@vercel/board 0.0.0-stage → 0.15.0

package/dist/cli.mjs

@@ -0,0 +1,2252 @@
+#!/usr/bin/env node
+import { i as fileSize, n as DIRECT_UPLOAD_BYTES_MAX, t as ATTACHMENT_BYTES_MAX } from "./files-SniSmeEr.mjs";
+import { a as AttachmentId } from "./schemas-Be08nyfW.mjs";
+import { i as withMentions, r as FILTER_FLAGS } from "./watch-spec-W0c7ypHJ.mjs";
+import { n as displayEmoji, r as normalizeEmoji } from "./emoji-CTLpvH-A.mjs";
+import { t as BoardError } from "./client-DGDPaN7U.mjs";
+import { c as VERSION } from "./watchers-hash-D9hbHLKB.mjs";
+import { a as detectAgent, c as projectUrl, i as connect, n as boardUrl, r as configDir, s as projectDir, t as http } from "./backend-http-BsDSgmeo.mjs";
+import { t as board } from "./server-Cxey38B-.mjs";
+import { t as conformance } from "./conformance-DRR23YNy.mjs";
+import { t as displayText } from "./bots-CGkO76qH.mjs";
+import { execFileSync, spawn } from "node:child_process";
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { appendFile, mkdir, readFile, stat, writeFile } from "node:fs/promises";
+import { chmodSync, existsSync, mkdirSync, readFileSync, realpathSync, renameSync, statSync, unlinkSync, writeFileSync } from "node:fs";
+import { homedir, tmpdir } from "node:os";
+import { basename, delimiter, dirname, isAbsolute, join } from "node:path";
+import { parseArgs } from "node:util";
+import { createServer } from "node:http";
+//#region src/inspect/style.ts
+/**
+* Just Chat's look: mono, quiet, one accent, hairlines only under headers.
+* The default cursor everywhere but text; buttons never get a pointer; nothing
+* scrolls smoothly; hovers are instant.
+*/
+const CSS = `
+:root {
+  --bg: #fafafa;
+  --bright: #040404;
+  --dim: #303030;
+  --muted: #646464;
+  --faint: #909090;
+  --hairline: #d9d9d9;
+  --shade: #f0f0f0;
+  --shade-hover: #e3e3e3;
+  --accent: rgb(255, 108, 2);
+  --accent-transparent: rgba(255, 108, 2, 0.2);
+  --label: #fafafa;
+  --red: #c70000;
+  --mono: 'Geist Mono', ui-monospace, SFMono-Regular, Menlo, monospace;
+  color-scheme: light dark;
+}
+@media (prefers-color-scheme: dark) {
+  :root {
+    --bg: #040404;
+    --bright: #fafafa;
+    --dim: #dedede;
+    --muted: #909090;
+    --faint: #646464;
+    --hairline: #252525;
+    --shade: #161616;
+    --shade-hover: #1b1b1b;
+    --red: #ff7b72;
+  }
+}
+* { box-sizing: border-box; }
+html { scroll-behavior: auto; -webkit-tap-highlight-color: var(--accent-transparent); }
+body {
+  margin: 0;
+  overflow: hidden;
+  background: var(--bg);
+  color: var(--dim);
+  font-family: var(--mono);
+  font-size: 13px;
+  letter-spacing: -0.02em;
+  line-height: 1.5;
+  cursor: default;
+}
+a { color: inherit; text-decoration: none; cursor: pointer; }
+button { cursor: default; font: inherit; color: inherit; background: none; border: 0; padding: 0; letter-spacing: inherit; }
+input, textarea { font: inherit; color: var(--bright); letter-spacing: inherit; cursor: text; }
+::selection { background: var(--accent-transparent); }
+a:focus-visible, button:focus-visible, [role='separator']:focus-visible { outline: 2px dashed var(--accent); outline-offset: 2px; }
+
+.boot { display: grid; place-items: center; height: 100dvh; color: var(--faint); }
+.boot.error, .error { color: var(--accent); }
+.empty, .error { padding: 20px; margin: 0; color: var(--faint); }
+.faint { color: var(--faint); }
+.grow { flex: 1; min-width: 0; }
+.hint { color: var(--faint); font-size: 11px; }
+
+.shell { display: flex; height: 100dvh; overflow: hidden; }
+
+/* --- sidebar: same background as the page; its edge is the resize line --- */
+.sidebar { position: relative; flex-shrink: 0; display: flex; }
+.sidebar-scroll { flex: 1; min-width: 0; display: flex; flex-direction: column; overflow-y: auto; padding: 0 8px 12px; }
+.brand {
+  height: 46px;
+  flex-shrink: 0;
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  margin: 0 -8px 8px;
