@slayzone/computer 0.36.0-beta.18 → 0.36.0-beta.19

package/dist/bin.cjs

@@ -85,103 +85,6 @@ var init_dirs = __esm({
   }
 });
 
-// ../../../node_modules/ws/lib/stream.js
-var require_stream = __commonJS({
-  "../../../node_modules/ws/lib/stream.js"(exports2, module2) {
-    "use strict";
-    var { Duplex } = require("stream");
-    function emitClose(stream) {
-      stream.emit("close");
-    }
-    function duplexOnEnd() {
-      if (!this.destroyed && this._writableState.finished) {
-        this.destroy();
-      }
-    }
-    function duplexOnError(err) {
-      this.removeListener("error", duplexOnError);
-      this.destroy();
-      if (this.listenerCount("error") === 0) {
-        this.emit("error", err);
-      }
-    }
-    function createWebSocketStream2(ws, options) {
-      let terminateOnDestroy = true;
-      const duplex = new Duplex({
-        ...options,
-        autoDestroy: false,
-        emitClose: false,
-        objectMode: false,
-        writableObjectMode: false
-      });
-      ws.on("message", function message(msg, isBinary) {
-        const data = !isBinary && duplex._readableState.objectMode ? msg.toString() : msg;
-        if (!duplex.push(data)) ws.pause();
-      });
-      ws.once("error", function error48(err) {
-        if (duplex.destroyed) return;
-        terminateOnDestroy = false;
-        duplex.destroy(err);
-      });
-      ws.once("close", function close() {
-        if (duplex.destroyed) return;
-        duplex.push(null);
-      });
-      duplex._destroy = function(err, callback) {
-        if (ws.readyState === ws.CLOSED) {
-          callback(err);
-          process.nextTick(emitClose, duplex);
-          return;
-        }
-        let called = false;
-        ws.once("error", function error48(err2) {
-          called = true;
-          callback(err2);
-        });
-        ws.once("close", function close() {
-          if (!called) callback(err);
-          process.nextTick(emitClose, duplex);
-        });
-        if (terminateOnDestroy) ws.terminate();
-      };
-      duplex._final = function(callback) {
-        if (ws.readyState === ws.CONNECTING) {
-          ws.once("open", function open2() {
-            duplex._final(callback);
-          });
-          return;
-        }
-        if (ws._socket === null) return;
-        if (ws._socket._writableState.finished) {
-          callback();
-          if (duplex._readableState.endEmitted) duplex.destroy();
-        } else {
-          ws._socket.once("finish", function finish() {
-            callback();
-          });
-          ws.close();
-        }
-      };
-      duplex._read = function() {
-        if (ws.isPaused) ws.resume();
-      };
-      duplex._write = function(chunk, encoding, callback) {
-        if (ws.readyState === ws.CONNECTING) {
-          ws.once("open", function open2() {
-            duplex._write(chunk, encoding, callback);
-          });
-          return;
-        }
-        ws.send(chunk, callback);
-      };
-      duplex.on("end", duplexOnEnd);
-      duplex.on("error", duplexOnError);
-      return duplex;
-    }
-    module2.exports = createWebSocketStream2;
-  }
-});
-
 // ../../../node_modules/ws/lib/constants.js
 var require_constants = __commonJS({
   "../../../node_modules/ws/lib/constants.js"(exports2, module2) {
@@ -191,6 +94,7 @@ var require_constants = __commonJS({
     if (hasBlob) BINARY_TYPES.push("blob");
     module2.exports = {
       BINARY_TYPES,
+      CLOSE_TIMEOUT: 3e4,
       EMPTY_BUFFER: Buffer.alloc(0),
       GUID: "258EAFA5-E914-47DA-95CA-C5AB0DC85B11",
       hasBlob,
@@ -345,7 +249,7 @@ var require_permessage_deflate = __commonJS({
     var kBuffers = Symbol("buffers");
     var kError = Symbol("error");
     var zlibLimiter;
-    var PerMessageDeflate = class {
+    var PerMessageDeflate2 = class {
       /**
        * Creates a PerMessageDeflate instance.
        *
@@ -356,6 +260,9 @@ var require_permessage_deflate = __commonJS({
        *     acknowledge disabling of client context takeover
        * @param {Number} [options.concurrencyLimit=10] The number of concurrent
        *     calls to zlib
+       * @param {Boolean} [options.isServer=false] Create the instance in either
+       *     server or client mode
+       * @param {Number} [options.maxPayload=0] The maximum allowed message length
        * @param {(Boolean|Number)} [options.serverMaxWindowBits] Request/confirm the
        *     use of a custom server window size
        * @param {Boolean} [options.serverNoContextTakeover=false] Request/accept
@@ -366,15 +273,12 @@ var require_permessage_deflate = __commonJS({
        *     deflate
        * @param {Object} [options.zlibInflateOptions] Options to pass to zlib on
        *     inflate
-       * @param {Boolean} [isServer=false] Create the instance in either server or
-       *     client mode
-       * @param {Number} [maxPayload=0] The maximum allowed message length
        */
-      constructor(options, isServer, maxPayload) {
-        this._maxPayload = maxPayload | 0;
+      constructor(options) {
         this._options = options || {};
         this._threshold = this._options.threshold !== void 0 ? this._options.threshold : 1024;
-        this._isServer = !!isServer;
+        this._maxPayload = this._options.maxPayload | 0;
+        this._isServer = !!this._options.isServer;
         this._deflate = null;
         this._inflate = null;
         this.params = null;
@@ -458,7 +362,7 @@ var require_permessage_deflate = __commonJS({
       acceptAsServer(offers) {
         const opts = this._options;
         const accepted = offers.find((params) => {
-          if (opts.serverNoContextTakeover === false && params.server_no_context_takeover || params.server_max_window_bits && (opts.serverMaxWindowBits === false || typeof opts.serverMaxWindowBits === "number" && opts.serverMaxWindowBits > params.server_max_window_bits) || typeof opts.clientMaxWindowBits === "number" && !params.client_max_window_bits) {
+          if (opts.serverNoContextTakeover === false && params.server_no_context_takeover || params.server_max_window_bits && (opts.serverMaxWindowBits === false || typeof opts.serverMaxWindowBits === "number" && opts.serverMaxWindowBits > params.server_max_window_bits) || typeof opts.clientMaxWindowBits === "number" && (typeof params.client_max_window_bits === "number" ? opts.clientMaxWindowBits > params.client_max_window_bits : !params.client_max_window_bits)) {
             return false;
           }
           return true;
@@ -683,7 +587,7 @@ var require_permessage_deflate = __commonJS({
         });
       }
     };
-    module2.exports = PerMessageDeflate;
+    module2.exports = PerMessageDeflate2;
     function deflateOnData(chunk) {
       this[kBuffers].push(chunk);
       this[kTotalLength] += chunk.length;
@@ -702,6 +606,10 @@ var require_permessage_deflate = __commonJS({
     }
     function inflateOnError(err) {
       this[kPerMessageDeflate]._inflate = null;
+      if (this[kError]) {
+        this[kCallback](this[kError]);
+        return;
+      }
       err[kStatusCode] = 1007;
       this[kCallback](err);
     }
@@ -914,7 +822,7 @@ var require_receiver = __commonJS({
   "../../../node_modules/ws/lib/receiver.js"(exports2, module2) {
     "use strict";
     var { Writable } = require("stream");
-    var PerMessageDeflate = require_permessage_deflate();
+    var PerMessageDeflate2 = require_permessage_deflate();
     var {
       BINARY_TYPES,
       EMPTY_BUFFER,
@@ -944,6 +852,10 @@ var require_receiver = __commonJS({
        *     extensions
        * @param {Boolean} [options.isServer=false] Specifies whether to operate in
        *     client or server mode
+       * @param {Number} [options.maxBufferedChunks=0] The maximum number of
+       *     buffered data chunks
+       * @param {Number} [options.maxFragments=0] The maximum number of message
+       *     fragments
        * @param {Number} [options.maxPayload=0] The maximum allowed message length
        * @param {Boolean} [options.skipUTF8Validation=false] Specifies whether or
        *     not to skip UTF-8 validation for text and close messages
@@ -954,6 +866,8 @@ var require_receiver = __commonJS({
         this._binaryType = options.binaryType || BINARY_TYPES[0];
         this._extensions = options.extensions || {};
         this._isServer = !!options.isServer;
+        this._maxBufferedChunks = options.maxBufferedChunks | 0;
+        this._maxFragments = options.maxFragments | 0;
         this._maxPayload = options.maxPayload | 0;
         this._skipUTF8Validation = !!options.skipUTF8Validation;
         this[kWebSocket] = void 0;
@@ -968,6 +882,7 @@ var require_receiver = __commonJS({
         this._opcode = 0;
         this._totalPayloadLength = 0;
         this._messageLength = 0;
+        this._numFragments = 0;
         this._fragments = [];
         this._errored = false;
         this._loop = false;
@@ -983,6 +898,18 @@ var require_receiver = __commonJS({
        */
       _write(chunk, encoding, cb) {
         if (this._opcode === 8 && this._state == GET_INFO) return cb();
+        if (this._maxBufferedChunks > 0 && this._buffers.length >= this._maxBufferedChunks) {
+          cb(
+            this.createError(
+              RangeError,
+              "Too many buffered chunks",
+              false,
+              1008,
+              "WS_ERR_TOO_MANY_BUFFERED_PARTS"
+            )
+          );
+          return;
+        }
         this._bufferedBytes += chunk.length;
         this._buffers.push(chunk);
         this.startLoop(cb);
@@ -1081,7 +1008,7 @@ var require_receiver = __commonJS({
           return;
         }
         const compressed = (buf[0] & 64) === 64;
-        if (compressed && !this._extensions[PerMessageDeflate.extensionName]) {
+        if (compressed && !this._extensions[PerMessageDeflate2.extensionName]) {
           const error48 = this.createError(
             RangeError,
             "RSV1 must be clear",
@@ -1306,6 +1233,17 @@ var require_receiver = __commonJS({
           this.controlMessage(data, cb);
           return;
         }
+        if (this._maxFragments > 0 && ++this._numFragments > this._maxFragments) {
+          const error48 = this.createError(
+            RangeError,
+            "Too many message fragments",
+            false,
+            1008,
+            "WS_ERR_TOO_MANY_BUFFERED_PARTS"
+          );
+          cb(error48);
+          return;
+        }
         if (this._compressed) {
           this._state = INFLATING;
           this.decompress(data, cb);
@@ -1325,7 +1263,7 @@ var require_receiver = __commonJS({
        * @private
        */
       decompress(data, cb) {
-        const perMessageDeflate = this._extensions[PerMessageDeflate.extensionName];
+        const perMessageDeflate = this._extensions[PerMessageDeflate2.extensionName];
         perMessageDeflate.decompress(data, this._fin, (err, buf) => {
           if (err) return cb(err);
           if (buf.length) {
@@ -1363,6 +1301,7 @@ var require_receiver = __commonJS({
         this._totalPayloadLength = 0;
         this._messageLength = 0;
         this._fragmented = 0;
+        this._numFragments = 0;
         this._fragments = [];
         if (this._opcode === 2) {
           let data;
@@ -1507,7 +1446,10 @@ var require_sender = __commonJS({
     "use strict";
