parts.join(\" · \") });\n  }\n  rows.push({\n    label: \"Version\",\n    value: updateAvailable ? `Update available (agent ${input.version.recommendedAgent ?? input.version.agent})`\n      : input.version.policy === \"hold\" ? `agent ${input.version.agent} · updates managed by your workspace`\n      : `Up to date (agent ${input.version.agent})`,\n  });\n\n  const actions: TrayAction[] = [];\n  if (pending > 0 && fix?.id !== \"send_now\" && state !== \"disconnected\") actions.push(ACTIONS.send_now);\n  if (updateAvailable && !input.working) actions.push(ACTIONS.update_now);\n  if (fix?.id !== \"check_now\") actions.push(ACTIONS.check_now);\n  if (input.workspace?.computer_url) actions.push(ACTIONS.open_workspace);\n\n  const where = [input.workspace?.name, input.workspace?.environment].filter(Boolean).join(\" · \");\n  const label = state === \"protected\" ? `Protected${where ? ` · ${where}` : \"\"}` : headline;\n  const tooltip = `Scopebond — ${label}`;\n  return {\n    state, headline, fix, actions, hint, rows,\n    tooltip: tooltip.length > 63 ? `${tooltip.slice(0, 62)}…` : tooltip,\n    recent_blocks: (input.recentBlocks ?? []).slice(0, 3),\n  };\n}\n\n/** What \"Check now\" says afterwards, for five seconds (SB387): never silence. */\nexport function checkResult(selfCheck: { ok: boolean; failed: string[] } | null, error: string | null): string {\n  if (error) return `Check could not finish: ${error}`.slice(0, 200);\n  if (!selfCheck) return \"Checked just now: this computer is not connected to a workspace, so only local checks ran\";\n  return selfCheck.ok ? \"Checked just now: all good\" : `Check found a problem: ${selfCheck.failed[0] ?? \"see status\"}`;\n}\n"]}
+{"version":3,"file":"tray-model.js","sourceRoot":"","sources":["../src/tray-model.ts"],"names":[],"mappings":"AAAA,6HAA6H;AAC7H,8HAA8H;AAC9H,uGAAuG;AAuDvG,MAAM,GAAG,GAAG,MAAM,CAAC;AACnB,MAAM,IAAI,GAAG,EAAE,GAAG,GAAG,CAAC;AACtB,mGAAmG;AACnG,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,GAAG,GAAG,CAAC;AAC7C,qEAAqE;AACrE,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,GAAG,IAAI,CAAC;AAC7C,mEAAmE;AACnE,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,CAAC;AAEnC,wGAAwG;AACxG,MAAM,UAAU,WAAW,CAAC,KAAgC;IAC1D,OAAO,CAAC,CAAC,KAAK,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,yIAAyI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACvM,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,SAAS,CAAC,KAAgC;IACxD,OAAO,CAAC,CAAC,KAAK,IAAI,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACrD,CAAC;AAED,kHAAkH;AAClH,MAAM,UAAU,UAAU,CAAC,KAAgC;IACzD,OAAO,CAAC,CAAC,KAAK,IAAI,2BAA2B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC5D,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,aAAa,CAAC,KAAgC;IAC5D,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpD,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,EAAU,EAAE,GAAW;IACzC,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IACrD,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,UAAU,CAAC;IAC9B,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,GAAG,CAAC,UAAU,CAAC;IAClC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,GAAG,CAAC,QAAQ,CAAC;IAChC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC;AAC1C,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC;IACvB,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;AAC/F,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,IAAmB,EAAE,IAAY,EAAW,EAAE;IAC3D,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;QAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9F,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,MAAM,OAAO,GAAyC;IACpD,QAAQ,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE,QAAQ,EAAE;IACxE,UAAU,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE;IACvE,SAAS,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE;IACnE,MAAM,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE;IAC3D,SAAS,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE;IACxE,cAAc,EAAE,EAAE,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,iBAAiB,EAAE;CAC5F,CAAC;AAEF,MAAM,UAAU,SAAS,CAAC,KAAgB;IACxC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;IACtC,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC1B,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;IAC1B,MAAM,QAAQ,GAAG,CAAC,CAAC,oBAAoB,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAC9F,oFAAoF;IACpF,MAAM,SAAS,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IACrF,MAAM,OAAO,GAAG,CAAC,CAAC,SAAS,IAAI,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACzD,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,eAAe,IAAI,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzG,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,aAAa,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,gBAAgB,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAE3L,IAAI,KAAgB,CAAC;IACrB,IAAI,QAAgB,CAAC;IACrB,IAAI,GAAG,GAAsB,IAAI,CAAC;IAClC,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,KAAK,GAAG,SAAS,CAAC;QAAC,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9C,CAAC;SAAM,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC,wBAAwB,KAAK,IAAI,EAAE,CAAC;QACzE,KAAK,GAAG,cAAc,CAAC;QAAC,QAAQ,GAAG,kEAAkE,CAAC;QACtG,IAAI,KAAK,CAAC,YAAY;YAAE,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC;;YAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IAC3E,CAAC;SAAM,IAAI,OAAO,GAAG,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,GAAG,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;QACrF,sHAAsH;QACtH,KAAK,GAAG,WAAW,CAAC;QAAC,QAAQ,GAAG,4BAA4B,OAAO,UAAU,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC;QAChH,IAAI,GAAG,gJAAgJ,CAAC;QACxJ,GAAG,GAAG,OAAO,CAAC,cAAc,CAAC;IAC/B,CAAC;SAAM,IAAI,OAAO,GAAG,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,GAAG,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;QACtF,gHAAgH;QAChH,KAAK,GAAG,WAAW,CAAC;QAAC,QAAQ,GAAG,oCAAoC,OAAO,UAAU,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC;QACxH,IAAI,GAAG,uNAAuN,CAAC;QAC/N,GAAG,GAAG,OAAO,CAAC,cAAc,CAAC;IAC/B,CAAC;SAAM,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QAClC,KAAK,GAAG,SAAS,CAAC;QAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QAClE,IAAI,MAAM,CAAC,GAAG,EAAE,KAAK,KAAK,SAAS;YAAE,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC;IAC5D,CAAC;SAAM,IAAI,OAAO,EAAE,CAAC;QACnB,KAAK,GAAG,UAAU,GAAG,oBAAoB,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;QACpE,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,0BAA0B,OAAO,UAAU,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,+CAA+C,CAAC;IACvJ,CAAC;SAAM,IAAI,OAAO,GAAG,CAAC,IAAI,SAAS,GAAG,oBAAoB,EAAE,CAAC;QAC3D,KAAK,GAAG,WAAW,CAAC;QAAC,QAAQ,GAAG,GAAG,OAAO,UAAU,