+  padding: 0 8px 0 16px;
+  border-bottom: 1px solid var(--hairline);
+  color: var(--bright);
+  font-weight: 600;
+}
+.sidebar h2 { margin: 16px 8px 4px; font-size: 11px; font-weight: 500; color: var(--faint); }
+.sidebar .item {
+  display: flex;
+  align-items: center;
+  gap: 6px;
+  padding: 5px 8px;
+  color: var(--muted);
+  font-size: 13px;
+  cursor: default;
+}
+.sidebar .item:hover, .sidebar .item[aria-current='page'] { background: var(--shade); color: var(--bright); }
+.sidebar .item .name { flex: 1; min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.sidebar .item.unread { color: var(--bright); font-weight: 600; }
+.sidebar .count { color: var(--faint); font-size: 11px; font-weight: 400; }
+.sidebar .dot { width: 6px; height: 6px; border-radius: 50%; background: var(--accent); }
+.whoami-wrap { margin-top: auto; padding-top: 16px; }
+.whoami { width: 100%; display: flex; align-items: center; gap: 6px; padding: 6px 8px; color: var(--muted); font-size: 11px; text-align: left; }
+.whoami:hover, .whoami[data-popup-open] { background: var(--shade); color: var(--bright); }
+.whoami .grow { display: grid; }
+.whoami .as, .whoami .url { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.whoami.naming { margin-top: auto; }
+.whoami.naming input { width: 100%; height: 28px; padding: 0 8px; border: 0; outline: 1px solid var(--muted); background: var(--shade); font-size: 12px; }
+.choice { display: flex; align-items: center; justify-content: space-between; gap: 12px; }
+.choice svg { color: var(--accent); }
+
+/* --- resize handles: a hairline that lights up --- */
+.resize { position: absolute; top: 0; bottom: 0; width: 7px; z-index: 5; cursor: col-resize; display: flex; justify-content: center; outline: none; }
+.resize.right { right: -3px; }
+.resize.left { left: -3px; }
+.resize i { width: 1px; height: 100%; background: var(--hairline); transition: background-color 0.12s; }
+.resize:hover i { background: var(--muted); }
+.resize.dragging i, .resize:focus-visible i { background: var(--accent); }
+
+/* --- main and the thread pane --- */
+.main, .pane { display: flex; flex-direction: column; min-width: 0; min-height: 0; }
+.main { flex: 1; }
+.pane { position: relative; flex-shrink: 0; }
+@media (max-width: 900px) {
+  .sidebar { display: none; }
+  .pane { position: fixed; inset: 0; width: auto !important; background: var(--bg); z-index: 30; }
+  .resize { display: none; }
+}
+
+.header {
+  height: 46px;
+  flex-shrink: 0;
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  padding: 0 12px 0 20px;
+  border-bottom: 1px solid var(--hairline);
+  white-space: nowrap;
+}
+.header .title { color: var(--bright); font-weight: 600; }
+.header .meta { color: var(--faint); font-size: 11px; overflow: hidden; text-overflow: ellipsis; }
+.header .spacer { flex: 1; }
+.header > .tool:first-child { margin-left: -8px; }
+
+.live { display: flex; align-items: center; gap: 6px; color: var(--faint); font-size: 11px; }
+.live i { width: 6px; height: 6px; border-radius: 50%; background: var(--faint); }
+.live.live i { background: var(--accent); }
+
+/* --- the feed: no row borders; a short conversation sits on the composer --- */
+.feed-wrap { position: relative; flex: 1; min-height: 0; display: flex; }
+.feed { flex: 1; overflow-y: auto; padding: 8px 0 12px; display: flex; flex-direction: column; overflow-anchor: none; }
+.feed > div { margin-top: auto; }
+.jump {
+  position: absolute;
+  bottom: 12px;
+  left: 50%;
+  transform: translateX(-50%);
+  padding: 3px 10px;
+  border: 1px solid var(--accent);
+  background: var(--bg);
+  color: var(--accent);
+  font-size: 11px;
+}
+.divider { display: flex; align-items: center; gap: 8px; margin: 14px 20px 4px; color: var(--faint); font-size: 11px; }
+.divider::after { content: ''; flex: 1; height: 1px; background: var(--hairline); }
+
+.message { position: relative; display: grid; grid-template-columns: 40px 1fr; gap: 8px; padding: 6px 20px 4px 8px; }