     var { Duplex } = require("stream");
     var { randomFillSync } = require("crypto");
-    var PerMessageDeflate = require_permessage_deflate();
+    var {
+      types: { isUint8Array }
+    } = require("util");
+    var PerMessageDeflate2 = require_permessage_deflate();
     var { EMPTY_BUFFER, kWebSocket, NOOP } = require_constants();
     var { isBlob, isValidStatusCode } = require_validation();
     var { mask: applyMask, toBuffer } = require_buffer_util();
@@ -1660,8 +1602,10 @@ var require_sender = __commonJS({
           buf.writeUInt16BE(code, 0);
           if (typeof data === "string") {
             buf.write(data, 2);
-          } else {
+          } else if (isUint8Array(data)) {
             buf.set(data, 2);
+          } else {
+            throw new TypeError("Second argument must be a string or a Uint8Array");
           }
         }
         const options = {
@@ -1791,7 +1735,7 @@ var require_sender = __commonJS({
        * @public
        */
       send(data, options, cb) {
-        const perMessageDeflate = this._extensions[PerMessageDeflate.extensionName];
+        const perMessageDeflate = this._extensions[PerMessageDeflate2.extensionName];
         let opcode = options.binary ? 2 : 1;
         let rsv1 = options.compress;
         let byteLength;
@@ -1915,7 +1859,7 @@ var require_sender = __commonJS({
           this.sendFrame(_Sender.frame(data, options), cb);
           return;
         }
-        const perMessageDeflate = this._extensions[PerMessageDeflate.extensionName];
+        const perMessageDeflate = this._extensions[PerMessageDeflate2.extensionName];
         this._bufferedBytes += options[kByteLength];
         this._state = DEFLATING;
         perMessageDeflate.compress(data, options.fin, (_, buf) => {
@@ -1958,7 +1902,7 @@ var require_sender = __commonJS({
       /**
        * Sends a frame.
        *
-       * @param {Buffer[]} list The frame to send
+       * @param {(Buffer | String)[]} list The frame to send
        * @param {Function} [cb] Callback
        * @private
        */
@@ -2353,11 +2297,11 @@ var require_extension = __commonJS({
       return offers;
     }
     function format(extensions) {
-      return Object.keys(extensions).map((extension) => {
-        let configurations = extensions[extension];
+      return Object.keys(extensions).map((extension2) => {
+        let configurations = extensions[extension2];
         if (!Array.isArray(configurations)) configurations = [configurations];
         return configurations.map((params) => {
-          return [extension].concat(
+          return [extension2].concat(
             Object.keys(params).map((k) => {
               let values = params[k];
               if (!Array.isArray(values)) values = [values];
@@ -2380,15 +2324,16 @@ var require_websocket = __commonJS({
     var http2 = require("http");
     var net = require("net");
     var tls = require("tls");
-    var { randomBytes, createHash: createHash2 } = require("crypto");
+    var { randomBytes, createHash } = require("crypto");
     var { Duplex, Readable } = require("stream");
     var { URL: URL2 } = require("url");
-    var PerMessageDeflate = require_permessage_deflate();
+    var PerMessageDeflate2 = require_permessage_deflate();
     var Receiver2 = require_receiver();
     var Sender2 = require_sender();
     var { isBlob } = require_validation();
     var {
       BINARY_TYPES,
+      CLOSE_TIMEOUT,
       EMPTY_BUFFER,
       GUID,
       kForOnEventAttribute,
@@ -2402,7 +2347,6 @@ var require_websocket = __commonJS({
     } = require_event_target();
     var { format, parse: parse3 } = require_extension();
     var { toBuffer } = require_buffer_util();
-    var closeTimeout = 30 * 1e3;
     var kAborted = Symbol("kAborted");
     var protocolVersions = [8, 13];
     var readyStates = ["CONNECTING", "OPEN", "CLOSING", "CLOSED"];
@@ -2448,6 +2392,7 @@ var require_websocket = __commonJS({
           initAsClient(this, address, protocols, options);
         } else {
           this._autoPong = options.autoPong;
+          this._closeTimeout = options.closeTimeout;
           this._isServer = true;
         }
       }
@@ -2541,6 +2486,10 @@ var require_websocket = __commonJS({
        *     multiple times in the same tick
        * @param {Function} [options.generateMask] The function used to generate the
        *     masking key
+       * @param {Number} [options.maxBufferedChunks=0] The maximum number of
+       *     buffered data chunks
+       * @param {Number} [options.maxFragments=0] The maximum number of message
+       *     fragments
        * @param {Number} [options.maxPayload=0] The maximum allowed message size
        * @param {Boolean} [options.skipUTF8Validation=false] Specifies whether or
        *     not to skip UTF-8 validation for text and close messages
@@ -2552,6 +2501,8 @@ var require_websocket = __commonJS({
           binaryType: this.binaryType,
           extensions: this._extensions,
           isServer: this._isServer,
+          maxBufferedChunks: options.maxBufferedChunks,
+          maxFragments: options.maxFragments,
           maxPayload: options.maxPayload,
           skipUTF8Validation: options.skipUTF8Validation
         });
@@ -2590,8 +2541,8 @@ var require_websocket = __commonJS({
           this.emit("close", this._closeCode, this._closeMessage);
           return;
         }
-        if (this._extensions[PerMessageDeflate.extensionName]) {
-          this._extensions[PerMessageDeflate.extensionName].cleanup();
+        if (this._extensions[PerMessageDeflate2.extensionName]) {
+          this._extensions[PerMessageDeflate2.extensionName].cleanup();
         }
         this._receiver.removeAllListeners();
         this._readyState = _WebSocket.CLOSED;
@@ -2753,7 +2704,7 @@ var require_websocket = __commonJS({
           fin: true,
           ...options
         };
-        if (!this._extensions[PerMessageDeflate.extensionName]) {
+        if (!this._extensions[PerMessageDeflate2.extensionName]) {
           opts.compress = false;
         }
         this._sender.send(data || EMPTY_BUFFER, opts, cb);
@@ -2849,7 +2800,10 @@ var require_websocket = __commonJS({
       const opts = {
         allowSynchronousEvents: true,
         autoPong: true,
+        closeTimeout: CLOSE_TIMEOUT,
         protocolVersion: protocolVersions[1],
+        maxBufferedChunks: 256 * 1024,
+        maxFragments: 16 * 1024,
         maxPayload: 100 * 1024 * 1024,
         skipUTF8Validation: false,
         perMessageDeflate: true,
@@ -2866,6 +2820,7 @@ var require_websocket = __commonJS({
         port: void 0
       };
       websocket._autoPong = opts.autoPong;
+      websocket._closeTimeout = opts.closeTimeout;
       if (!protocolVersions.includes(opts.protocolVersion)) {
         throw new RangeError(
           `Unsupported protocol version: ${opts.protocolVersion} (supported versions: ${protocolVersions.join(", ")})`
@@ -2877,7 +2832,7 @@ var require_websocket = __commonJS({
       } else {
         try {
           parsedUrl = new URL2(address);
-        } catch (e) {
+        } catch {
           throw new SyntaxError(`Invalid URL: ${address}`);
         }
       }
@@ -2891,7 +2846,7 @@ var require_websocket = __commonJS({
       const isIpcUrl = parsedUrl.protocol === "ws+unix:";
       let invalidUrlMessage;
       if (parsedUrl.protocol !== "ws:" && !isSecure && !isIpcUrl) {
-        invalidUrlMessage = `The URL's protocol must be one of "ws:", "wss:", "http:", "https", or "ws+unix:"`;
+        invalidUrlMessage = `The URL's protocol must be one of "ws:", "wss:", "http:", "https:", or "ws+unix:"`;
       } else if (isIpcUrl && !parsedUrl.pathname) {
         invalidUrlMessage = "The URL's pathname is empty";
       } else if (parsedUrl.hash) {
@@ -2925,13 +2880,13 @@ var require_websocket = __commonJS({
       opts.path = parsedUrl.pathname + parsedUrl.search;
       opts.timeout = opts.handshakeTimeout;
       if (opts.perMessageDeflate) {
-        perMessageDeflate = new PerMessageDeflate(
-          opts.perMessageDeflate !== true ? opts.perMessageDeflate : {},
-          false,
-          opts.maxPayload
-        );
+        perMessageDeflate = new PerMessageDeflate2({
+          ...opts.perMessageDeflate,
+          isServer: false,
+          maxPayload: opts.maxPayload
+        });
         opts.headers["Sec-WebSocket-Extensions"] = format({
-          [PerMessageDeflate.extensionName]: perMessageDeflate.offer()
+          [PerMessageDeflate2.extensionName]: perMessageDeflate.offer()
         });
       }
       if (protocols.length) {
@@ -3037,7 +2992,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest = createHash2("sha1").update(key + GUID).digest("base64");
+        const digest = createHash("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -3074,23 +3029,25 @@ var require_websocket = __commonJS({
             return;
           }
           const extensionNames = Object.keys(extensions);
-          if (extensionNames.length !== 1 || extensionNames[0] !== PerMessageDeflate.extensionName) {
+          if (extensionNames.length !== 1 || extensionNames[0] !== PerMessageDeflate2.extensionName) {
             const message = "Server indicated an extension that was not requested";
             abortHandshake(websocket, socket, message);
             return;
           }
           try {
-            perMessageDeflate.accept(extensions[PerMessageDeflate.extensionName]);
+            perMessageDeflate.accept(extensions[PerMessageDeflate2.extensionName]);
           } catch (err) {
             const message = "Invalid Sec-WebSocket-Extensions header";
             abortHandshake(websocket, socket, message);
             return;
           }
-          websocket._extensions[PerMessageDeflate.extensionName] = perMessageDeflate;
+          websocket._extensions[PerMessageDeflate2.extensionName] = perMessageDeflate;
         }
         websocket.setSocket(socket, head, {
           allowSynchronousEvents: opts.allowSynchronousEvents,
           generateMask: opts.generateMask,
+          maxBufferedChunks: opts.maxBufferedChunks,
+          maxFragments: opts.maxFragments,
           maxPayload: opts.maxPayload,
           skipUTF8Validation: opts.skipUTF8Validation
         });
@@ -3208,7 +3165,7 @@ var require_websocket = __commonJS({
     function setCloseTimer(websocket) {
       websocket._closeTimer = setTimeout(
         websocket._socket.destroy.bind(websocket._socket),
-        closeTimeout
+        websocket._closeTimeout
       );
     }
     function socketOnClose() {
@@ -3217,8 +3174,8 @@ var require_websocket = __commonJS({
       this.removeListener("data", socketOnData);
       this.removeListener("end", socketOnEnd);
       websocket._readyState = WebSocket2.CLOSING;
-      let chunk;
-      if (!this._readableState.endEmitted && !websocket._closeFrameReceived && !websocket._receiver._writableState.errorEmitted && (chunk = websocket._socket.read()) !== null) {
+      if (!this._readableState.endEmitted && !websocket._closeFrameReceived && !websocket._receiver._writableState.errorEmitted && this._readableState.length !== 0) {
+        const chunk = this.read(this._readableState.length);
         websocket._receiver.write(chunk);
       }
       websocket._receiver.end();
@@ -3254,6 +3211,104 @@ var require_websocket = __commonJS({
   }
 });
 
