@songsid/agend 2.1.12 → 2.2.0-alpha.1

package/README.md

@@ -7,7 +7,7 @@
     <a href="https://songsid.github.io/AgEnD"><img src="https://img.shields.io/badge/Website-songsid.github.io/AgEnD-blue" alt="Website"></a>
     <a href="https://www.npmjs.com/package/@songsid/agend"><img src="https://img.shields.io/npm/v/@songsid/agend" alt="npm"></a>
     <a href="LICENSE"><img src="https://img.shields.io/badge/License-MIT-blue.svg" alt="License: MIT"></a>
-    <a href="https://nodejs.org"><img src="https://img.shields.io/badge/Node.js-%3E%3D%2020-green.svg" alt="Node.js >= 20"></a>
+    <a href="https://nodejs.org"><img src="https://img.shields.io/badge/Node.js-%3E%3D%2022.14.0-green.svg" alt="Node.js >= 22.14.0"></a>
   </p>
 </p>
 
@@ -150,7 +150,7 @@ graph LR
 
 ## Requirements
 
-- Node.js >= 20
+- Node.js ^22.14.0 || ^23.6.0 || >=24
 - tmux
 - One of the supported AI coding CLIs (installed and authenticated)
 - Telegram bot token ([@BotFather](https://t.me/BotFather)) or Discord bot token

package/README.zh-TW.md

@@ -7,7 +7,7 @@
     <a href="https://songsid.github.io/AgEnD"><img src="https://img.shields.io/badge/Website-songsid.github.io/AgEnD-blue" alt="Website"></a>
     <a href="https://www.npmjs.com/package/@songsid/agend"><img src="https://img.shields.io/npm/v/@songsid/agend" alt="npm"></a>
     <a href="LICENSE"><img src="https://img.shields.io/badge/License-MIT-blue.svg" alt="License: MIT"></a>
-    <a href="https://nodejs.org"><img src="https://img.shields.io/badge/Node.js-%3E%3D%2020-green.svg" alt="Node.js >= 20"></a>
+    <a href="https://nodejs.org"><img src="https://img.shields.io/badge/Node.js-%3E%3D%2022.14.0-green.svg" alt="Node.js >= 22.14.0"></a>
   </p>
 </p>
 
@@ -150,7 +150,7 @@ graph LR
 
 ## 系統需求
 
-- Node.js >= 20
+- Node.js ^22.14.0 || ^23.6.0 || >=24
 - tmux
 - 以下任一 AI coding CLI（需安裝並完成認證）
 - Telegram bot token（[@BotFather](https://t.me/BotFather)）或 Discord bot token

package/dist/auth/one-time-code.d.ts

@@ -0,0 +1,19 @@
+export declare const ONE_TIME_CODE_LENGTH = 8;
+export declare function generateOneTimeCode(): string;
+/** `ABCD-EFGH` — a shape that survives being read aloud and retyped. */
+export declare function formatOneTimeCode(code: string): string;
+/**
+ * What the person typed, as the code it was meant to be.
+ *
+ * Case and the dash are presentation. Rejecting `abcd efgh` would be rejecting
+ * a correct answer, and the person retyping it has no idea which detail was
+ * wrong — so they spend attempts on formatting.
+ */
+export declare function normalizeOneTimeCode(input: string): string;
+/**
+ * Fixed-length constant-time compare.
+ *
+ * Both sides are padded to the same length first: `timingSafeEqual` throws on a
+ * mismatch, and returning early on one leaks the length through timing.
+ */
+export declare function constantTimeMatches(provided: string, expected: string): boolean;

