npm - @sleep2agi/agent-node - Versions diffs - 2.5.0-preview.135 → 2.5.0-preview.136 - Mend

@sleep2agi/agent-node 2.5.0-preview.135 → 2.5.0-preview.136

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (2) hide show

package/dist/cli.js +2 -2
package/package.json +1 -1

package/dist/cli.js CHANGED Viewed

@@ -116,7 +116,7 @@ ANET_BIN_REAL="$(node -e 'console.log(require("fs").realpathSync(process.argv[1]
 # or keep the pin in a file you own (no /etc, no sudo) — put ANET_DAEMON_PATH_CONF in the daemon environment so it survives a restart:
 ANET_BIN_REAL="$(node -e 'console.log(require("fs").realpathSync(process.argv[1]))' "$(command -v anet)")" && mkdir -p "$HOME/.anet" && printf 'ANET_BIN_ABS=%s\\n' "$ANET_BIN_REAL" > "$HOME/.anet/path.conf" && export ANET_DAEMON_PATH_CONF="$HOME/.anet/path.conf"`);if(!N1A(B.abs))throw iI("anet_bin_shape",`not absolute: ${B.abs}`,`export ANET_BIN_ABS=$(node -e "console.log(require('fs').realpathSync(process.argv[1]))" ${sG(B.abs)})`);let E=Rf(B.abs);if(!X1A(E,B.abs,Q))throw iI("anet_bin_shape",`contains symlink: ${B.abs} -> ${E}`,`export ANET_BIN_ABS=${sG(E)}`);Z1A(B.abs);let g=mH(B.abs);if(Q==="win32")L1A();else{if(g.uid!==0&&A.ANET_DAEMON_STRICT_ROOT_BIN==="1")throw iI("anet_bin_permission",`owner not root (uid=${g.uid})`,`sudo chown root:root ${sG(B.abs)} || unset ANET_DAEMON_STRICT_ROOT_BIN`);if((g.mode&18)!==0){let U=(g.mode&511).toString(8),J=(g.mode&16)!==0;throw iI("anet_bin_permission",`writable by group/other (mode=${U})`,`chmod go-w ${sG(B.abs)}`+(J?"   # 立即可用,但若它是 npm 装的,下次 `npm install -g` 会按安装时的 umask 改回去;"+" 持久修法是在 `umask 0022` 下重装(见 #1353)":""))}if((g.mode&73)===0)throw iI("anet_bin_permission","not executable",`chmod +x ${sG(B.abs)}`)}if(B.sha256){let U=$1A("sha256").update(O0(B.abs)).digest("hex");if(U!==B.sha256)throw Error(`anet_bin_unsafe_path: sha256 mismatch (install=${B.sha256.slice(0,8)} vs now=${U.slice(0,8)})`)}return B.abs}function jQ(){if(tG)return tG;return tG=q0(),tG}function K1A(){tG=null}function qf(A){return A==="darwin"?`${H1A}:${jf}`:jf}function w1A(A){return A==="win32"?Pf:Tf}function Dg(A,Q){if(Q==="win32"){let C=A.USERPROFILE||A.HOME||(A.HOMEDRIVE&&A.HOMEPATH?A.HOMEDRIVE+A.HOMEPATH:"");if(!C)throw Error("minimalEnv: cannot resolve Windows child HOME (USERPROFILE, HOME, and HOMEDRIVE+HOMEPATH all missing). Configure at least USERPROFILE for the daemon service account.");return C}let B=A.HOME;if(!B)throw Error("minimalEnv: cannot resolve POSIX child HOME (env.HOME missing). Ensure the daemon service unit sets HOME.");return B}function Sf(A=process.platform,Q=process.execPath){let B=fH(Q),C=qf(A);if(C.split(":").includes(B))return C;return`${B}:${C}`}function kf(A,Q){let B=A.trim();if(!B||/[\0\r\n]/.test(B))return null;if(Q==="win32"){if(B.includes(";"))return null;if(!yJ.isAbsolute(B))return null;return B.replace(/[\\/]+$/,"")||B}if(!B.startsWith("/")||B.includes(":"))return null;return B.length>1?B.replace(/\/+$/,""):B}function uH(A,Q=process.platform){if(!Array.isArray(A))return[];let B=[],C=new Set;for(let I of A){if(typeof I!=="string")continue;let E=kf(I,Q);if(!E||C.has(E))continue;C.add(E),B.push(E)}return B}function h1(A,Q=process.platform){return f1=uH(A,Q),f1}function j1A(A,Q=process.platform){return eG=uH(A,Q),eG}function _1A(){f1=[],eG=[]}function R1A(A){if(eG.length===0)return A;return`${eG.join(":")}:${A}`}function vf(A,Q,B=process.platform){let C=new Set(A.split(":").filter(Boolean)),I=[];for(let E of Q){let g=kf(E,B);if(!g||C.has(g))continue;C.add(g),I.push(g)}if(I.length===0)return A;return`${A}:${I.join(":")}`}function bf(A){return`missing_cli: 新节点的 PATH 上找不到可用的 ${A} 命令`+`(或 \`${A} --version\` 运行失败)。`+`把该命令所在目录的绝对路径写进这个 daemon 节点 config.json 的 ${xf}`+"(字符串数组),然后重启 daemon。"}function nA(A={},Q=process.platform,B=process.env){let C={};for(let J of yf){let Y=B[J];if(typeof Y==="string"&&Y!=="")C[J]=Y}let I={},E=w1A(Q);for(let[J,Y]of Object.entries(A)){if(YC(J))throw Error(`minimalEnv: reserved env key ${J} reached fork (denylist gap — investigate)`);if(E.has(J))throw Error(`minimalEnv: fixed env key ${J} reached fork`);I[J]=Y}let g=Dg(B,Q),U={...C,...I,PATH:R1A(vf(Sf(Q),f1,Q)),HOME:g,LANG:B.LANG||"C.UTF-8"};if(Q==="win32"){if(U.USERPROFILE=g,/^[A-Za-z]:/.test(g))U.HOMEDRIVE=g.slice(0,2),U.HOMEPATH=g.slice(2);else if(B.HOMEDRIVE&&B.HOMEPATH)U.HOMEDRIVE=B.HOMEDRIVE,U.HOMEPATH=B.HOMEPATH}return U}function cH(A,Q){switch(A){case"daemonProvider":if(!Y1(Q))throw Error("flag_value_invalid:daemonProvider");return;case"opencodeGeneration":if(Q!=="v1"&&Q!=="v2")throw Error(`flag_value_invalid:${A}:must be v1 or v2`);return;case"opencodeUnsafeTools":if(typeof Q!=="boolean")throw Error(`flag_value_invalid:${A}:must be boolean`);return;case"permissionMode":if(typeof Q!=="string"||!q1A.has(Q))throw Error(`flag_value_invalid:${A}:must be default/acceptEdits/plan/bypassPermissions`);return;case"dangerouslySkipPermissions":if(typeof Q!=="boolean")throw Error(`flag_value_invalid:${A}:must be boolean`);return;case"maxTurns":if(!Number.isInteger(Q)||Q<1||Q>9999)throw Error(`flag_value_invalid:${A}:must be integer 1..9999`);return;case"budget":if(typeof Q!=="number"||!Number.isFinite(Q)||Q<0||Q>1000)throw Error(`flag_value_invalid:${A}:must be number 0..1000`);return;case"timeout":if(!P5(Q))throw Error(`flag_value_invalid:${A}:timeout is in milliseconds: 0 (no limit) or an integer ${q5}..${T5}`);return;case"copresence":if(typeof Q!=="boolean")throw Error(`flag_value_invalid:${A}:must be boolean`);return;default:if(WJ.has(A)){let B=_G(A,Q,null);if(B)throw Error(`flag_value_invalid:${A}:${B.reason}`);return}throw Error(`flag_key_unknown:${A}`)}}function T1A(A){return A.replace(/([A-Z])/g,"-$1").toLowerCase()}function lH(A,Q){for(let B of["opencodeGeneration","opencodeUnsafeTools"]){if(!Object.prototype.hasOwnProperty.call(Q,B))continue;if(cH(B,Q[B]),A!=="opencode-cli")throw Error(`flag_not_applicable_to_runtime:${B}:${A}`)}if(Object.prototype.hasOwnProperty.call(Q,"opencodeUnsafeTools")&&Q.opencodeGeneration!=="v2")throw Error("opencode_unsafe_requires_v2:opencodeUnsafeTools requires explicit opencodeGeneration=v2");if(Q.opencodeGeneration==="v2"&&Q.opencodeUnsafeTools!==!0)throw Error("opencode_v2_requires_unsafe_opt_in:V2 preview enables every local tool; trusted tasks only. Explicit opencodeUnsafeTools=true required.")}function uf(A){let Q=A.flags||{};if(A.runtime!=="opencode-cli")return;if(Q.opencodeGeneration!=="v2"||Q.opencodeUnsafeTools!==!0)return;let B=A.model;if(!(typeof B==="string"&&B.length>0&&B.length<=100&&ff.test(B)&&!hf.test(B)&&B.includes("/")&&B.indexOf("/")===B.lastIndexOf("/")))throw Error("opencode_v2_requires_provider_model:OpenCode V2 uses the installed OpenCode provider/model (exactly one slash). This API does not take an anet provider preset.")}function cf(A){let Q={...A.flags||{}};delete Q.daemonProvider,lH(A.runtime,Q);for(let[U,J]of Object.entries(Q)){if(!WJ.has(U))continue;let Y=_G(U,J,A.runtime);if(Y)throw Error(`flag_value_invalid:${U}:${Y.reason}`)}let B=Q.opencodeGeneration;delete Q.opencodeGeneration;let C=Q.copresence===!0;delete Q.copresence;let I=Q.copresenceFullAccess;if(delete Q.copresenceFullAccess,C&&A.runtime==="codex-app-server")hb(Q);let E=C&&A.runtime==="codex-app-server"&&I!==!1,g={...C&&A.runtime==="codex-app-server"?{codexCopresence:!0}:{},...E?{codexCopresenceFullAccess:!0}:{}};if(B==="v1"||B==="v2")return{flags:Q,opencodeGeneration:B,...B==="v2"?{opencodeMode:"copresence"}:{},...g};return{flags:Q,...g}}function lf(A){for(let B of["opencodeGeneration","opencodeUnsafeTools"])if(Object.prototype.hasOwnProperty.call(A,B))throw Error(`flag_location_invalid:${B}:use node_spec.flags`);{let B=f5(A.name);if(!B.ok)throw Error(`node_name_invalid:${B.error}:${B.message}`);if(B.name!==A.name)throw Error("node_name_invalid:not_normalized")}if(!mf.has(A.runtime))throw Error("runtime_invalid");if(A.model!==void 0&&A.model!==null&&(A.model.length===0||A.model.length>100||!ff.test(A.model)||hf.test(A.model)))throw Error("model_invalid");if(Array.isArray(A.channels)&&A.channels.length>0)throw Error("channels_not_supported_in_p1");if(A.flags?.daemonProvider!==void 0&&(A.runtime!=="codex-app-server"||A.flags.copresence!==!0))throw Error("flag_not_applicable_to_runtime:daemonProvider");if(A.flags?.daemonProvider!==void 0&&(!Y1(A.flags.daemonProvider)||A.model!==A.flags.daemonProvider.model))throw Error("provider_create_model_mismatch");let Q=["node","create",A.name,"--runtime",A.runtime];if(A.model)Q.push("--model",A.model);lH(A.runtime,A.flags||{}),uf(A);for(let[B,C]of Object.entries(A.flags||{})){if(!["permissionMode","dangerouslySkipPermissions","maxTurns","budget","timeout","copresence","opencodeGeneration","opencodeUnsafeTools","daemonProvider",...WJ].includes(B))throw Error(`flag_key_unknown:${B}`);if(cH(B,C),B==="opencodeUnsafeTools"){if(C===!0)Q.push("--opencode-unsafe-tools");continue}if(B==="copresence"){if(!P1A.has(A.runtime))throw Error(`flag_not_applicable_to_runtime:${B}:${A.runtime}`);if(C===!0)Q.push("--copresence");continue}if(WJ.has(B)||B==="daemonProvider")continue;Q.push(`--${T1A(B)}`,String(C))}return Q}function S1A(A){return Object.entries(A).map(([Q,B])=>{let C=String(B).replace(/\\/g,"\\\\").replace(/"/g,"\\\"").replace(/\n/g,"\\n").replace(/\r/g,"\\r");return`${Q}="${C}"`}).join(`
 `)+`
-`}function m1(A,Q,B,C){let I=UI(A,".anet","nodes",Q,tC);TG(I,C(B))}async function x1A(A){let Q=await A.callCommHub("list_my_pending_create_requests",{});if(!Q?.ok){A.warn(`[create-node] pending reconcile failed: ${Q?.error||"unknown"}`);return}let B=Array.isArray(Q.requests)?Q.requests:[],C=0;for(let E of B){let g=typeof E?.request_id==="string"?E.request_id:"";if(!g)continue;if(A.recentlyHandledRequestIds?.has(g))continue;A.recentlyHandledRequestIds?.add(g);try{await A.handleCreateNodeDoorbell({request_id:g}),C+=1}catch(U){A.recentlyHandledRequestIds?.delete(g),A.warn(`[create-node] pending reconcile handler failed for ${g}: ${U?.message||U}`)}}let I=Array.isArray(Q.clone_requests)?Q.clone_requests:[];if(I.length>0&&!A.handleCloneNodeDoorbell)A.warn(`[clone-node] ${I.length} pending clone request(s) not replayed (no clone handler)`);for(let E of I){let g=typeof E?.request_id==="string"?E.request_id:"";if(!g||!A.handleCloneNodeDoorbell)continue;if(A.recentlyHandledRequestIds?.has(g))continue;A.recentlyHandledRequestIds?.add(g);try{await A.handleCloneNodeDoorbell({request_id:g}),C+=1}catch(U){A.recentlyHandledRequestIds?.delete(g),A.warn(`[clone-node] pending reconcile handler failed for ${g}: ${U?.message||U}`)}}if(C>0)A.log(`[create-node] pending reconcile handled ${C} request(s)`)}function u1(A,Q){let B=UI(A,".anet"),C=UI(B,"config.json");try{yH(B,{recursive:!0,mode:448})}catch{}D0(C);let I={};try{I=JSON.parse(O0(C,"utf-8"))}catch{}if(I.hub!==Q)I.hub=Q,FQ(C,I)}function pf(A,Q){if(A&&A.code===0&&!A.signal&&Q)return{started:!0};let B=!A?"exit not observed":A.signal?`signal ${A.signal}`:`exit code ${A.code}`;return{started:!1,how:Q?B:`${B}, no identity marker written`}}async function k1A(A,Q){let{request_id:B}=A,C=await Q.callCommHub("get_create_request",{request_id:B});if(C?.error==="clone_request"){Q.warn(`[create-node] ${B} is a clone request; not acking from the create handler`);return}if(!C?.ok||!C.node_spec||!C.child_token){Q.warn(`[create-node] get_create_request failed: ${C?.error||"unknown"}`),await Q.callCommHub("ack_create_request",{request_id:B,status:"failed",error:C?.error||"get_failed"}).catch(()=>{});return}if(Q.allowedRuntimes&&Q.allowedRuntimes.length>0&&!Q.allowedRuntimes.includes(C.node_spec.runtime)){Q.warn(`[create-node] runtime '${C.node_spec.runtime}' not in daemon's allowed_runtimes: [${Q.allowedRuntimes.join(",")}]`),await Q.callCommHub("ack_create_request",{request_id:B,status:"rejected",error:`runtime_not_in_local_allowlist: ${C.node_spec.runtime}`}).catch(()=>{});return}let I;try{I=lf(C.node_spec)}catch(w){Q.warn(`[create-node] spec rejected by daemon-side validate: ${w?.message||w}`),await Q.callCommHub("ack_create_request",{request_id:B,status:"rejected",error:`validate: ${w?.message||w}`}).catch(()=>{});return}if(C.node_spec.flags?.daemonProvider&&!Q.providerScope){await Q.callCommHub("ack_create_request",{request_id:B,status:"rejected",error:"provider_create_scope_unavailable"}).catch(()=>{});return}let E=nA(),g=await qJ(C.node_spec.runtime,E.PATH??"",E,{resolveOnPath:Eg,execVersion:TJ},uG);if(g.cli==="missing"&&g.command){let w=bf(g.command);Q.warn(`[create-node] ${w}`),await Q.callCommHub("ack_create_request",{request_id:B,status:"rejected",error:w.slice(0,800)}).catch(()=>{});return}let U=NH(C.node_spec.flags?.opencodeGeneration,g);if(U){Q.warn(`[create-node] ${U}`),await Q.callCommHub("ack_create_request",{request_id:B,status:"rejected",error:U.slice(0,800)}).catch(()=>{});return}let J;try{J=jQ()}catch(w){Q.warn(`[create-node] anet_bin_unsafe_path: ${w?.message||w}`),await Q.callCommHub("ack_create_request",{request_id:B,status:"failed",error:`bin: ${w?.message||w}`}).catch(()=>{});return}try{yH(Q.workDir,{recursive:!0,mode:448})}catch{}let Y=zJ(C.node_spec.name,C.node_spec.workdir),F=Q.workDir,G=C.node_spec.workdir;if(G!==void 0&&G!==null)try{F=B1(G,Y,{home:Dg(process.env,process.platform),platform:process.platform}),Y=zJ(C.node_spec.name,F),Q.log(`[create-node] child workdir: ${F}`)}catch(w){let l=w instanceof HQ?w.message:`workdir_invalid:${w?.message||w}`;Q.warn(`[create-node] workdir rejected: ${l}`),await Q.callCommHub("ack_create_request",{request_id:B,status:"rejected",error:`validate: ${l}`.slice(0,800)}).catch(()=>{});return}try{u1(Dg(process.env,process.platform),Q.hubUrl)}catch(w){Q.warn(`[create-node] global config write failed (continuing): ${w?.message||w}`)}let D;if(C.node_spec.runtime==="opencode-cli"&&C.node_spec.flags?.opencodeGeneration==="v2"&&C.node_spec.flags?.opencodeUnsafeTools===!0)try{let w=Dg(process.env,process.platform);D=Zy({projectDir:F,homeDir:w,xdgConfigHome:process.env.XDG_CONFIG_HOME});let l=typeof C.node_spec.model==="string"&&C.node_spec.model.trim()?C.node_spec.model.trim():void 0;Wy(D,l);let x=C.env_blob??{};for(let o of D.credentialEnv)if(typeof x[o]!=="string"||x[o].length===0)throw new EQ("opencode_v2_provider_credential_missing",`OpenCode provider ${JSON.stringify(D.providerId)} requires ${o}, which was not in the create env. The value is not printed.