+// ../../../node_modules/ws/lib/stream.js
+var require_stream = __commonJS({
+  "../../../node_modules/ws/lib/stream.js"(exports2, module2) {
+    "use strict";
+    var WebSocket2 = require_websocket();
+    var { Duplex } = require("stream");
+    function emitClose(stream) {
+      stream.emit("close");
+    }
+    function duplexOnEnd() {
+      if (!this.destroyed && this._writableState.finished) {
+        this.destroy();
+      }
+    }
+    function duplexOnError(err) {
+      this.removeListener("error", duplexOnError);
+      this.destroy();
+      if (this.listenerCount("error") === 0) {
+        this.emit("error", err);
+      }
+    }
+    function createWebSocketStream2(ws, options) {
+      let terminateOnDestroy = true;
+      const duplex = new Duplex({
+        ...options,
+        autoDestroy: false,
+        emitClose: false,
+        objectMode: false,
+        writableObjectMode: false
+      });
+      ws.on("message", function message(msg, isBinary) {
+        const data = !isBinary && duplex._readableState.objectMode ? msg.toString() : msg;
+        if (!duplex.push(data)) ws.pause();
+      });
+      ws.once("error", function error48(err) {
+        if (duplex.destroyed) return;
+        terminateOnDestroy = false;
+        duplex.destroy(err);
+      });
+      ws.once("close", function close() {
+        if (duplex.destroyed) return;
+        duplex.push(null);
+      });
+      duplex._destroy = function(err, callback) {
+        if (ws.readyState === ws.CLOSED) {
+          callback(err);
+          process.nextTick(emitClose, duplex);
+          return;
+        }
+        let called = false;
+        ws.once("error", function error48(err2) {
+          called = true;
+          callback(err2);
+        });
+        ws.once("close", function close() {
+          if (!called) callback(err);
+          process.nextTick(emitClose, duplex);
+        });
+        if (terminateOnDestroy) ws.terminate();
+      };
+      duplex._final = function(callback) {
+        if (ws.readyState === ws.CONNECTING) {
+          ws.once("open", function open2() {
+            duplex._final(callback);
+          });
+          return;
+        }
+        if (ws._socket === null) return;
+        if (ws._socket._writableState.finished) {
+          callback();
+          if (duplex._readableState.endEmitted) duplex.destroy();
+        } else {
+          ws._socket.once("finish", function finish() {
+            callback();
+          });
+          ws.close();
+        }
+      };
+      duplex._read = function() {
+        if (ws.isPaused) ws.resume();
+      };
+      duplex._write = function(chunk, encoding, callback) {
+        if (ws.readyState === ws.CONNECTING) {
+          ws.once("open", function open2() {
+            duplex._write(chunk, encoding, callback);
+          });
+          return;
+        }
+        ws.send(chunk, callback);
+      };
+      duplex.on("end", duplexOnEnd);
+      duplex.on("error", duplexOnError);
+      return duplex;
+    }
+    module2.exports = createWebSocketStream2;
+  }
+});
+
 // ../../../node_modules/ws/lib/subprotocol.js
 var require_subprotocol = __commonJS({
   "../../../node_modules/ws/lib/subprotocol.js"(exports2, module2) {
@@ -3306,12 +3361,12 @@ var require_websocket_server = __commonJS({
     var EventEmitter = require("events");
     var http2 = require("http");
     var { Duplex } = require("stream");
-    var { createHash: createHash2 } = require("crypto");
-    var extension = require_extension();
-    var PerMessageDeflate = require_permessage_deflate();
-    var subprotocol = require_subprotocol();
+    var { createHash } = require("crypto");
+    var extension2 = require_extension();
+    var PerMessageDeflate2 = require_permessage_deflate();
+    var subprotocol2 = require_subprotocol();
     var WebSocket2 = require_websocket();
-    var { GUID, kWebSocket } = require_constants();
+    var { CLOSE_TIMEOUT, GUID, kWebSocket } = require_constants();
     var keyRegex = /^[+/0-9A-Za-z]{22}==$/;
     var RUNNING = 0;
     var CLOSING = 1;
@@ -3330,8 +3385,15 @@ var require_websocket_server = __commonJS({
        *     pending connections
        * @param {Boolean} [options.clientTracking=true] Specifies whether or not to
        *     track clients
+       * @param {Number} [options.closeTimeout=30000] Duration in milliseconds to
+       *     wait for the closing handshake to finish after `websocket.close()` is
+       *     called
        * @param {Function} [options.handleProtocols] A hook to handle protocols
        * @param {String} [options.host] The hostname where to bind the server
+       * @param {Number} [options.maxBufferedChunks=262144] The maximum number of
+       *     buffered data chunks
+       * @param {Number} [options.maxFragments=16384] The maximum number of message
+       *     fragments
        * @param {Number} [options.maxPayload=104857600] The maximum allowed message
        *     size
        * @param {Boolean} [options.noServer=false] Enable no server mode
@@ -3353,11 +3415,14 @@ var require_websocket_server = __commonJS({
         options = {
           allowSynchronousEvents: true,
           autoPong: true,
+          maxBufferedChunks: 256 * 1024,
+          maxFragments: 16 * 1024,
           maxPayload: 100 * 1024 * 1024,
           skipUTF8Validation: false,
           perMessageDeflate: false,
           handleProtocols: null,
           clientTracking: true,
+          closeTimeout: CLOSE_TIMEOUT,
           verifyClient: null,
           noServer: false,
           backlog: null,
@@ -3513,9 +3578,11 @@ var require_websocket_server = __commonJS({
           abortHandshakeOrEmitwsClientError(this, req, socket, 400, message);
           return;
         }
-        if (version2 !== 8 && version2 !== 13) {
+        if (version2 !== 13 && version2 !== 8) {
           const message = "Missing or invalid Sec-WebSocket-Version header";
-          abortHandshakeOrEmitwsClientError(this, req, socket, 400, message);
+          abortHandshakeOrEmitwsClientError(this, req, socket, 400, message, {
+            "Sec-WebSocket-Version": "13, 8"
+          });
           return;
         }
         if (!this.shouldHandle(req)) {
@@ -3526,7 +3593,7 @@ var require_websocket_server = __commonJS({
         let protocols = /* @__PURE__ */ new Set();
         if (secWebSocketProtocol !== void 0) {
           try {
-            protocols = subprotocol.parse(secWebSocketProtocol);
+            protocols = subprotocol2.parse(secWebSocketProtocol);
           } catch (err) {
             const message = "Invalid Sec-WebSocket-Protocol header";
             abortHandshakeOrEmitwsClientError(this, req, socket, 400, message);
@@ -3536,16 +3603,16 @@ var require_websocket_server = __commonJS({
         const secWebSocketExtensions = req.headers["sec-websocket-extensions"];
         const extensions = {};
         if (this.options.perMessageDeflate && secWebSocketExtensions !== void 0) {
-          const perMessageDeflate = new PerMessageDeflate(
-            this.options.perMessageDeflate,
-            true,
-            this.options.maxPayload
-          );
+          const perMessageDeflate = new PerMessageDeflate2({
+            ...this.options.perMessageDeflate,
+            isServer: true,
+            maxPayload: this.options.maxPayload
+          });
           try {
-            const offers = extension.parse(secWebSocketExtensions);
-            if (offers[PerMessageDeflate.extensionName]) {
-              perMessageDeflate.accept(offers[PerMessageDeflate.extensionName]);
-              extensions[PerMessageDeflate.extensionName] = perMessageDeflate;
+            const offers = extension2.parse(secWebSocketExtensions);
+            if (offers[PerMessageDeflate2.extensionName]) {
+              perMessageDeflate.accept(offers[PerMessageDeflate2.extensionName]);
+              extensions[PerMessageDeflate2.extensionName] = perMessageDeflate;
             }
           } catch (err) {
             const message = "Invalid or unacceptable Sec-WebSocket-Extensions header";
@@ -3601,7 +3668,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest = createHash2("sha1").update(key + GUID).digest("base64");
+        const digest = createHash("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -3616,10 +3683,10 @@ var require_websocket_server = __commonJS({
             ws._protocol = protocol;
           }
         }
-        if (extensions[PerMessageDeflate.extensionName]) {
-          const params = extensions[PerMessageDeflate.extensionName].params;
-          const value = extension.format({
-            [PerMessageDeflate.extensionName]: [params]
+        if (extensions[PerMessageDeflate2.extensionName]) {
+          const params = extensions[PerMessageDeflate2.extensionName].params;
+          const value = extension2.format({
+            [PerMessageDeflate2.extensionName]: [params]
           });
           headers.push(`Sec-WebSocket-Extensions: ${value}`);
           ws._extensions = extensions;
@@ -3629,6 +3696,8 @@ var require_websocket_server = __commonJS({
         socket.removeListener("error", socketOnError);
         ws.setSocket(socket, head, {
           allowSynchronousEvents: this.options.allowSynchronousEvents,
+          maxBufferedChunks: this.options.maxBufferedChunks,
+          maxFragments: this.options.maxFragments,
           maxPayload: this.options.maxPayload,
           skipUTF8Validation: this.options.skipUTF8Validation
         });
@@ -3674,13 +3743,13 @@ var require_websocket_server = __commonJS({
 ` + Object.keys(headers).map((h) => `${h}: ${headers[h]}`).join("\r\n") + "\r\n\r\n" + message
       );
     }
-    function abortHandshakeOrEmitwsClientError(server, req, socket, code, message) {
+    function abortHandshakeOrEmitwsClientError(server, req, socket, code, message, headers) {
       if (server.listenerCount("wsClientError")) {
         const err = new Error(message);
         Error.captureStackTrace(err, abortHandshakeOrEmitwsClientError);
         server.emit("wsClientError", err, socket, req);
       } else {
-        abortHandshake(socket, code, message);
+        abortHandshake(socket, code, message, headers);
       }
     }
   }
@@ -4709,10 +4778,10 @@ var init_agent_hooks = __esm({
   }
 });
 