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,kBAAkB,CAAC;QAAC,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC;IACzH,CAAC;SAAM,IAAI,MAAM,CAAC,KAAK,KAAK,OAAO,IAAI,MAAM,CAAC,GAAG,EAAE,KAAK,KAAK,WAAW,EAAE,CAAC;QACzE,KAAK,GAAG,WAAW,CAAC;QAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAAC,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC;IAC3E,CAAC;SAAM,IAAI,KAAK,CAAC,KAAK,EAAE,UAAU,IAAI,CAAC,CAAC,SAAS,IAAI,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,GAAG,cAAc,EAAE,CAAC;QACnG,KAAK,GAAG,WAAW,CAAC;QAAC,QAAQ,GAAG,yBAAyB,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;QAAC,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC;IAC3I,CAAC;SAAM,CAAC;QACN,KAAK,GAAG,WAAW,CAAC;QAAC,QAAQ,GAAG,WAAW,CAAC;IAC9C,CAAC;IAED,MAAM,IAAI,GAAsB,EAAE,CAAC;IACnC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,cAAc,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5F,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,iCAAiC,CAAC;QACtF,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;QACnI,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,KAAK,CAAC,UAAU,IAAI,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,GAAG,cAAc,CAAC,CAAC,CAAC,mBAAmB,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,IAAI,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;IACjP,CAAC;IACD,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,OAAO,KAAK,CAAC;YACzB,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC,eAAe,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,qBAAqB,CAAC;YAC3F,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,kBAAkB,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,YAAY;gBAC1F,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,oCAAoC;oBAC1E,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,qCAAqC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG;wBAC7G,CAAC,CAAC,GAAG,OAAO,oBAAoB,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,UAAU,KAAK,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;QACzH,IAAI,KAAK,CAAC,KAAK,CAAC,cAAc;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,cAAc,0BAA0B,CAAC,CAAC;QACpG,IAAI,KAAK,CAAC,KAAK,CAAC,iBAAiB;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,iBAAiB,sBAAsB,CAAC,CAAC;QACtG,IAAI,KAAK,CAAC,WAAW;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,WAAW,YAAY,CAAC,CAAC;QACpE,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,CAAC,IAAI,CAAC;QACR,KAAK,EAAE,SAAS;QAChB,KAAK,EAAE,eAAe,CAAC,CAAC,CAAC,2BAA2B,KAAK,CAAC,OAAO,CAAC,gBAAgB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,GAAG;YAC1G,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,OAAO,CAAC,KAAK,sCAAsC;gBACtG,CAAC,CAAC,qBAAqB,KAAK,CAAC,OAAO,CAAC,KAAK,GAAG;KAChD,CAAC,CAAC;IAEH,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,IAAI,OAAO,GAAG,CAAC,IAAI,GAAG,EAAE,EAAE,KAAK,UAAU,IAAI,KAAK,KAAK,cAAc;QAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACtG,IAAI,eAAe,IAAI,CAAC,KAAK,CAAC,OAAO;QAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACxE,IAAI,GAAG,EAAE,EAAE,KAAK,WAAW;QAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7D,IAAI,KAAK,CAAC,SAAS,EAAE,YAAY;QAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAExE,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChG,MAAM,KAAK,GAAG,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC1F,MAAM,OAAO,GAAG,eAAe,KAAK,EAAE,CAAC;IACvC,OAAO;QACL,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI;QACzC,OAAO,EAAE,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO;QACnE,aAAa,EAAE,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;KACtD,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,WAAW,CAAC,SAAmD,EAAE,KAAoB;IACnG,IAAI,KAAK;QAAE,OAAO,2BAA2B,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACnE,IAAI,CAAC,SAAS;QAAE,OAAO,2FAA2F,CAAC;IACnH,OAAO,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,0BAA0B,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,YAAY,EAAE,CAAC;AACvH,CAAC","sourcesContent":["// What the tray shows, as data (SB387, SB388). The tray (today a PowerShell script, later a native one) only draws this: one\n// state, one headline, the rows that have data, the one fix when something is wrong, and the actions that apply now. It never\n// works out health itself, so the tray, `status` and the workspace's computer page say the same thing.\n\nimport type { StatusJson } from \"@scopebond/hook\";\nimport type { Health } from \"./health.js\";\n\n/** The six icon states of the \"S\" tile (D143): no badge when protected; a badge with its own glyph otherwise. */\nexport type TrayState = \"protected\" | \"working\" | \"offline\" | \"attention\" | \"problem\" | \"disconnected\";\n\nexport interface TrayAction {\n  id: \"send_now\" | \"update_now\" | \"check_now\" | \"repair\" | \"reconnect\" | \"open_workspace\";\n  label: string;\n  /** The agent's local route that does it (POST). */\n  route: string;\n}\n\nexport interface TrayModel {\n  state: TrayState;\n  /** One line at the top, and the tooltip (Windows allows 63 characters in a classic tray tooltip). */\n  headline: string;\n  tooltip: string;\n  /** Rules, Delivery, Today, Version: each only when there is data (never \"unknown\"). */\n  rows: Array<{ label: string; value: string }>;\n  /** The one fix when something is wrong (shown first, in place of the usual actions). */\n  fix: TrayAction | null;\n  /** Actions that apply now, in menu order. */\n  actions: TrayAction[];\n  /** A sign-in or similar step no button can do, in words. */\n  hint: string | null;\n  recent_blocks: RecentBlock[];\n}\n\n/** A recent block. `can_act`: the person may still allow it or ask an admin from the tray (D144); `acted`: what they did. */\nexport interface RecentBlock { action_id: string | null; summary: string; at: string; rule: string | null; can_act?: boolean; acted?: \"allowed\" | \"asked\" | null }\n\nexport interface TrayInput {\n  status: StatusJson;\n  health: Health;\n  now: number;\n  /** When this computer last came back from sleep or started (the agent sees the gap between its cycles). */\n  awakeSince: number;\n  /** A long step the agent is running (an update, a sign-in, a repair), or null. */\n  working: string | null;\n  rules: { checked_at: number | null; managed: boolean; block: number; monitor: number } | null;\n  /** `recorded_after`: out of policy but reported only after it ran (a Cursor edit); never counted as blocked. */\n  today: { actions: number; blocked: number; recorded_after?: number; allowed_by_person: number } | null;\n  recentBlocks?: RecentBlock[];\n  version: { agent: string; hook: string; policy: \"recommended\" | \"hold\" | \"unknown\"; recommendedAgent: string | null; recommendedHook: string | null };\n  workspace: { name: string | null; environment: string | null; computer_url: string | null } | null;\n  computerName: string;\n  /** Items about this computer waiting in the workspace's Review (from the workspace's summary). */\n  openReviews?: number;\n  /** Whether the agent can run the sign-in itself (`POST /reconnect`); until then the tray shows the command. */\n  canReconnect?: boolean;\n}\n\nconst MIN = 60_000;\nconst HOUR = 60 * MIN;\n/** Records waiting this long while the computer is awake and online need attention (D143 §4.1). */\nexport const WAITING_ATTENTION_MS = 15 * MIN;\n/** Offline (the workspace unreachable) this long needs attention. */\nexport const OFFLINE_ATTENTION_MS = 4 * HOUR;\n/** Rules not checked for this long while online need attention. */\nexport const RULES_STALE_MS = HOUR;\n\n/** A delivery error that means the workspace could not be reached (no answer at all), not a refusal. */\nexport function unreachable(error: string | null | undefined): boolean {\n  return !!error && !