`);Q.log(`[create-node] OpenCode V2 model ${D.model} matches this machine's OpenCode config`)}catch(w){let l=w instanceof Error?w.message:String(w);Q.warn(`[create-node] ${l}`),await Q.callCommHub("ack_create_request",{request_id:B,status:"rejected",error:`validate: ${l}`.slice(0,800)}).catch(()=>{});return}let N=UI(F,".anet","nodes",Y);{let w;try{let l=JSON.parse(O0(UI(N,"config.json"),"utf-8"));w=l?.alias??l?.node_name}catch{}if(w!==void 0&&w!==C.node_spec.name){let l=`node_dir_taken: ${UI(".anet","nodes",Y)} in ${F} already holds node "${String(w).slice(0,80)}"`;Q.warn(`[create-node] ${l}`),await Q.callCommHub("ack_create_request",{request_id:B,status:"rejected",error:`validate: ${l}`.slice(0,800)}).catch(()=>{});return}}if(C.node_spec.runtime!=="opencode-cli")try{yH(N,{recursive:!0,mode:448})}catch{}let V=UI(N,"config.json"),{flags:W,codexCopresence:Z,codexCopresenceFullAccess:M,opencodeGeneration:X,opencodeMode:L}=cf(C.node_spec),K=C.node_spec.runtime==="opencode-cli"?X??"v1":X,R=C.node_spec.runtime==="opencode-cli"&&K==="v2"&&L==="copresence";try{let w={node_id:`node_${B.replace(/^cr_/,"")}`,node_name:C.node_spec.name,alias:C.node_spec.name,runtime:C.node_spec.runtime,...C.network_id?{network_id:C.network_id}:{},...D?{model:D.model}:C.node_spec.model?{model:C.node_spec.model}:{},...D&&D.credentialEnv.length?{env:Object.fromEntries(D.credentialEnv.map((x)=>[x,{_envRef:x}]))}:{},hub:Q.hubUrl,token:C.child_token,...Object.keys(W).length?{flags:W}:{},...Z?{codexCopresence:Z}:{},...M?{codexCopresenceFullAccess:M}:{},...K?{opencodeGeneration:K}:{},...L?{opencodeMode:L}:{}},l=!1;if(C.node_spec.flags?.daemonProvider)try{l=JSON.parse(O0(V,"utf8")).daemonProviderCreation?.request_id===B}catch{}if(l);else if(C.node_spec.runtime==="opencode-cli"){if(Z1(N,w),D)nb(N,Vy(D))}else FQ(V,w);if(!l&&Z&&C.node_spec.runtime==="codex-app-server")try{F1(UI(N,"codex-home")),Q.log(`[create-node] seeded co-presence yolo config.toml under ${N}`)}catch(x){Q.warn(`[create-node] codex-home yolo seed failed: ${x?.message||x}`)}Q.log(`[create-node] wrote child config: ${V}`)}catch(w){Q.warn(`[create-node] write child config failed: ${w?.message||w}`),await Q.callCommHub("ack_create_request",{request_id:B,status:"failed",error:`write_config: ${w?.message||w}`}).catch(()=>{});return}try{I1(Q.workDir,C.node_spec.name,F)}catch(w){Q.warn(`[create-node] child workdir registry write failed: ${w?.message||w}`),await Q.callCommHub("ack_create_request",{request_id:B,status:"failed",error:`workdir_registry: ${w?.message||w}`.slice(0,800)}).catch(()=>{});return}if(C.env_blob&&Object.keys(C.env_blob).length>0)try{m1(F,Y,C.env_blob,Q.serializeEnvLocal)}catch(w){Q.warn(`[create-node] secrets.env write failed: ${w?.message||w}`)}if(Q.providerScope)try{FQ(UI(F,".anet","nodes",Y,"secrets-source.json"),{schema:1,daemon_dir:UI(Q.workDir,".anet","nodes",Q.providerScope.alias),network_id:Q.providerScope.networkId,daemon_node_id:Q.providerScope.daemonId,node_id:`node_${B.replace(/^cr_/,"")}`})}catch{await Q.callCommHub("ack_create_request",{request_id:B,status:"failed",error:"secret_source_write_failed"}).catch(()=>{});return}if(C.node_spec.flags?.daemonProvider)try{let w=JSON.stringify({request_id:B,alias:C.node_spec.name,network_id:Q.providerScope.networkId,daemon_node_id:Q.providerScope.daemonId,selection:C.node_spec.flags.daemonProvider}),l=await new Promise((QA,BA)=>{let MA=G1A(process.execPath,[J,"daemon","provider","initialize",Q.providerScope.alias],{cwd:Q.workDir,env:nA(),timeout:uG,maxBuffer:65536,encoding:"utf8",windowsHide:!0},(S,EA)=>S?BA(Error("provider_initialization_unavailable")):QA(EA));MA.stdin?.on("error",()=>BA(Error("provider_initialization_unavailable"))),MA.stdin?.end(w)}),x=JSON.parse(l),o=x.initialization,h=C.node_spec.flags.daemonProvider;if(!Y1(h)||x.ok!==!0||o?.status!=="initialized"||o.request_id!==B||o.node_id!==`node_${B.slice(3)}`||o.provider_revision!==h.revision||o.provider_id!==h.provider_id||o.auth_id!==h.auth_id||o.model!==h.model||o.verification!=="configuration_only")throw Error("provider_initialization_unconfirmed")}catch{await Q.callCommHub("ack_create_request",{request_id:B,status:"failed",error:"provider_initialization_unconfirmed"}).catch(()=>{});return}let q=-1,c=Date.now(),m=null,k=`node_${B.replace(/^cr_/,"")}`;try{let l=(Q.spawnChild??((o,h,QA)=>D1A(o,h,{cwd:QA.cwd,env:QA.env,stdio:["ignore","ignore","ignore"],detached:!0})))(J,["node","start",Y],{cwd:F,env:nA()});q=l.pid||-1;let x=q;l.once("exit",(o,h)=>{if(m={code:o,signal:h},Z||R)Promise.resolve().then(() => (uB(),pI)).then(({forgetSpawnedChildIfPid:QA})=>{QA(k,x)}).catch(()=>{})});try{l.stdin?.destroy()}catch{}try{l.stdout?.destroy()}catch{}try{l.stderr?.destroy()}catch{}if(l.unref(),Q.log(`[create-node] spawned child '${C.node_spec.name}' pid=${q}`),q>0)try{process.kill(q,0),Q.log(`[create-node] post-spawn kill-0 verify OK: pid=${q} alive`)}catch(o){let h=`child died immediately after spawn: ${o?.message||o}`;Q.warn(`[create-node] ${h}`),await Q.callCommHub("ack_create_request",{request_id:B,status:"failed",error:h}).catch(()=>{});return}}catch(w){let l=(w?.message||String(w)).slice(0,800);Q.warn(`[create-node] fork (start) failed: ${l}`),await Q.callCommHub("ack_create_request",{request_id:B,status:"failed",error:`fork_start: ${l}`}).catch(()=>{});return}if(q>0&&typeof C.node_spec.name==="string")try{let w=`node_${B.replace(/^cr_/,"")}`,{recordSpawnedChild:l}=await Promise.resolve().then(() => (uB(),pI));l(w,C.node_spec.name,q)}catch(w){Q.warn(`[create-node] childrenMap record failed (stop-daemon won't see this child): ${w?.message||w}`)}let d=Q.capabilityCheckMs??5000;if(await new Promise((w)=>setTimeout(w,d)),R){let w=c+(Q.capabilityCheckMs===void 0?35000:d);while(!m&&Date.now()<w)await new Promise((BA)=>setTimeout(BA,50));let l=m,x=JH(l)?await M1(N,V,c,w):YH(N,V,c),{forgetSpawnedChildIfPid:o,recordSpawnedChild:h}=await Promise.resolve().then(() => (uB(),pI));if(o(k,q),JH(l)&&x.ok){h(k,C.node_spec.name,x.bridgePid),Q.log(`[create-node] +${d}ms: OpenCode launcher exited 0; live bridge/serve/TUI generation verified`),await Q.callCommHub("ack_create_request",{request_id:B,status:"started",child_pid:x.bridgePid,launch_verified:!0}).catch((BA)=>Q.warn(`[create-node] ack failed: ${BA?.message||BA}`));return}let QA=`OpenCode launcher exit=${l?.code??"unknown"} signal=${l?.signal??"none"}; ${x.ok?"live generation but unsuccessful launcher":x.reason}`;Q.warn(`[create-node] runtime_capability_check_failed: ${QA}`),await Q.callCommHub("ack_create_request",{request_id:B,status:"runtime_capability_check_failed",error:QA,runtime:C.node_spec.runtime}).catch(()=>{});return}let y=!1;if(q>0)try{process.kill(q,0),y=!0,Q.log(`[create-node] +${d}ms capability check OK: pid=${q} still alive`)}catch(w){if(Z){for(let BA=0;BA<10&&!m;BA++)await new Promise((MA)=>setTimeout(MA,50));let x=m,o=(()=>{try{return mH(UI(N,"copresence-identity.json")),!0}catch{return!1}})();try{let{forgetSpawnedChildIfPid:BA}=await Promise.resolve().then(() => (uB(),pI));BA(k,q)}catch{}let h=pf(x,o);if(h.started){Q.log(`[create-node] +${d}ms: co-presence launcher pid=${q} exited 0 with its identity marker on disk — tmux sessions own the node now`),await Q.callCommHub("ack_create_request",{request_id:B,status:"started",child_pid:q}).catch((BA)=>Q.warn(`[create-node] ack failed: ${BA?.message||BA}`));return}let QA=`codex co-presence launcher ended within ${d}ms (${h.how}) — run \`anet node start ${Y}\` in ${F} to see why`;Q.warn(`[create-node] runtime_capability_check_failed: ${QA}`),await Q.callCommHub("ack_create_request",{request_id:B,status:"runtime_capability_check_failed",error:QA.slice(0,800),runtime:C.node_spec.runtime}).catch(()=>{});return}let l=`child died within ${d}ms post-spawn (likely missing runtime binary or auth for runtime='${C.node_spec.runtime}'): ${w?.message||w}`;Q.warn(`[create-node] runtime_capability_check_failed: ${l}`);try{let{forgetSpawnedChild:x}=await Promise.resolve().then(() => (uB(),pI)),o=x(`node_${B.replace(/^cr_/,"")}`);Q.log(`[create-node] childrenMap rollback after capability failure: removed=${o}`)}catch(x){Q.warn(`[create-node] childrenMap rollback failed: ${x?.message||x}`)}await Q.callCommHub("ack_create_request",{request_id:B,status:"runtime_capability_check_failed",error:l.slice(0,800),runtime:C.node_spec.runtime}).catch(()=>{});return}await Q.callCommHub("ack_create_request",{request_id:B,status:"started",child_pid:q}).catch((w)=>Q.warn(`[create-node] ack failed: ${w?.message||w}`))}function v1A(A=process.env,Q=process.platform){try{return{state:"ready",abs:q0(A,Q)}}catch(B){return{state:"blocked",code:B?.anetBinCode??"anet_bin_unknown",detail:B instanceof Error?B.message:String(B)}}}var hH=!1,tG=null,jf="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",H1A="/opt/homebrew/bin:/opt/homebrew/sbin",Tf,Pf,SiA,xf="daemonExtraPath",f1,eG,yf,_f="[a-zA-Z0-9._:\\-]+",ff,hf,mf,O1A,q1A,P1A;var uQ=H(()=>{jU();m5();vG();$0();RG();u5();eE();K2();AH();My();n5();X1();cG();Tf=new Set(["PATH","HOME","LANG"]),Pf=new Set(["PATH","HOME","LANG","USERPROFILE","HOMEDRIVE","HOMEPATH"]);SiA=new Set([...Tf,...Pf]);f1=[],eG=[];yf=["USER","LOGNAME","HTTPS_PROXY","https_proxy","HTTP_PROXY","http_proxy","ALL_PROXY","all_proxy","NO_PROXY","no_proxy"];ff=new RegExp(`^${_f}(?:/${_f})?$`),hf=/(^|\/)\.+(\/|$)/,mf=new Set(["claude-agent-sdk","claude-code-cli","codex-sdk","codex-app-server","grok-build-acp","grok-build-cli","opencode-cli"]),O1A={VALID_RUNTIMES:mf},q1A=new Set(["default","acceptEdits","plan","bypassPermissions"]);P1A=new Set(["codex-app-server"])});import{execFileSync as e1A}from"child_process";import{createHash as AVA}from"crypto";import{closeSync as QVA,constants as Yh,existsSync as BVA,fstatSync as Fh,lstatSync as n1,openSync as IVA,readFileSync as Nh,readSync as CVA,realpathSync as cJ,statSync as A3}from"fs";import{basename as Gh,delimiter as EVA,dirname as FE,isAbsolute as a1,join as lJ,relative as Vh,resolve as rH,sep as gVA}from"path";function B3(A){return RI("v1",A)}function Wh(A){if(A===GE||!Q3.includes(A))return null;return`opencode-ai@${A} is the previous release pin and is still accepted for now; upgrade to the vetted opencode-ai@${GE} with: anet opencode upgrade-pin ${GE}`}function Zh(A,Q){return A==="v1"?B3(Q):RI(A,Q)}function sH(A,Q){if(A==="v1")return JVA(Q);let B=JB(A);return Error(`unsupported opencode ${A} version ${Q}; this agent-node accepts only ${B.packageName}@${B.acceptedVersions.join(", ")||"(none)"} (${B.status})`)}function JVA(A){return Error(`unsupported opencode version ${A}; this agent-node is vetted only for opencode-ai@${GE} (transition: ${Q3.join(", ")||"none"})`)}function FVA(A,Q=process.getuid?.(),B=process.getgid?.()){if(Q===void 0)return!1;if(A.uid!==Q&&A.uid!==0)return!1;let C=Q>0&&B===Q&&A.uid===Q&&A.gid===Q;return(Number(A.mode)&(C?2:18))===0}function Dh(A,Q){let B=Vh(A,Q);return B===""||B!==".."&&!B.startsWith(`..${gVA}`)&&!a1(B)}function GVA(A){let Q=rH(A);try{return cJ(Q)}catch(B){if(B?.code==="ENOENT")return Q;throw Error(`cannot canonicalize forbidden OpenCode root ${Q}: ${B?.message||B}`)}}function tH(A){try{return n1(A),!0}catch(Q){if(Q?.code==="ENOENT")return!1;return!0}}function DVA(A){if(!tH(A))return!1;try{let Q=n1(A);if(Q.isSymbolicLink()||!Q.isFile()||(Q.mode&2)!==0||Q.size<=0||Q.size>1048576)return!0;let C=JSON.parse(Nh(A,"utf8"))?.workspaces;return Array.isArray(C)||Boolean(C&&typeof C==="object"&&Array.isArray(C.packages))}catch{return!0}}function r1(A=process.cwd()){if(!a1(A))throw Error("OpenCode project cwd must be absolute");let Q=rH(A),B;try{B=cJ(Q)}catch(E){if(E?.code!=="ENOENT")throw E;let g=FE(Q);while(!tH(g)){let J=FE(g);if(J===g)break;g=J}let U=cJ(g);B=rH(U,Vh(g,Q))}let C=new Set([B]),I=B;while(!0){if(YVA.some((g)=>tH(lJ(I,g))))C.add(I);if(DVA(lJ(I,"package.json")))C.add(I);let E=FE(I);if(E===I)break;I=E}return[...C]}function eH(A,Q,B){let C=A3(A);if(!(Q==="file"?C.isFile():C.isDirectory())||!FVA(C))throw Error(`resolved opencode ${B} has unsafe ownership or mode`)}function aH(A,Q){return A.dev===Q.dev&&A.ino===Q.ino}function o1(A,Q){let B=n1(A);if(B.isSymbolicLink()||!B.isFile())throw Error(`resolved opencode ${Q} is not a canonical regular file`);let C;try{C=IVA(A,Yh.O_RDONLY|(Yh.O_NOFOLLOW||0));let I=Fh(C);if(!I.isFile()||!aH(B,I))throw Error(`resolved opencode ${Q} changed before attestation`);let E=AVA("sha256"),g=Buffer.allocUnsafe(1048576),U=0;while(!0){let F=CVA(C,g,0,g.length,null);if(F===0)break;E.update(g.subarray(0,F)),U+=F}let J=Fh(C),Y=n1(A);if(!aH(I,J)||!aH(J,Y)||Y.isSymbolicLink()||!Y.isFile()||U!==I.size||J.size!==I.size)throw Error(`resolved opencode ${Q} changed during attestation`);return{dev:String(I.dev),ino:String(I.ino),size:I.size,sha256:E.digest("hex")}}finally{if(C!==void 0)QVA(C)}}function $h(A,Q){return A.dev===Q.dev&&A.ino===Q.ino&&A.size===Q.size&&A.sha256===Q.sha256}function $VA(A){let Q=A;while(!0){eH(Q,"directory",`package directory ${Q}`);let B=FE(Q);if(B===Q)return;Q=B}}function NVA(A,Q){let B=A;for(let C of Q.split("/").reverse()){if(Gh(B)!==C)return!1;B=FE(B)}return Gh(B)==="node_modules"}function Mh(A,Q,B,C="opencode-ai"){let I=FE(A),E=FE(I);if(!NVA(E,C))throw Error(`resolved opencode binary is not inside a node_modules/${C} wrapper`);let g=lJ(E,"bin","opencode.exe");if(A!==g)throw Error(`resolved executable is not the canonical ${C} bin/opencode.exe entrypoint`);for(let $ of B){if(!$)continue;let N=GVA($);if(Dh(N,E)||Dh(E,N))throw Error(`resolved ${C} package overlaps forbidden root: ${N}`)}eH(A,"file","binary");let U=A3(A);if(process.platform!=="win32"&&(U.mode&73)===0)throw Error("resolved opencode binary has unsafe ownership or mode");let J=lJ(E,"package.json"),Y;try{Y=cJ(J)}catch($){throw Error(`resolved ${C} package.json is missing: ${$?.message||$}`)}if(Y!==J)throw Error(`resolved ${C} package.json must not be a symlink`);eH(J,"file","package.json"),$VA(I);let F;try{F=JSON.parse(Nh(J,"utf8"))}catch($){throw Error(`resolved ${C} package.json is invalid: ${$?.message||$}`)}let G=F.bin&&typeof F.bin==="object"?F.bin.opencode:void 0,D=typeof G==="string"?G.replace(/^\.\//,""):G;if(F.name!==C||F.version!==Q||D!=="bin/opencode.exe")throw Error(`resolved executable is not ${C}@${Q} with bin.opencode=bin/opencode.exe`);return A}function VVA(A,Q){for(let B of Q.split(EVA)){if(!B)continue;let C=lJ(B,A);if(!BVA(C))continue;try{let I=A3(C);if(I.isFile()&&(process.platform==="win32"||(I.mode&73)!==0))return C}catch{}}throw Error("opencode not found on the trusted launch PATH")}function s1(A={}){let Q=A.generation??"v1";if(A.expectedVersion===void 0){let G,D=Q==="v1"?UVA:L1(Q);if(D.length===0)throw sH(Q,"(none)");for(let $ of D)try{return s1({...A,expectedVersion:$})}catch(N){if(G===void 0)G=N}throw G}let B=A.expectedVersion;if(!Zh(Q,B))throw sH(Q,B);let C=JB(Q).packageName,I;if(A.requestedBinary){if(!a1(A.requestedBinary))throw Error("ANET_OPENCODE_BIN must be an absolute path");I=A.requestedBinary}else I=VVA("opencode",A.searchPath??"");let E=cJ(I);Mh(E,B,A.forbiddenRoots??