-// raw-import:/tmp/slz-publish-wt.2QxCLO/packages/shared/hooks/src/notify.sh
+// raw-import:/tmp/slz-publish-wt.A7COkR/packages/shared/hooks/src/notify.sh
 var notify_default;
 var init_notify = __esm({
-  "raw-import:/tmp/slz-publish-wt.2QxCLO/packages/shared/hooks/src/notify.sh"() {
+  "raw-import:/tmp/slz-publish-wt.A7COkR/packages/shared/hooks/src/notify.sh"() {
     notify_default = `#!/bin/sh
 # SlayZone agent lifecycle hook \u2014 BENIGN DUMB FORWARDER.
 #
@@ -4874,10 +4943,10 @@ exit 0
   }
 });
 
-// raw-import:/tmp/slz-publish-wt.2QxCLO/packages/shared/hooks/src/opencode-plugin.js
+// raw-import:/tmp/slz-publish-wt.A7COkR/packages/shared/hooks/src/opencode-plugin.js
 var opencode_plugin_default;
 var init_opencode_plugin = __esm({
-  "raw-import:/tmp/slz-publish-wt.2QxCLO/packages/shared/hooks/src/opencode-plugin.js"() {
+  "raw-import:/tmp/slz-publish-wt.A7COkR/packages/shared/hooks/src/opencode-plugin.js"() {
     opencode_plugin_default = "// SlayZone opencode plugin v1\n//\n// Forwards OpenCode SDK session lifecycle events to the SlayZone agent-hook\n// notify script over a local shell exec. Plugin is loaded by OpenCode from\n//   ${XDG_CONFIG_HOME:-~/.config}/opencode/plugin/slayzone-notify.js\n//\n// The {{NOTIFY_PATH}} placeholder is substituted by the SlayZone installer\n// (packages/apps/app/src/main/agent-hooks/opencode-plugin-installer.ts) at\n// install time with the absolute path to `~/.slayzone/hooks/notify.sh`.\n//\n// Behavior:\n//   - No-op when SLAYZONE_TASK_ID is unset (plugin only fires inside SlayZone PTYs).\n//   - Subagent (child session) events are suppressed \u2014 oh-my-opencode + similar\n//     tools spawn many child sessions and would otherwise flap Start/Stop.\n//   - On client.session.list() error, sessions are assumed CHILD (safer to\n//     suppress than emit a false-positive Start/Stop).\n//   - Handles both modern (session.status w/ nested type) and legacy\n//     (session.busy / session.idle) event shapes for forward compat.\n//   - Singleton guard prevents double-load if OpenCode re-imports the plugin.\n\nexport const SlayzoneNotifyPlugin = async ({ $, client }) => {\n  if (globalThis.__slayzoneOpencodePluginV1) return {}\n  globalThis.__slayzoneOpencodePluginV1 = true\n  if (!process?.env?.SLAYZONE_TASK_ID) return {}\n\n  const notifyPath = '{{NOTIFY_PATH}}'\n  let currentState = 'idle' // 'idle' | 'busy'\n  let rootSessionID = null // first non-child session we see\n  let stopSent = false // dedup Stop emits\n  const childSessionCache = new Map() // sessionID -> isChild bool\n\n  const notify = async (eventName) => {\n    const payload = JSON.stringify({ hook_event_name: eventName })\n    try {\n      await $`bash ${notifyPath} ${payload}`\n    } catch {\n      // Hook failures must never bubble into the OpenCode TUI.\n    }\n  }\n\n  const isChildSession = async (sessionID) => {\n    if (!sessionID) return true\n    if (!client?.session?.list) return true\n    if (childSessionCache.has(sessionID)) return childSessionCache.get(sessionID)\n    try {\n      const sessions = await client.session.list()\n      const session = sessions.data?.find((s) => s.id === sessionID)\n      const isChild = !!session?.parentID\n      childSessionCache.set(sessionID, isChild)\n      return isChild\n    } catch {\n      // On error, assume CHILD \u2014 safer than emitting a false-positive Start/Stop.\n      return true\n    }\n  }\n\n  const handleBusy = async (sessionID) => {\n    if (!rootSessionID) rootSessionID = sessionID\n    if (sessionID !== rootSessionID) return\n    if (currentState === 'idle') {\n      currentState = 'busy'\n      stopSent = false\n      await notify('Start')\n    }\n  }\n\n  const handleStop = async (sessionID) => {\n    if (rootSessionID && sessionID !== rootSessionID) return\n    if (currentState === 'busy' && !stopSent) {\n      currentState = 'idle'\n      stopSent = true\n      await notify('Stop')\n      rootSessionID = null // reset for next session\n    }\n  }\n\n  return {\n    event: async ({ event }) => {\n      const sessionID = event.properties?.sessionID ?? event.properties?.info?.id ?? null\n\n      if (event.type === 'session.created') {\n        const isChild = Boolean(event.properties?.info?.parentID)\n        if (sessionID) childSessionCache.set(sessionID, isChild)\n        if (!isChild) await notify('SessionStart')\n        return\n      }\n\n      if (event.type === 'session.deleted') {\n        const cached = sessionID ? childSessionCache.get(sessionID) : undefined\n        const isChild = cached !== undefined ? cached : await isChildSession(sessionID)\n        if (!isChild) await notify('SessionEnd')\n        if (sessionID) childSessionCache.delete(sessionID)\n        return\n      }\n\n      if (await isChildSession(sessionID)) return\n\n      if (event.type === 'session.status') {\n        const status = event.properties?.status\n        if (status?.type === 'busy') await handleBusy(sessionID)\n        else if (status?.type === 'idle') await handleStop(sessionID)\n      }\n      // Backwards-compat: some OpenCode versions emit busy/idle as top-level events.\n      if (event.type === 'session.busy') await handleBusy(sessionID)\n      if (event.type === 'session.idle') await handleStop(sessionID)\n      if (event.type === 'session.error') await handleStop(sessionID)\n    },\n    'permission.ask': async (_permission, output) => {\n      if (output.status === 'ask') await notify('PermissionRequest')\n    }\n  }\n}\n";
   }
 });
@@ -4937,6 +5006,7 @@ init_dirs();
 var DEFAULT_LOCAL_COMPUTER_NAME = "local-computer";
 