/HTTP \\d{3}/.test(error) && /fetch failed|ENOTFOUND|ECONNREFUSED|ECONNRESET|ETIMEDOUT|EAI_AGAIN|ENETUNREACH|EHOSTUNREACH|getaddrinfo|network|socket|could not reach/i.test(error);\n}\n\n/** The workspace refused records because it reached its monthly limit (they stay on the computer). */\nexport function overQuota(error: string | null | undefined): boolean {\n  return !!error && /HTTP 429 \\(quota\\)/.test(error);\n}\n\n/** The workspace's plan keeps fewer agents active than it has, and this one is paused (HTTP 402 agent_paused). */\nexport function planPaused(error: string | null | undefined): boolean {\n  return !!error && /HTTP 402 \\(agent_paused\\)/.test(error);\n}\n\n/** The HTTP status of a refusal the workspace answered (not \"unreachable\"), or null. */\nexport function refusedStatus(error: string | null | undefined): number | null {\n  const m = error ? /HTTP (\\d{3})/.exec(error) : null;\n  return m ? Number(m[1]) : null;\n}\n\nexport function ago(at: number, now: number): string {\n  const s = Math.max(0, Math.round((now - at) / 1000));\n  if (s < 60) return \"just now\";\n  const m = Math.round(s / 60);\n  if (m < 60) return `${m} min ago`;\n  const h = Math.round(m / 60);\n  if (h < 36) return `${h} h ago`;\n  return `${Math.round(h / 24)} days ago`;\n}\n\nfunction clock(at: number): string {\n  const d = new Date(at);\n  return `${String(d.getHours()).padStart(2, \"0\")}:${String(d.getMinutes()).padStart(2, \"0\")}`;\n}\n\nconst newer = (want: string | null, have: string): boolean => {\n  if (!want) return false;\n  const a = want.split(\".\").map(Number), b = have.split(\".\").map(Number);\n  for (let i = 0; i < 3; i++) if ((a[i] ?? 0) !== (b[i] ?? 0)) return (a[i] ?? 0) > (b[i] ?? 0);\n  return false;\n};\n\nconst ACTIONS: Record<TrayAction[\"id\"], TrayAction> = {\n  send_now: { id: \"send_now\", label: \"Send records now\", route: \"/flush\" },\n  update_now: { id: \"update_now\", label: \"Update now\", route: \"/update\" },\n  check_now: { id: \"check_now\", label: \"Check now\", route: \"/check\" },\n  repair: { id: \"repair\", label: \"Repair\", route: \"/repair\" },\n  reconnect: { id: \"reconnect\", label: \"Reconnect…\", route: \"/reconnect\" },\n  open_workspace: { id: \"open_workspace\", label: \"Open workspace\", route: \"/open-workspace\" },\n};\n\nexport function trayModel(input: TrayInput): TrayModel {\n  const { status, health, now } = input;\n  const d = status.delivery;\n  const pending = d.pending;\n  const oldestAt = d.oldest_pending_age_s === null ? null : now - d.oldest_pending_age_s * 1000;\n  // Sleep-aware (SB388): time the computer was asleep or off never counts as waiting.\n  const waitingMs = oldestAt === null ? 0 : now - Math.max(oldestAt, input.awakeSince);\n  const offline = d.connected && unreachable(d.last_error);\n  const offlineFor = offline ? now - Math.max(d.last_success_at ?? input.awakeSince, input.awakeSince) : 0;\n  const updateAvailable = input.version.policy === \"recommended\" && (newer(input.version.recommendedAgent, input.version.agent) || newer(input.version.recommendedHook, input.version.hook));\n\n  let state: TrayState;\n  let headline: string;\n  let fix: TrayAction | null = null;\n  let hint: string | null = null;\n  if (input.working) {\n    state = \"working\"; headline = input.working;\n  } else if (health.level === \"red\" && d.connection_refused_since !== null) {\n    state = \"disconnected\"; headline = \"Not connected to your workspace: using this computer's own rules\";\n    if (input.canReconnect) fix = ACTIONS.reconnect; else hint = health.hint;\n  } else if (pending > 0 && overQuota(d.last_error) && health.fix?.route !== \"/repair\") {\n    // Not \"sending\": the workspace refuses them until its limit allows. Nothing is lost; say so, and where it is changed.\n    state = \"attention\"; headline = `Workspace limit reached: ${pending} record${pending === 1 ? \"\" : \"s\"} waiting`;\n    hint = \"Your workspace reached its monthly limit. Records stay on this computer and send once the limit allows; a workspace owner can change the plan.\";\n    fix = ACTIONS.open_workspace;\n  } else if (pending > 0 && planPaused(d.last_error) && health.fix?.route !== \"/repair\") {\n    // Not a delivery problem to retry: the plan paused this agent. Sending again changes nothing; an owner decides.\n    state = \"attention\"; headline = `Paused by your workspace's plan: ${pending} record${pending === 1 ? \"\" : \"s\"} waiting`;\n    hint = \"Your workspace's plan keeps fewer agents active than it has, and this one is paused. This computer keeps checking actions and keeps its records; they send once an owner keeps this agent active or changes the plan.