[],C);let g=lJ(FE(FE(E)),"package.json"),U=o1(E,"binary"),J=o1(g,"package.json"),Y;try{Y=e1A(E,["--version"],{encoding:"utf8",stdio:["ignore","pipe","pipe"],timeout:5000,env:A.probeEnv,cwd:A.probeCwd}).trim()}catch(G){throw Error(`opencode version probe failed: ${G?.message||G}`)}let F=Y.match(/(\d+\.\d+\.\d+)/)?.[1]??Y;if(F!==B)throw Error(`expected ${C}@${B}; resolved binary reports ${F||"no version"}`);return Q==="v1"?{binary:E,packageJson:g,expectedVersion:B,binaryFile:U,packageJsonFile:J}:{binary:E,packageJson:g,expectedVersion:B,binaryFile:U,packageJsonFile:J,generation:Q}}function I3(A,Q={}){let B=Q.expectedVersion??A.expectedVersion,C=A.generation??"v1";if(!Zh(C,B))throw sH(C,B);if(A.expectedVersion!==B)throw Error("resolved opencode attestation version changed after probe");if(!a1(A.binary))throw Error("resolved opencode binary must remain absolute");let I=cJ(A.binary);if(I!==A.binary)throw Error("resolved opencode binary path changed after version probe");Mh(I,B,Q.forbiddenRoots??[],JB(C).packageName);let E=o1(I,"binary"),g=o1(A.packageJson,"package.json");if(!$h(A.binaryFile,E)||!$h(A.packageJsonFile,g))throw Error("resolved opencode package bytes changed after version probe");return I}var GE,Q3,UVA,YVA;var QD=H(()=>{OJ();GE=Hy,Q3=Object.freeze(L1("v1").filter((A)=>A!==GE)),UVA=Object.freeze([GE,...Q3.filter((A)=>A!==GE)]);YVA=[".git","pnpm-workspace.yaml","lerna.json","nx.json","rush.json","turbo.json"]});import{posix as KVA,win32 as HVA}from"path";function J3(A){let Q=A.platform??process.platform,B=Q==="win32"?HVA.isAbsolute:KVA.isAbsolute;if(!A.cwd||A.cwd.includes("\x00")||!B(A.cwd))throw Error("Grok child environment requires an absolute cwd");let C={},I=Q==="win32"?[...g3,...U3]:g3;for(let E of I){let g=A.parentEnv[E];if(g!==void 0&&g!=="")C[E]=g}if(C.HOME=A.home,Q==="win32"){C.USERPROFILE=A.home;let E=A.home.length>=2&&A.home[1]===":"?A.home.slice(0,2):"";if(E)C.HOMEDRIVE=E,C.HOMEPATH=A.home.slice(2)||"\\"}C.PWD=A.cwd,C.GROK_HOME=A.home,C.GROK_AUTH_PATH=A.authPath;for(let E of["CLAUDE","CURSOR"])for(let g of["SKILLS","RULES","AGENTS","MCPS","HOOKS","SESSIONS"])C[`GROK_${E}_${g}_ENABLED`]="false";if(C.GROK_CODEX_SESSIONS_ENABLED="false",C.GROK_FOLDER_TRUST="1",C.GROK_DISABLE_AUTOUPDATER="1",C.GROK_CHANGELOG_OFFLINE="1",C.GROK_LEADER_LOG="off",C.GROK_SUBAGENTS="0",C.GROK_WEB_FETCH="0",C.GROK_MEMORY="0",A.oidcIssuer)C.GROK_OIDC_ISSUER=A.oidcIssuer;if(A.oidcClientId)C.GROK_OIDC_CLIENT_ID=A.oidcClientId;if(A.expectedParentPid!==void 0){if(!Number.isSafeInteger(A.expectedParentPid)||A.expectedParentPid<=0)throw Error("Grok child expected parent PID must be a positive safe integer");C.ANET_EXPECTED_PARENT_PID=String(A.expectedParentPid)}if(A.defaultSelectedPermission)C.GROK_DEFAULT_SELECTED_PERMISSION=A.defaultSelectedPermission;return C}function e1(A,Q=process.platform){let B={};if(Q==="win32")for(let C of U3){let I=A[C];if(I!==void 0&&I!=="")B[C]=I}for(let C of jVA){let I=A[C];if(I!==void 0&&I!=="")B[C]=I}if(!B.PATH)B.PATH="/usr/local/bin:/usr/bin:/bin";return B}function $g(A,Q){let B={};for(let[C,I]of Object.entries(A)){if(!_VA.has(C)||I===void 0)continue;B[C]=I}if(!B.PATH)B.PATH="/usr/local/bin:/usr/bin:/bin";if(Q){let C=$g(Q),I=[...new Set([...Object.keys(C),...Object.keys(B)])].sort();for(let E of I)if(B[E]!==C[E])throw Error(`Grok child environment changed at final spawn boundary: ${E}`)}return B}function Sh(A,Q,B,C="xterm-256color",I,E){if(!B||B.includes("\x00")||!C||C.includes("\x00")||!/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(I)||!/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(E))throw Error("Grok PTY environment requires a valid cwd, terminal name, sandbox profile, and Leader owner");let g=$g(A,Q);if(g.PWD!==B)throw Error("Grok PTY cwd differs from the reviewed child environment");return g.TERM=C,g.GROK_SANDBOX=I,g.ANET_GROK_LEADER_OWNER=E,g}var g3,U3,wVA,jVA,_VA;var ID=H(()=>{g3=["PATH","TMPDIR","TMP","TEMP","LANG","LC_ALL","LC_CTYPE","TZ","SHELL","USER","LOGNAME","TERM","COLORTERM","NO_COLOR"],U3=["SystemRoot","SystemDrive","windir","ComSpec","PATHEXT","APPDATA","LOCALAPPDATA","ProgramData","ProgramFiles","NUMBER_OF_PROCESSORS","PROCESSOR_ARCHITECTURE"],wVA=["HOME","USERPROFILE","HOMEDRIVE","HOMEPATH","PWD","GROK_HOME","GROK_AUTH_PATH","GROK_OIDC_ISSUER","GROK_OIDC_CLIENT_ID","GROK_CLAUDE_SKILLS_ENABLED","GROK_CURSOR_SKILLS_ENABLED","GROK_CLAUDE_RULES_ENABLED","GROK_CURSOR_RULES_ENABLED","GROK_CLAUDE_AGENTS_ENABLED","GROK_CURSOR_AGENTS_ENABLED","GROK_CLAUDE_MCPS_ENABLED","GROK_CURSOR_MCPS_ENABLED","GROK_CLAUDE_HOOKS_ENABLED","GROK_CURSOR_HOOKS_ENABLED","GROK_CLAUDE_SESSIONS_ENABLED","GROK_CURSOR_SESSIONS_ENABLED","GROK_CODEX_SESSIONS_ENABLED","GROK_FOLDER_TRUST","GROK_DEFAULT_SELECTED_PERMISSION","GROK_DISABLE_AUTOUPDATER","GROK_CHANGELOG_OFFLINE","GROK_LEADER_LOG","GROK_SUBAGENTS","GROK_WEB_FETCH","GROK_MEMORY","ANET_EXPECTED_PARENT_PID"],jVA=["PATH","TMPDIR","TMP","TEMP","LANG","LC_ALL","LC_CTYPE","TZ"],_VA=new Set([...g3,...U3,...wVA])});var _m=(A)=>typeof A==="string"&&/^[A-Z_][A-Z0-9_]{0,127}$/.test(A)&&!YC(A)&&!["CODEX_HOME","CLAUDE_CONFIG_DIR","XDG_CONFIG_HOME","XDG_DATA_HOME","TMUX","TMUX_PANE","TEMP","TMP"].includes(A)&&!["COMMHUB_","ANET_","CLAUDE_CODE_"].some((Q)=>A.startsWith(Q));var Rm=H(()=>{jU()});var Sm={};WA(Sm,{scopedSecretJson:()=>dJ,readScopedNodeEnv:()=>b9A});import{closeSync as P9A,constants as Om,existsSync as qm,fstatSync as S9A,lstatSync as Pm,openSync as x9A,readFileSync as k9A,realpathSync as v9A}from"node:fs";import{dirname as Tm,join as JD,resolve as O3}from"node:path";function dJ(A){let Q=Pm(A),B=x9A(A,Om.O_RDONLY|(Om.O_NOFOLLOW||0));try{let C=S9A(B);if(!C.isFile()||Q.isSymbolicLink()||C.nlink!==1||C.dev!==Q.dev||C.ino!==Q.ino||C.size>4194304||process.getuid&&C.uid!==process.getuid()||process.platform!=="win32"&&C.mode&63)throw Error("unsafe_secret_file");try{return JSON.parse(k9A(B,"utf8"))}catch{throw Error("invalid_secret_state")}}finally{P9A(B)}}function b9A(A){let Q=JD(A,"secrets-source.json");if(!qm(Q))return{};let B=dJ(Q),C=dJ(JD(A,"config.json"));if(B.schema!==1||typeof B.daemon_dir!=="string"||!B.node_id||!B.network_id||C.node_id!==B.node_id||C.network_id!==B.network_id)throw Error("secret_scope_mismatch");let I=JD(B.daemon_dir,"scoped-secrets.json");if(!qm(I))return{};let E=Pm(B.daemon_dir);if(!E.isDirectory()||v9A(B.daemon_dir)!==O3(B.daemon_dir)||process.getuid&&E.uid!==process.getuid()||process.platform!=="win32"&&E.mode&18)throw Error("unsafe_secret_directory");let g=dJ(JD(B.daemon_dir,"config.json"));if(g.role!=="host_supervisor"||g.network_id!==B.network_id||g.node_id!==B.daemon_node_id)throw Error("secret_scope_mismatch");if(B.adopted_request_id){let Y=dJ(JD(Tm(Tm(B.daemon_dir)),"child-workdirs.json")),F=Object.hasOwn(Y,B.alias)?Y[B.alias]:null;if(F?.adopted!==!0||F.node_id!==B.node_id||F.request_id!==B.adopted_request_id||O3(F.nodeDir)!==O3(A))throw Error("secret_binding_revoked")}let U=dJ(I);if(U.schema!==1||U.network_id!==B.network_id||U.daemon_node_id!==B.daemon_node_id||!Number.isSafeInteger(U.revision)||U.revision<0||!U.defaults||!U.nodes||Array.isArray(U.defaults)||Array.isArray(U.nodes))throw Error("invalid_secret_state");let J={...U.defaults,...U.nodes[B.node_id]??{}};if(Object.entries(J).some(([Y,F])=>!_m(Y)||typeof F!=="string"||!F||Buffer.byteLength(F)>8192||F.includes("\x00")))throw Error("invalid_secret_state");return J}var xm=H(()=>{Rm()});import{closeSync as y9A,constants as km,fstatSync as f9A,lstatSync as h9A,openSync as m9A,readFileSync as u9A,realpathSync as c9A}from"fs";import{dirname as l9A,join as p9A,resolve as vm}from"path";function S3(){return["---",`name: ${ym}`,`description: Fixed Agent Network co-presence preview profile (${T3})`,"injectDefaultTools: false","discoverSkills: false","inheritSkills: false","tools:",...FD.map((A)=>`  - ${A}`),"---",YD?`${q3}: Answer the current user directly. The runtime-owned outbound-only commhub MCP integration and general web_search are available; do not claim inbound CommHub, lifecycle/presence ownership, filesystem, shell, web-fetch/media, or subagent access. Web search is not an x.com-only network sandbox.`:QV?`${q3}: Answer the current user directly. The runtime-owned outbound-only commhub MCP integration plus read_file, grep, and list_dir are available under Grok's strict sandbox: project tree plus essential system paths only; protected credential paths remain denied. Do not claim shell, write/edit, web/media, lifecycle/presence ownership, or subagent access.`:`${q3}: Answer the current user directly. Only the runtime-owned outbound-only commhub MCP integration is available; do not claim inbound CommHub, lifecycle/presence ownership, filesystem, shell, web/media, or subagent access.`,""].join(`
+`}function m1(A,Q,B,C){let I=UI(A,".anet","nodes",Q,tC);TG(I,C(B))}async function x1A(A){let Q=await A.callCommHub("list_my_pending_create_requests",{});if(!Q?.ok){A.warn(`[create-node] pending reconcile failed: ${Q?.error||"unknown"}`);return}let B=Array.isArray(Q.requests)?Q.requests:[],C=0;for(let E of B){let g=typeof E?.request_id==="string"?E.request_id:"";if(!g)continue;if(A.recentlyHandledRequestIds?.has(g))continue;A.recentlyHandledRequestIds?.add(g);try{await A.handleCreateNodeDoorbell({request_id:g}),C+=1}catch(U){A.recentlyHandledRequestIds?.delete(g),A.warn(`[create-node] pending reconcile handler failed for ${g}: ${U?.message||U}`)}}let I=Array.isArray(Q.clone_requests)?Q.clone_requests:[];if(I.length>0&&!A.handleCloneNodeDoorbell)A.warn(`[clone-node] ${I.length} pending clone request(s) not replayed (no clone handler)`);for(let E of I){let g=typeof E?.request_id==="string"?E.request_id:"";if(!g||!A.handleCloneNodeDoorbell)continue;if(A.recentlyHandledRequestIds?.has(g))continue;A.recentlyHandledRequestIds?.add(g);try{await A.handleCloneNodeDoorbell({request_id:g}),C+=1}catch(U){A.recentlyHandledRequestIds?.delete(g),A.warn(`[clone-node] pending reconcile handler failed for ${g}: ${U?.message||U}`)}}if(C>0)A.log(`[create-node] pending reconcile handled ${C} request(s)`)}function u1(A,Q){let B=UI(A,".anet"),C=UI(B,"config.json");try{yH(B,{recursive:!0,mode:448})}catch{}D0(C);let I={};try{I=JSON.parse(O0(C,"utf-8"))}catch{}if(I.hub!==Q)I.hub=Q,FQ(C,I)}function pf(A,Q){if(A&&A.code===0&&!A.signal&&Q)return{started:!0};let B=!A?"exit not observed":A.signal?`signal ${A.signal}`:`exit code ${A.code}`;return{started:!1,how:Q?B:`${B}, no identity marker written`}}async function k1A(A,Q){let{request_id:B}=A,C=await Q.callCommHub("get_create_request",{request_id:B});if(C?.error==="clone_request"){Q.warn(`[create-node] ${B} is a clone request; not acking from the create handler`);return}if(!C?.ok||!C.node_spec||!C.child_token){Q.warn(`[create-node] get_create_request failed: ${C?.error||"unknown"}`),await Q.callCommHub("ack_create_request",{request_id:B,status:"failed",error:C?.error||"get_failed"}).catch(()=>{});return}if(Q.allowedRuntimes&&Q.allowedRuntimes.length>0&&!Q.allowedRuntimes.includes(C.node_spec.runtime)){Q.warn(`[create-node] runtime '${C.node_spec.runtime}' not in daemon's allowed_runtimes: [${Q.allowedRuntimes.join(",")}]`),await Q.callCommHub("ack_create_request",{request_id:B,status:"rejected",error:`runtime_not_in_local_allowlist: ${C.node_spec.runtime}`}).catch(()=>{});return}let I;try{I=lf(C.node_spec)}catch(w){Q.warn(`[create-node] spec rejected by daemon-side validate: ${w?.message||w}`),await Q.callCommHub("ack_create_request",{request_id:B,status:"rejected",error:`validate: ${w?.message||w}`}).catch(()=>{});return}if(C.node_spec.flags?.daemonProvider&&!Q.providerScope){await Q.callCommHub("ack_create_request",{request_id:B,status:"rejected",error:"provider_create_scope_unavailable"}).catch(()=>{});return}let E=nA(),g=await qJ(C.node_spec.runtime,E.PATH??"",E,{resolveOnPath:Eg,execVersion:TJ},uG);if(g.cli==="missing"&&g.command){let w=bf(g.command);Q.warn(`[create-node] ${w}`),await Q.callCommHub("ack_create_request",{request_id:B,status:"rejected",error:w.slice(0,800)}).catch(()=>{});return}let U=NH(C.node_spec.flags?.opencodeGeneration,g);if(U){Q.warn(`[create-node] ${U}`),await Q.callCommHub("ack_create_request",{request_id:B,status:"rejected",error:U.slice(0,800)}).catch(()=>{});return}let J;try{J=jQ()}catch(w){Q.warn(`[create-node] anet_bin_unsafe_path: ${w?.message||w}`),await Q.callCommHub("ack_create_request",{request_id:B,status:"failed",error:`bin: ${w?.message||w}`}).catch(()=>{});return}try{yH(Q.workDir,{recursive:!0,mode:448})}catch{}let Y=zJ(C.node_spec.name,C.node_spec.workdir),F=Q.workDir,G=C.node_spec.workdir;if(G!==void 0&&G!==null)try{F=B1(G,Y,{home:Dg(process.env,process.platform),platform:process.platform}),Y=zJ(C.node_spec.name,F),Q.log(`[create-node] child workdir: ${F}`)}catch(w){let l=w instanceof HQ?w.message:`workdir_invalid:${w?.message||w}`;Q.warn(`[create-node] workdir rejected: ${l}`),await Q.callCommHub("ack_create_request",{request_id:B,status:"rejected",error:`validate: ${l}`.slice(0,800)}).catch(()=>{});return}try{u1(Dg(process.env,process.platform),Q.hubUrl)}catch(w){Q.warn(`[create-node] global config write failed (continuing): ${w?.message||w}`)}let D;if(C.node_spec.runtime==="opencode-cli"&&C.node_spec.flags?.opencodeGeneration==="v2"&&C.node_spec.flags?.opencodeUnsafeTools===!0)try{let w=Dg(process.env,process.platform);D=Zy({projectDir:F,homeDir:w,xdgConfigHome:process.env.XDG_CONFIG_HOME});let l=typeof C.node_spec.model==="string"&&C.node_spec.model.trim()?C.node_spec.model.trim():void 0;Wy(D,l);let x=C.env_blob??{};for(let o of D.credentialEnv)if(typeof x[o]!=="string"||x[o].length===0)throw new EQ("opencode_v2_provider_credential_missing",`OpenCode provider ${JSON.stringify(D.providerId)} requires ${o}, which was not in the create env. The value is not printed.`);Q.log(`[create-node] OpenCode V2 model ${D.model} matches this machine's OpenCode config`)}catch(w){let l=w instanceof Error?w.message:String(w);Q.warn(`[create-node] ${l}`),await Q.callCommHub("ack_create_request",{request_id:B,status:"rejected",error:`validate: ${l}`.slice(0,800)}).catch(()=>{});return}let N=UI(F,".anet","nodes",Y);{let w;try{let l=JSON.parse(O0(UI(N,"config.json"),"utf-8"));w=l?.alias??l?.node_name}catch{}if(w!==void 0&&w!