package/dist/auth/one-time-code.js

@@ -0,0 +1,49 @@
+/**
+ * The typed one-time code, as a primitive.
+ *
+ * Shared by the pre-fleet setup page (`setup-auth.ts`) and the dashboard login
+ * (`web-login.ts`). What is shared is only what has no policy in it: the
+ * alphabet, how a code is generated, shown and read back, and how two strings
+ * are compared. Attempt budgets, lifetimes and what a redeemed code is *worth*
+ * differ between the two and stay with their owners — the setup page burns
+ * itself on the fifth failure, a long-lived fleet must not.
+ */
+import { randomInt, timingSafeEqual } from "node:crypto";
+/** RFC 4648 base32, minus nothing: the digits 0/1 are absent from it already. */
+const CODE_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+export const ONE_TIME_CODE_LENGTH = 8;
+export function generateOneTimeCode() {
+    let code = "";
+    for (let i = 0; i < ONE_TIME_CODE_LENGTH; i++)
+        code += CODE_ALPHABET[randomInt(CODE_ALPHABET.length)];
+    return code;
+}
+/** `ABCD-EFGH` — a shape that survives being read aloud and retyped. */
+export function formatOneTimeCode(code) {
+    return `${code.slice(0, 4)}-${code.slice(4)}`;
+}
+/**
+ * What the person typed, as the code it was meant to be.
+ *
+ * Case and the dash are presentation. Rejecting `abcd efgh` would be rejecting
+ * a correct answer, and the person retyping it has no idea which detail was
+ * wrong — so they spend attempts on formatting.
+ */
+export function normalizeOneTimeCode(input) {
+    return input.replace(/[^0-9A-Za-z]/g, "").toUpperCase();
+}
+/**
+ * Fixed-length constant-time compare.
+ *
+ * Both sides are padded to the same length first: `timingSafeEqual` throws on a
+ * mismatch, and returning early on one leaks the length through timing.
+ */
+export function constantTimeMatches(provided, expected) {
+    const width = Math.max(provided.length, expected.length, 1);
+    const a = Buffer.alloc(width);
+    const b = Buffer.alloc(width);
+    a.write(provided, "utf8");
+    b.write(expected, "utf8");
+    return timingSafeEqual(a, b) && provided.length === expected.length;
+}
+//# sourceMappingURL=one-time-code.js.map

package/dist/auth/one-time-code.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"one-time-code.js","sourceRoot":"","sources":["../../src/auth/one-time-code.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEzD,iFAAiF;AACjF,MAAM,aAAa,GAAG,kCAAkC,CAAC;AACzD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAEtC,MAAM,UAAU,mBAAmB;IACjC,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,oBAAoB,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,aAAa,CAAC,SAAS,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;IACtG,OAAO,IAAI,CAAC;AACd,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,OAAO,KAAK,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AAC1D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAgB,EAAE,QAAgB;IACpE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC5D,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1B,OAAO,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,CAAC;AACtE,CAAC"}

package/dist/auth-api.d.ts

@@ -0,0 +1,52 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { Logger } from "./logger.js";
+import { type SessionTier, type WebSessionStore } from "./web-session.js";
+import type { LoginCodeOwner, WebLoginCodes } from "./web-login.js";
+export declare const LOGIN_REFUSED_MESSAGE = "That code did not work \u2014 it may be wrong, expired or already used. Ask for a new one with /dashboard.";
+export declare const LOGIN_PAUSED_MESSAGE = "Too many wrong codes \u2014 sign-in is paused for a few minutes.";
+export interface AuthApiContext {
+    readonly webToken: string | null;
+    readonly webSessions: WebSessionStore | null;
+    readonly webLoginCodes: WebLoginCodes | null;
+    readonly logger: Logger;
+    /** Told after every successful sign-in, so the operator can be shown one they did not make. */
+    confirmPublicWebLogin?(info: {
+        label: string;
+        handle: string;
+        owner: LoginCodeOwner;
+    }, isCurrent: () => boolean): Promise<void>;
+    onWebLogin?(info: {
+        label: string;
+        surface: "local" | "gateway";
+        tier: SessionTier;
+        handle: string;
+    }): void;
+}
+/** True for a name `/assets/` serves. The public link's manifest asks this too: one list, not two. */
+export declare function isServedAsset(name: string): boolean;
+export declare function isAuthPath(path: string): boolean;
+/**
+ * Whether a request skips the global gate. Everything not named here goes
+ * through `decideWebGate`.
+ *
+ * - `/health` (GET) is the monitor's probe; `/agent` (POST) authenticates itself
+ *   with an instance token.
+ * - The sign-in page and its endpoints are the way *through* the gate; each route
+ *   in this file does its own checks.
+ * - `/view`'s reads and `/api/ai-usage` are open by default, and only reads: a
+ *   write to any of them is gated like everything else, so it needs a session
+ *   (with the cookie-write checks) or the header token, never a `?token=`.
+ *   `web.view_access: session` closes the reads too.
+ */
+export declare function bypassesWebGate(req: {
+    method?: string | undefined;
+    url?: string | undefined;
+}, path: string, config: {
+    web?: {
+        view_access?: string;
+    } | undefined;
+} | null | undefined, isViewRead: (path: string) => boolean): boolean;
+/** The sign-in page. Also what a browser navigation gets from a gated page it has no cookie for. */
+export declare function serveSigninPage(res: ServerResponse, status?: number): void;
+export declare function handleAuthRequest(req: IncomingMessage, res: ServerResponse, url: URL, ctx: AuthApiContext): boolean;
+export declare const REVOCATION_NOT_DURABLE_MESSAGE = "Signed out for now, but the change could not be saved: the session file could not be updated or removed, so a fleet restart may bring the session back. Fix the permissions on ~/.agend/web-sessions.json and sign out again, or rotate the token (agend web-token rotate).";

