@sleep2agi/agent-network 2.3.0-preview.39 → 2.3.0-preview.40

package/dist/src/opencode-agent-node-pair.d.ts

@@ -1,6 +1,6 @@
-export declare const OPENCODE_AGENT_NETWORK_VERSION = "2.3.0-preview.34";
-export declare const OPENCODE_AGENT_NODE_VERSION = "2.5.0-preview.28";
-export declare const OPENCODE_AGENT_NODE_SPEC = "@sleep2agi/agent-node@2.5.0-preview.28";
+export declare const OPENCODE_AGENT_NETWORK_VERSION = "2.3.0-preview.40";
+export declare const OPENCODE_AGENT_NODE_VERSION = "2.5.0-preview.32";
+export declare const OPENCODE_AGENT_NODE_SPEC = "@sleep2agi/agent-node@2.5.0-preview.32";
 export declare function opencodeExactPairInstallCommand(): string;
 /** Runtime capability advertised by agent-node's operator-facing help. */
 export declare function agentNodeHelpSupportsOpencode(help: string): boolean;

package/dist/src/outbound-tool-names.d.ts

@@ -0,0 +1 @@
+export declare const OUTBOUND_TOOL_NAMES: Set<string>;

package/dist/src/package-mode-preflight.d.ts

@@ -0,0 +1,31 @@
+export interface UmaskVerdict {
+    /** Will a freshly npm-extracted payload fail the (mode & 0o022) === 0 check? */
+    willProduceUnsafeModes: boolean;
+    /** Octal umask string as an operator would type it. */
+    umaskOctal: string;
+    /** Which write bits this umask fails to mask off. */
+    leaks: Array<"group" | "other">;
+}
+/**
+ * Read a umask value the way the package check will experience it.
+ *
+ * A umask bit SET means "withhold this permission". So group-write is withheld
+ * only when 0o020 is set in the umask; umask 0002 withholds other-write and
+ * nothing else, which is exactly the failing case.
+ */
+export declare function judgeUmask(umask: number): UmaskVerdict;
+/** One line for `anet doctor`, or null when there is nothing to say. */
+export declare function describeUmaskRisk(verdict: UmaskVerdict): string | null;
+export interface ExtractedPayload {
+    path: string;
+    uid: number;
+    mode: number;
+}
+/**
+ * Which already-extracted payloads would be rejected right now.
+ *
+ * Reports facts about copies that exist on disk; it never fetches. An empty
+ * result means "nothing extracted yet", which is not the same as "safe" — the
+ * umask verdict is what speaks to the next fetch.
+ */
+export declare function rejectedPayloads(payloads: ExtractedPayload[], processUid: number): ExtractedPayload[];

package/dist/src/tmux-exact-target.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Exact-match tmux target for a session name.
+ *
+ * tmux treats a leading `=` as "this exact name, no prefix matching". Names are
+ * passed to tmux as argv entries, never through a shell, so no quoting belongs
+ * here — callers that build a copy-pasteable command for a human should shell-
+ * quote the result themselves.
+ */
+export declare function exactSession(name: string): string;
+/**
+ * True when this target is already pinned to an exact session.
+ *
+ * Applying the prefix twice would look for a session literally named `=x`.
+ */
+export declare function isExactTarget(target: string): boolean;
+/** Idempotent form, for call sites that may receive either shape. */
+export declare function ensureExactSession(nameOrTarget: string): string;
+/** One row of `tmux list-panes -a -F '#{session_name}\t#{window_index}.#{pane_index}'`. */
+export interface PaneRow {
+    session: string;
+    /** `window.pane`, e.g. `0.0`. */
+    coord: string;
+}
+export declare function parsePaneRows(listOutput: string): PaneRow[];
+/**
+ * Pane target for a session, or null when that exact session has no pane.
+ *
+ * Matching is exact string equality on the session name — the whole point is to
+ * not hand tmux a name it might prefix-match, and to not hand it a `=` form it
+ * cannot resolve for non-ASCII names.
+ */
+export declare function paneTargetFor(listOutput: string, sessionName: string): string | null;
+/** The format string the two functions above expect. */
+export declare const PANE_LIST_FORMAT = "#{session_name}\t#{window_index}.#{pane_index}";