\";\n    fix = ACTIONS.open_workspace;\n  } else if (health.level === \"red\") {\n    state = \"problem\"; headline = health.headline; hint = health.hint;\n    if (health.fix?.route === \"/repair\") fix = ACTIONS.repair;\n  } else if (offline) {\n    state = offlineFor > OFFLINE_ATTENTION_MS ? \"attention\" : \"offline\";\n    headline = pending ? `Workspace unreachable: ${pending} record${pending === 1 ? \"\" : \"s\"} waiting` : \"Workspace unreachable: still checking actions\";\n  } else if (pending > 0 && waitingMs > WAITING_ATTENTION_MS) {\n    state = \"attention\"; headline = `${pending} record${pending === 1 ? \"\" : \"s\"} waiting to send`; fix = ACTIONS.send_now;\n  } else if (health.level === \"amber\" && health.fix?.route === \"/maintain\") {\n    state = \"attention\"; headline = health.headline; fix = ACTIONS.check_now;\n  } else if (input.rules?.checked_at && d.connected && now - input.rules.checked_at > RULES_STALE_MS) {\n    state = \"attention\"; headline = `Rules not checked for ${ago(input.rules.checked_at, now).replace(\" ago\", \"\")}`; fix = ACTIONS.check_now;\n  } else {\n    state = \"protected\"; headline = \"Protected\";\n  }\n\n  const rows: TrayModel[\"rows\"] = [];\n  if (input.rules) {\n    const when = input.rules.checked_at ? ` · checked ${ago(input.rules.checked_at, now)}` : \"\";\n    const source = input.rules.managed ? \"Up to date\" : \"Using this computer's own rules\";\n    const counts = input.rules.block + input.rules.monitor > 0 ? ` · ${input.rules.block} block · ${input.rules.monitor} monitor` : \"\";\n    rows.push({ label: \"Rules\", value: `${input.rules.managed && input.rules.checked_at && now - input.rules.checked_at > RULES_STALE_MS ? `Not checked for ${ago(input.rules.checked_at, now).replace(\" ago\", \"\")}` : source}${when}${counts}` });\n  }\n  if (d.connected) {\n    const value = pending === 0\n      ? (d.last_success_at ? `All sent · ${ago(d.last_success_at, now)}` : \"Nothing to send yet\")\n      : offline ? `${pending} waiting since ${oldestAt ? clock(oldestAt) : \"earlier\"} · offline`\n      : overQuota(d.last_error) ? `${pending} waiting · workspace limit reached`\n      : refusedStatus(d.last_error) ? `${pending} waiting · last try refused (HTTP ${refusedStatus(d.last_error)})`\n      : `${pending} waiting · sending`;\n    rows.push({ label: \"Delivery\", value });\n  }\n  if (input.today) {\n    const parts = [`${input.today.actions} action${input.today.actions === 1 ? \"\" : \"s\"}`, `${input.today.blocked} blocked`];\n    if (input.today.recorded_after) parts.push(`${input.today.recorded_after} recorded, not prevented`);\n    if (input.today.allowed_by_person) parts.push(`${input.today.allowed_by_person} allowed by a person`);\n    if (input.openReviews) parts.push(`${input.openReviews} in Review`);\n    rows.push({ label: \"Today\", value: parts.join(\" · \") });\n  }\n  rows.push({\n    label: \"Version\",\n    value: updateAvailable ? `Update available (agent ${input.version.recommendedAgent ?? input.version.agent})`\n      : input.version.policy === \"hold\" ? `agent ${input.version.agent} · updates managed by your workspace`\n      : `Up to date (agent ${input.version.agent})`,\n  });\n\n  const actions: TrayAction[] = [];\n  if (pending > 0 && fix?.id !== \"send_now\" && state !== \"disconnected\") actions.push(ACTIONS.send_now);\n  if (updateAvailable && !input.working) actions.push(ACTIONS.update_now);\n  if (fix?.id !== \"check_now\") actions.push(ACTIONS.check_now);\n  if (input.workspace?.computer_url) actions.push(ACTIONS.open_workspace);\n\n  const where = [input.workspace?.name, input.workspace?.environment].filter(Boolean).join(\" · \");\n  const label = state === \"protected\" ? `Protected${where ? ` · ${where}` : \"\"}` : headline;\n  const tooltip = `Scopebond — ${label}`;\n  return {\n    state, headline, fix, actions, hint, rows,\n    tooltip: tooltip.length > 63 ? `${tooltip.slice(0, 62)}…` : tooltip,\n    recent_blocks: (input.recentBlocks ?? []).slice(0, 3),\n  };\n}\n\n/** What \"Check now\" says afterwards, for five seconds (SB387): never silence. */\nexport function checkResult(selfCheck: { ok: boolean; failed: string[] } | null, error: string | null): string {\n  if (error) return `Check could not finish: ${error}`.slice(0, 200);\n  if (!selfCheck) return \"Checked just now: this computer is not connected to a workspace, so only local checks ran\";\n  return selfCheck.ok ? \"Checked just now: all good\" : `Check found a problem: ${selfCheck.failed[0] ?? \"see status\"}`;\n}\n"]}

package/dist/update.d.ts

@@ -1,33 +1,77 @@
 import { type Harness, type HookConnection } from "@scopebond/hook";
+/** The largest answer to /v1/client-version the agent reads. */
+export declare const CLIENT_VERSION_MAX_BYTES = 4096;
+/** The only registry the agent installs from. */
+export declare const NPM_REGISTRY = "https://registry.npmjs.org/";
+/** The repository and branch an installed agent's npm provenance must name. */
+export declare const PROVENANCE_REPOSITORY = "https://github.com/avouro-com/scopebond";
+export declare const PROVENANCE_REF = "refs/heads/main";
 export declare function agentVersion(): string;
+export declare const isVersion: (v: unknown) => v is string;
 export interface ClientVersion {
     policy: "recommended" | "hold";
     hook: string | null;
     agent: string | null;
 }
-export declare function fetchClientVersion(connection: Pick<HookConnection, "url" | "credential">, fetchImpl?: typeof fetch, timeoutMs?: number): Promise<ClientVersion | null>;
+/** The versions the workspace names for this computer, or null when there is no usable answer. Anything unexpected — an
+ *  answer over the size limit, not an object, a policy other than "recommended" or "hold", a version that is not a strict
+ *  x.y.z or is more than one major version ahead — refuses the whole answer, so nothing changes. */
+export declare function fetchClientVersion(connection: Pick<HookConnection, "url" | "credential">, fetchImpl?: typeof fetch, timeoutMs?: number, running?: {
+    agent: string;
+    hook: string;
+}): Promise<ClientVersion | null>;
 /** Compare x.y.z versions: negative when a < b. */
 export declare function compareVersions(a: string, b: string): number;
 /** The hook version a settings command runs, when it names one (an `npx` pin or a pinned copy). */
 export declare function commandHookVersion(command: string): string | null;
-/** The command an agent-maintained settings entry runs: the hook version this agent carries,
- *  through npx, so it resolves Node at run time and an agent update never swaps files under it. */
-/** The hook command upkeep writes. The hook this agent carries is pinned by its absolute path (fast,
- *  and it needs neither the registry nor npx on the coding tool's PATH); another version, or a pin that
- *  cannot be made, falls back to the portable npx form. */
-export declare function maintainedHookCommand(harness: Harness, version?: string): string;
+/** The hook command upkeep writes: always the hook this agent carries, by its absolute path (a durable pinned copy when the
+ *  carried one lives somewhere npm may clear). Never an `npx` form, which would resolve a package from the registry each
+ *  time the coding tool runs it. */
+export declare function maintainedHookCommand(harness: Harness): string;
 /** This Node's own npm, run directly (no shell, and never another Node's npm first on PATH), or null. */
 export declare function ownNpm(): [string, string[]] | null;
-/** Bring the user-level Scopebond hook entries to `version`, and repair any that cannot start.