package/dist/auth-api.js

@@ -0,0 +1,346 @@
+import { readBoundedWebBody } from "./web-body.js";
+import { performance } from "node:perf_hooks";
+import { withinBudget } from "./monotonic-budget.js";
+import { gatewayRequestContext, isWebRequestCurrent } from "./web-request-context.js";
+/**
+ * The sign-in surface: the page, the exchange, and session management.
+ *
+ *   GET    /signin                  static page — no side effects, no secret
+ *   GET    /assets/<file>           the two scripts the page and the panels load
+ *   POST   /auth/login              {code} → session cookie
+ *   GET    /auth/session            who am I (+ the CSRF value this session must send)
+ *   POST   /auth/logout             end this session
+ *   GET    /auth/sessions           this operator's signed-in devices
+ *   DELETE /auth/sessions/<handle>  end one of them
+ *   DELETE /auth/sessions           end all of them
+ *   POST   /auth/issue-code         X-Agend-Token only — how `agend web --code` asks for a code
+ *
+ * Every GET here is free of side effects: a chat client that previews a link
+ * cannot spend a code, mint a session, or move a counter. The only thing that
+ * consumes a code is a POST from the page's own origin.
+ *
+ * Nothing here is behind the global gate — this *is* the way through it — so each
+ * route does its own checks, with the same primitives the gate uses.
+ *
+ * See `docs/design/web-unification-secure-login.zh-TW.md` §3.
+ */
+import { sendPanelHtml } from "./web-host-guard.js";
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { authorizeSession, buildClearedSessionCookies, buildSessionCookie, hasValidHeaderToken, isSameOriginRequest, isSecureRequest, readSessionCookie, WEB_CSRF_MESSAGE, } from "./web-auth.js";
+import { csrfTokenFor, labelFromUserAgent, sessionIdHash, tokenEpoch } from "./web-session.js";
+const __dirname = dirname(fileURLToPath(import.meta.url));
+export const LOGIN_REFUSED_MESSAGE = "That code did not work — it may be wrong, expired or already used. Ask for a new one with /dashboard.";
+export const LOGIN_PAUSED_MESSAGE = "Too many wrong codes — sign-in is paused for a few minutes.";
+const MAX_LOGIN_BODY = 1024;
+/** The only files `/assets/` will serve. A map, not a directory: nothing else can be named into it. */
+const ASSETS = {
+    "agend-auth.js": { file: join("shared", "agend-auth.js"), type: "text/javascript; charset=utf-8" },
+    "signin.js": { file: join("shared", "signin.js"), type: "text/javascript; charset=utf-8" },
+    "theme.js": { file: join("shared", "theme.js"), type: "text/javascript; charset=utf-8" },
+    // #1408: the design tokens every panel shares, and the font they name (Inter, SIL OFL 1.1: shared/fonts/OFL.txt).
+    "tokens.css": { file: join("shared", "tokens.css"), type: "text/css; charset=utf-8" },
+    "inter.woff2": { file: join("shared", "fonts", "inter.woff2"), type: "font/woff2" },
+    // #1408: the app shell's public closure — the entry module, everything it imports statically, and the vendored
+    // Preact + htm (shared/vendor/vendor.json, byte-checked). Static code with no data, like signin.js; the panels that
+    // need a session stay behind the gate under /ui/js/ and are reached only by a dynamic import.
+    ...Object.fromEntries([
+        "app.js", "app-html.js", "app-i18n.js", "app-route.js", "app-nav.js", "app-ctx.js", "app-stream.js", "app-store.js",
+        "app-shell.js", "app-session.js", "app-needs.js", "ui-confirm.js", "ui-dialog.js", "ui-menu.js", "ui-states.js", "ui-icons.js", "ui-toast.js",
+        // #1408 step 2: View is public (an anonymous reader opens it under web.view_access: open), loaded on demand.
+        "panel-view.js", "view-strings.js",
+        "preact.module.js", "preact-hooks.module.js", "htm.module.js",
+    ].map(name => [name, { file: join("shared", name), type: "text/javascript; charset=utf-8" }])),
+    "app.css": { file: join("shared", "app.css"), type: "text/css; charset=utf-8" },
+};
+/** True for a name `/assets/` serves. The public link's manifest asks this too: one list, not two. */
+export function isServedAsset(name) {
+    return Object.prototype.hasOwnProperty.call(ASSETS, name);
+}
+export function isAuthPath(path) {
+    return path === "/" || path === "/signin" || path.startsWith("/auth/") || path.startsWith("/assets/");
+}
+/**
+ * Whether a request skips the global gate. Everything not named here goes
+ * through `decideWebGate`.
+ *
+ * - `/health` (GET) is the monitor's probe; `/agent` (POST) authenticates itself
+ *   with an instance token.