 // ../../shared/platform/src/slayzone-config.ts
+var IGNORED_COMPUTER_CONFIG_KEYS = ["pinnedCertSha256"];
 function getComputerConfigFilePath() {
   return (0, import_node_path.join)(getSlayzoneHomeDir(), "computer.config.json");
 }
@@ -4953,8 +5023,6 @@ function coerceComputerConfig(raw) {
     const roots = raw.allowedRoots.filter((r) => typeof r === "string" && r.length > 0);
     if (roots.length > 0) cfg.allowedRoots = roots;
   }
-  if (typeof raw.pinnedCertSha256 === "string" && raw.pinnedCertSha256.length > 0)
-    cfg.pinnedCertSha256 = raw.pinnedCertSha256;
   return cfg;
 }
 function readJsonObject(path8) {
@@ -5005,6 +5073,11 @@ function loadComputerConfigFile(path8 = getComputerConfigFilePath()) {
   const legacy = readJsonObject(legacyConfigFilePathFor(path8));
   return legacy ? coerceComputerConfig(legacy) : {};
 }
+function ignoredComputerConfigKeys(path8 = getComputerConfigFilePath()) {
+  const raw = readJsonObject(path8) ?? readJsonObject(legacyConfigFilePathFor(path8));
+  if (!raw) return [];
+  return IGNORED_COMPUTER_CONFIG_KEYS.filter((key) => raw[key] !== void 0);
+}
 function saveComputerConfigFile(cfg, path8 = getComputerConfigFilePath()) {
   writeJsonAtomic(path8, cfg);
 }
@@ -19435,7 +19508,11 @@ var gitCreateWorktreeParamsSchema = external_exports.object({
 });
 var gitRemoveWorktreeParamsSchema = external_exports.object({
   projectPath: external_exports.string().min(1),
-  worktreePath: external_exports.string().min(1)
+  worktreePath: external_exports.string().min(1),
+  /** Also force-delete the worktree's branch (`git branch -D`). OFF unless asked: the
+   *  hub's archive / delete / purge paths remove only the worktree, and unmerged,
+   *  unpushed commits on the branch would otherwise be left dangling. */
+  deleteBranch: external_exports.boolean().optional()
 });
 var gitRemoveWorktreeResultSchema = external_exports.object({
   branchDeleted: external_exports.boolean().optional(),
@@ -19690,23 +19767,6 @@ var procListResultSchema = external_exports.object({
   )
 });
 
-// ../../domains/computer-transport/src/shared/pinning.ts
-var import_node_crypto = require("node:crypto");
-var FINGERPRINT_RE = /^[0-9a-f]{64}$/;
-function normalizeCertSha256Fingerprint(input) {
-  const normalized = input.replace(/[:\s]/g, "").toLowerCase();
-  if (!FINGERPRINT_RE.test(normalized)) {
-    throw new Error(`invalid sha256 certificate fingerprint: '${input}'`);
-  }
-  return normalized;
-}
-function certSha256FingerprintFromDer(der) {
-  return (0, import_node_crypto.createHash)("sha256").update(der).digest("hex");
-}
-function certMatchesFingerprint(expected, presentedDer) {
-  return normalizeCertSha256Fingerprint(expected) === certSha256FingerprintFromDer(presentedDer);
-}
-
 // ../../domains/computer-transport/src/shared/events.ts
 var TypedEventEmitter = class {
   listeners = /* @__PURE__ */ new Map();
@@ -19789,9 +19849,7 @@ function slayzoneRootDir() {
 }
 var storedComputerCredentialsSchema = external_exports.object({
   computerId: external_exports.string().min(1),
-  apiKey: external_exports.string().min(1),
-  /** Pin recorded at enroll time (lowercase hex sha256 of the hub leaf DER). */
-  pinnedFingerprint: external_exports.string().optional()
+  apiKey: external_exports.string().min(1)
 });
 var credentialsMapSchema = external_exports.record(external_exports.string(), storedComputerCredentialsSchema);
 function hubHostFromUrl(url2) {
@@ -19869,25 +19927,27 @@ function createFileCredentialStore(hubHost, options = {}) {
 }
 
 // ../../domains/computer-transport/src/client/hub-dialer.ts
-var import_node_crypto2 = require("node:crypto");
+var import_node_crypto = require("node:crypto");
 
 // ../../../node_modules/ws/wrapper.mjs
 var import_stream = __toESM(require_stream(), 1);
+var import_extension = __toESM(require_extension(), 1);
+var import_permessage_deflate = __toESM(require_permessage_deflate(), 1);
 var import_receiver = __toESM(require_receiver(), 1);
 var import_sender = __toESM(require_sender(), 1);
+var import_subprotocol = __toESM(require_subprotocol(), 1);
 var import_websocket = __toESM(require_websocket(), 1);
 var import_websocket_server = __toESM(require_websocket_server(), 1);
 var wrapper_default = import_websocket.default;
 
 // ../../domains/computer-transport/src/client/hub-dialer.ts
-var PROCESS_EPOCH = (0, import_node_crypto2.randomUUID)();
+var PROCESS_EPOCH = (0, import_node_crypto.randomUUID)();
 var DEFAULT_HEARTBEAT_INTERVAL_MS = 15e3;
 var DEFAULT_HEARTBEAT_TIMEOUT_MS = 1e4;
 var HubDialer = class {
   events;
   opts;
   log;
-  pinnedFingerprint;
   stateValue = "stopped";
   current = null;
   retryTimer = null;
@@ -19911,14 +19971,6 @@ var HubDialer = class {
     if (protocol !== "ws:" && protocol !== "wss:") {
       throw new Error(`hub url must be ws:// or wss://, got '${opts.url}'`);
     }
-    if (opts.pinnedCertSha256 !== void 0) {
-      if (protocol !== "wss:") {
-        throw new Error("pinnedCertSha256 requires a wss:// hub url");
-      }
-      this.pinnedFingerprint = normalizeCertSha256Fingerprint(opts.pinnedCertSha256);
-    } else {
-      this.pinnedFingerprint = null;
-    }
   }
   get state() {
     return this.stateValue;
@@ -19981,55 +20033,11 @@ var HubDialer = class {
     this.stateValue = state;
     this.events.emit("state-change", { state });
   }
-  buildWsOptions() {
-    if (!this.pinnedFingerprint) return {};
-    const expected = this.pinnedFingerprint;
-    const tlsOptions = {
-      // The pin *replaces* CA-chain trust — hubs present self-signed certs.
-      // NOTE: with rejectUnauthorized:false node records a checkServerIdentity
-      // failure in socket.authorizationError but does NOT abort the handshake,
-      // so the pin is ENFORCED in verifyPinnedCert() (ws 'upgrade' event) —
-      // this override only makes the failure observable early.
-      rejectUnauthorized: false,
-      checkServerIdentity: (_host, cert) => {
-        if (!cert?.raw) return new Error("hub presented no certificate");
-        if (!certMatchesFingerprint(expected, cert.raw)) {
-          const actual = certSha256FingerprintFromDer(cert.raw);
-          return new Error(
-            `hub certificate fingerprint mismatch: expected ${expected}, got ${actual}`
-          );
-        }
-        return void 0;
-      }
-    };
-    return tlsOptions;
-  }
-  /**
-   * Hard pin enforcement. Runs on the ws 'upgrade' event — after the TLS
-   * handshake and the (secret-free) HTTP upgrade request, but before 'open',
-   * so no computer frame (hello/enroll credentials) is ever sent to an unpinned
-   * peer. Returns false and tears the socket down on mismatch.
-   */
-  verifyPinnedCert(ws, tlsSocket) {
-    const expected = this.pinnedFingerprint;
-    if (!expected) return true;
-    const cert = typeof tlsSocket.getPeerCertificate === "function" ? tlsSocket.getPeerCertificate() : null;
-    const raw = cert && cert.raw ? cert.raw : null;
-    if (raw && certMatchesFingerprint(expected, raw)) return true;
-    const actual = raw ? certSha256FingerprintFromDer(raw) : "no certificate";
-    const error48 = new Error(
-      `hub certificate fingerprint mismatch: expected ${expected}, got ${actual}`
-    );
-    this.log("computer dialer rejected hub certificate", { error: error48.message });
-    this.events.emit("error", { error: error48, fatal: false });
-    ws.terminate();
-    return false;
-  }
   connect() {
     this.retryTimer = null;
     this.triedTokenRefresh = false;
     this.setState("connecting");
-    const ws = new wrapper_default(this.opts.url, this.buildWsOptions());
+    const ws = new wrapper_default(this.opts.url);
     const conn = {
       ws,
       rpc: null,
@@ -20050,11 +20058,6 @@ var HubDialer = class {
       }
     });
     this.current = conn;
-    if (this.pinnedFingerprint) {
-      ws.on("upgrade", (response) => {
-        this.verifyPinnedCert(ws, response.socket);
-      });
-    }
     ws.on("open", () => {
       if (this.current === conn && !this.stopping) void this.authenticate(conn);
     });
@@ -20181,8 +20184,7 @@ var HubDialer = class {
       try {
         await this.opts.credentialStore.save({
           computerId: result.computerId,
-          apiKey: result.apiKey,
-          ...this.pinnedFingerprint ? { pinnedFingerprint: this.pinnedFingerprint } : {}
+          apiKey: result.apiKey
         });
       } catch (err) {
         const error48 = new Error(
@@ -20297,7 +20299,8 @@ var import_node_path3 = require("node:path");
 