==C.node_spec.name){let l=`node_dir_taken: ${UI(".anet","nodes",Y)} in ${F} already holds node "${String(w).slice(0,80)}"`;Q.warn(`[create-node] ${l}`),await Q.callCommHub("ack_create_request",{request_id:B,status:"rejected",error:`validate: ${l}`.slice(0,800)}).catch(()=>{});return}}if(C.node_spec.runtime!=="opencode-cli")try{yH(N,{recursive:!0,mode:448})}catch{}let V=UI(N,"config.json"),{flags:W,codexCopresence:Z,codexCopresenceFullAccess:M,opencodeGeneration:X,opencodeMode:L}=cf(C.node_spec),K=C.node_spec.runtime==="opencode-cli"?X??"v1":X,R=C.node_spec.runtime==="opencode-cli"&&K==="v2"&&L==="copresence";try{let w={node_id:`node_${B.replace(/^cr_/,"")}`,node_name:C.node_spec.name,alias:C.node_spec.name,runtime:C.node_spec.runtime,...C.network_id?{network_id:C.network_id}:{},...D?{model:D.model}:C.node_spec.model?{model:C.node_spec.model}:{},...D&&D.credentialEnv.length?{env:Object.fromEntries(D.credentialEnv.map((x)=>[x,{_envRef:x}]))}:{},hub:Q.hubUrl,token:C.child_token,...Object.keys(W).length?{flags:W}:{},...Z?{codexCopresence:Z}:{},...M?{codexCopresenceFullAccess:M}:{},...K?{opencodeGeneration:K}:{},...L?{opencodeMode:L}:{}},l=!1;if(C.node_spec.flags?.daemonProvider)try{l=JSON.parse(O0(V,"utf8")).daemonProviderCreation?.request_id===B}catch{}if(l);else if(C.node_spec.runtime==="opencode-cli"){if(Z1(N,w),D)nb(N,Vy(D))}else FQ(V,w);if(!l&&Z&&C.node_spec.runtime==="codex-app-server")try{F1(UI(N,"codex-home")),Q.log(`[create-node] seeded co-presence yolo config.toml under ${N}`)}catch(x){Q.warn(`[create-node] codex-home yolo seed failed: ${x?.message||x}`)}Q.log(`[create-node] wrote child config: ${V}`)}catch(w){Q.warn(`[create-node] write child config failed: ${w?.message||w}`),await Q.callCommHub("ack_create_request",{request_id:B,status:"failed",error:`write_config: ${w?.message||w}`}).catch(()=>{});return}try{I1(Q.workDir,C.node_spec.name,F)}catch(w){Q.warn(`[create-node] child workdir registry write failed: ${w?.message||w}`),await Q.callCommHub("ack_create_request",{request_id:B,status:"failed",error:`workdir_registry: ${w?.message||w}`.slice(0,800)}).catch(()=>{});return}if(C.env_blob&&Object.keys(C.env_blob).length>0)try{m1(F,Y,C.env_blob,Q.serializeEnvLocal)}catch(w){Q.warn(`[create-node] secrets.env write failed: ${w?.message||w}`)}if(Q.providerScope)try{FQ(UI(F,".anet","nodes",Y,"secrets-source.json"),{schema:1,daemon_dir:UI(Q.workDir,".anet","nodes",Q.providerScope.alias),network_id:Q.providerScope.networkId||C.network_id,daemon_node_id:Q.providerScope.daemonId,node_id:`node_${B.replace(/^cr_/,"")}`})}catch{await Q.callCommHub("ack_create_request",{request_id:B,status:"failed",error:"secret_source_write_failed"}).catch(()=>{});return}if(C.node_spec.flags?.daemonProvider)try{let w=JSON.stringify({request_id:B,alias:C.node_spec.name,network_id:Q.providerScope.networkId,daemon_node_id:Q.providerScope.daemonId,selection:C.node_spec.flags.daemonProvider}),l=await new Promise((QA,BA)=>{let MA=G1A(process.execPath,[J,"daemon","provider","initialize",Q.providerScope.alias],{cwd:Q.workDir,env:nA(),timeout:uG,maxBuffer:65536,encoding:"utf8",windowsHide:!0},(S,EA)=>S?BA(Error("provider_initialization_unavailable")):QA(EA));MA.stdin?.on("error",()=>BA(Error("provider_initialization_unavailable"))),MA.stdin?.end(w)}),x=JSON.parse(l),o=x.initialization,h=C.node_spec.flags.daemonProvider;if(!Y1(h)||x.ok!==!0||o?.status!=="initialized"||o.request_id!==B||o.node_id!==`node_${B.slice(3)}`||o.provider_revision!==h.revision||o.provider_id!==h.provider_id||o.auth_id!==h.auth_id||o.model!==h.model||o.verification!=="configuration_only")throw Error("provider_initialization_unconfirmed")}catch{await Q.callCommHub("ack_create_request",{request_id:B,status:"failed",error:"provider_initialization_unconfirmed"}).catch(()=>{});return}let q=-1,c=Date.now(),m=null,k=`node_${B.replace(/^cr_/,"")}`;try{let l=(Q.spawnChild??((o,h,QA)=>D1A(o,h,{cwd:QA.cwd,env:QA.env,stdio:["ignore","ignore","ignore"],detached:!0})))(J,["node","start",Y],{cwd:F,env:nA()});q=l.pid||-1;let x=q;l.once("exit",(o,h)=>{if(m={code:o,signal:h},Z||R)Promise.resolve().then(() => (uB(),pI)).then(({forgetSpawnedChildIfPid:QA})=>{QA(k,x)}).catch(()=>{})});try{l.stdin?.destroy()}catch{}try{l.stdout?.destroy()}catch{}try{l.stderr?.destroy()}catch{}if(l.unref(),Q.log(`[create-node] spawned child '${C.node_spec.name}' pid=${q}`),q>0)try{process.kill(q,0),Q.log(`[create-node] post-spawn kill-0 verify OK: pid=${q} alive`)}catch(o){let h=`child died immediately after spawn: ${o?.message||o}`;Q.warn(`[create-node] ${h}`),await Q.callCommHub("ack_create_request",{request_id:B,status:"failed",error:h}).catch(()=>{});return}}catch(w){let l=(w?.message||String(w)).slice(0,800);Q.warn(`[create-node] fork (start) failed: ${l}`),await Q.callCommHub("ack_create_request",{request_id:B,status:"failed",error:`fork_start: ${l}`}).catch(()=>{});return}if(q>0&&typeof C.node_spec.name==="string")try{let w=`node_${B.replace(/^cr_/,"")}`,{recordSpawnedChild:l}=await Promise.resolve().then(() => (uB(),pI));l(w,C.node_spec.name,q)}catch(w){Q.warn(`[create-node] childrenMap record failed (stop-daemon won't see this child): ${w?.message||w}`)}let d=Q.capabilityCheckMs??5000;if(await new Promise((w)=>setTimeout(w,d)),R){let w=c+(Q.capabilityCheckMs===void 0?35000:d);while(!m&&Date.now()<w)await new Promise((BA)=>setTimeout(BA,50));let l=m,x=JH(l)?await M1(N,V,c,w):YH(N,V,c),{forgetSpawnedChildIfPid:o,recordSpawnedChild:h}=await Promise.resolve().then(() => (uB(),pI));if(o(k,q),JH(l)&&x.ok){h(k,C.node_spec.name,x.bridgePid),Q.log(`[create-node] +${d}ms: OpenCode launcher exited 0; live bridge/serve/TUI generation verified`),await Q.callCommHub("ack_create_request",{request_id:B,status:"started",child_pid:x.bridgePid,launch_verified:!0}).catch((BA)=>Q.warn(`[create-node] ack failed: ${BA?.message||BA}`));return}let QA=`OpenCode launcher exit=${l?.code??"unknown"} signal=${l?.signal??"none"}; ${x.ok?"live generation but unsuccessful launcher":x.reason}`;Q.warn(`[create-node] runtime_capability_check_failed: ${QA}`),await Q.callCommHub("ack_create_request",{request_id:B,status:"runtime_capability_check_failed",error:QA,runtime:C.node_spec.runtime}).catch(()=>{});return}let y=!1;if(q>0)try{process.kill(q,0),y=!0,Q.log(`[create-node] +${d}ms capability check OK: pid=${q} still alive`)}catch(w){if(Z){for(let BA=0;BA<10&&!m;BA++)await new Promise((MA)=>setTimeout(MA,50));let x=m,o=(()=>{try{return mH(UI(N,"copresence-identity.json")),!0}catch{return!1}})();try{let{forgetSpawnedChildIfPid:BA}=await Promise.resolve().then(() => (uB(),pI));BA(k,q)}catch{}let h=pf(x,o);if(h.started){Q.log(`[create-node] +${d}ms: co-presence launcher pid=${q} exited 0 with its identity marker on disk — tmux sessions own the node now`),await Q.callCommHub("ack_create_request",{request_id:B,status:"started",child_pid:q}).catch((BA)=>Q.warn(`[create-node] ack failed: ${BA?.message||BA}`));return}let QA=`codex co-presence launcher ended within ${d}ms (${h.how}) — run \`anet node start ${Y}\` in ${F} to see why`;Q.warn(`[create-node] runtime_capability_check_failed: ${QA}`),await Q.callCommHub("ack_create_request",{request_id:B,status:"runtime_capability_check_failed",error:QA.slice(0,800),runtime:C.node_spec.runtime}).catch(()=>{});return}let l=`child died within ${d}ms post-spawn (likely missing runtime binary or auth for runtime='${C.node_spec.runtime}'): ${w?.message||w}`;Q.warn(`[create-node] runtime_capability_check_failed: ${l}`);try{let{forgetSpawnedChild:x}=await Promise.resolve().then(() => (uB(),pI)),o=x(`node_${B.replace(/^cr_/,"")}`);Q.log(`[create-node] childrenMap rollback after capability failure: removed=${o}`)}catch(x){Q.warn(`[create-node] childrenMap rollback failed: ${x?.message||x}`)}await Q.callCommHub("ack_create_request",{request_id:B,status:"runtime_capability_check_failed",error:l.slice(0,800),runtime:C.node_spec.runtime}).catch(()=>{});return}await Q.callCommHub("ack_create_request",{request_id:B,status:"started",child_pid:q}).catch((w)=>Q.warn(`[create-node] ack failed: ${w?.message||w}`))}function v1A(A=process.env,Q=process.platform){try{return{state:"ready",abs:q0(A,Q)}}catch(B){return{state:"blocked",code:B?.anetBinCode??"anet_bin_unknown",detail:B instanceof Error?B.message:String(B)}}}var hH=!1,tG=null,jf="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",H1A="/opt/homebrew/bin:/opt/homebrew/sbin",Tf,Pf,SiA,xf="daemonExtraPath",f1,eG,yf,_f="[a-zA-Z0-9._:\\-]+",ff,hf,mf,O1A,q1A,P1A;var uQ=H(()=>{jU();m5();vG();$0();RG();u5();eE();K2();AH();My();n5();X1();cG();Tf=new Set(["PATH","HOME","LANG"]),Pf=new Set(["PATH","HOME","LANG","USERPROFILE","HOMEDRIVE","HOMEPATH"]);SiA=new Set([...Tf,...Pf]);f1=[],eG=[];yf=["USER","LOGNAME","HTTPS_PROXY","https_proxy","HTTP_PROXY","http_proxy","ALL_PROXY","all_proxy","NO_PROXY","no_proxy"];ff=new RegExp(`^${_f}(?:/${_f})?$`),hf=/(^|\/)\.+(\/|$)/,mf=new Set(["claude-agent-sdk","claude-code-cli","codex-sdk","codex-app-server","grok-build-acp","grok-build-cli","opencode-cli"]),O1A={VALID_RUNTIMES:mf},q1A=new Set(["default","acceptEdits","plan","bypassPermissions"]);P1A=new Set(["codex-app-server"])});import{execFileSync as e1A}from"child_process";import{createHash as AVA}from"crypto";import{closeSync as QVA,constants as Yh,existsSync as BVA,fstatSync as Fh,lstatSync as n1,openSync as IVA,readFileSync as Nh,readSync as CVA,realpathSync as cJ,statSync as A3}from"fs";import{basename as Gh,delimiter as EVA,dirname as FE,isAbsolute as a1,join as lJ,relative as Vh,resolve as rH,sep as gVA}from"path";function B3(A){return RI("v1",A)}function Wh(A){if(A===GE||!Q3.includes(A))return null;return`opencode-ai@${A} is the previous release pin and is still accepted for now; upgrade to the vetted opencode-ai@${GE} with: anet opencode upgrade-pin ${GE}`}function Zh(A,Q){return A==="v1"?B3(Q):RI(A,Q)}function sH(A,Q){if(A==="v1")return JVA(Q);let B=JB(A);return Error(`unsupported opencode ${A} version ${Q}; this agent-node accepts only ${B.packageName}@${B.acceptedVersions.join(", ")||"(none)"} (${B.status})`)}function JVA(A){return Error(`unsupported opencode version ${A}; this agent-node is vetted only for opencode-ai@${GE} (transition: ${Q3.join(", ")||"none"})`)}function FVA(A,Q=process.getuid?.(),B=process.getgid?.()){if(Q===void 0)return!1;if(A.uid!==Q&&A.uid!==0)return!1;let C=Q>0&&B===Q&&A.uid===Q&&A.gid===Q;return(Number(A.mode)&(C?2:18))===0}function Dh(A,Q){let B=Vh(A,Q);return B===""||B!==".."&&!B.startsWith(`..${gVA}`)&&!a1(B)}function GVA(A){let Q=rH(A);try{return cJ(Q)}catch(B){if(B?.code==="ENOENT")return Q;throw Error(`cannot canonicalize forbidden OpenCode root ${Q}: ${B?.message||B}`)}}function tH(A){try{return n1(A),!0}catch(Q){if(Q?.code==="ENOENT")return!1;return!0}}function DVA(A){if(!tH(A))return!1;try{let Q=n1(A);if(Q.isSymbolicLink()||!Q.isFile()||(Q.mode&2)!==0||Q.size<=0||Q.size>1048576)return!0;let C=JSON.parse(Nh(A,"utf8"))?.workspaces;return Array.isArray(C)||Boolean(C&&typeof C==="object"&&Array.isArray(C.packages))}catch{return!0}}function r1(A=process.cwd()){if(!a1(A))throw Error("OpenCode project cwd must be absolute");let Q=rH(A),B;try{B=cJ(Q)}catch(E){if(E?.code!=="ENOENT")throw E;let g=FE(Q);while(!tH(g)){let J=FE(g);if(J===g)break;g=J}let U=cJ(g);B=rH(U,Vh(g,Q))}let C=new Set([B]),I=B;while(!0){if(YVA.some((g)=>tH(lJ(I,g))))C.add(I);if(DVA(lJ(I,"package.json")))C.add(I);let E=FE(I);if(E===I)break;I=E}return[...C]}function eH(A,Q,B){let C=A3(A);if(!(Q==="file"?C.isFile():C.isDirectory())||!FVA(C))throw Error(`resolved opencode ${B} has unsafe ownership or mode`)}function aH(A,Q){return A.dev===Q.dev&&A.ino===Q.ino}function o1(A,Q){let B=n1(A);if(B.isSymbolicLink()||!B.isFile())throw Error(`resolved opencode ${Q} is not a canonical regular file`);let C;try{C=IVA(A,Yh.O_RDONLY|(Yh.O_NOFOLLOW||0));let I=Fh(C);if(!I.isFile()||!aH(B,I))throw Error(`resolved opencode ${Q} changed before attestation`);let E=AVA("sha256"),g=Buffer.allocUnsafe(1048576),U=0;while(!0){let F=CVA(C,g,0,g.length,null);if(F===0)break;E.update(g.subarray(0,F)),U+=F}let J=Fh(C),Y=n1(A);if(!aH(I,J)||!aH(J,Y)||Y.isSymbolicLink()||!Y.isFile()||U!==I.size||J.size!==I.size)throw Error(`resolved opencode ${Q} changed during attestation`);return{dev:String(I.dev),ino:String(I.ino),size:I.size,sha256:E.digest("hex")}}finally{if(C!==void 0)QVA(C)}}function $h(A,Q){return A.dev===Q.dev&&A.ino===Q.ino&&A.size===Q.size&&A.sha256===Q.sha256}function $VA(A){let Q=A;while(!0){eH(Q,"directory",`package directory ${Q}`);let B=FE(Q);if(B===Q)return;Q=B}}function NVA(A,Q){let B=A;for(let C of Q.split("/").reverse()){if(Gh(B)!==C)return!1;B=FE(B)}return Gh(B)==="node_modules"}function Mh(A,Q,B,C="opencode-ai"){let I=FE(A),E=FE(I);if(!NVA(E,C))throw Error(`resolved opencode binary is not inside a node_modules/${C} wrapper`);let g=lJ(E,"bin","opencode.exe");if(A!==g)throw Error(`resolved executable is not the canonical ${C} bin/opencode.exe entrypoint`);for(let $ of B){if(!$)continue;let N=GVA($);if(Dh(N,E)||Dh(E,N))throw Error(`resolved ${C} package overlaps forbidden root: ${N}`)}eH(A,"file","binary");let U=A3(A);if(process.platform!=="win32"&&(U.mode&73)===0)throw Error("resolved opencode binary has unsafe ownership or mode");let J=lJ(E,"package.json"),Y;try{Y=cJ(J)}catch($){throw Error(`resolved ${C} package.json is missing: ${$?.message||$}`)}if(Y!==J)throw Error(`resolved ${C} package.json must not be a symlink`);eH(J,"file","package.json"),$VA(I);let F;try{F=JSON.parse(Nh(J,"utf8"))}catch($){throw Error(`resolved ${C} package.json is invalid: ${$?.message||$}`)}let G=F.bin&&typeof F.bin==="object"?F.bin.opencode:void 0,D=typeof G==="string"?G.replace(/^\.\//,""):G;if(F.name!==C||F.version!==Q||D!=="bin/opencode.exe")throw Error(`resolved executable is not ${C}@${Q} with bin.opencode=bin/opencode.exe`);return A}function VVA(A,Q){for(let B of Q.split(EVA)){if(!B)continue;let C=lJ(B,A);if(!BVA(C))continue;try{let I=A3(C);if(I.isFile()&&(process.platform==="win32"||(I.mode&73)!==0))return C}catch{}}throw Error("opencode not found on the trusted launch PATH")}function s1(A={}){let Q=A.generation??"v1";if(A.expectedVersion===void 0){let G,D=Q==="v1"?UVA:L1(Q);if(D.length===0)throw sH(Q,"(none)");for(let $ of D)try{return s1({...A,expectedVersion:$})}catch(N){if(G===void 0)G=N}throw G}let B=A.expectedVersion;if(!Zh(Q,B))throw sH(Q,B);let C=JB(Q).packageName,I;if(A.requestedBinary){if(!a1(A.requestedBinary))throw Error("ANET_OPENCODE_BIN must be an absolute path");I=A.requestedBinary}else I=VVA("opencode",A.searchPath??"");let E=cJ(I);Mh(E,B,A.forbiddenRoots??