+.message.continued { padding-top: 1px; padding-bottom: 1px; }
+.message.active { background: var(--shade); }
+.message.pending { opacity: 0.5; }
+.message.failed { opacity: 1; }
+.gutter { display: flex; justify-content: center; align-items: flex-start; }
+.gutter-time { visibility: hidden; color: var(--faint); font-size: 10px; line-height: 21px; }
+.message.active .gutter-time, .gutter-time.shown { visibility: visible; }
+.avatar {
+  flex-shrink: 0;
+  display: inline-grid;
+  place-items: center;
+  border-radius: 4px;
+  background: var(--shade-hover);
+  color: var(--muted);
+  font-weight: 600;
+  overflow: hidden;
+}
+.avatar img { width: 100%; height: 100%; object-fit: cover; }
+.body { min-width: 0; }
+.meta-line { display: flex; flex-wrap: wrap; align-items: baseline; gap: 8px; }
+.author { color: var(--bright); font-weight: 600; }
+.where { color: var(--faint); font-size: 12px; }
+.where a { color: var(--accent); cursor: default; }
+.where a:hover { text-decoration: underline; }
+.time, .id { color: var(--faint); font-size: 11px; }
+/* Message text is markdown. Blocks stay compact; a short message reads as one line. */
+.text { overflow-wrap: anywhere; color: var(--dim); font-size: 14px; cursor: text; }
+.text > :first-child { margin-top: 0; }
+.text > :last-child { margin-bottom: 0; }
+.text > p:last-child, .text > p:has(+ .edited) { display: inline; }
+.text p { margin: 0 0 6px; }
+.text a { color: var(--accent); text-decoration: none; text-underline-offset: 3px; overflow-wrap: anywhere; }
+.text a:hover { text-decoration: underline; }
+.text strong { color: var(--bright); font-weight: 600; }
+.text h1, .text h2, .text h3, .text h4 { margin: 8px 0 4px; color: var(--bright); font-size: 14px; font-weight: 600; }
+.text ul, .text ol { margin: 2px 0 6px; padding-left: 20px; }
+.text li + li { margin-top: 1px; }
+.text blockquote { margin: 4px 0; padding-left: 10px; border-left: 2px solid var(--hairline); color: var(--muted); }
+.text code { padding: 1px 4px; border-radius: 3px; background: var(--shade); color: var(--bright); font-size: 0.92em; }
+.message.active .text code { background: var(--shade-hover); }
+.text pre { margin: 4px 0 6px; padding: 10px; overflow-x: auto; border: 1px solid var(--hairline); border-radius: 4px; background: var(--shade); line-height: 1.5; }
+.text pre code, .message.active .text pre code { padding: 0; border-radius: 0; background: none; font-size: 13px; }
+.text table { margin: 4px 0 6px; border-collapse: collapse; font-size: 12px; display: block; overflow-x: auto; max-width: 100%; }
+.text th, .text td { padding: 3px 10px; border: 1px solid var(--hairline); text-align: left; white-space: nowrap; }
+.text th { color: var(--bright); font-weight: 600; background: var(--shade); }
+.text img { max-width: 100%; max-height: 260px; vertical-align: middle; }
+.text hr { border: 0; height: 1px; margin: 8px 0; background: var(--hairline); }
+.text input[type='checkbox'] { margin: 0 6px 0 0; vertical-align: middle; }
+.text ul.contains-task-list { list-style: none; padding-left: 2px; }
+.avatar-wrap { position: relative; display: inline-flex; }
+.source {
+  position: absolute;
+  right: -5px;
+  bottom: -5px;
+  width: 16px;
+  height: 16px;
+  padding: 2px;
+  border-radius: 4px;
+  background: var(--bg);
+  color: var(--bright);
+}
+.source svg { display: block; width: 100%; height: 100%; }
+.source.text { display: grid; place-items: center; font-size: 9px; font-weight: 600; }
+.mention { color: var(--accent); font-weight: 600; }
+.removed { color: var(--faint); font-style: italic; }
+.edited { color: var(--faint); font-size: 11px; }
+.undelivered { margin-top: 4px; font-size: 11px; color: var(--accent); }
+.undelivered button { text-decoration: underline; }
+
+.chips { display: flex; flex-wrap: wrap; gap: 4px; margin-top: 4px; }
+.badge, .label, .chip {