+ * - The sign-in page and its endpoints are the way *through* the gate; each route
+ *   in this file does its own checks.
+ * - `/view`'s reads and `/api/ai-usage` are open by default, and only reads: a
+ *   write to any of them is gated like everything else, so it needs a session
+ *   (with the cookie-write checks) or the header token, never a `?token=`.
+ *   `web.view_access: session` closes the reads too.
+ */
+export function bypassesWebGate(req, path, config, isViewRead) {
+    const method = req.method ?? "GET";
+    if (method === "GET" && req.url === "/health")
+        return true;
+    if (method === "POST" && req.url === "/agent")
+        return true;
+    if (isAuthPath(path))
+        return true;
+    return (method === "GET" || method === "HEAD") && config?.web?.view_access !== "session" && isViewRead(path);
+}
+function json(res, code, body, headers = {}) {
+    res.writeHead(code, { "Content-Type": "application/json", ...headers });
+    res.end(JSON.stringify(body));
+}
+/** The sign-in page. Also what a browser navigation gets from a gated page it has no cookie for. */
+export function serveSigninPage(res, status = 200) {
+    try {
+        const html = readFileSync(join(__dirname, "ui", "signin.html"), "utf-8");
+        sendPanelHtml(res, html, status, { "Cache-Control": "no-store" });
+    }
+    catch {
+        json(res, 500, { error: "signin.html not found" });
+    }
+}
+async function readJsonBody(req) {
+    try {
+        const parsed = JSON.parse((await readBoundedWebBody(req, MAX_LOGIN_BODY)).toString("utf8") || "{}");
+        return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+function isJsonRequest(req) {
+    return String(req.headers["content-type"] ?? "").toLowerCase().startsWith("application/json");
+}
+export function handleAuthRequest(req, res, url, ctx) {
+    const path = url.pathname;
+    if (!isAuthPath(path))
+        return false;
+    const method = req.method ?? "GET";
+    const gateReq = req;
+    // ── `/` is a door, not a page: everything about who may enter is decided at /ui ──
+    if (path === "/") {
+        if (method !== "GET" && method !== "HEAD") {
+            json(res, 405, { error: "method not allowed" });
+            return true;
+        }
+        res.writeHead(302, { Location: "/ui", "Cache-Control": "no-store" });
+        res.end();
+        return true;
+    }
+    // ── The page and its scripts: public, inert ──
+    if (path === "/signin") {
+        if (method !== "GET" && method !== "HEAD") {
+            json(res, 405, { error: "method not allowed" });
+            return true;
+        }
+        serveSigninPage(res);
+        return true;
+    }
+    if (path.startsWith("/assets/")) {
+        const asset = method === "GET" ? ASSETS[path.slice("/assets/".length)] : undefined;
+        if (!asset) {
+            json(res, 404, { error: "not found" });
+            return true;
+        }
+        try {
+            const body = readFileSync(join(__dirname, "ui", asset.file));
+            res.writeHead(200, { "Content-Type": asset.type });
+            res.end(body);
+        }
+        catch {
+            json(res, 404, { error: "not found" });
+        }
+        return true;
+    }
+    // ── POST /auth/login ──
+    if (path === "/auth/login") {
+        if (method !== "POST") {
+            json(res, 405, { error: "method not allowed" });
+            return true;
+        }
+        // Origin is required, not merely checked: the sign-in page is always same-origin,
+        // and a login POST with no Origin is nobody's legitimate request.
+        if (!req.headers.origin || !isSameOriginRequest(gateReq)) {
+            json(res, 403, { error: "Cross-site request rejected" });
+            return true;
+        }
+        if (!isJsonRequest(req)) {
+            json(res, 415, { error: "expected application/json" });
+            return true;
+        }
+        const token = ctx.webToken;
+        if (!token || !ctx.webSessions || !ctx.webLoginCodes) {
+            json(res, 401, { error: LOGIN_REFUSED_MESSAGE });
+            return true;
+        }
+        const sessions = ctx.webSessions;
+        const codes = ctx.webLoginCodes;
+        // A notice ACK cannot create an orphan credential after the browser has
+        // disconnected. Normal completed request-body close is not an abort.
+        const publicRequest = !!gatewayRequestContext(req);
+        let disconnected = false;
+        let candidateId;
+        const disconnect = () => {
+            disconnected = true;
+            if (candidateId)