[],C);let g=lJ(FE(FE(E)),"package.json"),U=o1(E,"binary"),J=o1(g,"package.json"),Y;try{Y=e1A(E,["--version"],{encoding:"utf8",stdio:["ignore","pipe","pipe"],timeout:5000,env:A.probeEnv,cwd:A.probeCwd}).trim()}catch(G){throw Error(`opencode version probe failed: ${G?.message||G}`)}let F=Y.match(/(\d+\.\d+\.\d+)/)?.[1]??Y;if(F!==B)throw Error(`expected ${C}@${B}; resolved binary reports ${F||"no version"}`);return Q==="v1"?{binary:E,packageJson:g,expectedVersion:B,binaryFile:U,packageJsonFile:J}:{binary:E,packageJson:g,expectedVersion:B,binaryFile:U,packageJsonFile:J,generation:Q}}function I3(A,Q={}){let B=Q.expectedVersion??A.expectedVersion,C=A.generation??"v1";if(!Zh(C,B))throw sH(C,B);if(A.expectedVersion!==B)throw Error("resolved opencode attestation version changed after probe");if(!a1(A.binary))throw Error("resolved opencode binary must remain absolute");let I=cJ(A.binary);if(I!==A.binary)throw Error("resolved opencode binary path changed after version probe");Mh(I,B,Q.forbiddenRoots??[],JB(C).packageName);let E=o1(I,"binary"),g=o1(A.packageJson,"package.json");if(!$h(A.binaryFile,E)||!$h(A.packageJsonFile,g))throw Error("resolved opencode package bytes changed after version probe");return I}var GE,Q3,UVA,YVA;var QD=H(()=>{OJ();GE=Hy,Q3=Object.freeze(L1("v1").filter((A)=>A!==GE)),UVA=Object.freeze([GE,...Q3.filter((A)=>A!==GE)]);YVA=[".git","pnpm-workspace.yaml","lerna.json","nx.json","rush.json","turbo.json"]});import{posix as KVA,win32 as HVA}from"path";function J3(A){let Q=A.platform??process.platform,B=Q==="win32"?HVA.isAbsolute:KVA.isAbsolute;if(!A.cwd||A.cwd.includes("\x00")||!B(A.cwd))throw Error("Grok child environment requires an absolute cwd");let C={},I=Q==="win32"?[...g3,...U3]:g3;for(let E of I){let g=A.parentEnv[E];if(g!==void 0&&g!=="")C[E]=g}if(C.HOME=A.home,Q==="win32"){C.USERPROFILE=A.home;let E=A.home.length>=2&&A.home[1]===":"?A.home.slice(0,2):"";if(E)C.HOMEDRIVE=E,C.HOMEPATH=A.home.slice(2)||"\\"}C.PWD=A.cwd,C.GROK_HOME=A.home,C.GROK_AUTH_PATH=A.authPath;for(let E of["CLAUDE","CURSOR"])for(let g of["SKILLS","RULES","AGENTS","MCPS","HOOKS","SESSIONS"])C[`GROK_${E}_${g}_ENABLED`]="false";if(C.GROK_CODEX_SESSIONS_ENABLED="false",C.GROK_FOLDER_TRUST="1",C.GROK_DISABLE_AUTOUPDATER="1",C.GROK_CHANGELOG_OFFLINE="1",C.GROK_LEADER_LOG="off",C.GROK_SUBAGENTS="0",C.GROK_WEB_FETCH="0",C.GROK_MEMORY="0",A.oidcIssuer)C.GROK_OIDC_ISSUER=A.oidcIssuer;if(A.oidcClientId)C.GROK_OIDC_CLIENT_ID=A.oidcClientId;if(A.expectedParentPid!==void 0){if(!Number.isSafeInteger(A.expectedParentPid)||A.expectedParentPid<=0)throw Error("Grok child expected parent PID must be a positive safe integer");C.ANET_EXPECTED_PARENT_PID=String(A.expectedParentPid)}if(A.defaultSelectedPermission)C.GROK_DEFAULT_SELECTED_PERMISSION=A.defaultSelectedPermission;return C}function e1(A,Q=process.platform){let B={};if(Q==="win32")for(let C of U3){let I=A[C];if(I!==void 0&&I!=="")B[C]=I}for(let C of jVA){let I=A[C];if(I!==void 0&&I!=="")B[C]=I}if(!B.PATH)B.PATH="/usr/local/bin:/usr/bin:/bin";return B}function $g(A,Q){let B={};for(let[C,I]of Object.entries(A)){if(!_VA.has(C)||I===void 0)continue;B[C]=I}if(!B.PATH)B.PATH="/usr/local/bin:/usr/bin:/bin";if(Q){let C=$g(Q),I=[...new Set([...Object.keys(C),...Object.keys(B)])].sort();for(let E of I)if(B[E]!==C[E])throw Error(`Grok child environment changed at final spawn boundary: ${E}`)}return B}function Sh(A,Q,B,C="xterm-256color",I,E){if(!B||B.includes("\x00")||!C||C.includes("\x00")||!/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(I)||!/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(E))throw Error("Grok PTY environment requires a valid cwd, terminal name, sandbox profile, and Leader owner");let g=$g(A,Q);if(g.PWD!==B)throw Error("Grok PTY cwd differs from the reviewed child environment");return g.TERM=C,g.GROK_SANDBOX=I,g.ANET_GROK_LEADER_OWNER=E,g}var g3,U3,wVA,jVA,_VA;var ID=H(()=>{g3=["PATH","TMPDIR","TMP","TEMP","LANG","LC_ALL","LC_CTYPE","TZ","SHELL","USER","LOGNAME","TERM","COLORTERM","NO_COLOR"],U3=["SystemRoot","SystemDrive","windir","ComSpec","PATHEXT","APPDATA","LOCALAPPDATA","ProgramData","ProgramFiles","NUMBER_OF_PROCESSORS","PROCESSOR_ARCHITECTURE"],wVA=["HOME","USERPROFILE","HOMEDRIVE","HOMEPATH","PWD","GROK_HOME","GROK_AUTH_PATH","GROK_OIDC_ISSUER","GROK_OIDC_CLIENT_ID","GROK_CLAUDE_SKILLS_ENABLED","GROK_CURSOR_SKILLS_ENABLED","GROK_CLAUDE_RULES_ENABLED","GROK_CURSOR_RULES_ENABLED","GROK_CLAUDE_AGENTS_ENABLED","GROK_CURSOR_AGENTS_ENABLED","GROK_CLAUDE_MCPS_ENABLED","GROK_CURSOR_MCPS_ENABLED","GROK_CLAUDE_HOOKS_ENABLED","GROK_CURSOR_HOOKS_ENABLED","GROK_CLAUDE_SESSIONS_ENABLED","GROK_CURSOR_SESSIONS_ENABLED","GROK_CODEX_SESSIONS_ENABLED","GROK_FOLDER_TRUST","GROK_DEFAULT_SELECTED_PERMISSION","GROK_DISABLE_AUTOUPDATER","GROK_CHANGELOG_OFFLINE","GROK_LEADER_LOG","GROK_SUBAGENTS","GROK_WEB_FETCH","GROK_MEMORY","ANET_EXPECTED_PARENT_PID"],jVA=["PATH","TMPDIR","TMP","TEMP","LANG","LC_ALL","LC_CTYPE","TZ"],_VA=new Set([...g3,...U3,...wVA])});var _m=(A)=>typeof A==="string"&&/^[A-Z_][A-Z0-9_]{0,127}$/.test(A)&&!YC(A)&&!["CODEX_HOME","CLAUDE_CONFIG_DIR","XDG_CONFIG_HOME","XDG_DATA_HOME","TMUX","TMUX_PANE","TEMP","TMP"].includes(A)&&!["COMMHUB_","ANET_","CLAUDE_CODE_"].some((Q)=>A.startsWith(Q));var Rm=H(()=>{jU()});var Sm={};WA(Sm,{scopedSecretJson:()=>dJ,readScopedNodeEnv:()=>b9A});import{closeSync as P9A,constants as Om,existsSync as qm,fstatSync as S9A,lstatSync as Pm,openSync as x9A,readFileSync as k9A,realpathSync as v9A}from"node:fs";import{dirname as Tm,join as JD,resolve as O3}from"node:path";function dJ(A){let Q=Pm(A),B=x9A(A,Om.O_RDONLY|(Om.O_NOFOLLOW||0));try{let C=S9A(B);if(!C.isFile()||Q.isSymbolicLink()||C.nlink!==1||C.dev!==Q.dev||C.ino!==Q.ino||C.size>4194304||process.getuid&&C.uid!==process.getuid()||process.platform!=="win32"&&C.mode&63)throw Error("unsafe_secret_file");try{return JSON.parse(k9A(B,"utf8"))}catch{throw Error("invalid_secret_state")}}finally{P9A(B)}}function b9A(A){let Q=JD(A,"secrets-source.json");if(!qm(Q))return{};let B=dJ(Q),C=dJ(JD(A,"config.json"));if(B.schema!==1||typeof B.daemon_dir!=="string"||!B.node_id||!B.network_id||C.node_id!==B.node_id||C.network_id!==B.network_id)throw Error("secret_scope_mismatch");let I=JD(B.daemon_dir,"scoped-secrets.json");if(!qm(I))return{};let E=Pm(B.daemon_dir);if(!E.isDirectory()||v9A(B.daemon_dir)!==O3(B.daemon_dir)||process.getuid&&E.uid!==process.getuid()||process.platform!=="win32"&&E.mode&18)throw Error("unsafe_secret_directory");let g=dJ(JD(B.daemon_dir,"config.json"));if(g.role!=="host_supervisor"||g.network_id!==B.network_id||g.node_id!==B.daemon_node_id)throw Error("secret_scope_mismatch");if(B.adopted_request_id){let Y=dJ(JD(Tm(Tm(B.daemon_dir)),"child-workdirs.json")),F=Object.hasOwn(Y,B.alias)?Y[B.alias]:null;if(F?.adopted!==!0||F.node_id!==B.node_id||F.request_id!==B.adopted_request_id||O3(F.nodeDir)!==O3(A))throw Error("secret_binding_revoked")}let U=dJ(I);if(U.schema!==1||U.network_id!==B.network_id||U.daemon_node_id!==B.daemon_node_id||!Number.isSafeInteger(U.revision)||U.revision<0||!U.defaults||!U.nodes||Array.isArray(U.defaults)||Array.isArray(U.nodes))throw Error("invalid_secret_state");let J={...U.defaults,...U.nodes[B.node_id]??{}};if(Object.entries(J).some(([Y,F])=>!_m(Y)||typeof F!=="string"||!F||Buffer.byteLength(F)>8192||F.includes("\x00")))throw Error("invalid_secret_state");return J}var xm=H(()=>{Rm()});import{closeSync as y9A,constants as km,fstatSync as f9A,lstatSync as h9A,openSync as m9A,readFileSync as u9A,realpathSync as c9A}from"fs";import{dirname as l9A,join as p9A,resolve as vm}from"path";function S3(){return["---",`name: ${ym}`,`description: Fixed Agent Network co-presence preview profile (${T3})`,"injectDefaultTools: false","discoverSkills: false","inheritSkills: false","tools:",...FD.map((A)=>`  - ${A}`),"---",YD?`${q3}: Answer the current user directly. The runtime-owned outbound-only commhub MCP integration and general web_search are available; do not claim inbound CommHub, lifecycle/presence ownership, filesystem, shell, web-fetch/media, or subagent access. Web search is not an x.com-only network sandbox.`:QV?`${q3}: Answer the current user directly. The runtime-owned outbound-only commhub MCP integration plus read_file, grep, and list_dir are available under Grok's strict sandbox: project tree plus essential system paths only; protected credential paths remain denied. Do not claim shell, write/edit, web/media, lifecycle/presence ownership, or subagent access.`:`${q3}: Answer the current user directly. Only the runtime-owned outbound-only commhub MCP integration is available; do not claim inbound CommHub, lifecycle/presence ownership, filesystem, shell, web/media, or subagent access.`,""].join(`
 `)}function fm(A,Q){let B=c9A(vm(Q)),C=p9A(B,P3);if(vm(A)!==C||l9A(C)!==B)throw Error("grok copresence agent profile is outside its runtime-owned home");let I=h9A(C),E=process.getuid?.();if(I.isSymbolicLink()||!I.isFile()||I.nlink!==1||!aC(I.mode,384)||E!==void 0&&I.uid!==E)throw Error("grok copresence agent profile is not an owner-only regular file");let g=m9A(C,km.O_RDONLY|(km.O_NOFOLLOW||0));try{let U=f9A(g);if(!U.isFile()||U.nlink!==1||U.dev!==I.dev||U.ino!==I.ino||!aC(U.mode,384)||E!==void 0&&U.uid!==E||u9A(g,"utf8")!==S3())throw Error("grok copresence agent profile differs from the fixed preview policy")}finally{y9A(g)}}var T3,YD,QV,FD,bm,ym="anet-copresence-preview",P3,q3="ANET_COPRESENCE_PROFILE_V1";var x3=H(()=>{wU();T3=Pv(),YD=T3==="x-search",QV=T3==="repo-read",FD=Object.freeze(["todo_write","search_tool","use_tool",...YD?["web_search"]:[],...QV?["read_file","grep","list_dir"]:[]]),bm=Object.freeze(["run_terminal_command","run_terminal_cmd","search_replace","write_file","edit_file","apply_patch","write","kill_command_or_subagent","get_command_or_subagent_output","wait_commands_or_subagents","scheduler_create","scheduler_delete","scheduler_list","monitor","update_goal","enter_plan_mode","exit_plan_mode","ask_user_question","web_fetch","http_request","image_gen","image_edit","generate_image","video_gen","generate_video","browser","computer","screenshot"]),P3=`${ym}.md`});var gV={};WA(gV,{resolveGrokCommhubMcpCommand:()=>h3,reclaimStaleProjectSandboxPlaceholders:()=>EV,prepareGrokCliHome:()=>w6A,isOverBroadGrokTrustTarget:()=>i3,hardenExistingGrokSessionStore:()=>om,grokProjectPolicyPaths:()=>Au,grokCliStateKey:()=>g6A,cleanupGrokCliStoppedTuiGeneration:()=>c3,cleanupGrokCliPostStopState:()=>l3,canTrustGrokProjectCwd:()=>z6A,assertNoProjectGrokExecutableSources:()=>Qu,assertNoDiscoveredGrokHooks:()=>H6A,assertGrokCommhubMcpDoctor:()=>Q6A,acquireGrokProjectTurnLock:()=>d3,GROK_POST_STOP_CLEANUP_POLICY:()=>$E});import{createHash as i9A,randomBytes as b3}from"crypto";import{spawn as d9A}from"child_process";import{accessSync as lm,chmodSync as k3,closeSync as GQ,constants as _A,existsSync as pm,fchmodSync as x0,fstatSync as GB,lstatSync as jB,mkdirSync as n9A,openSync as sQ,readdirSync as CV,readFileSync as $D,readlinkSync as o9A,realpathSync as _B,renameSync as im,rmdirSync as dm,rmSync as oJ,statSync as ND,symlinkSync as a9A,unlinkSync as r9A,writeFileSync as s9A}from"fs";import{basename as y3,delimiter as t9A,dirname as k0,isAbsolute as f3,join as ZA,parse as e9A,relative as v3,resolve as gQ}from"path";import{homedir as nm}from"os";import{createServer as A6A}from"node:net";function h3(A,Q){if(!A||A.includes("\x00")||A.includes("\r")||A.includes(`
 `))throw Error("grok copresence CommHub MCP command is invalid");let B=zI()?[""]:[...(process.env.PATHEXT||".COM;.EXE;.BAT;.CMD").split(";").map((g)=>g.trim()).filter(Boolean),""],C=(g)=>B.map((U)=>`${g}${U}`),I=(g)=>zI()?[]:[gQ(g,"node_modules",A,"bin",`${A}.exe`)],E=f3(A)?C(A):Q.split(t9A).filter(Boolean).flatMap((g)=>[...I(g),...C(gQ(g,A))]);for(let g of E)try{let U=_B(g);if(!ND(U).isFile())continue;return lm(U,_A.X_OK),U}catch{}throw Error("grok copresence CommHub MCP command could not be resolved or executed")}function Q6A(A){let Q;try{Q=JSON.parse(A)}catch{throw Error("grok copresence CommHub MCP doctor returned invalid JSON")}let B=Array.isArray(Q?.servers)?Q.servers.find((g)=>g?.name==="commhub"):void 0,C=["command found","server started","handshake OK","4 tools discovered"],I=Array.isArray(B?.checks)?B.checks:[],E=C.filter((g)=>!I.some((U)=>U?.label===g&&U?.passed===!0));if(Q?.healthy_count!==1||Q?.failing_count!==0||B?.healthy!==!0||E.length>0)throw Error(`grok copresence CommHub MCP readiness failed${E.length?`: ${E.join(", ")}`:""}`)}function B6A(A){let Q=DQ(A);if(!Q)return;let B=process.getuid?.();if(Q.isSymbolicLink()||!Q.isDirectory())throw Error(`grok-build-cli refuses transient post-stop state at ${A}: expected a real directory`);if(B!==void 0)cB(A,B,Q.uid)}function I6A(A){let Q=DQ(A);if(!Q)return;let B=`${A}.anet-post-stop-${b3(12).toString("hex")}`;if(DQ(B))throw Error(`grok-build-cli refuses occupied transient quarantine path: ${B}`);im(A,B);let C=jB(B);if(C.isSymbolicLink()||!C.isDirectory()||!JI(Q,C))throw Error(`grok-build-cli transient post-stop state changed during quarantine: ${A}`);oJ(B,{recursive:!0,force:!1})}async function E6A(A){let Q=HU(A,SQ()),B=A6A();B.on("connection",(I)=>{try{I.destroy()}catch{}}),await new Promise((I,E)=>{let g=(J)=>{B.removeListener("listening",U),E(Error(`grok-build-cli project turn lock is already held (${Q}): ${J?.message||J}`))},U=()=>{B.removeListener("error",g),I()};B.once("error",g),B.once("listening",U),B.listen(Q)});let C=!1;return{async release(){if(C)return;C=!0,await new Promise((I)=>B.close(()=>I()))}}}function om(A){let Q=ZA(gQ(A),"sessions");if(!DQ(Q))return;if(hm.has(Q))return;let C=process.getuid?.(),I=(E)=>{let g=jB(E);if(g.isSymbolicLink())throw Error(`grok-build-cli refuses symlink in isolated session store: ${E}`);if(C!==void 0)cB(E,C,g.uid);if(g.isDirectory()){let J;try{J=sQ(E,_A.O_RDONLY|(_A.O_DIRECTORY||0)|(_A.O_NOFOLLOW||0)),fI(()=>x0(J,448))}finally{if(J!==void 0)GQ(J)}for(let Y of CV(E))I(ZA(E,Y));return}if(!g.isFile()||g.nlink!==1)throw Error(`grok-build-cli refuses non-private session state: ${E}`);let U=sQ(E,_A.O_RDONLY|(_A.O_NOFOLLOW||0));try{let J=GB(U);if(!J.isFile()||J.nlink!==1||J.dev!==g.dev||J.ino!==g.ino)throw Error(`grok-build-cli session state changed during mode repair: ${E}`);fI(()=>x0(U,384))}finally{GQ(U)}};I(Q),hm.add(Q)}function g6A(A){if(!A||A==="."||A==="..")throw Error("grok-build-cli node identity cannot be empty, '.' or '..'");return`node-${i9A("sha256").update(A).digest("hex").slice(0,24)}`}function DQ(A){try{return jB(A)}catch(Q){if(Q?.code==="ENOENT")return;throw Q}}function cB(A,Q,B){if(Q!