 // ../../shared/platform/src/join-token.ts
 var JOIN_TOKEN_PREFIX = "szjt1";
-function decodeJoinToken(token) {
+var JOIN_TOKEN_MAX_TTL_MS = 60 * 6e4;
+function parseJoinTokenBody(token) {
   const dot = token.indexOf(".");
   if (dot === -1 || token.slice(0, dot) !== JOIN_TOKEN_PREFIX) return null;
   const body = token.slice(dot + 1);
@@ -20305,15 +20308,23 @@ function decodeJoinToken(token) {
   try {
     const parsed = JSON.parse(Buffer.from(body, "base64url").toString("utf8"));
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
-    const { hubUrl, certFingerprint, secret } = parsed;
-    if (typeof hubUrl !== "string" || typeof certFingerprint !== "string" || typeof secret !== "string") {
-      return null;
-    }
-    return { hubUrl, certFingerprint, secret };
+    return parsed;
   } catch {
     return null;
   }
 }
+function decodeJoinToken(token) {
+  const parsed = parseJoinTokenBody(token);
+  if (!parsed) return null;
+  const { hubUrl, secret } = parsed;
+  if (typeof hubUrl !== "string" || typeof secret !== "string") return null;
+  return { hubUrl, secret };
+}
+function joinTokenCarriesCertPin(token) {
+  if (!decodeJoinToken(token)) return false;
+  const pin = parseJoinTokenBody(token)?.certFingerprint;
+  return typeof pin === "string" && pin !== "";
+}
 
 // src/config.ts
 var computerConfigSchema = external_exports.object({
@@ -20344,9 +20355,7 @@ var computerConfigSchema = external_exports.object({
   /** Filesystem roots this computer may operate under (fs./git. commands). */
   allowedRoots: external_exports.array(external_exports.string().min(1)),
   /** Capability tags advertised at enrollment. */
-  capabilities: external_exports.array(external_exports.string().min(1)),
-  /** sha256 pin of the hub TLS leaf cert (lowercase hex; colons tolerated). */
-  pinnedCertSha256: external_exports.string().min(1).optional()
+  capabilities: external_exports.array(external_exports.string().min(1))
 });
 var ENV_VARS = {
   // Authority ONLY — `host[:port]`, no scheme, no path. The dial scheme
@@ -20358,8 +20367,8 @@ var ENV_VARS = {
   // into terminals, so outside the collision).
   hubAddress: "SLAYZONE_HUB_ADDRESS",
   // HUB_-prefixed because the token is hub-scoped BY VALUE, not by reader: the hub
-  // mints it and it embeds the hub's `wss://…/computers` url, the hub's TLS cert
-  // fingerprint, and a secret checked against the hub's `join_tokens` row.
+  // mints it and it embeds the hub's `wss://…/computers` url and a secret checked
+  // against the hub's `join_tokens` row.
   // `mintJoinToken` binds it to NO computer (computer_id is NULL until redemption), so
   // any computer can redeem any unused token — the old `SLAYZONE_RUNNER_JOIN_TOKEN`
   // named its CONSUMER, which is what CLAUDE.md rule 2 forbids. `_TOKEN` suffix +
@@ -20377,9 +20386,8 @@ var ENV_VARS = {
   // <ROOT>/computer.config.json `allowedRoots` (+ the ROOT default in bin.ts). The
   // computer NAME likewise has no env channel — it derives from SUPERVISED (→
   // DEFAULT_LOCAL_COMPUTER_NAME) or computer.config.json `computerName`, else the hostname.
-  // The cert pin has NO env channel either: it arrives via the join token (auto
-  // path) or <ROOT>/computer.config.json `pinnedCertSha256` (explicit standalone path).
-  // Never a bare env var — a fingerprint is never fished out of ambient env.
+  // There is no certificate pin on any channel: a wss:// hub's front end is verified
+  // the normal way (see ignoredCertPinNotices).
 };
 var DEFAULT_CAPABILITIES = ["pty", "git", "fs", "proc"];
 function realpathBoundary(target) {
@@ -20428,7 +20436,6 @@ function fromSharedConfig(shared) {
   if (shared.joinToken !== void 0) out.joinToken = shared.joinToken;
   if (shared.computerName !== void 0) out.name = shared.computerName;
   if (shared.allowedRoots !== void 0) out.allowedRoots = shared.allowedRoots;
-  if (shared.pinnedCertSha256 !== void 0) out.pinnedCertSha256 = shared.pinnedCertSha256;
   return out;
 }
 function loadComputerConfig(env = process.env, shared = env === process.env && env.SLAYZONE_SUPERVISED !== "1" ? loadComputerConfigFile() : {}) {
@@ -20449,15 +20456,7 @@ function loadComputerConfig(env = process.env, shared = env === process.env && e
     // fallback in bin.ts. No env channel either way.
     allowedRoots: env.SLAYZONE_SUPERVISED === "1" ? [(0, import_node_os2.homedir)()] : [],
     capabilities: [...DEFAULT_CAPABILITIES],
-    ...fromToken ? {
-      hubUrl: fromToken.hubUrl,
-      // A token minted by the current hub carries an EMPTY fingerprint: the hub
-      // no longer presents a certificate of its own, so there is nothing to pin
-      // and the front end's certificate is verified the normal way. An empty
-      // string must read as "no pin", never reach the schema (min(1)) and fail
-      // the whole config. A token from an older hub still carries a real pin.
-      ...fromToken.certFingerprint !== "" ? { pinnedCertSha256: fromToken.certFingerprint } : {}
-    } : {},
+    ...fromToken ? { hubUrl: fromToken.hubUrl } : {},
     // <ROOT>/computer.config.json — base under env (spread after). The single config file.
     ...fromShared,
     ...hubUrlFromEnv !== void 0 ? { hubUrl: hubUrlFromEnv } : {},
@@ -20470,12 +20469,6 @@ function loadComputerConfig(env = process.env, shared = env === process.env && e
       `invalid computer configuration (${issues}). Set ${ENV_VARS.hubAddress} (and ${ENV_VARS.joinToken} for first contact) or a <ROOT>/computer.config.json.`
     );
   }
-  const explicitPin = fromShared.pinnedCertSha256;
-  if (explicitPin !== void 0 && urlProtocol(result.data.hubUrl) === "ws:") {
-    throw new Error(
-      `config pinnedCertSha256 requires a wss:// hub url; got '${result.data.hubUrl}'. Pinning has no effect without TLS \u2014 use a wss:// url or drop the pin.`
-    );
-  }
   for (const url2 of effectiveHubUrls(result.data)) {
     if (urlProtocol(url2) === "ws:" && !isLoopbackComputerUrl(url2)) {
       throw new Error(
@@ -20485,6 +20478,21 @@ function loadComputerConfig(env = process.env, shared = env === process.env && e
   }
   return result.data;
 }
+function ignoredCertPinNotices(env = process.env, shared = env === process.env && env.SLAYZONE_SUPERVISED !== "1" ? loadComputerConfigFile() : {}, ignoredFileKeys = env === process.env && env.SLAYZONE_SUPERVISED !== "1" ? ignoredComputerConfigKeys() : []) {
+  const notices = [];
+  const joinToken = env[ENV_VARS.joinToken] ?? shared.joinToken;
+  if (joinToken && joinTokenCarriesCertPin(joinToken)) {
+    notices.push(
+      "ignoring the certificate pin in the join token (minted by an older hub): the hub's certificate is verified against the trusted CAs instead"
+    );
+  }
+  if (ignoredFileKeys.includes("pinnedCertSha256")) {
+    notices.push(
+      "ignoring 'pinnedCertSha256' in computer.config.json: certificate pinning was removed and the hub's certificate is verified against the trusted CAs instead \u2014 delete the key"
+    );
+  }
+  return notices;
+}
 function urlProtocol(url2) {
   try {
     return new URL(url2).protocol;
@@ -20498,7 +20506,7 @@ function effectiveHubUrls(config2) {
 }
 