+                sessions.revokeById(candidateId);
+        };
+        if (publicRequest) {
+            req.once("aborted", disconnect);
+            res.once?.("close", disconnect);
+        }
+        void readJsonBody(req).then(async (body) => {
+            if (!body || typeof body.code !== "string") {
+                json(res, 400, { error: "expected {\"code\": \"XXXX-XXXX\"}" });
+                return;
+            }
+            const gateway = gatewayRequestContext(req);
+            const current = () => isWebRequestCurrent(req) && ctx.webToken === token
+                && (!publicRequest || (!disconnected && !req.aborted && !(req.destroyed && !req.complete) && !res.destroyed && !res.writableEnded));
+            if (!current()) {
+                json(res, 401, { error: LOGIN_REFUSED_MESSAGE });
+                return;
+            }
+            const result = codes.redeem(body.code, tokenEpoch(token), gateway?.exposureId ?? "local");
+            if (result.kind === "paused") {
+                json(res, 429, { error: LOGIN_PAUSED_MESSAGE }, { "Retry-After": String(Math.ceil(result.retryAfterMs / 1000)) });
+                return;
+            }
+            if (result.kind === "invalid") {
+                ctx.logger.debug("web sign-in refused");
+                json(res, 401, { error: LOGIN_REFUSED_MESSAGE });
+                return;
+            }
+            // A new id every time, whatever the request carried: the browser never
+            // gets to choose the value it will be authenticated by, and a cookie it
+            // already had is retired rather than upgraded.
+            const previous = readSessionCookie(gateReq);
+            if (previous && sessions.authenticate(previous, tokenEpoch(token), { touch: false, surface: gateway?.surface, exposureId: gateway?.exposureId }))
+                sessions.revokeById(previous);
+            const label = labelFromUserAgent(typeof req.headers["user-agent"] === "string" ? req.headers["user-agent"] : undefined);
+            const { sessionId, record } = sessions.create({ tier: result.tier, surface: gateway?.surface ?? "local", label, tokenEpoch: tokenEpoch(token), exposureId: gateway?.exposureId, pending: !!gateway });
+            if (gateway)
+                candidateId = sessionId;
+            if (gateway) {
+                try {
+                    if (!result.owner || !ctx.confirmPublicWebLogin)
+                        throw new Error("public notice unavailable");
+                    await withinBudget(ctx.confirmPublicWebLogin({ label, handle: record.handle, owner: result.owner }, current), performance.now() + 5_000);
+                    if (!current() || !sessions.activate(sessionId))
+                        throw new Error("public login closed");
+                }
+                catch {
+                    sessions.revokeById(sessionId);
+                    ctx.logger.debug("Public sign-in could not be confirmed");
+                    if (!res.destroyed)
+                        json(res, 503, { error: "Sign-in could not be confirmed. Ask for a new code and try again." });
+                    return;
+                }
+            }
+            ctx.logger.info({ handle: record.handle, label, tier: record.tier, surface: record.surface }, "Web sign-in");
+            try {
+                if (!gateway)
+                    ctx.onWebLogin?.({ label, surface: record.surface, tier: record.tier, handle: record.handle });
+            }
+            catch (err) {
+                ctx.logger.debug({ err }, "web sign-in notice failed");
+            }
+            json(res, 200, { ok: true, csrf: csrfTokenFor(sessionId), tier: record.tier, expiresAt: record.absoluteExpiry }, {
+                "Set-Cookie": buildSessionCookie(sessionId, isSecureRequest(gateReq), (record.absoluteExpiry - record.created) / 1000),
+            });
+        }).catch(() => { if (!res.destroyed && !res.headersSent)
+            json(res, 500, { error: "sign-in failed" }); })
+            .finally(() => { req.removeListener("aborted", disconnect); res.removeListener?.("close", disconnect); });
+        return true;
+    }
+    // ── POST /auth/issue-code — a local script's way to ask for a code ──
+    if (path === "/auth/issue-code") {
+        if (method !== "POST") {
+            json(res, 405, { error: "method not allowed" });
+            return true;
+        }
+        const token = ctx.webToken;
+        if (gatewayRequestContext(req) || !token || !ctx.webLoginCodes || !isSameOriginRequest(gateReq) || !hasValidHeaderToken(gateReq, token)) {