==B)throw Error(`grok-build-cli refuses ${A}: owner ${B} does not match runtime uid ${Q}`)}function DD(A,Q){if(!DQ(A))n9A(A,{mode:448});let B;try{B=sQ(A,_A.O_RDONLY|(_A.O_DIRECTORY||0)|(_A.O_NOFOLLOW||0));let C=GB(B);if(!C.isDirectory())throw Error(`grok-build-cli refuses ${Q} at ${A}: expected a real directory, not a symlink or file`);let I=process.getuid?.();if(I!==void 0)cB(A,I,C.uid);fI(()=>x0(B,448))}catch(C){if(C?.code==="ELOOP"||C?.code==="ENOTDIR")throw Error(`grok-build-cli refuses ${Q} at ${A}: expected a real directory, not a symlink or file`);throw C}finally{if(B!==void 0)GQ(B)}}function m3(A){let Q=DQ(A);if(!Q)return;if(Q.isSymbolicLink()||!Q.isFile())throw Error(`grok-build-cli refuses generated state at ${A}: expected a regular file`);let B=process.getuid?.();if(B!==void 0)cB(A,B,Q.uid)}function U6A(A){if(!DQ(A))return;m3(A);let B=sQ(A,_A.O_RDONLY|(_A.O_NOFOLLOW||0));try{let C=GB(B);if(!C.isFile())throw Error(`grok-build-cli refuses generated state at ${A}: not a regular file`);let I=process.getuid?.();if(I!==void 0)cB(A,I,C.uid);return $D(B,"utf8")}finally{GQ(B)}}function Vg(A,Q){m3(A);let B=ZA(k0(A),`.${y3(A)}.${b3(8).toString("hex")}.tmp`),C=sQ(B,_A.O_WRONLY|_A.O_CREAT|_A.O_EXCL|(_A.O_NOFOLLOW||0),384);try{s9A(C,Q,"utf8"),fI(()=>x0(C,384)),GQ(C),im(B,A)}catch(I){try{GQ(C)}catch{}throw oJ(B,{force:!0}),I}}function mm(A){if(!DQ(A))return;m3(A),oJ(A,{force:!0})}function JI(A,Q){return A.dev===Q.dev&&A.ino===Q.ino}function nJ(A,Q){let B=gQ(A);if(A!==B)throw Error(`grok-build-cli refuses ${Q}: path is not canonical`);let C;try{C=sQ(B,_A.O_RDONLY|(_A.O_DIRECTORY||0)|(_A.O_NOFOLLOW||0));let I=GB(C);if(!I.isDirectory()||_B(B)!==B)throw Error(`grok-build-cli refuses ${Q}: expected a real directory`);let E=process.getuid?.();if(E!==void 0)cB(B,E,I.uid);fI(()=>x0(C,448))}catch(I){if(I?.code==="ELOOP"||I?.code==="ENOTDIR")throw Error(`grok-build-cli refuses ${Q}: expected a real directory`);throw I}finally{if(C!==void 0)GQ(C)}}function am(A){let Q=jB(A),B=process.getuid?.();if(Q.isSymbolicLink()||!Q.isFile()||Q.nlink!==1)throw Error(`grok-build-cli refuses post-stop state at ${A}: expected a single-link regular file`);if(B!==void 0)cB(A,B,Q.uid);let C;try{C=sQ(A,_A.O_RDONLY|(_A.O_NOFOLLOW||0));let I=GB(C);if(!I.isFile()||I.nlink!==1||!JI(Q,I))throw Error(`grok-build-cli refuses post-stop state at ${A}: file changed during validation`);if(B!==void 0)cB(A,B,I.uid);return{fd:C,stat:I}}catch(I){if(C!==void 0)GQ(C);throw I}}function BV(A,Q){if(!DQ(A))return;let C=am(A);try{if(Q!==void 0&&C.stat.size!==Q)throw Error(`grok-build-cli refuses post-stop state at ${A}: expected size ${Q}`);let I=jB(A);if(!JI(C.stat,I))throw Error(`grok-build-cli refuses post-stop state at ${A}: file changed before removal`);oJ(A)}finally{GQ(C.fd)}}function Y6A(A){let Q=process.getuid?.();if(Q===void 0)throw Error("grok-build-cli cannot prove project placeholder ownership on this platform");let B;try{B=sQ(A,_A.O_RDONLY|(_A.O_DIRECTORY||0)|(_A.O_NOFOLLOW||0));let C=GB(B),I=jB(A);if(!C.isDirectory()||I.isSymbolicLink()||!I.isDirectory()||!JI(C,I)||_B(A)!==A)throw Error("grok-build-cli refuses post-stop project cleanup: expected the canonical real project cwd");return cB(A,Q,C.uid),{fd:B,stat:C,uid:Q}}catch(C){if(B!==void 0)GQ(B);if(C?.code==="ELOOP"||C?.code==="ENOTDIR")throw Error("grok-build-cli refuses post-stop project cleanup: expected the canonical real project cwd");throw C}}function F6A(A,Q){if(A.isSymbolicLink()||!A.isFile()||A.nlink!==1||A.size!==0)return!1;if(zI()&&(A.mode&4095)!==292)return!1;if(Q!==void 0&&A.uid!==Q)return!1;return!0}function um(A){let Q=DQ(A);if(!Q||!zI())return"";let B=Q,C=process.getuid?.();if(B.isSymbolicLink()||!B.isFile()||B.nlink!==1||B.size!==0)return"";if(C!==void 0&&B.uid!==C)return"";return` (this is an empty read-deny placeholder with mode ${(B.mode&4095).toString(8).padStart(4,"0")}, not the 0444 grok plants elsewhere; `+"if grok left it, run `chmod 0444 .grok .claude .cursor .mcp.json .envrc` in the project and start again — see issue #1887)"}function GD(A){let Q=DQ(A);if(!Q)return!1;return F6A(Q,process.getuid?.())}function EV(A){let Q=$E.projectSandboxPlaceholders.basenames.filter((B)=>GD(ZA(A,B)));if(Q.length===0)return[];return u3(gQ(A)),[...Q]}function IV(A,Q,B,C){if(Q.isSymbolicLink()||!Q.isFile()||Q.nlink!==1||Q.size!==0||zI()&&(Q.mode&4095)!==292)throw Error(`grok-build-cli refuses post-stop project placeholder at ${A}: expected an empty owner-held single-link regular file with mode 0444`);if(cB(A,B,Q.uid),C&&!JI(Q,C))throw Error(`grok-build-cli refuses post-stop project placeholder at ${A}: file changed during validation`)}function G6A(A,Q,B){let C=ZA(A,Q),I=DQ(C);if(!I)return;if(J6A.has(Q)&&!I.isSymbolicLink()&&I.isDirectory())return;IV(C,I,B);let E;try{E=sQ(C,_A.O_RDONLY|(_A.O_NOFOLLOW||0));let g=GB(E);return IV(C,g,B,I),{path:C,fd:E,stat:g}}catch(g){if(E!==void 0)GQ(E);throw g}}function cm(A,Q,B){let C=jB(A);if(C.isSymbolicLink()||!C.isDirectory()||!JI(C,Q)||_B(A)!==A)throw Error("grok-build-cli refuses post-stop project cleanup: project cwd changed during validation");cB(A,B,C.uid)}function u3(A){let Q=Y6A(A),B=[];try{for(let C of $E.projectSandboxPlaceholders.basenames){let I=G6A(A,C,Q.uid);if(I)B.push(I)}cm(A,Q.stat,Q.uid);for(let C of B){let I=jB(C.path);IV(C.path,I,Q.uid,C.stat)}for(let C of B){cm(A,Q.stat,Q.uid);let I=jB(C.path);IV(C.path,I,Q.uid,C.stat),r9A(C.path)}}finally{for(let C of B)GQ(C.fd);GQ(Q.fd)}}function rm(A){if(!DQ(A))return;let Q=am(A);try{fI(()=>x0(Q.fd,384))}finally{GQ(Q.fd)}}function D6A(A){let Q=e9A(A);return ZA(Q.dir,`${Q.name}.lock`)}function sm(A,Q){if(!Number.isSafeInteger(Q)||Q<=0)throw Error("grok-build-cli post-stop cleanup requires positive integer TUI process ids");return ZA(A,`sandbox-blocked-dir.${Q}`)}function tm(A){let Q=DQ(A);if(!Q)return;if(Q.isSymbolicLink()||!Q.isDirectory())throw Error(`grok-build-cli refuses post-stop state at ${A}: expected an empty real directory`);let B=process.getuid?.();if(B!==void 0)cB(A,B,Q.uid);let C=jB(A);if(!JI(Q,C))throw Error(`grok-build-cli refuses post-stop state at ${A}: directory changed before removal`);try{dm(A)}catch(I){if(I?.code==="ENOTEMPTY"||I?.code==="EEXIST")throw Error(`grok-build-cli refuses post-stop state at ${A}: expected an empty real directory`);throw I}}function c3(A){let Q=gQ(A.stateHome),B=gQ(A.projectCwd);if(A.stateHome!==Q||A.projectCwd!==B)throw Error("grok-build-cli stopped-generation cleanup requires canonical absolute paths");let C=sm(Q,A.tuiProcessId);nJ(Q,"stopped-generation state home"),tm(C),u3(B)}function N6A(A){return $6A.some((Q)=>A.startsWith(Q))}function V6A(A,Q,B){if(Q.isDirectory()){fI(()=>k3(A,448));let E=!1,g;try{g=sQ(A,_A.O_RDONLY|(_A.O_DIRECTORY||0)|(_A.O_NOFOLLOW||0));let J=GB(g);if(!J.isDirectory()||!JI(Q,J)||B!==void 0&&J.uid!==B)throw Error(`grok-build-cli refuses post-stop sandbox placeholder ${A}: identity changed during reclaim`);E=CV(A).length===0}finally{if(g!==void 0)GQ(g)}if(!E){fI(()=>k3(A,0));return}let U=jB(A);if(U.isSymbolicLink()||!U.isDirectory()||!JI(Q,U))throw Error(`grok-build-cli refuses post-stop sandbox placeholder ${A}: directory changed before removal`);dm(A);return}if(!Q.isFile()||Q.nlink!==1||Q.size!==0)return;fI(()=>k3(A,448));let C;try{C=sQ(A,_A.O_RDONLY|(_A.O_NOFOLLOW||0));let E=GB(C);if(!E.isFile()||E.nlink!==1||E.size!==0||!JI(Q,E)||B!==void 0&&E.uid!==B)throw Error(`grok-build-cli refuses post-stop sandbox placeholder ${A}: file changed during reclaim`)}finally{if(C!==void 0)GQ(C)}let I=jB(A);if(I.isSymbolicLink()||!I.isFile()||!JI(Q,I))throw Error(`grok-build-cli refuses post-stop sandbox placeholder ${A}: file changed before removal`);oJ(A)}function em(A,Q=""){let B=jB(A);if(B.isSymbolicLink()){if(Q==="agent_id")return;throw Error(`grok-build-cli refuses symlink in post-stop state: ${A}`)}let C=process.getuid?.();if(C!==void 0)cB(A,C,B.uid);if(N6A(y3(A))){V6A(A,B,C);return}if(B.isDirectory()){nJ(A,`post-stop directory ${A}`);for(let I of CV(A))em(ZA(A,I),Q?ZA(Q,I):I);return}if(!B.isFile()||B.nlink!==1)throw Error(`grok-build-cli refuses non-private post-stop state: ${A}`);rm(A)}function l3(A){let Q=gQ(A.stateHome),B=gQ(A.projectCwd),C=gQ(A.leaderSocket);if(A.stateHome!==Q||A.projectCwd!==B||A.leaderSocket!==C)throw Error("grok-build-cli post-stop cleanup requires canonical absolute paths");if(!Array.isArray(A.tuiProcessIds)||new Set(A.tuiProcessIds).size!==A.tuiProcessIds.length)throw Error("grok-build-cli post-stop cleanup requires unique TUI process ids");let I=A.tuiProcessIds.map((Y)=>sm(Q,Y));nJ(Q,"post-stop state home");let E=k0(C);nJ(E,"post-stop runtime directory");for(let Y of $E.emptyStateFiles)BV(ZA(Q,Y),0);for(let Y of $E.stateFiles)BV(ZA(Q,Y));let g=ZA(Q,"sessions");if(DQ(g))nJ(g,"post-stop sessions directory");let U=encodeURIComponent(B),J=ZA(g,U);if(DQ(J))nJ(J,"post-stop cwd session directory");for(let Y of $E.cwdSessionFiles)BV(ZA(J,Y));for(let Y of $E.sessionRootFiles)BV(ZA(g,Y));for(let Y of $E.transientStateDirectories)B6A(ZA(Q,Y));for(let Y of $E.transientStateDirectories)I6A(ZA(Q,Y));for(let Y of I)tm(Y);em(Q),rm(D6A(C)),u3(B)}function W6A(A,Q){let B=process.getuid?.(),C,I;try{C=sQ(A,_A.O_RDONLY|(_A.O_NOFOLLOW||0)),I=sQ(Q,_A.O_RDONLY|(_A.O_NOFOLLOW||0));let E=GB(C),g=GB(I),U=(D)=>D.isFile()&&D.nlink===1&&(B===void 0||D.uid===B)&&D.size>0&&D.size<=4096;if(!U(E)||zI()&&(E.mode&2)!==0||!U(g)||!aC(g.mode,384)||E.size!==g.size)return!1;let J=$D(C),Y=$D(I),F=GB(C),G=GB(I);return JI(E,F)&&JI(g,G)&&E.size===F.size&&g.size===G.size&&J.equals(Y)}catch{return!1}finally{if(I!==void 0)GQ(I);if(C!==void 0)GQ(C)}}function Z6A(A,Q,B){let C=ZA(A,B),I=ZA(Q,B);if(!pm(C))return;let E=DQ(I);if(E){if(E.isSymbolicLink()&&gQ(k0(I),o9A(I))===gQ(C))return;if(E.isFile()&&!E.isSymbolicLink()&&W6A(C,I))return;throw Error(`grok-build-cli refuses generated credential state at ${I}`)}a9A(C,I)}function M6A(A){let Q=DQ(A);if(!Q)return;let B=process.getuid?.();if(B===void 0&&zI())throw Error("grok-build-cli requires Unix uid checks for source auth.json");if(Q.isSymbolicLink()||!Q.isFile()||Q.nlink!==1)throw Error("grok-build-cli source auth.json must be a single-link regular file");if(B!==void 0&&Q.uid!==B)throw Error("grok-build-cli source auth.json must be owned by the runtime uid");if(!aC(Q.mode,384))throw Error("grok-build-cli source auth.json must have mode 0600");let C;try{C=sQ(A,_A.O_RDONLY|(_A.O_NOFOLLOW||0));let I=GB(C);if(!I.isFile()||I.nlink!==1||I.dev!==Q.dev||I.ino!==Q.ino)throw Error("grok-build-cli source auth.json changed during validation");if(B!==void 0&&I.uid!==B||!aC(I.mode,384))throw Error("grok-build-cli source auth.json changed security metadata during validation");return $D(C,"utf8")}catch(I){if(I?.code==="ELOOP")throw Error("grok-build-cli source auth.json must not be a symlink");throw I}finally{if(C!==void 0)GQ(C)}}function p3(A){let Q=_B(gQ(A)),B=[],C=Q,I=!1;while(!0){if(B.push(C),DQ(ZA(C,".git"))){I=!0;break}let g=k0(C);if(g===C)break;C=g}let E=I?B:[Q];return{directories:E,root:E[E.length-1]}}function Au(A){return p3(A).directories.flatMap((Q)=>[ZA(Q,".grok"),ZA(Q,".claude"),ZA(Q,".cursor"),ZA(Q,".mcp.json"),ZA(Q,".envrc")])}function Qu(A,Q=!1){for(let B of p3(A).directories){let C=ZA(B,".grok"),I=DQ(C);if(I&&(I.isSymbolicLink()||!I.isDirectory())&&!GD(C))throw Error(`grok-build-cli refuses project policy state at ${C}: expected a real directory${um(C)}`);for(let E of[".grok/hooks",".grok/plugins"]){if(I&&!I.isDirectory()&&GD(C))break;let g=ZA(B,E);if(!DQ(g))continue;throw Error(`grok-build-cli refuses project executable configuration at ${g}: Grok can execute it outside the model tool sandbox`)}if(!Q)continue;for(let E of[".grok",".claude",".cursor"]){let g=ZA(B,E),U=DQ(g);if(U&&(U.isSymbolicLink()||!U.isDirectory())&&!GD(g))throw Error(`grok-build-cli refuses project policy state at ${g}: expected a real directory${um(g)}`);if(U&&U.isDirectory()&&CV(g).length!==0)throw Error(`grok-build-cli refuses project executable configuration at ${g}: shared-TUI folder trust requires an empty project extension directory`)}for(let E of[".mcp.json",".envrc"]){let g=ZA(B,E);if(!DQ(g))continue;if(GD(g))continue;throw Error(`grok-build-cli refuses project executable configuration at ${g}: folder trust would activate code outside the model tool sandbox`)}}}function Bu(A,Q){let B=v3(A,Q);return B===""||B!==".."&&!B.startsWith(`..${process.platform==="win32"?"\\":"/"}`)&&!f3(B)}function X6A(A,Q){let B=ZA(Q,".anet"),C=gQ(A.command),I=gQ(A.serverPath),E=gQ(A.envFile);if(A.command!==C||A.serverPath!==I||A.envFile!==E||I!==ZA(B,"node-server.js")||E!==ZA(B,".env"))throw Error("grok-build-cli commhub MCP paths must be the canonical project .anet artifacts");try{if(!ND(C).isFile()||_B(C)!==C)throw Error("not canonical");lm(C,_A.X_OK)}catch{throw Error("grok-build-cli commhub MCP command is not a canonical executable file")}let g=process.getuid?.();for(let[U,J,Y]of[[I,"server",void 0],[E,"environment",384]]){let F=jB(U);if(F.isSymbolicLink()||!F.isFile()||F.nlink!==1||_B(U)!==U||g!==void 0&&F.uid!==g||Y!==void 0&&!aC(F.mode,Y))throw Error(`grok-build-cli commhub MCP ${J} is not an owner-held canonical file`)}for(let[U,J]of[[A.alias,"alias"],[A.resumeId,"resume id"]])if(!U||/[\0\r\n]/.test(U))throw Error(`grok-build-cli commhub MCP ${J} is invalid`);return{command:C,serverPath:I,envFile:E,alias:A.alias,resumeId:A.resumeId,activeTaskFile:A.activeTaskFile}}function L6A(A,Q,B){let C=(Y,F,G)=>{let D=jB(Y),$=sQ(Y,_A.O_RDONLY|(_A.O_NOFOLLOW||0));try{let N=GB($),V=process.getuid?.();if(!N.isFile()||N.nlink!==1||N.dev!==D.dev||N.ino!==D.ino||V!==void 0&&N.uid!==V||G!==void 0&&!aC(N.mode,G))throw Error(`grok-build-cli commhub MCP ${F} changed during staging`);return $D($,"utf8")}finally{GQ($)}},I=ZA(B,"runtime-mcp");DD(I,"commhub MCP runtime directory");let E=ZA(k0(Q),".anet-grok-credentials"),g=ZA(E,y3(B));DD(E,"commhub MCP credential root"),DD(g,"commhub MCP credential directory");let U=ZA(I,"node-server.js"),J=ZA(g,".env");return Vg(U,C(A.serverPath,"server")),Vg(J,C(A.envFile,"environment",384)),{config:{...A,serverPath:U,envFile:J},credentialDir:g}}function i3(A,Q){return k0(A)===A||A===Q}function z6A(A,Q){try{let B=_B(gQ(A));if(!ND(B).isDirectory())return!1;return!i3(B,_B(gQ(Q??nm())))}catch{return!1}}function K6A(A,Q){let B=gQ(A),C=_B(B);if(C!==B)throw Error("grok-build-cli refuses folder trust through a symlinked project path");if(!ND(C).isDirectory())throw Error("grok-build-cli folder trust target must be a directory");let E=_B(gQ(nm()));if(i3(C,E))throw Error("grok-build-cli refuses over-broad folder trust for a home or filesystem root");for(let g of[E,...Q.map((U)=>gQ(U))])if(Bu(C,g))throw Error("grok-build-cli refuses folder trust overlapping runtime credential or state paths");return C}async function d3(A,Q="flock",B=process.env){let C=p3(A).root,I=_B(C);if(!zI()){let N=ZA(I,C6A),V=sQ(N,_A.O_RDWR|_A.O_CREAT,384),W;try{W=await E6A(N)}catch(M){throw GQ(V),M}let Z=!1;return{fd:V,async release(){if(Z)return;Z=!0,await W.release(),GQ(V)}}}let E=!1;try{E=_B(A)!==I}catch{E=!1}if(!ND(I).isDirectory())throw Error(`grok-build-cli project root is not a directory: ${I}`);let U=ZA(I,".anet"),J=DQ(U);if(!J||J.isSymbolicLink()||!J.isDirectory())throw Error(`grok-build-cli requires a real project .anet directory for its turn lock: ${U}`);let Y=ZA(U,".grok-build-cli-turn.lock"),F=sQ(Y,_A.O_RDWR|_A.O_CREAT|(_A.O_NOFOLLOW||0),384);try{let N=GB(F);if(!N.isFile()||N.nlink!==1)throw Error(`grok-build-cli turn lock must be a single-link regular file: ${Y}`);let V=process.getuid?.();if(V!==void 0)cB(Y,V,N.uid);fI(()=>x0(F,384))}catch(N){throw GQ(F),N}let G="process.stdout.write('LOCKED\\n');process.stdin.resume()",D=d9A(Q,["--no-fork","--exclusive","--nonblock","3",process.execPath,"-e",G],{cwd:I,env:e1(B),stdio:["pipe","pipe","pipe",F]});try{await new Promise((N,V)=>{let W="",Z="",M=!1,X=setTimeout(()=>{if(M)return;M=!0,D.kill("SIGKILL"),V(Error("grok-build-cli timed out acquiring the project turn lock"))},3000);X.unref?.();let L=(K)=>{if(M)return;M=!0,clearTimeout(X),V(Error(K))};D.stdout.setEncoding("utf8"),D.stdout.on("data",(K)=>{if(W=(W+K).slice(-64),!M&&W.includes(`LOCKED