+  display: inline-flex;
+  align-items: center;
+  gap: 4px;
+  padding: 1px 7px;
+  border: 1px solid var(--hairline);
+  background: var(--shade);
+  color: var(--muted);
+  font-size: 11px;
+  line-height: 16px;
+}
+.badge.slack, .badge.github { border-color: var(--accent-transparent); background: none; color: var(--accent); }
+.label:hover, .chip:hover { color: var(--bright); background: var(--shade-hover); }
+.label button { color: var(--faint); display: inline-flex; }
+.label button:hover { color: var(--bright); }
+/* Your own reaction: a little brighter, not louder. */
+.chip.mine { border-color: var(--muted); background: var(--shade-hover); color: var(--bright); }
+/* Attachments: media in a fixed frame, so loading never moves the page; files as chips. */
+.links { display: flex; flex-direction: column; gap: 6px; margin-top: 6px; }
+.link-embed { padding: 2px 0 2px 10px; border-left: 2px solid var(--hairline); }
+.link-meta { display: flex; gap: 8px; align-items: baseline; font-size: 12px; color: var(--muted); }
+.link-meta .author { font-size: 13px; }
+.link-meta a, .link-file a { color: var(--accent); text-decoration: none; overflow-wrap: anywhere; }
+.link-meta a:hover, .link-file a:hover { text-decoration: underline; }
+.link-file { display: flex; gap: 4px; align-items: center; margin-top: 2px; font-size: 12px; color: var(--muted); }
+.attachments { display: flex; flex-wrap: wrap; gap: 6px; margin-top: 6px; }
+.attachment-media { display: block; width: 320px; max-width: 100%; height: 200px; border: 1px solid var(--hairline); background: var(--shade); overflow: hidden; }
+.attachment-media img, .attachment-media video { display: block; width: 100%; height: 100%; object-fit: contain; }
+.file { display: inline-flex; align-items: center; gap: 6px; max-width: 100%; padding: 4px 8px; border: 1px solid var(--hairline); background: var(--shade); color: var(--dim); font-size: 12px; }
+button.file:hover { background: var(--shade-hover); color: var(--bright); }
+.file-name { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.file button { color: var(--faint); display: inline-flex; }
+.file button:hover { color: var(--bright); }
+.composer-files { margin: 0 12px 4px; }
+.replies { display: inline-flex; align-items: center; gap: 6px; margin: 4px 0 0 -4px; padding: 2px 6px 2px 4px; color: var(--dim); font-size: 12px; font-weight: 600; }
+.replies:hover { background: var(--shade-hover); color: var(--bright); }
+.replies .time { font-weight: 400; }
+.replies .faces { display: inline-flex; }
+.replies .faces .avatar + .avatar { margin-left: -4px; }
+
+.editor { display: grid; gap: 2px; margin: 2px 0; }
+.editor textarea {
+  width: 100%;
+  padding: 8px 10px;
+  border: 1px solid var(--hairline);
+  background: var(--bg);
+  resize: none;
+  outline: none;
+  font-size: 14px;
+}
+.editor textarea:focus { border-color: var(--muted); }
+
+/* --- hover actions: one hairline box at the row's corner --- */
+.actions { position: absolute; top: -12px; right: 20px; z-index: 5; display: flex; border: 1px solid var(--hairline); background: var(--bg); }
+.tool {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  gap: 4px;
+  min-width: 28px;
+  height: 26px;
+  padding: 0 6px;
+  color: var(--muted);
+  font-size: 13px;
+}
+.tool:hover, .tool[data-popup-open] { background: var(--shade); color: var(--bright); }
+.tool.on { color: var(--accent); }
+.tool .count, .tool .tool-label { font-size: 11px; }
+
+/* --- menus and popovers: square, a dim edge, an offset dot shadow --- */
+.positioner { z-index: 50; outline: none; }
+.frame { position: relative; isolation: isolate; }
+.dots {
+  position: absolute;
+  left: 6px;
+  top: 6px;
+  width: 100%;
+  height: 100%;
+  z-index: -1;
+  background-image: radial-gradient(var(--faint) 0.8px, transparent 0.8px);
+  background-size: 4px 4px;
+  pointer-events: none;
+}