+            json(res, 401, { error: "X-Agend-Token required" });
+            return true;
+        }
+        const issued = ctx.webLoginCodes.issue({ tier: "admin", epoch: tokenEpoch(token) });
+        ctx.logger.info({ source: "cli" }, "Web login code issued");
+        json(res, 200, { code: issued.display, expiresAt: issued.expiresAt });
+        return true;
+    }
+    // ── The session's own endpoints: a session, and nothing else, is the credential ──
+    if (path === "/auth/session" || path === "/auth/logout" || path === "/auth/sessions" || path.startsWith("/auth/sessions/")) {
+        const auth = authorizeSession(gateReq, ctx.webToken, ctx.webSessions, { touch: path === "/auth/session" });
+        if (auth.kind === "reject") {
+            json(res, auth.status, auth.message === WEB_CSRF_MESSAGE ? { error: auth.message } : { ok: false, error: auth.message });
+            return true;
+        }
+        const sessions = ctx.webSessions;
+        const { session, sessionId } = auth;
+        if (path === "/auth/session" && method === "GET") {
+            json(res, 200, {
+                ok: true,
+                csrf: csrfTokenFor(sessionId),
+                handle: session.handle,
+                tier: session.tier,
+                surface: session.surface,
+                label: session.label,
+                created: session.created,
+                expiresAt: session.absoluteExpiry,
+                idleExpiresAt: session.idleExpiry,
+                idleMs: sessions.idleWindowMs(session.surface),
+            });
+            return true;
+        }
+        if (path === "/auth/logout" && method === "POST") {
+            const { durable } = sessions.revokeById(sessionId);
+            if (!durable)
+                return notDurable(res, ctx, { handle: session.handle }, "Web sign-out not saved");
+            ctx.logger.info({ handle: session.handle }, "Web sign-out");
+            json(res, 200, { ok: true }, { "Set-Cookie": buildClearedSessionCookies() });
+            return true;
+        }
+        if (path === "/auth/sessions" && method === "GET") {
+            json(res, 200, { sessions: sessions.list(sessionIdHash(sessionId)) });
+            return true;
+        }
+        if (path === "/auth/sessions" && method === "DELETE") {
+            const { count, durable } = sessions.revokeAll();
+            if (!durable)
+                return notDurable(res, ctx, { count }, "Web sessions revoked in memory only");
+            ctx.logger.info({ count }, "Web sessions revoked (all)");
+            json(res, 200, { ok: true, revoked: count }, { "Set-Cookie": buildClearedSessionCookies() });
+            return true;
+        }
+        if (path.startsWith("/auth/sessions/") && method === "DELETE") {
+            const handle = path.slice("/auth/sessions/".length);
+            const wasCurrent = handle === session.handle;
+            const { found, durable } = sessions.revokeByHandle(handle);
+            if (!found) {
+                json(res, 404, { error: "no such session" });
+                return true;
+            }
+            if (!durable)
+                return notDurable(res, ctx, { handle }, "Web session revoked in memory only", wasCurrent);
+            ctx.logger.info({ handle }, "Web session revoked");
+            json(res, 200, { ok: true, current: wasCurrent }, wasCurrent ? { "Set-Cookie": buildClearedSessionCookies() } : {});
+            return true;
+        }
+        json(res, 405, { error: "method not allowed" });
+        return true;
+    }
+    json(res, 404, { error: "not found" });
+    return true;
+}
+export const REVOCATION_NOT_DURABLE_MESSAGE = "Signed out for now, but the change could not be saved: the session file could not be updated or removed, so a fleet restart may bring the session back. Fix the permissions on ~/.agend/web-sessions.json and sign out again, or rotate the token (agend web-token rotate).";
+/**
+ * A revocation that holds only in memory is reported as a failure (500), never as "ok": the browser is
+ * still told to drop its cookie (it is signed out here), but whoever asked must not believe a session is
+ * dead that the next start revives.
+ */
+function notDurable(res, ctx, detail, msg, clearCookie = true) {
+    ctx.logger.warn({ ...detail, durable: false }, msg);
+    json(res, 500, { ok: false, durable: false, error: REVOCATION_NOT_DURABLE_MESSAGE }, clearCookie ? { "Set-Cookie": buildClearedSessionCookies() } : {});
+    return true;
+}
+//# sourceMappingURL=auth-api.js.map