 `))M=!0,clearTimeout(X),N()}),D.stderr.setEncoding("utf8"),D.stderr.on("data",(K)=>{Z=(Z+K).slice(-500)}),D.once("error",(K)=>L(`grok-build-cli could not start flock: ${K.message}`)),D.once("exit",(K)=>{if(!M)L(K===1?`grok-build-cli project is busy; concurrent turns are refused (lock ${Y}${E?`, resolved by walking up from ${A} — see issue #884`:""})`:`grok-build-cli flock holder exited before acquisition (${K??"signal"}${Z?`: ${Z.trim()}`:""})`)})})}catch(N){throw GQ(F),N}let $=!1;return{fd:F,async release(){if($)return;$=!0,await new Promise((N)=>{if(D.exitCode!==null||D.signalCode!==null)return N();let V=setTimeout(()=>{D.kill("SIGKILL"),N()},1000);V.unref?.(),D.once("exit",()=>{clearTimeout(V),N()}),D.stdin.end()}),GQ(F)}}}function H6A(A){let Q;try{Q=JSON.parse(A)}catch{throw Error("grok-build-cli hook audit returned invalid JSON")}if(!Q||typeof Q!=="object"||!Array.isArray(Q.hooks))throw Error("grok-build-cli hook audit response is missing the hooks array");let B=0,C=(E)=>{if(!E||typeof E!=="object")return;if(typeof E.hookCount==="number"&&E.hookCount>0)B+=E.hookCount;if(Array.isArray(E.hooks)&&E!==Q)B+=E.hooks.length;if(Array.isArray(E))E.forEach(C);else Object.values(E).forEach(C)};if(Q.plugins)C(Q.plugins);let I=Q.hooks.length+B;if(I>0)throw Error(`grok-build-cli refuses to start: grok inspect discovered ${I} executable hook${I===1?"":"s"} outside the model tool sandbox`)}function w6A(A){let Q=gQ(A.sourceHome),B=gQ(A.stateRoot),C=gQ(A.stateHome),I=ZA(Q,"auth.json"),E=[...new Set(A.denyPaths.filter(Boolean).map((k)=>gQ(k)))],g=DQ(Q);if(!g||g.isSymbolicLink()||!g.isDirectory())throw Error("grok-build-cli source GROK_HOME must be an existing real directory");if(_B(Q)!==Q)throw Error("grok-build-cli source GROK_HOME must not traverse a symlinked ancestor");let U=v3(B,C);if(!U||U==="."||U===".."||U.startsWith(`..${process.platform==="win32"?"\\":"/"}`)||f3(U)||k0(U)!==".")throw Error(`grok-build-cli isolated state home must be one direct child of ${B}`);if(Q===C)throw Error("grok-build-cli source GROK_HOME and isolated state home must be different");if(A.useLeader===!0&&!A.projectCwd)throw Error("grok-build-cli shared TUI requires an explicit project cwd for folder trust");if(A.useLeader===!0&&E.some((k)=>Bu(k,I)))throw Error("grok-build-cli shared TUI auth path overlaps a required sandbox deny; choose a separate GROK_HOME");let J=A.projectCwd?A.useLeader===!0?K6A(A.projectCwd,[Q,B,C,I]):_B(gQ(A.projectCwd)):void 0;if(J)Qu(J,A.useLeader===!0);let Y=A.commhubMcp?X6A(A.commhubMcp,J):void 0,F=M6A(I);DD(B,"isolated state root"),DD(C,"isolated state home");let G=Y?L6A(Y,B,C):void 0,D=G?.config;om(C);for(let k of["hooks","hooks-paths","plugins","agents","skills","commands","lsp","lsp-servers","lsp.json","settings.json","managed_config.toml","requirements.toml"])oJ(ZA(C,k),{recursive:!0,force:!0});let $=ZA(C,".sandbox-profile-id"),N=(U6A($)||"").trim();if(!/^anet-[a-f0-9]{24}$/.test(N))N=`anet-${b3(12).toString("hex")}`,Vg($,`${N}
@@ -300,7 +300,7 @@ ${A}`}function Pk(A,Q,B,C,I){let{interactiveDashboardTask:E,messageType:g}=B,U=t
 `,"config.json",B.stat),!0}QD();OJ();async function Xh(A,Q){let B=!1,C;for(let I of A)try{await Q(I)}catch(E){if(!B)C=E;B=!0}if(B)throw C}function C3(A,Q){let B=Promise.resolve(),C=new Map,I=async(E)=>{let g=Q?.initialDelayMs??0;while(!0)try{await E();return}catch(U){if(A(U),!Q)return;await new Promise((J)=>{setTimeout(J,g).unref?.()}),g=Math.min(g*2,Q.maxDelayMs)}};return{schedule(E){let g=C.get(E);if(g){g.dirty=!0;return}let U={dirty:!1};C.set(E,U);let J=async()=>{try{do U.dirty=!1,await I(E);while(U.dirty)}finally{C.delete(E)}};B=B.then(J,J)},idle(){return B}}}var WVA=new Set(["replied","failed","cancelled","expired"]);function ZVA(A){return typeof A==="string"&&WVA.has(A)}async function Lh(A,Q){if(!Q)return{skip:!1,status:null,reason:"no-task-id"};let B;try{B=await A(Q)}catch{return{skip:!1,status:null,reason:"lookup-failed"}}if(!B||B.ok===!1||!B.task)return{skip:!1,status:null,reason:"not-found"};let C=typeof B.task.status==="string"?B.task.status:null;return ZVA(C)?{skip:!0,status:C,reason:"terminal"}:{skip:!1,status:C,reason:"open"}}function zh(A){if(A.meta&&typeof A.meta==="object"&&!Array.isArray(A.meta))return A.meta;if(typeof A.meta_json!=="string"||A.meta_json.length===0)return null;try{let Q=JSON.parse(A.meta_json);return Q&&typeof Q==="object"&&!Array.isArray(Q)?Q:null}catch{return null}}function E3(A){let Q=A.type??"task";if(Q!=="task"&&Q!=="broadcast")return!1;let B=zh(A);if(!B||B.source!=="dashboard-chat")return!1;if(typeof B.client_request_id!=="string"||!/^dreq_[a-f0-9]{32}$/.test(B.client_request_id))return!1;return B.auth_origin==="user"}function Kh(A){if(!E3(A))return null;let Q=zh(A)?.client_request_id;return typeof Q==="string"?Q:null}async function Hh(A,Q){for(let B of A)await Q(B)}function wh(A){if(!Number.isInteger(A.maxConcurrent)||A.maxConcurrent<1)throw Error("maxConcurrent must be a positive integer");let Q=new Set,B=new Set,C=[],I=()=>{while(Q.size<A.maxConcurrent&&C.length>0){let E=C.shift(),g=A.key(E.message);B.delete(g),Q.add(g);let U;try{U=E.handler(E.message)}catch(J){U=Promise.reject(J)}U.catch(A.onError).finally(()=>{Q.delete(g);try{A.onSettled?.()}catch(J){A.onError(J)}finally{I()}})}};return{submit(E,g){let U=0,J=0;for(let Y of E){let F=A.key(Y);if(Q.has(F)||B.has(F)){J++;continue}B.add(F),C.push({message:Y,handler:g}),U++}return I(),{active:Q.size,queued:C.length,accepted:U,deduplicated:J}},stats(){return{active:Q.size,queued:C.length}}}}function jh(A,Q){return A!=="codex-app-server"||Q===0}var MVA={self:"sender alias equals node alias; reply-loop guard","own-prefix":"message carries this node's own reply prefix; reply-loop guard",cooldown:"sender cooldown is active","low-value-inbound":"non-task message matched the low-value filter"};function _h(A){let Q=MVA[A.reason]||"inbound filter rejected the message";return`skipped inbound ${A.messageType} ${A.taskId} from ${A.sender}: ${A.reason} (${Q}); acknowledged without model delivery`}function Rh(A){let Q=A||"task";return Q==="task"||Q==="broadcast"}function Oh(A){let{alias:Q,from:B,content:C,msgType:I}=A;if(B===Q&&!A.imBridge)return"self";if(C.startsWith(`[${Q}]`))return"own-prefix";let E=I==="task"||I==="broadcast"||I==="reply";if(!E&&B!=="hub"&&B!=="api"){if(A.lastReplyAt&&A.now-A.lastReplyAt<A.cooldownMs)return"cooldown"}if(!E&&A.isLowValue(C))return"low-value-inbound";return null}var XVA="skipped by agent-node: self-sent task (sender is this node; reply-loop guard), no turn ran. To wake a node later, use a Hub scheduled task or /aloop instead of send_task to yourself. (#519)",LVA="skipped by agent-node: task text starts with this node's own reply prefix (echo of its own reply; reply-loop guard), no turn ran. (#519)";function zVA(A){if(A==="self")return XVA;if(A==="own-prefix")return LVA;return null}async function qh(A,Q){let B=zVA(Q.reason);if(!B)return{kind:"not-applicable",detail:`reason ${Q.reason} does not close a task`};if(!Rh(Q.msgType))return{kind:"not-applicable",detail:`type ${Q.msgType} carries no task`};if(!Q.taskId)return{kind:"not-applicable",detail:"no task id"};try{let C=await A("cancel_task",{task_id:Q.taskId,reason:B});if(C&&typeof C==="object"&&C.ok===!0)return{kind:"closed",tool:"cancel_task"};return{kind:"not-closed",tool:"cancel_task",detail:JSON.stringify(C??null).slice(0,200)}}catch(C){return{kind:"error",tool:"cancel_task",detail:String(C?.message??C).slice(0,200)}}}async function Th(A,Q){if(!Rh(Q.msgType))return{kind:"not-applicable",detail:`type ${Q.msgType} carries no task`};if(!Q.taskId)return{kind:"not-applicable",detail:"no task id"};let C=`${Q.result.trim()||"(empty reply)"} [low-value reply withheld from sender by agent-node (#519)]`.slice(0,4000);try{return await A("report_completion",{alias:Q.alias,task:Q.taskId,result:C}),{kind:"closed",tool:"report_completion"}}catch(I){return{kind:"error",tool:"report_completion",detail:String(I?.message??I).slice(0,200)}}}function BD(A,Q){switch(Q.kind){case"closed":return`closed task ${A} via ${Q.tool} (#519)`;case"not-closed":return`task ${A} not closed by ${Q.tool} (already terminal?): ${Q.detail}`;case"not-applicable":return`task ${A} left as-is: ${Q.detail}`;case"error":return`failed to close task ${A} via ${Q.tool}: ${Q.detail}`}}function t1(){let A=null;return{run(Q){if(A)return A;let B=Promise.resolve().then(Q);return A=B,B.finally(()=>{if(A===B)A=null}).catch(()=>{}),B},pending(){return A}}}function Ph(){let A=null,Q=t1();return{async getOrOpen(B){if(A?.isRunning)return A;return Q.run(async()=>{if(A?.isRunning)return A;A=null;let C=await B();if(!C.isRunning)throw Error("codex app-server session stopped while opening");return A=C,C})},invalidate(B){if(!B||A===B)A=null},current(){return A},pending(){return Q.pending()}}}ID();y2();import{closeSync as CD,constants as DE,existsSync as RVA,fchmodSync as AV,fstatSync as xh,fsyncSync as OVA,ftruncateSync as qVA,lstatSync as TVA,mkdirSync as PVA,openSync as F3,readdirSync as SVA,readFileSync as xVA,realpathSync as Y3,writeSync as kVA}from"node:fs";import{join as kh,resolve as G3}from"node:path";function vh(){return process.platform==="linux"&&RVA("/proc/self/fd")}function bh(A,Q){return vh()?`/proc/self/fd/${A}`:Q}function yh(A,Q){let B=xh(A),C=process.getuid?.();if(!B.isFile()||B.nlink!==1||C!==void 0&&B.uid!==C)throw Error(`private log is not a single owner-controlled file: ${Q}`);AV(A,384)}function fh(A){let Q=G3(A);if(Y3(Q)!==Q)throw Error(`private log directory is not canonical: ${Q}`);let B=F3(Q,DE.O_RDONLY|(DE.O_DIRECTORY||0)|(DE.O_NOFOLLOW||0));try{let C=xh(B),I=process.getuid?.();if(!C.isDirectory()||I!==void 0&&C.uid!==I)throw Error(`private log directory is not owner-controlled: ${Q}`);if(vh()&&Y3(`/proc/self/fd/${B}`)!==Q)throw Error(`private log directory changed during validation: ${Q}`);if(process.platform!=="win32")AV(B,448);return B}catch(C){throw CD(B),C}}function hh(A,Q,B){let C=0;while(C<Q.length){let I=kVA(A,Q,C,Q.length-C,B===null?null:B+C);if(I<=0)throw Error("private log write made no progress");C+=I}}function vVA(A,Q){let B=F3(A,DE.O_RDWR|(DE.O_NOFOLLOW||0));try{yh(B,A);let C=Buffer.from(Q.redactText(xVA(B,"utf8")).text,"utf8");if(qVA(B,0),C.length>0)hh(B,C,0);OVA(B),AV(B,384)}finally{CD(B)}}function mh(A,Q){let B=G3(A);PVA(B,{recursive:!0,mode:448});let C=TVA(B),I=process.getuid?.();if(C.isSymbolicLink()||!C.isDirectory()||Y3(B)!==B||I!==void 0&&C.uid!==I)throw Error(`private log directory is not owner-controlled: ${B}`);let E=fh(B);try{let g=bh(E,B);for(let U of SVA(g)){if(!U.endsWith(".log"))continue;vVA(kh(g,U),Q)}}finally{CD(E)}return B}function D3(A,Q,B,C){if(!/^\d{4}-\d{2}-\d{2}\.log$/.test(Q))throw Error("private log filename is not a canonical daily log name");let I=fh(A),E=kh(bh(I,G3(A)),Q),g;try{g=F3(E,DE.O_WRONLY|DE.O_CREAT|DE.O_APPEND|(DE.O_NOFOLLOW||0),384),yh(g,E);let U=Buffer.from(C.redactText(B).text,"utf8");if(U.length>0)hh(g,U,null);AV(g,384)}finally{if(g!==void 0)CD(g);CD(I)}}function $3(A){return JSON.stringify(A)}function uh(A){let Q=A.configNodeId||"",B=A.envNodeId||"";if(Q){if(B&&B!==Q)A.warn?.(`COMMHUB_NODE_ID mismatch: env=${$3(B)} config=${$3(Q)} config_path=${$3(A.configPath||"config.json")}; ignoring env COMMHUB_NODE_ID, using config node_id`);return{value:Q,source:"config"}}if(B)return{value:B,source:"env"};return{value:"",source:"none"}}function bVA(A){let Q=A?.task_id||A?.message_id||A?.id;if(Q)return String(Q);let B=A?.content?.[0]?.text;if(typeof B!=="string")return null;try{let C=JSON.parse(B);return C?.task_id||C?.message_id||C?.id||null}catch{return null}}function pJ(A,Q,B,C={}){let I=O4({from_alias:A.fromAlias,to_alias:A.toAlias,task_id:B,parent_task_id:A.parentTaskId,network_id:A.networkId,transport:"mcp_http",status:Q,duration_ms:Date.now()-A.startedAt,lifecycle_tracking:"tracked",...C.errorCode?{error_code:C.errorCode}:{},...C.errorMessage?{error_message:_4(C.errorMessage)}:{}});if(C.event)I.event=C.event;A.log(R4(I))}async function ch(A,Q,B){let C=B.now??Date.now,I=B.sleep??((V)=>new Promise((W)=>setTimeout(W,V))),E=B.timeoutMs??120000,g=B.pollIntervalMs??2000,U=B.stale30Ms??30000,J=B.stale60Ms??60000,Y=B.emit,F=C()+E,G=null,D=new Set,$=!1,N=!1;while(C()<F){G=await B.getTask(A);let V=G?.task||G,W=V?.status;if((W==="acked"||W==="running"||W==="processing")&&!D.has(W))D.add(W),Y(W==="acked"?"acked":"started",A);if(W==="replied"||W==="failed"||W==="cancelled")return Y(W==="replied"?"replied":"failed",A,{...W==="replied"?{}:{errorCode:`task_${W}`,event:"task.failed"}}),{kind:"terminal",status:W,latest:G,row:V};let Z=C()-Q;if(!