- *  Entries of other tools are never touched. Returns the files changed. */
-export declare function maintainHookEntries(harnesses: Harness[], version?: string, moveVersions?: boolean): Array<{
+/** Bring the user-level Scopebond hook entries to the hook this agent carries, and repair any that cannot start. Under
+ *  "recommended" (`moveVersions`) an entry naming an older hook, or any `npx` entry, is pinned to the carried hook; under
+ *  "hold" only broken entries and `npx` entries that name no version or the carried one are (their version does not
+ *  change). Entries of other tools are never touched. Returns the files changed. */
+export declare function maintainHookEntries(harnesses: Harness[], moveVersions?: boolean): Array<{
     harness: Harness;
     file: string;
     reason: string;
 }>;
-/** Install `@scopebond/agent@version` globally with this computer's npm. */
-export declare function installAgent(version: string, timeoutMs?: number): Promise<{
+/** npm's arguments for a global install of `spec`: package scripts off, the public registry pinned (also for the
+ *  @scopebond scope, which a scope registry setting would otherwise take over). */
+export declare function npmInstallArgs(spec: string): string[];
+/** The environment npm runs with: this process's, without settings that would change the registry or turn scripts back on. */
+export declare function npmEnvironment(env?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+export type ProvenanceResult = {
+    ok: true;
+} | {
+    ok: false;
+    reason: string;
+};
+/** Check, before installing, that npm's provenance for exactly `@scopebond/agent@version` says it was built by this
+ *  repository's main branch, for the tarball the registry serves. The statement is the one the registry verified when the
+ *  package was published; it is read here, not re-verified against Sigstore. */
+export declare function checkProvenance(version: string, fetchImpl?: typeof fetch, timeoutMs?: number): Promise<ProvenanceResult>;
+/** Install `@scopebond/agent@version` globally with this computer's npm: provenance checked first (unless `provenance` is
+ *  false, for going back to the version already running), package scripts off, the public registry pinned. */
+export declare function installAgent(version: string, o?: {
+    timeoutMs?: number;
+    fetchImpl?: typeof fetch;
+    provenance?: boolean;
+}): Promise<{
+    ok: boolean;
+    output: string;
+}>;
+/** Run the agent program now on disk (`version`) and confirm it starts and reports `version`. */
+export declare function startCheck(version: string, cli?: string, timeoutMs?: number): Promise<{
     ok: boolean;
     output: string;
 }>;
+/** A version that was installed but did not start, kept so it is not installed again for a while. */
+export declare const FAILED_UPDATE_FILE = "update-failed.json";
+export declare const FAILED_UPDATE_RETRY_MS: number;
+export declare function recordFailedUpdate(dir: string, version: string, now?: number): void;
+export declare function recentlyFailedUpdate(dir: string, version: string, now?: number): boolean;
 //# sourceMappingURL=update.d.ts.map

package/dist/update.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../src/update.ts"],"names":[],"mappings":"AAQA,OAAO,EAEmD,KAAK,OAAO,EAAE,KAAK,cAAc,EAC1F,MAAM,iBAAiB,CAAC;AAOzB,wBAAgB,YAAY,IAAI,MAAM,CAMrC;AAED,MAAM,WAAW,aAAa;IAAG,MAAM,EAAE,aAAa,GAAG,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE;AAE5G,wBAAsB,kBAAkB,CAAC,UAAU,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,GAAG,YAAY,CAAC,EAAE,SAAS,GAAE,OAAO,KAAa,EAAE,SAAS,SAAS,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAUnL;AAED,mDAAmD;AACnD,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAI5D;AAED,mGAAmG;AACnG,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAIjE;AAED;mGACmG;AACnG;;2DAE2D;AAC3D,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,SAAgB,GAAG,MAAM,CAUvF;AAED,yGAAyG;AACzG,wBAAgB,MAAM,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,CAGlD;AAED;2EAC2E;AAC3E,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,OAAO,SAAgB,EAAE,YAAY,UAAO,GAAG,KAAK,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAajK;AAED,4EAA4E;AAC5E,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,SAAa,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAgB9G"}
+{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../src/update.ts"],"names":[],"mappings":"AAYA,OAAO,EAEmD,KAAK,OAAO,EAAE,KAAK,cAAc,EAC1F,MAAM,iBAAiB,CAAC;AAKzB,gEAAgE;AAChE,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAC7C,iDAAiD;AACjD,eAAO,MAAM,YAAY,gCAAgC,CAAC;AAC1D,+EAA+E;AAC/E,eAAO,MAAM,qBAAqB,4CAA4C,CAAC;AAC/E,eAAO,MAAM,cAAc,oBAAoB,CAAC;AAKhD,wBAAgB,YAAY,IAAI,MAAM,CAMrC;AAED,eAAO,MAAM,SAAS,GAAI,GAAG,OAAO,KAAG,CAAC,IAAI,MAAkD,CAAC;AAE/F,MAAM,WAAW,aAAa;IAAG,MAAM,EAAE,aAAa,GAAG,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE;AA2B5G;;oGAEoG;AACpG,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,GAAG,YAAY,CAAC,EAAE,SAAS,GAAE,OAAO,KAAa,EAAE,SAAS,SAAS,EAC3G,OAAO,GAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAmD,GACxF,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAoB/B;AAED,mDAAmD;AACnD,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAI5D;AAED,mGAAmG;AACnG,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAIjE;AAID;;oCAEoC;AACpC,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAS9D;AAED,yGAAyG;AACzG,wBAAgB,MAAM,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,CAGlD;AAED;;;oFAGoF;AACpF,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,YAAY,UAAO,GAAG,KAAK,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAexI;AAED;mFACmF;AACnF,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAErD;AAED,8HAA8H;AAC9H,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAAC,UAAU,CAQtF;AAED,MAAM,MAAM,gBAAgB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5E;;gFAEgF;AAChF,wBAAsB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,GAAE,OAAO,KAAa,EAAE,SAAS,SAAS,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA+BrI;AAED;8GAC8G;AAC9G,wBAAsB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAsB5K;AAED,iGAAiG;AACjG,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,SAAiB,EAAE,SAAS,SAAS,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAgB9H;AAED,qGAAqG;AACrG,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AACvD,eAAO,MAAM,sBAAsB,QAAsB,CAAC;AAE1D,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,SAAa,GAAG,IAAI,CAEvF;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,SAAa,GAAG,OAAO,CAK5F"}

package/dist/update.js

@@ -1,12 +1,25 @@
-// Updates under the workspace's control (D130). The agent asks the workspace which versions this
-// computer should run; with "recommended" it installs the named agent from npm (which brings the
-// matching hook, pinned exactly) and restarts; with "hold" it changes nothing. The hook entries in
-// the agent settings are moved to the hook version the agent carries.