 // src/host-id.ts
-var import_node_crypto3 = require("node:crypto");
+var import_node_crypto2 = require("node:crypto");
 var import_promises3 = require("node:fs/promises");
 var import_node_os3 = require("node:os");
 var import_node_path4 = require("node:path");
@@ -20508,6 +20516,9 @@ function slayzoneRootDir2() {
   return (0, import_node_path4.join)(home, ".slayzone");
 }
 function hostIdFilePath(baseDir) {
+  return (0, import_node_path4.join)(baseDir ?? slayzoneRootDir2(), "computer.host.json");
+}
+function legacyHostIdFilePath(baseDir) {
   return (0, import_node_path4.join)(baseDir ?? slayzoneRootDir2(), "computer.host-id.json");
 }
 function sharedHostIdPath() {
@@ -20571,13 +20582,20 @@ async function reconcileHostId(options = {}) {
   const sharedPath = options.sharedPath === void 0 ? sharedHostIdPath() : options.sharedPath;
   const log = options.log ?? (() => void 0);
   let durable = await readDurable(filePath);
+  if (!durable) {
+    const legacy = await readDurable(legacyHostIdFilePath(options.baseDir));
+    if (legacy) {
+      durable = legacy;
+      await writeDurable(filePath, durable);
+    }
+  }
   const shared = sharedPath ? await readShared(sharedPath) : null;
   if (shared && durable && shared !== durable) {
     log("host id adopted from the shared file", { from: durable, to: shared });
     durable = shared;
     await writeDurable(filePath, durable);
   } else if (!durable) {
-    durable = shared ?? (0, import_node_crypto3.randomUUID)();
+    durable = shared ?? (0, import_node_crypto2.randomUUID)();
     await writeDurable(filePath, durable);
   }
   if (sharedPath && shared !== durable) {
@@ -20970,7 +20988,7 @@ function subscribeFileWatcher(rootPath, listener) {
     const watcher = fs2.watch(root, { recursive: true }, (_eventType, filename) => {
       if (!filename) return;
       const relPath = filename.replace(/\\/g, "/");
-      if (isIgnored(root, relPath, false)) return;
+      if (ignoredSafely(root, relPath)) return;
       if (path3.basename(relPath) === ".gitignore") {
         invalidateIgnoreCache(root);
       }
@@ -20991,6 +21009,9 @@ function subscribeFileWatcher(rootPath, listener) {
         }, 100)
       );
     });
+    watcher.on("error", (err) => {
+      console.warn(`[file-editor] watcher on ${root}: ${err.message}`);
+    });
     watchers.set(root, { watcher, listeners, debounceMap });
     return () => unsubscribe(root, listener);
   } catch {
@@ -20998,6 +21019,13 @@ function subscribeFileWatcher(rootPath, listener) {
     };
   }
 }
+function ignoredSafely(root, relPath) {
+  try {
+    return isIgnored(root, relPath, false);
+  } catch {
+    return false;
+  }
+}
 function unsubscribe(root, listener) {
   const entry = watchers.get(root);
   if (!entry) return;
@@ -21140,6 +21168,75 @@ async function discoverRepos(rootPath, maxDepth = DEFAULT_REPO_SCAN_DEPTH) {
   return entries;
 }
 
+// ../../shared/platform/src/hub-switches.ts
+var HUB_SWITCH_ENV = {
+  requireLogin: "SLAYZONE_HUB_REQUIRE_LOGIN",
+  enablePassword: "SLAYZONE_HUB_ENABLE_PASSWORD",
+  enableSso: "SLAYZONE_HUB_ENABLE_SSO",
+  enableProcesses: "SLAYZONE_HUB_ENABLE_PROCESSES",
+  enableIntegrations: "SLAYZONE_HUB_ENABLE_INTEGRATIONS"
+};
+var HUB_SSO_ENV = {
+  tenantId: "SLAYZONE_HUB_SSO_TENANT_ID",
+  clientId: "SLAYZONE_HUB_SSO_CLIENT_ID",
+  /** PEM certificate registered on the Entra app (its SHA-256 thumbprint goes in each assertion). Env only. */
+  certPath: "SLAYZONE_HUB_SSO_CERT_PATH",
+  /** PEM private key of that certificate (RSA, unencrypted). Env only. */
+  keyPath: "SLAYZONE_HUB_SSO_KEY_PATH",
+  /** `0|1`, default `1`: refuse a sign-in whose ID token's `amr` does not contain `mfa`. */
+  requireMfa: "SLAYZONE_HUB_SSO_REQUIRE_MFA"
+};
+var RETIRED_HUB_SSO_CLIENT_SECRET_ENV = "SLAYZONE_HUB_SSO_CLIENT_SECRET";
+var HUB_ADDRESS_ENV = {
+  /** Where the hub LISTENS. Renamed from `SLAYZONE_HUB_ADDRESS`, which now only
+   *  means "the hub to connect to" on a computer / `slay`. */
+  listen: "SLAYZONE_HUB_LISTEN_ADDRESS",
+  /** How OTHER machines reach the hub (`host[:port]`, no scheme). */
+  public: "SLAYZONE_HUB_PUBLIC_ADDRESS",
+  /** Signing key of hub-auth. */
+  authSecret: "SLAYZONE_HUB_AUTH_SECRET"
+};
+var LEGACY_HUB_LISTEN_ENV = "SLAYZONE_HUB_ADDRESS";
+var HUB_SESSION_RETENTION_DAYS_ENV = "SLAYZONE_HUB_SESSION_RETENTION_DAYS";
+var HUB_ALLOWED_WEB_ORIGINS_ENV = "SLAYZONE_HUB_ALLOWED_WEB_ORIGINS";
+var HUB_TRUSTED_PROXIES_ENV = "SLAYZONE_HUB_TRUSTED_PROXIES";
+var HUB_CONVEX_ADDRESS_ENV = "SLAYZONE_HUB_CONVEX_ADDRESS";
+var HUB_PROCESS_ENV = [
+  ...Object.values(HUB_SWITCH_ENV),
+  ...Object.values(HUB_SSO_ENV),
+  RETIRED_HUB_SSO_CLIENT_SECRET_ENV,
+  ...Object.values(HUB_ADDRESS_ENV),
+  LEGACY_HUB_LISTEN_ENV,
+  HUB_ALLOWED_WEB_ORIGINS_ENV,
+  HUB_TRUSTED_PROXIES_ENV,
+  HUB_SESSION_RETENTION_DAYS_ENV,
+  HUB_CONVEX_ADDRESS_ENV
+];
+
+// ../../shared/platform/src/security-log.ts
+var import_node_async_hooks = require("node:async_hooks");
+var LINE_SEPARATOR = String.fromCharCode(8232);
+var PARAGRAPH_SEPARATOR = String.fromCharCode(8233);
+var contextStore = new import_node_async_hooks.AsyncLocalStorage();
+
+// ../../shared/platform/src/hub-switch-refusal.ts
+var MESSAGES = {
+  HUB_PROCESSES_DISABLED: `This hub does not run processes, automation commands, terminals or agents itself (${HUB_SWITCH_ENV.enableProcesses}=0).`,
+  HUB_INTEGRATIONS_DISABLED: `Integrations are switched off on this hub (${HUB_SWITCH_ENV.enableIntegrations}=0).`,
+  NO_COMPUTER_CONNECTED: `Connect a computer: this hub does not read project files or run git, gh or other commands itself (${HUB_SWITCH_ENV.enableProcesses}=0).`,
+  HUB_PASSWORD_DISABLED: `Password sign-in is switched off on this hub (${HUB_SWITCH_ENV.enablePassword}=0).`,
+  HUB_CONVEX_NOT_CONFIGURED: `GitHub sign-in is off on this hub: no Convex deployment is configured (${HUB_CONVEX_ADDRESS_ENV}).`,
+  HUB_CONVEX_MISMATCH: `This hub starts GitHub sign-in only against its own Convex deployment (${HUB_CONVEX_ADDRESS_ENV}); the request named another.`
+};
+var VARIABLES = {
+  HUB_PROCESSES_DISABLED: HUB_SWITCH_ENV.enableProcesses,
+  HUB_INTEGRATIONS_DISABLED: HUB_SWITCH_ENV.enableIntegrations,
+  NO_COMPUTER_CONNECTED: HUB_SWITCH_ENV.enableProcesses,
+  HUB_PASSWORD_DISABLED: HUB_SWITCH_ENV.enablePassword,
+  HUB_CONVEX_NOT_CONFIGURED: HUB_CONVEX_ADDRESS_ENV,
+  HUB_CONVEX_MISMATCH: HUB_CONVEX_ADDRESS_ENV
+};
+
 // src/handlers/fs.ts
 var BROWSE_ALWAYS_HIDDEN = /* @__PURE__ */ new Set([".git", ".DS_Store", "node_modules"]);
 function createFsHandlers(ctx) {
@@ -21381,14 +21478,16 @@ var ENV_MANIFEST = {
   // (name by what the value IS). `_SECRET` = a key you HOLD and sign with, vs
   // `_TOKEN` = a bearer you PRESENT (SLAYZONE_HUB_TOKEN above).
   SLAYZONE_HUB_AUTH_SECRET: "secret",
-  // Hub-scoped by VALUE: the hub mints it, and it embeds the hub's url, the hub's
-  // TLS cert fingerprint, and a secret verified against the hub's `join_tokens`
+  // Hub-scoped by VALUE: the hub mints it, and it embeds the hub's url and a
+  // secret verified against the hub's `join_tokens`
   // row. `mintJoinToken` binds it to NO computer (computer_id stays NULL until
   // redemption), so any computer can redeem any unused token — there is no computer in
   // the value to name. Rule 2 (name by what the value IS, not who reads it).
   SLAYZONE_HUB_JOIN_TOKEN: "secret",
-  // Entra OIDC client secret (SSO). Env only — never read from hub.config.json,
-  // never logged, never in a terminal.
+  // Retired before it was ever read: Entra sign-in authenticates with a certificate
+  // (SLAYZONE_HUB_SSO_CERT_PATH / _KEY_PATH below), and boot refuses a hub that still
+  // sets this (B7). Still classified `secret` so a leftover value never reaches a
+  // terminal or a log.
   SLAYZONE_HUB_SSO_CLIENT_SECRET: "secret",
   // Per-boot bearer the desktop's `/cap` listener requires on every connection
   // (desktop-bridge-server.ts `verifyClient`). Loopback is NOT trusted there —
@@ -21411,6 +21510,9 @@ var ENV_MANIFEST = {
   // hub-only; where the hub listens
   SLAYZONE_HUB_PUBLIC_ADDRESS: "infra",
   // hub-only; how other machines reach it, written into join tokens
+  // Hub-only; the front ends (IPs/CIDRs, comma-separated) whose X-Forwarded-For names
+  // the client (client-address.ts). Not `_ADDRESS`: these are networks, not an authority.
+  SLAYZONE_HUB_TRUSTED_PROXIES: "infra",
   // Per-hub switches (0|1) replacing SLAYZONE_MODE. Infra: they describe THIS hub
   // process, so a task terminal must not inherit them (a hub started from one would
   // otherwise pick up its parent's switches by accident).
@@ -21421,10 +21523,23 @@ var ENV_MANIFEST = {
   SLAYZONE_HUB_ENABLE_INTEGRATIONS: "infra",
   SLAYZONE_HUB_SSO_TENANT_ID: "infra",
   SLAYZONE_HUB_SSO_CLIENT_ID: "infra",
+  // Paths to the Entra client certificate and its private key, and the MFA switch.
+  // Infra, not secret: a path is not the key (the file's own permissions protect it),
+  // but a task terminal must still never inherit a hub's SSO wiring.
+  SLAYZONE_HUB_SSO_CERT_PATH: "infra",
+  SLAYZONE_HUB_SSO_KEY_PATH: "infra",
+  SLAYZONE_HUB_SSO_REQUIRE_MFA: "infra",
   // Operator-facing hub name (`slay hub ls`/`stop` address a hub by it). Infra,
   // not global: it identifies THIS hub process, so inheriting it into a task
   // terminal — which may target a different hub entirely — would mislabel.
   SLAYZONE_HUB_NAME: "infra",
+  // Days THIS hub keeps session content (T-23, hub session-retention.ts); 0 = off, the
+  // default. Infra like the switches: a hub started from a task terminal must not
+  // inherit its parent's period and start deleting.
+  SLAYZONE_HUB_SESSION_RETENTION_DAYS: "infra",
+  // The Convex deployment (host[:port]) the hub starts GitHub sign-in against — never
+  // a client-named one (T-99). Hub process config, set by the desktop app for its hub.
+  SLAYZONE_HUB_CONVEX_ADDRESS: "infra",
   SLAYZONE_DESKTOP_BRIDGE_ADDRESS: "infra",
   // sidecar→desktop capability bridge + REST proxy
   SLAYZONE_SUPERVISED: "infra",
@@ -21461,7 +21576,8 @@ var ENV_MANIFEST = {
   // --- identity: per-task/agent; overlay re-adds the correct value per spawn ---
   SLAYZONE_TASK_ID: "identity",
   SLAYZONE_PROJECT_ID: "identity",
-  SLAYZONE_SESSION_ID: "identity",
+  // `SLAYZONE_SESSION_ID` (a warm agent's pre-task identity) is RETIRED and
+  // deliberately unlisted: warm agents boot with SLAYZONE_TASK_ID now.
   SLAYZONE_AGENT_ID: "identity",
   SLAYZONE_AGENT_HOOK_URL: "identity",
   // Pairs with _HOOK_URL (where to post / who is posting). The pre-v4 name
@@ -21608,6 +21724,7 @@ function createGitHandlers(ctx) {
         throw err;
       }
     }
+    if (params.deleteBranch !== true) return {};
     if (removedBranch === null) return {};
     const branch = removedBranch.replace(/^refs\/heads\//, "").trim();
     if (!branch) return {};
@@ -21730,39 +21847,6 @@ init_dirs();
 // ../../shared/platform/src/paths.ts
 init_dirs();
 