+.menu { min-width: 172px; padding: 6px; border: 1px solid var(--dim); background: var(--bg); outline: none; }
+.menu.list { max-height: 260px; overflow-y: auto; }
+.item {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  padding: 6px 8px;
+  color: var(--muted);
+  outline: none;
+  cursor: default;
+  white-space: nowrap;
+}
+.item[data-highlighted] { background: var(--shade); color: var(--bright); }
+.item.danger, .item.danger[data-highlighted] { color: var(--red); }
+.item .hint { margin-left: 12px; }
+.separator { height: 1px; margin: 4px 0; background: var(--hairline); }
+.empty-item { padding: 6px 8px; color: var(--faint); }
+.emoji-row { display: grid; grid-template-columns: repeat(6, 1fr); }
+.item.emoji { justify-content: center; padding: 6px 0; font-size: 15px; }
+.emoji-grid { display: grid; grid-template-columns: repeat(12, 30px); padding: 6px; }
+.emoji-grid .emoji { height: 30px; font-size: 16px; }
+.emoji-grid .emoji:hover { background: var(--shade); }
+.popover { width: min(380px, calc(100vw - 32px)); padding: 12px; }
+.popover-title { margin: 0 0 8px; color: var(--bright); font-size: 12px; font-weight: 600; }
+
+.labels-editor { display: grid; gap: 10px; }
+.labels-editor > .hint { margin: 0; }
+.label-rows { display: grid; }
+.label-row { display: grid; grid-template-columns: minmax(0, 1fr) minmax(0, 1.4fr) auto; align-items: center; gap: 8px; padding: 2px 0 2px 8px; }
+.label-row:hover { background: var(--shade); }
+.label-key { color: var(--bright); overflow: hidden; text-overflow: ellipsis; }
+.label-value { color: var(--muted); overflow: hidden; text-overflow: ellipsis; }
+.label-add { display: flex; align-items: center; gap: 6px; }
+.suggest { display: flex; align-items: center; min-width: 0; padding: 0 8px; background: var(--shade); }
+.suggest input { width: 100%; min-width: 0; height: 28px; border: 0; outline: none; background: none; }
+.suggest:focus-within { outline: 1px solid var(--muted); }
+.suggest .prefix { color: var(--faint); }
+.label-add > .suggest { width: 38%; }
+
+/* --- filters --- */
+.filter-bar { flex-shrink: 0; display: flex; flex-wrap: wrap; align-items: center; gap: 6px; padding: 8px 20px 0; }
+.clear { color: var(--faint); font-size: 11px; }
+.clear:hover { color: var(--bright); }
+.filter-form { display: grid; gap: 12px; }
+.filter-form > .clear { justify-self: start; }
+.filter-row { display: grid; grid-template-columns: 52px minmax(0, 1fr); align-items: start; gap: 10px; }
+.filter-name { color: var(--faint); font-size: 11px; line-height: 28px; }
+.filter-row .grow { display: grid; gap: 6px; }
+.segments { display: flex; flex-wrap: wrap; gap: 2px; }
+.segment { height: 28px; padding: 0 10px; background: var(--shade); color: var(--muted); }
+.segment:hover { color: var(--bright); }
+.segment.on { background: var(--bright); color: var(--bg); }
+
+/* --- the composer: an outline, not a border --- */
+.composer { flex-shrink: 0; padding: 0 20px 20px; }
+.composer-box {
+  display: flex;
+  flex-direction: column;
+  background: var(--bg);
+  outline: 2px dotted var(--hairline);
+  outline-offset: -1px;
+  cursor: text;
+}
+.composer-box:focus-within { background: var(--shade); outline-style: dashed; }
+.composer-box textarea {
+  width: 100%;
+  min-height: 58px;
+  max-height: 160px;
+  padding: 10px 12px 2px;
+  border: 0;
+  outline: none;
+  background: none;
+  color: var(--dim);
+  font-size: 14px;
+  line-height: 1.5;
+  resize: none;
+  overflow-y: auto;
+}
+.composer-box textarea::placeholder { color: var(--faint); }
+.composer-channel { margin: 8px 8px 0; align-self: flex-start; width: min(320px, calc(100% - 16px)); }
+.composer-labels { margin: 8px 12px 0; }
+.composer-footer { display: flex; align-items: center; gap: 2px; min-height: 40px; padding: 2px 8px 8px; }
+.composer-footer .hint { margin-left: auto; margin-right: 8px; }
+.pane .composer-footer .hint { display: none; }
+.pane .composer-footer .send { margin-left: auto; }