+// Updates under the workspace's control. The agent asks the workspace which versions this computer should run; with
+// "recommended" it installs the named agent from npm (which brings the matching hook, pinned exactly) and restarts; with
+// "hold" it changes nothing. The hook entries in the agent settings are pinned to the hook version the agent carries.
+//
+// The npm path is hardened: the workspace's answer is bounded (size, strict x.y.z, no more than one major version ahead),
+// the exact version must carry npm provenance from this repository's main branch, npm runs with package scripts off and
+// the public registry pinned, the new program must start and report the version before the old one hands over, and a
+// version that did not start is rolled back and not retried for a day.
 import { spawn } from "node:child_process";
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { absoluteHookCommand, configuredHookCommands, ensureDurableRuntime, hookCliPath, hookCommandResolves, hookVersion, isScopebondHookCommand, isSingleExecutable, nativeHookCommand, userHarnessFile, writeHarnessConfig, } from "@scopebond/hook";
-const VERSION = /^[0-9]+\.[0-9]+\.[0-9]+$/;
+import { agentCliPath } from "./self.js";
+/** x.y.z with no leading zeros, no tags, and each part of a sane size. */
+const VERSION = /^(0|[1-9][0-9]{0,3})\.(0|[1-9][0-9]{0,3})\.(0|[1-9][0-9]{0,5})$/;
+/** The largest answer to /v1/client-version the agent reads. */
+export const CLIENT_VERSION_MAX_BYTES = 4096;
+/** The only registry the agent installs from. */
+export const NPM_REGISTRY = "https://registry.npmjs.org/";
+/** The repository and branch an installed agent's npm provenance must name. */
+export const PROVENANCE_REPOSITORY = "https://github.com/avouro-com/scopebond";
+export const PROVENANCE_REF = "refs/heads/main";
 export function agentVersion() {
     if (typeof __SCOPEBOND_AGENT_VERSION__ === "string")
         return __SCOPEBOND_AGENT_VERSION__;
@@ -18,16 +31,64 @@ export function agentVersion() {
         return "0.0.0";
     }
 }
-export async function fetchClientVersion(connection, fetchImpl = fetch, timeoutMs = 10_000) {
+export const isVersion = (v) => typeof v === "string" && VERSION.test(v);
+/** A response body as text, or null when it is larger than `max` bytes. */
+async function boundedText(res, max) {
+    const declared = Number(res.headers.get("content-length"));
+    if (Number.isFinite(declared) && declared > max)
+        return null;
+    if (!res.body)
+        return "";
+    const reader = res.body.getReader();
+    const chunks = [];
+    let size = 0;
+    for (;;) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        size += value.byteLength;
+        if (size > max) {
+            void reader.cancel().catch(() => { });
+            return null;
+        }
+        chunks.push(value);
+    }
+    return Buffer.concat(chunks).toString("utf8");
+}
+/** Whether `named` is a version this computer may be moved to from `running`: well formed and at most one major ahead. */
+function inRange(named, running) {
+    const major = Number(named.split(".")[0]);
+    const current = Number((isVersion(running) ? running : "0.0.0").split(".")[0]);
+    return major <= current + 1;
+}
+/** The versions the workspace names for this computer, or null when there is no usable answer. Anything unexpected — an
+ *  answer over the size limit, not an object, a policy other than "recommended" or "hold", a version that is not a strict
+ *  x.y.z or is more than one major version ahead — refuses the whole answer, so nothing changes. */
+export async function fetchClientVersion(connection, fetchImpl = fetch, timeoutMs = 10_000, running = { agent: agentVersion(), hook: hookVersion() }) {
     try {
         const res = await fetchImpl(new URL("/v1/client-version", connection.url).toString(), {
             headers: { authorization: `Bearer ${connection.credential}` }, redirect: "error", signal: AbortSignal.timeout(timeoutMs),
         });
         if (!res.ok)
             return null;
-        const body = await res.json();
-        const ok = (v) => typeof v === "string" && VERSION.test(v) ? v : null;
-        return { policy: body.policy === "hold" ? "hold" : "recommended", hook: ok(body.hook), agent: ok(body.agent) };
+        const text = await boundedText(res, CLIENT_VERSION_MAX_BYTES);
+        if (text === null)
+            return null;
+        const body = JSON.parse(text);
+        if (!body || typeof body !== "object" || Array.isArray(body))
+            return null;
+        const { policy, hook, agent } = body;
+        if (policy !== "recommended" && policy !== "hold")
+            return null;
+        const version = (v, current) => {
+            if (v === null || v === undefined)
+                return null;
+            return isVersion(v) && inRange(v, current) ? v : undefined;
+        };
+        const h = version(hook, running.hook), a = version(agent, running.agent);
+        if (h === undefined || a === undefined)
+            return null;
+        return { policy, hook: h, agent: a };
     }
     catch {
         return null;
@@ -47,59 +108,131 @@ export function commandHookVersion(command) {
         ?? /[\\/]runtime[\\/]([0-9]+\.[0-9]+\.[0-9]+)[\\/]/.exec(command)?.[1]
         ?? null;
 }
-/** The command an agent-maintained settings entry runs: the hook version this agent carries,
- *  through npx, so it resolves Node at run time and an agent update never swaps files under it. */
-/** The hook command upkeep writes. The hook this agent carries is pinned by its absolute path (fast,
- *  and it needs neither the registry nor npx on the coding tool's PATH); another version, or a pin that
- *  cannot be made, falls back to the portable npx form. */
-export function maintainedHookCommand(harness, version = hookVersion()) {
+const isNpxCommand = (command) => /(^|\s)npx(\.cmd)?\s/.test(command);
+/** The hook command upkeep writes: always the hook this agent carries, by its absolute path (a durable pinned copy when the
+ *  carried one lives somewhere npm may clear). Never an `npx` form, which would resolve a package from the registry each
+ *  time the coding tool runs it. */
+export function maintainedHookCommand(harness) {
     // The single executable carries its own hook, at the path the installer keeps.