package/dist/auth-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-api.js","sourceRoot":"","sources":["../src/auth-api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AACtF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGzC,OAAO,EACL,gBAAgB,EAChB,0BAA0B,EAC1B,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,EACf,iBAAiB,EACjB,gBAAgB,GAEjB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,EAA0C,MAAM,kBAAkB,CAAC;AAGvI,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE1D,MAAM,CAAC,MAAM,qBAAqB,GAChC,uGAAuG,CAAC;AAC1G,MAAM,CAAC,MAAM,oBAAoB,GAAG,6DAA6D,CAAC;AAElG,MAAM,cAAc,GAAG,IAAI,CAAC;AAY5B,uGAAuG;AACvG,MAAM,MAAM,GAA6D;IACvE,eAAe,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,EAAE,IAAI,EAAE,gCAAgC,EAAE;IAClG,WAAW,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,gCAAgC,EAAE;IAC1F,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,IAAI,EAAE,gCAAgC,EAAE;IACxF,kHAAkH;IAClH,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE;IACrF,aAAa,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,aAAa,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE;IACnF,+GAA+G;IAC/G,oHAAoH;IACpH,8FAA8F;IAC9F,GAAG,MAAM,CAAC,WAAW,CAAC;QACpB,QAAQ,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc,EAAE,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,cAAc;QACnH,cAAc,EAAE,gBAAgB,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa;QAC7I,6GAA6G;QAC7G,eAAe,EAAE,iBAAiB;QAClC,kBAAkB,EAAE,wBAAwB,EAAE,eAAe;KAC9D,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,gCAAgC,EAAE,CAAC,CAAC,CAAC;IAC9F,SAAS,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE;CAChF,CAAC;AAEF,sGAAsG;AACtG,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;AACxG,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,eAAe,CAC7B,GAA8D,EAC9D,IAAY,EACZ,MAAyE,EACzE,UAAqC;IAErC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC;IACnC,IAAI,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC3D,IAAI,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3D,IAAI,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,GAAG,EAAE,WAAW,KAAK,SAAS,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;AAC/G,CAAC;AAED,SAAS,IAAI,CAAC,GAAmB,EAAE,IAAY,EAAE,IAAa,EAAE,UAA6C,EAAE;IAC7G,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IACxE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAChC,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,eAAe,CAAC,GAAmB,EAAE,MAAM,GAAG,GAAG;IAC/D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,aAAa,CAAC,EAAE,OAAO,CAAC,CAAC;QACzE,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;IACrD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,GAAoB;IAC9C,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,kBAAkB,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;QAC7G,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAiC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnH,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAC1B,CAAC;AAED,SAAS,aAAa,CAAC,GAAoB;IACzC,OAAO,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;AAChG,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,GAAoB,EACpB,GAAmB,EACnB,GAAQ,EACR,GAAmB;IAEnB,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC1B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC;IACnC,MAAM,OAAO,GAAG,GAAgC,CAAC;IAEjD,oFAAoF;IACpF,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;QACjB,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;QAC5G,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;QACrE,GAAG,CAAC,GAAG,EAAE,CAAC;QACV,OAAO,IAAI,CAAC;IACd,CAAC;IAED,gDAAgD;IAChD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;QAC5G,eAAe,CAAC,GAAG,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACnF,IAAI,CAAC,KAAK,EAAE,CAAC;YAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;QACpE,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YAC7D,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YACnD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,yBAAyB;IACzB,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;QAC3B,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;QACxF,kFAAkF;QAClF,kEAAkE;QAClE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC;YAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;QACpI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;YAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;QACjG,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC;QAC3B,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;YAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;QACxH,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,CAAC;QACjC,MAAM,KAAK,GAAG,GAAG,CAAC,aAAa,CAAC;QAChC,wEAAwE;QACxE,qEAAqE;QACrE,MAAM,aAAa,GAAG,CAAC,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC;QACnD,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,IAAI,WAA+B,CAAC;QACpC,MAAM,UAAU,GAAG,GAAS,EAAE;YAC5B,YAAY,GAAG,IAAI,CAAC;YACpB,IAAI,WAAW;gBAAE,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QACpD,CAAC,CAAC;QACF,IAAI,aAAa,EAAE,CAAC;YAAC,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;YAAC,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAAC,CAAC;QACxF,KAAK,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,EAAC,IAAI,EAAC,EAAE;YACvC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YACxH,MAAM,OAAO,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;YAC3C,MAAM,OAAO,GAAG,GAAY,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK;mBAC5E,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,YAAY,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;YACtI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;gBAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YAC7E,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,UAAU,IAAI,OAAO,CAAC,CAAC;YAC1F,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC7B,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,EAAE,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;gBAClH,OAAO;YACT,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC9B,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;gBACxC