+.send { height: 32px; padding: 0 12px; background: var(--accent); color: var(--label); font-weight: 500; }
+.send.small { height: 28px; padding: 0 10px; }
+.send:disabled { opacity: 0.5; }
+
+.inbox-row { display: grid; grid-template-columns: 70px 90px 1fr; gap: 12px; padding: 6px 20px; }
+.inbox-row:hover { background: var(--shade); }
+.inbox-row pre { margin: 4px 0 0; color: var(--faint); font-size: 11px; white-space: pre-wrap; overflow-wrap: anywhere; }
+
+.toasts { position: fixed; right: 16px; bottom: 16px; display: grid; gap: 8px; z-index: 60; }
+.toast { max-width: 420px; padding: 8px 12px; border: 1px solid var(--dim); background: var(--bg); color: var(--bright); }
+`;
+/** The prebuilt UI: next to the CLI in `dist`, or in `dist` when running from source. */
+const BUNDLES = [new URL("./inspect/app.js", import.meta.url), new URL("../../dist/inspect/app.js", import.meta.url)];
+async function bundle() {
+	for (const candidate of BUNDLES) try {
+		return await readFile(candidate, "utf8");
+	} catch {}
+	return null;
+}
+const shell = (token) => `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="inspect-token" content="${token}">
+<title>board</title>
+<style>${CSS}</style>
+</head>
+<body>
+<div id="root"></div>
+<script type="module" src="/app.js"><\/script>
+</body>
+</html>`;
+const CSP = [
+	"default-src 'none'",
+	"img-src https: http://localhost:* http://127.0.0.1:* data: blob:",
+	"media-src blob:",
+	"style-src 'unsafe-inline'",
+	"script-src 'self'",
+	"connect-src 'self'",
+	"form-action 'none'",
+	"base-uri 'none'",
+	"frame-ancestors 'none'"
+].join("; ");
+/**
+* Serves the UI, and a proxy for the board's API that adds your credentials, on
+* 127.0.0.1. Because the proxy acts as you, it answers only its own page: every
+* request must name this server's host (no DNS rebinding) and carry the per-run
+* token that only the page has, and writes must also come from its origin. Your
+* board token never leaves this process.
+*/
+async function startInspector(options) {
+	const { client } = options;
+	const me = await client.me();
+	const board = (await client.discovery().catch(() => null))?.url ?? client.url;
+	const app = await bundle();
+	const token = randomBytes(24).toString("base64url");
+	let origins = /* @__PURE__ */ new Set();
+	const streams = /* @__PURE__ */ new Set();
+	async function proxy(request, response, url) {
+		const reading = request.method === "GET" || request.method === "HEAD";
+		if (!sameSecret(String(request.headers["x-inspect-token"] ?? ""), token) || !reading && !origins.has(String(request.headers.origin))) return json(response, 403, { error: {
+			code: "forbidden",
+			message: "the board is reachable only from the inspector's own page"
+		} });
+		const path = url.pathname.slice(6) || "/";
+		let decoded;
+		try {
+			decoded = decodeURIComponent(path);
+		} catch {
+			decoded = "..";
+		}
+		if (/(^|\/)\.\.?(\/|$)|\\/.test(decoded)) return json(response, 400, { error: {
+			code: "bad_path",
+			message: "no relative paths"
+		} });
+		const controller = new AbortController();
+		streams.add(controller);
+		response.on("close", () => controller.abort());
+		try {
+			const body = reading ? void 0 : await read(request, path === "/attachments" ? ATTACHMENT_BYTES_MAX : void 0);
+			const chosen = request.headers["x-inspect-profile"];
+			const as = typeof chosen === "string" ? chosen === "" ? null : chosen : void 0;
+			const upstream = await client.request(`${path}${url.search}`, {
+				...as !== void 0 ? { as } : {},
+				method: request.method ?? "GET",
+				headers: {
+					...request.headers["content-type"] ? { "content-type": String(request.headers["content-type"]) } : {},
+					...request.headers.accept ? { accept: String(request.headers.accept) } : {},
+					...request.headers["x-board-filename"] ? { "x-board-filename": String(request.headers["x-board-filename"]) } : {}
+				},