     if (isSingleExecutable())
         return nativeHookCommand(harness);
-    if (version === hookVersion()) {
-        try {
-            const pin = ensureDurableRuntime(hookCliPath(), version);
-            if (pin.cli)
-                return absoluteHookCommand(pin.cli, harness);
-        }
-        catch { /* fall back below */ }
+    const cli = hookCliPath();
+    try {
+        const pin = ensureDurableRuntime(cli, hookVersion());
+        if (pin.cli)
+            return absoluteHookCommand(pin.cli, harness);
     }
-    return `npx -y @scopebond/hook@${version} ${harness}`;
+    catch { /* the carried hook's own path below */ }
+    return absoluteHookCommand(cli, harness);
 }
 /** This Node's own npm, run directly (no shell, and never another Node's npm first on PATH), or null. */
 export function ownNpm() {
     const cli = join(dirname(process.execPath), process.platform === "win32" ? "" : "../lib", "node_modules", "npm", "bin", "npm-cli.js");
     return existsSync(cli) ? [process.execPath, [cli]] : null;
 }
-/** Bring the user-level Scopebond hook entries to `version`, and repair any that cannot start.
- *  Entries of other tools are never touched. Returns the files changed. */
-export function maintainHookEntries(harnesses, version = hookVersion(), moveVersions = true) {
+/** Bring the user-level Scopebond hook entries to the hook this agent carries, and repair any that cannot start. Under
+ *  "recommended" (`moveVersions`) an entry naming an older hook, or any `npx` entry, is pinned to the carried hook; under
+ *  "hold" only broken entries and `npx` entries that name no version or the carried one are (their version does not
+ *  change). Entries of other tools are never touched. Returns the files changed. */
+export function maintainHookEntries(harnesses, moveVersions = true) {
+    const carried = hookVersion();
     const changed = [];
     for (const harness of harnesses) {
         const file = userHarnessFile(harness);
         const ours = configuredHookCommands(file).filter((c) => isScopebondHookCommand(c));
         if (!ours.length)
             continue;
-        const broken = ours.some((c) => !hookCommandResolves(c));
-        const behind = moveVersions && ours.some((c) => { const v = commandHookVersion(c); return v !== null && compareVersions(v, version) < 0; });
-        if (!broken && !behind)
+        const broken = ours.some((c) => !isNpxCommand(c) && !hookCommandResolves(c));
+        const npx = ours.some((c) => { if (!isNpxCommand(c))
+            return false; const v = commandHookVersion(c); return moveVersions || v === null || v === carried; });
+        const behind = moveVersions && ours.some((c) => { const v = commandHookVersion(c); return v !== null && compareVersions(v, carried) < 0; });
+        if (!broken && !npx && !behind)
             continue;
-        writeHarnessConfig(file, harness, maintainedHookCommand(harness, version));
-        changed.push({ harness, file, reason: broken ? "the hook command could not start" : `moved to hook ${version}` });
+        writeHarnessConfig(file, harness, maintainedHookCommand(harness));
+        changed.push({ harness, file, reason: broken ? "the hook command could not start" : npx ? `pinned to the hook this agent carries (${carried})` : `moved to hook ${carried}` });
     }
     return changed;
 }
-/** Install `@scopebond/agent@version` globally with this computer's npm. */
-export function installAgent(version, timeoutMs = 5 * 60_000) {
-    if (!VERSION.test(version))
-        return Promise.resolve({ ok: false, output: "not a version" });
+/** npm's arguments for a global install of `spec`: package scripts off, the public registry pinned (also for the
+ *  @scopebond scope, which a scope registry setting would otherwise take over). */
+export function npmInstallArgs(spec) {
+    return ["install", "-g", spec, "--ignore-scripts", `--registry=${NPM_REGISTRY}`, `--@scopebond:registry=${NPM_REGISTRY}`, "--no-fund", "--no-audit"];
+}
+/** The environment npm runs with: this process's, without settings that would change the registry or turn scripts back on. */
+export function npmEnvironment(env = process.env) {
+    const out = {};
+    for (const [key, value] of Object.entries(env)) {
+        const k = key.toLowerCase();
+        if (k.startsWith("npm_config_") && (k.endsWith("registry") || k.includes("ignore_scripts") || k.includes("ignore-scripts") || k.includes("script_shell") || k.includes("script-shell")))
+            continue;
+        out[key] = value;
+    }
+    return out;
+}
+/** Check, before installing, that npm's provenance for exactly `@scopebond/agent@version` says it was built by this
+ *  repository's main branch, for the tarball the registry serves. The statement is the one the registry verified when the
+ *  package was published; it is read here, not re-verified against Sigstore. */
+export async function checkProvenance(version, fetchImpl = fetch, timeoutMs = 30_000) {
+    const get = async (url, max) => {
+        const res = await fetchImpl(url, { redirect: "error", signal: AbortSignal.timeout(timeoutMs), headers: { accept: "application/json" } });
+        if (!res.ok)
+            throw new Error(`${res.status}`);
+        const text = await boundedText(res, max);
+        if (text === null)
+            throw new Error("too large");
+        return JSON.parse(text);
+    };
+    try {
+        const meta = await get(`${NPM_REGISTRY}@scopebond%2fagent/${version}`, 512 * 1024);
+        if (meta?.version !== version)
+            return { ok: false, reason: "the registry did not describe this version" };
+        const integrity = meta.dist?.integrity ?? "";
+        const att = meta.dist?.attestations;
+        if (!att?.url || !att.provenance?.predicateType?.startsWith("https://slsa.dev/provenance/"))