$&&Z>=U&&W==="delivered")$=!0,Y("delivered",A,{event:"task.warning.delivered_stale_30s"});if(!N&&Z>=J&&W==="delivered")N=!0,Y("delivered",A,{event:"task.warning.delivered_stale_60s"});await I(g)}return Y("expired",A,{errorCode:"lifecycle_timeout"}),{kind:"expired",latest:G}}async function lh(A,Q,B){pJ(Q,"sending",null);try{let C=await B({alias:A.alias,task:A.task,priority:A.priority||"normal",from_session:Q.fromAlias,parent_task_id:Q.parentTaskId||void 0}),I=bVA(C);if(!I)pJ(Q,"failed",null,{errorCode:"missing_task_id",errorMessage:"CommHub response omitted task_id"});else pJ(Q,"delivered",I);return C}catch(C){throw pJ(Q,"failed",null,{errorCode:"send_failed",errorMessage:C}),C}}function ph(A){let Q=A||"task";if(Q==="task"||Q==="broadcast")return{deliverToRuntime:!0,replyExpected:!0};if(Q==="reply")return{deliverToRuntime:!0,replyExpected:!1};return{deliverToRuntime:!1,replyExpected:!1}}async function ih(A,Q,B){let C=await B.deliverToRuntime(A);if(Q)return{kind:"request",result:C};return await B.acknowledge(A.id),{kind:"terminal_peer_reply",result:C}}function dh(A,Q){if(A.type!=="new_reply")return!1;return Q(),!0}p4();function N3(){return{hubSupportsTool:null}}function yVA(A){if(!(A instanceof hB))return!1;if(A.code===-32601)return!0;let Q=String(A.message||"");return A.code===-32602&&/(?:unknown|not found|does not exist).{0,80}send_peer_reply|send_peer_reply.{0,80}(?:unknown|not found|does not exist)/i.test(Q)}function fVA(A){if(!(A instanceof hB))return!1;return A.code==="peer_reply_unsupported"||A.code==="peer_reply_origin_not_node"||A.code==="reply_task_not_owned"||A.code==="peer_reply_node_token_required"||yVA(A)}async function nh(A,Q,B=N3()){try{let C=await Q.sendAtomic(A);return B.hubSupportsTool=!0,{route:"atomic",payload:C}}catch(C){if(!fVA(C))throw C;return{route:"legacy-reply",payload:await Q.sendLegacyReply(A)}}}import{chmodSync as oh,closeSync as V3,existsSync as hVA,fchmodSync as mVA,fsyncSync as uVA,openSync as ah,readFileSync as cVA,renameSync as lVA,unlinkSync as rh,writeFileSync as pVA}from"node:fs";import{randomBytes as iVA}from"node:crypto";var sh=15000,dVA=2500,Am=300000,ED=2000,nVA=new Set(["replied","failed","cancelled","expired"]);function Z3(A){if(A===void 0||A===null||String(A).trim()==="")return sh;let Q=Number(A);if(!Number.isSafeInteger(Q))return sh;return Math.min(Am,Math.max(dVA,Q))}function W3(){return{version:3,consumed_task_ids:[],consumed_client_request_ids:[],surfaced_outbound_terminal_ids:[],outbound_deliveries:[],outbound_terminal_watermark:0,inbound_lifecycle:[],last_success_at:null}}function Ng(A){if(!Array.isArray(A))return[];return[...new Set(A.filter((Q)=>typeof Q==="string"&&Q.length>0&&Q.length<=512))].slice(-ED)}function oVA(A){if(!A||typeof A!=="object")return W3();let Q=A;return{version:3,consumed_task_ids:Ng(Q.consumed_task_ids),consumed_client_request_ids:Ng(Q.consumed_client_request_ids),surfaced_outbound_terminal_ids:Ng(Q.surfaced_outbound_terminal_ids),outbound_deliveries:Array.isArray(Q.outbound_deliveries)?Q.outbound_deliveries.filter((B)=>!!B&&typeof B.task_id==="string"&&typeof B.idempotency_key==="string"&&["pending","delivering","delivered"].includes(B.state)).slice(-ED):Ng(Q.surfaced_outbound_terminal_ids).map((B)=>({task_id:B,idempotency_key:`commhub-terminal:${B}`,state:"delivered"})),outbound_terminal_watermark:Number.isSafeInteger(Q.outbound_terminal_watermark)&&Number(Q.outbound_terminal_watermark)>=0?Number(Q.outbound_terminal_watermark):0,inbound_lifecycle:Array.isArray(Q.inbound_lifecycle)?Q.inbound_lifecycle.filter((B)=>!!B&&typeof B.task_id==="string"&&["delivered","submitted","consumed","completed"].includes(B.state)).slice(-ED):Ng(Q.consumed_task_ids).map((B)=>({task_id:B,state:"consumed"})),last_success_at:typeof Q.last_success_at==="string"?Q.last_success_at:null}}function th(A){return Kh(A)}function eh(A){return typeof A.task_id==="string"&&A.task_id?A.task_id:A.id}function aVA(A){let Q=A,B=String(Q?.message??A??"");return Q?.code===-32601||Q?.code===-32602||/unknown tool|tool .+ not found|method not found|-3260[12]/i.test(B)}var rVA=new Set(["from_node_id_identity_mismatch","node_token_required"]);function sVA(A){let Q=A;return Q?.appLevel===!0&&typeof Q.code==="string"&&rVA.has(Q.code)}class Qm{path;state;constructor(A){this.path=A;this.state=this.read()}snapshot(){return this.state=this.read(),this.state}update(A){this.withLock(()=>{let Q=this.read();A(Q),Q.consumed_task_ids=Ng(Q.consumed_task_ids),Q.consumed_client_request_ids=Ng(Q.consumed_client_request_ids),Q.surfaced_outbound_terminal_ids=Ng(Q.surfaced_outbound_terminal_ids),Q.outbound_deliveries=Q.outbound_deliveries.filter((B)=>B.state!=="delivered").slice(-ED),Q.inbound_lifecycle=Q.inbound_lifecycle.slice(-ED),this.write(Q),this.state=Q})}claimOutbound(A,Q,B,C){return this.withLock(()=>{let I=this.read(),E=I.outbound_deliveries.find((g)=>g.task_id===A);if(E?.state==="delivered"||E?.state==="delivering"&&(E.lease_until??0)>B)return!1;if(E)E.state="delivering",E.lease_until=B+C;else I.outbound_deliveries.push({task_id:A,idempotency_key:Q,state:"delivering",lease_until:B+C});return this.write(I),this.state=I,!0},!1)}withLock(A,Q){let B=`${this.path}.lock`,C;try{C=ah(B,"wx",384)}catch{if(arguments.length>1)return Q;throw Error("compensation cursor is locked")}try{return A()}finally{V3(C);try{rh(B)}catch{}}}read(){if(!hVA(this.path))return W3();try{let A=oVA(JSON.parse(cVA(this.path,"utf8")));return oh(this.path,384),A}catch{return W3()}}write(A){let Q=`${this.path}.tmp-${process.pid}-${iVA(6).toString("hex")}`,B=null;try{B=ah(Q,"wx",384),mVA(B,384),pVA(B,`${JSON.stringify(A)}
 `,"utf8"),uVA(B),V3(B),B=null,lVA(Q,this.path),oh(this.path,384)}finally{if(B!==null)V3(B);try{rh(Q)}catch{}}}}function Bm(A){let Q=Z3(A.intervalMs),B=A.adapters,C=new Qm(A.cursorPath),I="probing",E=null,g=!1,U=!1,J=null,Y=0,F=!1,G=!1,D=B.now??Date.now,$=Math.max(30000,Q*2),N=B.setTimer??((q,c)=>{let m=setTimeout(q,c);return m.unref?.(),m}),V=B.clearTimer??((q)=>clearTimeout(q)),W=(q)=>{let c=C.snapshot(),m=eh(q),k=th(q);return c.consumed_task_ids.includes(m)||!!k&&c.consumed_client_request_ids.includes(k)},Z=(q)=>{let c=eh(q),m=th(q);C.update((k)=>{if(k.consumed_task_ids.push(c),m)k.consumed_client_request_ids.push(m);let d=k.inbound_lifecycle.find((y)=>y.task_id===c);if(d)d.state="completed";else k.inbound_lifecycle.push({task_id:c,state:"completed"})})},M={delivered:0,submitted:1,consumed:2,completed:3},X=(q,c)=>{if(!q)return;C.update((m)=>{let k=m.inbound_lifecycle.find((d)=>d.task_id===q);if(!k)m.inbound_lifecycle.push({task_id:q,state:c});else if(M[c]>M[k.state])k.state=c;if(M[c]>=M.consumed)m.consumed_task_ids.push(q)})},L=(q)=>{if(U||I==="realtime-only")return;if(J!==null)V(J);J=N(()=>{J=null,R("timer")},q)},K=async(q)=>{try{let c=C.snapshot().outbound_terminal_watermark,[m,k]=await Promise.all([B.getInbox(),G?Promise.resolve({tasks:[],hasMore:!1}):B.listOutbound(c).catch((y)=>{if(!sVA(y))throw y;return G=!0,B.warn(`[commhub-compensation] outbound reconciliation disabled: this node's token is not bound to its node_id (${y.code}); inbox compensation continues. Re-issue a node-bound token to restore lost-reply reconciliation.`),{tasks:[],hasMore:!1}})]),d=k.tasks;if(I==="probing")I="active",B.log(`[commhub-compensation] active (${Q}ms; SSE remains primary)`);if(m.some((y)=>!W(y)))B.scheduleInboxDrain();for(let y of d){if(!y?.task_id||!nVA.has(y.status))continue;if(!Number.isSafeInteger(y.terminal_seq)||Number(y.terminal_seq)<=0)throw Object.assign(Error("Hub terminal sequence missing"),{code:-32602});let w=Number(y.terminal_seq),l=C.snapshot();if(w<=l.outbound_terminal_watermark)continue;let x=C.snapshot().outbound_deliveries.find((h)=>h.task_id===y.task_id);if(x?.state==="delivered"){C.update((h)=>{h.outbound_terminal_watermark=Math.max(h.outbound_terminal_watermark,w)});continue}let o=x?.idempotency_key??`commhub-terminal:${y.task_id}`;if(!C.claimOutbound(y.task_id,o,D(),$))break;try{await B.onOutboundTerminal(y,o)}catch(h){throw C.update((QA)=>{let BA=QA.outbound_deliveries.find((MA)=>MA.task_id===y.task_id);if(BA)BA.state="pending",BA.lease_until=0}),h}C.update((h)=>{let QA=h.outbound_deliveries.find((BA)=>BA.task_id===y.task_id);if(QA)QA.state="delivered",QA.lease_until=0;h.outbound_terminal_watermark=Math.max(h.outbound_terminal_watermark,w)})}if(C.update((y)=>{y.last_success_at=new Date(D()).toISOString()}),k.hasMore)g=!0;Y=0,B.log(`[commhub-compensation] ${q} poll ok; inbox=${m.length} outbound=${d.length}`),L(Q)}catch(c){if(aVA(c)){if(I="realtime-only",!F)F=!0,B.warn("[commhub-compensation] Hub lacks durable inbox/outbox polling capability; realtime-only mode (SSE/turn-steer only)");return}Y++;let m=Math.min(Am,Q*2**Math.min(Y,5));B.warn(`[commhub-compensation] poll failed; retry in ${m}ms: ${c instanceof Error?c.message:String(c)}`),L(m)}},R=(q)=>{if(U||I==="realtime-only")return;if(E){g=!0;return}E=(async()=>{let c=q;do g=!1,await K(c),c="idle";while(g&&!U&&I!=="realtime-only")})().finally(()=>{E=null})};return{get mode(){return I},get outboundDisabled(){return G},trigger:R,recordConsumed:Z,recordLifecycle:X,wasConsumed:W,async idle(){await E},stop(){if(U=!0,J!==null)V(J);J=null}}}import{appendFileSync as pIA,mkdirSync as zW,statSync as IkA}from"fs";import{appendFileSync as tVA,mkdirSync as eVA,writeSync as A9A}from"node:fs";import{join as Q9A}from"node:path";function Im(A){if(A instanceof Error)return`${A.name}: ${A.message}`.replace(/[\r\n]+/g," ");return String(A).replace(/[\r\n]+/g," ")}function B9A(A){if(A instanceof Error)return A.stack||`${A.name}: ${A.message}`;return String(A)}function Cm(A){let Q=A.stdout??process.stdout,B=A.stderr??process.stderr,C=A.now??(()=>new Date),I=A.redact??((W)=>W),E=A.exit??((W)=>process.exit(W)),g=A.alias??"agent-node",U=!1,J=!1,Y=!1,F="normal",G=!1,D=(W,Z,M)=>{return`[${C().toISOString().slice(11,19)}] [${W.padEnd(5)}] [${g}] [${Z}] ${M}`},$=(W)=>{try{let Z=C().toISOString().slice(0,10),M=I(W);if(A.appendLine)A.appendLine(Z,M);else eVA(A.logDir,{recursive:!0,mode:448}),tVA(Q9A(A.logDir,`${Z}.log`),M+`
 `,{mode:384})}catch{}},N=(W)=>(Z)=>{if(Z?.code==="EPIPE"){if(W==="stdout")U=!0;else J=!0;if(!Y)Y=!0,$(D("WARN","stream",`${W} EPIPE; terminal output disabled, file logging continues`));return}if(F=`${W} error: ${Im(Z)}`,!G)G=!0,E(1)};Q.on("error",N("stdout")),B.on("error",N("stderr"));let V=(W,Z)=>{if(G)return;G=!0,F=`${W}: ${Im(Z)}`;let M=B9A(Z);if($(D("ERROR","fatal",`${W}: ${M}`)),!J)try{A9A(2,`${M}
-`)}catch(X){if(X?.code==="EPIPE")J=!0}E(1)};return process.on("uncaughtException",(W)=>V("uncaughtException",W)),process.on("unhandledRejection",(W)=>V("unhandledRejection",W)),process.on("exit",(W)=>$(D(W===0?"INFO":"ERROR","exit",`code=${W} reason=${F}`))),{outputBroken:()=>U||J}}var Em={name:"@sleep2agi/agent-node",version:"2.5.0-preview.135",description:"AI Agent runtime for CommHub networks. Supports Claude Code CLI, Claude Agent SDK, Codex SDK, Codex app-server, Grok Build ACP, and OpenCode CLI.",bin:{"agent-node":"dist/cli.js"},type:"module",files:["dist","README.md"],scripts:{build:"bun build src/cli.ts --outdir dist --entry-naming cli.js --target node --minify --external @anthropic-ai/claude-agent-sdk --external '@anthropic-ai/claude-agent-sdk-*' --external @openai/codex-sdk --external node-pty && bun build src/upload-file-mcp-stdio.ts --outdir dist --entry-naming upload-file-mcp-stdio.js --target node --minify",prepublishOnly:"npm run build"},keywords:["agent","ai","commhub","claude","claude-code","codex","gpt5","grok","xai","grok-build-cli","copresence","acp","sdk","minimax","mimo","runtime","node","anthropic"],author:"sleep2agi",license:"Apache-2.0",homepage:"https://anet.sh",repository:{type:"git",url:"git+https://github.com/sleep2agi/agent-network.git",directory:"agent-node"},publishConfig:{access:"public",tag:"preview"},bugs:{url:"https://github.com/sleep2agi/agent-network/issues"},engines:{node:">=18.17.0"},dependencies:{"@anthropic-ai/claude-agent-sdk":"0.3.289",undici:"^6.27.0",ws:"^8.22.0",zod:"^4.4.3"},optionalDependencies:{"@openai/codex":"^0.133.0","@openai/codex-sdk":"^0.133.0","node-pty":"^1.1.0"},devDependencies:{"@types/ws":"^8.18.2"}};pG();RG();import{chmodSync as C9A,existsSync as E9A,mkdirSync as g9A,readFileSync as U9A,writeFileSync as J9A}from"node:fs";import{join as Y9A}from"node:path";var gm="model_reasoning_effort";function M3(A){return jG(A)}function F9A(A,Q){let B=A.includes(`\r
+`)}catch(X){if(X?.code==="EPIPE")J=!0}E(1)};return process.on("uncaughtException",(W)=>V("uncaughtException",W)),process.on("unhandledRejection",(W)=>V("unhandledRejection",W)),process.on("exit",(W)=>$(D(W===0?"INFO":"ERROR","exit",`code=${W} reason=${F}`))),{outputBroken:()=>U||J}}var Em={name:"@sleep2agi/agent-node",version:"2.5.0-preview.136",description:"AI Agent runtime for CommHub networks. Supports Claude Code CLI, Claude Agent SDK, Codex SDK, Codex app-server, Grok Build ACP, and OpenCode CLI.",bin:{"agent-node":"dist/cli.js"},type:"module",files:["dist","README.md"],scripts:{build:"bun build src/cli.ts --outdir dist --entry-naming cli.js --target node --minify --external @anthropic-ai/claude-agent-sdk --external '@anthropic-ai/claude-agent-sdk-*' --external @openai/codex-sdk --external node-pty && bun build src/upload-file-mcp-stdio.ts --outdir dist --entry-naming upload-file-mcp-stdio.js --target node --minify",prepublishOnly:"npm run build"},keywords:["agent","ai","commhub","claude","claude-code","codex","gpt5","grok","xai","grok-build-cli","copresence","acp","sdk","minimax","mimo","runtime","node","anthropic"],author:"sleep2agi",license:"Apache-2.0",homepage:"https://anet.sh",repository:{type:"git",url:"git+https://github.com/sleep2agi/agent-network.git",directory:"agent-node"},publishConfig:{access:"public",tag:"preview"},bugs:{url:"https://github.com/sleep2agi/agent-network/issues"},engines:{node:">=18.17.0"},dependencies:{"@anthropic-ai/claude-agent-sdk":"0.3.289",undici:"^6.27.0",ws:"^8.22.0",zod:"^4.4.3"},optionalDependencies:{"@openai/codex":"^0.133.0","@openai/codex-sdk":"^0.133.0","node-pty":"^1.1.0"},devDependencies:{"@types/ws":"^8.18.2"}};pG();RG();import{chmodSync as C9A,existsSync as E9A,mkdirSync as g9A,readFileSync as U9A,writeFileSync as J9A}from"node:fs";import{join as Y9A}from"node:path";var gm="model_reasoning_effort";function M3(A){return jG(A)}function F9A(A,Q){let B=A.includes(`\r
 `)?`\r
 `:`
 `,C=A.endsWith(`

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@sleep2agi/agent-node",
-  "version": "2.5.0-preview.135",
+  "version": "2.5.0-preview.136",
   "description": "AI Agent runtime for CommHub networks. Supports Claude Code CLI, Claude Agent SDK, Codex SDK, Codex app-server, Grok Build ACP, and OpenCode CLI.",
   "bin": {
     "agent-node": "dist/cli.js"