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;gBACjD,OAAO;YACT,CAAC;YACD,uEAAuE;YACvE,wEAAwE;YACxE,+CAA+C;YAC/C,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;YAC5C,IAAI,QAAQ,IAAI,QAAQ,CAAC,YAAY,CAAC,QAAQ,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;gBAAE,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YAChL,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACxH,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACtM,IAAI,OAAO;gBAAE,WAAW,GAAG,SAAS,CAAC;YACrC,IAAI,OAAO,EAAE,CAAC;gBACZ,IAAI,CAAC;oBACH,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,qBAAqB;wBAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;oBAC9F,MAAM,YAAY,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC;oBACzI,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;gBAC1F,CAAC;gBAAC,MAAM,CAAC;oBACP,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;oBAC/B,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;oBAC1D,IAAI,CAAC,GAAG,CAAC,SAAS;wBAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,mEAAmE,EAAE,CAAC,CAAC;oBACnH,OAAO;gBACT,CAAC;YACH,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,aAAa,CAAC,CAAC;YAC7G,IAAI,CAAC;gBAAC,IAAI,CAAC,OAAO;oBAAE,GAAG,CAAC,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YAAC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,2BAA2B,CAAC,CAAC;YAAC,CAAC;YAC7L,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,cAAc,EAAE,EAAE;gBAC/G,YAAY,EAAE,kBAAkB,CAAC,SAAS,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;aACvH,CAAC,CAAC;QACL,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,GAAG,CAAC,WAAW;YAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;aACrG,OAAO,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,cAAc,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5G,OAAO,IAAI,CAAC;IACd,CAAC;IAED,uEAAuE;IACvE,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;QAChC,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;QACxF,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC;QAC3B,IAAI,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;YACxI,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;YACpD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACpF,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,uBAAuB,CAAC,CAAC;QAC5D,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;QACtE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,oFAAoF;IACpF,IAAI,IAAI,KAAK,eAAe,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,gBAAgB,IAAI,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC3H,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,IAAI,KAAK,eAAe,EAAE,CAAC,CAAC;QAC3G,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC3B,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,KAAK,gBAAgB,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;YACzH,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAY,CAAC;QAClC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;QAEpC,IAAI,IAAI,KAAK,eAAe,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YACjD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;gBACb,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE,YAAY,CAAC,SAAS,CAAC;gBAC7B,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,SAAS,EAAE,OAAO,CAAC,cAAc;gBACjC,aAAa,EAAE,OAAO,CAAC,UAAU;gBACjC,MAAM,EAAE,QAAQ,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC;aAC/C,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,IAAI,KAAK,cAAc,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACjD,MAAM,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YACnD,IAAI,CAAC,OAAO;gBAAE,OAAO,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,wBAAwB,CAAC,CAAC;YAChG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC;YAC5D,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,YAAY,EAAE,0BAA0B,EAAE,EAAE,CAAC,CAAC;YAC7E,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,IAAI,KAAK,gBAAgB,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YAClD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC;YACtE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,IAAI,KAAK,gBAAgB,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC,SAAS,EAAE,CAAC;YAChD,IAAI,CAAC,OAAO;gBAAE,OAAO,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,qCAAqC,CAAC,CAAC;YAC5F,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,4BAA4B,CAAC,CAAC;YACzD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,YAAY,EAAE,0BAA0B,EAAE,EAAE,CAAC,CAAC;YAC7F,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;YACpD,MAAM,UAAU,GAAG,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC;YAC7C,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;YAC3D,IAAI,CAAC,KAAK,EAAE,CAAC;gBAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;gBAAC,OAAO,IAAI,CAAC;YAAC,CAAC;YAC1E,IAAI,CAAC,OAAO;gBAAE,OAAO,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,oCAAoC,EAAE,UAAU,CAAC,CAAC;YACxG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,qBAAqB,CAAC,CAAC;YACnD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,0BAA0B,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACpH,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IACvC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,MAAM,8BAA8B,GACzC,6QAA6Q,CAAC;AAEhR;;;;GAIG;AACH,SAAS,UAAU,CAAC,GAAmB,EAAE,GAAuB,EAAE,MAA+B,EAAE,GAAW,EAAE,WAAW,GAAG,IAAI;IAChI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC;IACpD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA8B,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,0BAA0B,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACxJ,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/backend/claude-code.d.ts

@@ -50,6 +50,10 @@ export declare function claudeResumeMenuState(pane: string): {
     active: boolean;
     defaultCursor: boolean;
 };
+export declare function claudeColdResumePromptState(pane: string): {
+    titled: boolean;
+    exact: boolean;
+};
 /**
  * Claude Code's live input box, read as a region (#1200). Captured live from 2.1.293 under the production launch
  * (tests/fixtures/claude-2.1.293-*.pane.txt):