+            return { ok: false, reason: "this version has no npm provenance" };
+        if (!integrity.startsWith("sha512-"))
+            return { ok: false, reason: "this version has no sha512 integrity" };
+        const want = Buffer.from(integrity.slice("sha512-".length), "base64").toString("hex");
+        if (!att.url.startsWith(`${NPM_REGISTRY}-/npm/v1/attestations/`))
+            return { ok: false, reason: "the provenance is not on the registry" };
+        const bundle = await get(att.url, 1024 * 1024);
+        const slsa = bundle?.attestations?.find((a) => a.predicateType?.startsWith("https://slsa.dev/provenance/"));
+        if (!slsa?.bundle?.dsseEnvelope?.payload)
+            return { ok: false, reason: "this version has no npm provenance" };
+        const statement = JSON.parse(Buffer.from(slsa.bundle.dsseEnvelope.payload, "base64").toString("utf8"));
+        const subject = statement.subject?.find((s) => s.name === `pkg:npm/%40scopebond/agent@${version}`);
+        if (!subject || subject.digest?.sha512 !== want)
+            return { ok: false, reason: "the provenance is for another tarball" };
+        const workflow = statement.predicate?.buildDefinition?.externalParameters?.workflow;
+        if (workflow?.repository !== PROVENANCE_REPOSITORY)
+            return { ok: false, reason: `the provenance names ${workflow?.repository ?? "no repository"}, not ${PROVENANCE_REPOSITORY}` };
+        if (workflow.ref !== PROVENANCE_REF)
+            return { ok: false, reason: `the provenance names ${workflow.ref ?? "no branch"}, not ${PROVENANCE_REF}` };
+        return { ok: true };
+    }
+    catch (error) {
+        return { ok: false, reason: `the registry could not be asked (${error.message.slice(0, 80)})` };
+    }
+}
+/** Install `@scopebond/agent@version` globally with this computer's npm: provenance checked first (unless `provenance` is
+ *  false, for going back to the version already running), package scripts off, the public registry pinned. */
+export async function installAgent(version, o = {}) {
+    if (!isVersion(version))
+        return { ok: false, output: "not a version" };
+    if (o.provenance !== false) {
+        const checked = await checkProvenance(version, o.fetchImpl);
+        if (!checked.ok)
+            return { ok: false, output: `npm provenance check failed: ${checked.reason}; nothing was installed` };
+    }
+    const timeoutMs = o.timeoutMs ?? 5 * 60_000;
     return new Promise((resolve) => {
         const win = process.platform === "win32";
-        const args = ["install", "-g", `@scopebond/agent@${version}`, "--no-fund", "--no-audit"];
+        const args = npmInstallArgs(`@scopebond/agent@${version}`);
+        const env = npmEnvironment();
         // This Node's own npm when it can be found; otherwise npm on PATH (a .cmd on Windows, which Node only
         // starts through a shell; the arguments are fixed and the version is validated).
         const own = ownNpm();
-        const child = own ? spawn(own[0], [...own[1], ...args], { windowsHide: true }) : spawn(win ? "npm.cmd" : "npm", args, { shell: win, windowsHide: true });
+        const child = own ? spawn(own[0], [...own[1], ...args], { windowsHide: true, env }) : spawn(win ? "npm.cmd" : "npm", args, { shell: win, windowsHide: true, env });
         let output = "";
         child.stdout?.on("data", (d) => { output += d; });
         child.stderr?.on("data", (d) => { output += d; });
@@ -108,4 +241,42 @@ export function installAgent(version, timeoutMs = 5 * 60_000) {
         child.on("close", (code) => { clearTimeout(timer); resolve({ ok: code === 0, output: output.slice(-2000) }); });
     });
 }
+/** Run the agent program now on disk (`version`) and confirm it starts and reports `version`. */
+export function startCheck(version, cli = agentCliPath(), timeoutMs = 60_000) {
+    return new Promise((resolve) => {
+        const child = spawn(process.execPath, ["--disable-warning=ExperimentalWarning", cli, "version"], {
+            windowsHide: true, stdio: ["ignore", "pipe", "pipe"], env: { ...process.env, SCOPEBOND_AGENT_TRAY: "off" },
+        });
+        let output = "";
+        child.stdout?.on("data", (d) => { if (output.length < 4096)
+            output += d; });
+        child.stderr?.on("data", (d) => { if (output.length < 4096)
+            output += d; });
+        const timer = setTimeout(() => { child.kill(); resolve({ ok: false, output: `${output}\ntimed out` }); }, timeoutMs);
+        child.on("error", (error) => { clearTimeout(timer); resolve({ ok: false, output: String(error) }); });
+        child.on("close", (code) => {
+            clearTimeout(timer);
+            const first = output.trim().split(/\r?\n/)[0] ?? "";
+            resolve({ ok: code === 0 && first.split(/\s+/)[0] === `agent/${version}`, output: output.trim().slice(-500) });
+        });
+    });
+}
+/** A version that was installed but did not start, kept so it is not installed again for a while. */
+export const FAILED_UPDATE_FILE = "update-failed.json";
+export const FAILED_UPDATE_RETRY_MS = 24 * 60 * 60 * 1000;
+export function recordFailedUpdate(dir, version, now = Date.now()) {
+    try {
+        writeFileSync(join(dir, FAILED_UPDATE_FILE), `${JSON.stringify({ version, at: now })}\n`, { mode: 0o600 });
+    }
+    catch { /* best effort */ }
+}
+export function recentlyFailedUpdate(dir, version, now = Date.now()) {
+    try {
+        const r = JSON.parse(readFileSync(join(dir, FAILED_UPDATE_FILE), "utf8"));
+        return r.version === version && typeof r.at === "number" && now - r.at >= 0 && now - r.at < FAILED_UPDATE_RETRY_MS;
+    }
+    catch {
+        return false;
+    }
+}
 //# sourceMappingURL=update.js.map