package/dist/src/tmux-pane-prompt.d.ts

@@ -0,0 +1,22 @@
+/** A prompt the watcher knows how to answer, or null. */
+export type PanePrompt = "dev-channels" | "folder-trust";
+/**
+ * Which known prompt (if any) the pane is currently blocking on.
+ *
+ * Dev-channels is checked FIRST, even though it appears second in time. The two
+ * prompts are sequential — trust, then channels — so a capture showing both
+ * means the trust prompt is already answered and only its text is still sitting
+ * in the pane. Classifying that as "folder-trust" would make a watcher that has
+ * already answered trust ignore the prompt it was waiting for, and the node
+ * would hang exactly as if the fix had never been made. Preferring the later
+ * prompt keeps a stale line of scrollback from outranking the live prompt.
+ */
+export declare function classifyPanePrompt(pane: string): PanePrompt | null;
+/**
+ * Best-effort one-line explanation of why a detached start died, taken from the
+ * dead pane's own output.
+ *
+ * Returns null when the pane holds nothing that looks like a refusal — the
+ * caller must then fall back to a generic message rather than inventing one.
+ */
+export declare function extractStartFailureReason(pane: string): string | null;

package/dist/src/unsafe-package-path-reason.d.ts

@@ -0,0 +1,17 @@
+export interface PathModeFacts {
+    /** Owner uid of the path. */
+    uid: number;
+    /** Permission bits (st_mode & 0o777). */
+    mode: number;
+    /** uid of the process doing the check. */
+    processUid: number;
+}
+export type UnsafePathReason = "owner" | "group-writable" | "world-writable" | null;
+/** Which condition makes this path unsafe to execute from, if any. */
+export declare function classifyUnsafePath(facts: PathModeFacts): UnsafePathReason;
+/**
+ * Operator-facing explanation. Names the path, the offending bits, and the
+ * command that fixes it — a message that says only "unsafe" leaves the reader
+ * guessing between four different conditions.
+ */
+export declare function describeUnsafePath(path: string, facts: PathModeFacts): string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sleep2agi/agent-network",
-  "version": "2.3.0-preview.39",
+  "version": "2.3.0-preview.40",
   "description": "AI Agent Network CLI — Local-first multi-agent orchestration across 6 runtimes (Claude Code CLI / Claude Agent SDK / Codex SDK / Codex app-server / Grok Build ACP / OpenCode CLI) and 8+ LLM providers. Apache 2.0.",
   "type": "module",
   "main": "dist/src/client.js",
@@ -12,7 +12,7 @@
     }
   },
   "bin": {
-    "anet": "dist/bin/cli.js"
+    "anet": "dist/bin/anet.cjs"
   },
   "files": [
     "dist"
@@ -20,7 +20,7 @@
   "scripts": {
     "typecheck": "tsc --noEmit",
     "test:feishu-bridge": "bun tests/feishu-bridge-ackplaceholder.test.ts",
-    "build": "bun build src/client.ts --outdir dist/src --target node --minify && bun build bin/cli.ts --outdir dist/bin --target node --minify --external @sleep2agi/commhub-server --external bun:sqlite --external '../../server/*' && bun build src/node-server.ts --outdir dist/src --target node --minify && bun build src/im/feishu/worker.ts --outdir dist/src/im/feishu --target node --minify --external @larksuiteoapi/node-sdk && tsc --emitDeclarationOnly --declaration --outDir dist && npx javascript-obfuscator dist/bin/cli.js --output dist/bin/cli.js --compact true --string-array true --string-array-encoding base64 && npx javascript-obfuscator dist/src/client.js --output dist/src/client.js --compact true --string-array true && npx javascript-obfuscator dist/src/node-server.js --output dist/src/node-server.js --compact true --string-array true",
+    "build": "bun build src/client.ts --outdir dist/src --target node --minify && bun build bin/cli.ts --outdir dist/bin --target node --minify --external @sleep2agi/commhub-server --external bun:sqlite --external '../../server/*' && bun build src/node-server.ts --outdir dist/src --target node --minify && bun build src/im/feishu/worker.ts --outdir dist/src/im/feishu --target node --minify --external @larksuiteoapi/node-sdk && tsc --emitDeclarationOnly --declaration --outDir dist && npx javascript-obfuscator dist/bin/cli.js --output dist/bin/cli.js --compact true --string-array true --string-array-encoding base64 && npx javascript-obfuscator dist/src/client.js --output dist/src/client.js --compact true --string-array true && npx javascript-obfuscator dist/src/node-server.js --output dist/src/node-server.js --compact true --string-array true && cp bin/anet.cjs dist/bin/anet.cjs",
     "prepublishOnly": "npm run build"
   },
   "keywords": [