-// ../../shared/platform/src/hub-switches.ts
-var HUB_SWITCH_ENV = {
-  requireLogin: "SLAYZONE_HUB_REQUIRE_LOGIN",
-  enablePassword: "SLAYZONE_HUB_ENABLE_PASSWORD",
-  enableSso: "SLAYZONE_HUB_ENABLE_SSO",
-  enableProcesses: "SLAYZONE_HUB_ENABLE_PROCESSES",
-  enableIntegrations: "SLAYZONE_HUB_ENABLE_INTEGRATIONS"
-};
-var HUB_SSO_ENV = {
-  tenantId: "SLAYZONE_HUB_SSO_TENANT_ID",
-  clientId: "SLAYZONE_HUB_SSO_CLIENT_ID",
-  /** Secret — env only, never read from `hub.config.json`, never logged. */
-  clientSecret: "SLAYZONE_HUB_SSO_CLIENT_SECRET"
-};
-var HUB_ADDRESS_ENV = {
-  /** Where the hub LISTENS. Renamed from `SLAYZONE_HUB_ADDRESS`, which now only
-   *  means "the hub to connect to" on a computer / `slay`. */
-  listen: "SLAYZONE_HUB_LISTEN_ADDRESS",
-  /** How OTHER machines reach the hub (`host[:port]`, no scheme). */
-  public: "SLAYZONE_HUB_PUBLIC_ADDRESS",
-  /** Signing key of hub-auth. */
-  authSecret: "SLAYZONE_HUB_AUTH_SECRET"
-};
-var LEGACY_HUB_LISTEN_ENV = "SLAYZONE_HUB_ADDRESS";
-var HUB_ALLOWED_WEB_ORIGINS_ENV = "SLAYZONE_HUB_ALLOWED_WEB_ORIGINS";
-var HUB_PROCESS_ENV = [
-  ...Object.values(HUB_SWITCH_ENV),
-  ...Object.values(HUB_SSO_ENV),
-  ...Object.values(HUB_ADDRESS_ENV),
-  LEGACY_HUB_LISTEN_ENV,
-  HUB_ALLOWED_WEB_ORIGINS_ENV
-];
-
 // ../../shared/platform/src/index.ts
 init_fs_utils();
 
@@ -21773,6 +21857,16 @@ init_dirs();
 var import_child_process = require("child_process");
 var import_util3 = require("util");
 var execFileAsync = (0, import_util3.promisify)(import_child_process.execFile);
+var WINDOWS_SHIM = [
+  "@echo off",
+  `for /f "tokens=1 delims=." %%v in ('node -e "process.stdout.write(process.versions.node)"') do set NODE_MAJOR=%%v`,
+  "if %NODE_MAJOR% LEQ 22 (",
+  '  node --experimental-sqlite --no-warnings "%~dp0slay.js" %*',
+  ") else (",
+  '  node --no-warnings "%~dp0slay.js" %*',
+  ")",
+  ""
+].join("\r\n");
 
 // ../../shared/platform/src/shell.ts
 var import_node_fs6 = __toESM(require("node:fs"), 1);
@@ -21814,15 +21908,6 @@ function buildShellInvocation(command) {
 var SLZ_FILE_HOST = "app";
 var SLZ_FILE_PREFIX = `slz-file://${SLZ_FILE_HOST}`;
 
-// ../../shared/platform/src/html-theme-css.ts
-var FORCED_HTML_THEME_CSS = {
-  dark: [
-    "html{filter:invert(90%) hue-rotate(180deg)!important}",
-    "img,video,canvas,svg,iframe{filter:invert(90%) hue-rotate(180deg)!important}"
-  ].join(""),
-  light: ":root{color-scheme:light!important}"
-};
-
 // ../../shared/platform/src/ipc-dedup.ts
 var UNCHANGED = Object.freeze({ __ipc_unchanged__: true });
 
@@ -22484,29 +22569,12 @@ function startComputer(config2, deps = {}) {
   let handle;
   const connectHub = (hubUrl, isPrimary) => {
     const credentialStore = (isPrimary ? deps.credentialStore : void 0) ?? createFileCredentialStore(hubHostFromUrl(hubUrl));
-    const isSecureUrl = (() => {
-      try {
-        return new URL(hubUrl).protocol === "wss:";
-      } catch {
-        return false;
-      }
-    })();
-    const pinnedCertSha256 = config2.pinnedCertSha256 && isSecureUrl ? config2.pinnedCertSha256 : void 0;
-    if (config2.pinnedCertSha256 && !isSecureUrl) {
-      log(
-        "ignoring token-decoded cert fingerprint on a non-wss hub url (pinning requires wss://)",
-        {
-          hubUrl
-        }
-      );
-    }
     let dispatch;
     const dialer = new HubDialer({
       url: hubUrl,
       identity,
       credentialStore,
       ...config2.joinToken && isPrimary ? { joinToken: config2.joinToken } : {},
-      ...pinnedCertSha256 ? { pinnedCertSha256 } : {},
       onHubRequest: (method, params) => dispatch.handle(method, params),
       log
     });
@@ -22671,6 +22739,7 @@ async function main() {
     process.stdout.write(`[computer] ${message}${suffix}
 `);
   };
+  for (const notice of ignoredCertPinNotices()) log(notice);
   if (process.env.SLAYZONE_SUPERVISED !== "1") {
     const { installAgentHooks: installAgentHooks2 } = await Promise.resolve().then(() => (init_agent_hooks2(), agent_hooks_exports));
     await installAgentHooks2(log);