+				...body ? { body } : {},
+				signal: controller.signal
+			});
+			response.writeHead(upstream.status, {
+				"content-type": upstream.headers.get("content-type") ?? "application/json",
+				"cache-control": "no-store",
+				"x-content-type-options": "nosniff"
+			});
+			if (upstream.body) for await (const chunk of upstream.body) response.write(chunk);
+			response.end();
+		} catch (error) {
+			if (controller.signal.aborted || response.headersSent) return void response.end();
+			json(response, 502, { error: {
+				code: "unreachable",
+				message: `the board didn't answer: ${error.message}`
+			} });
+		} finally {
+			streams.delete(controller);
+		}
+	}
+	const server = createServer((request, response) => {
+		const url = new URL(request.url ?? "/", "http://inspector");
+		if (!origins.has(`http://${request.headers.host}`)) return send(response, 421, "text/plain; charset=utf-8", "wrong host");
+		if (url.pathname === "/board" || url.pathname.startsWith("/board/")) return void proxy(request, response, url).catch(() => response.headersSent ? response.end() : send(response, 500, "text/plain; charset=utf-8", "error"));
+		if (request.method !== "GET") return send(response, 405, "text/plain; charset=utf-8", "method not allowed");
+		if (url.pathname === "/app.js") return app ? send(response, 200, "text/javascript; charset=utf-8", app) : send(response, 503, "text/plain; charset=utf-8", "the inspector's UI isn't built: run `pnpm --filter @vercel/board build`");
+		send(response, 200, "text/html; charset=utf-8", shell(token), { "content-security-policy": CSP });
+	});
+	const port = await listen(server, options.port ?? 4747, options.port === void 0);
+	origins = /* @__PURE__ */ new Set([`http://127.0.0.1:${port}`, `http://localhost:${port}`]);
+	return {
+		url: `http://127.0.0.1:${port}`,
+		board,
+		me,
+		close: () => new Promise((resolve) => {
+			for (const stream of streams) stream.abort();
+			server.close(() => resolve());
+			server.closeAllConnections();
+		})
+	};
+}
+function sameSecret(given, expected) {
+	const a = Buffer.from(given);
+	const b = Buffer.from(expected);
+	return a.length === b.length && timingSafeEqual(a, b);
+}
+function read(request, limit = 1048576) {
+	return new Promise((resolve, reject) => {
+		let size = 0;
+		const chunks = [];
+		request.on("data", (chunk) => {
+			size += chunk.length;
+			if (size > limit) {
+				reject(/* @__PURE__ */ new Error("request too large"));
+				request.destroy();
+			} else chunks.push(chunk);
+		});
+		request.on("end", () => resolve(new Uint8Array(Buffer.concat(chunks))));
+		request.on("error", reject);
+	});
+}
+function send(response, status, type, body, headers = {}) {
+	response.writeHead(status, {
+		"content-type": type,
+		"cache-control": "no-store",
+		"x-content-type-options": "nosniff",
+		"referrer-policy": "no-referrer",
+		...headers
+	});
+	response.end(body);
+}
+const json = (response, status, body) => send(response, status, "application/json", JSON.stringify(body));
+/** Listens on the port, or any free one when the default port is taken. */
+async function listen(server, port, fallback) {
+	try {
+		return await listenOn(server, port);
+	} catch (error) {
+		if (fallback && error.code === "EADDRINUSE") return listenOn(server, 0);
+		throw error;
+	}
+}
+function listenOn(server, port) {
+	return new Promise((resolve, reject) => {
+		const onError = (error) => {
+			server.off("listening", onListening);
+			reject(error);
+		};
+		const onListening = () => {
+			server.off("error", onError);
+			resolve(server.address().port);
+		};
+		server.once("error", onError);
+		server.once("listening", onListening);
+		server.listen(port, "127.0.0.1");
+	});
+}
+//#endregion
+//#region src/cli/format.ts
+/** "claude via julian" for a profile, the name otherwise. */
+/**
+* Text for a terminal. What boards and platforms say can carry control characters, ESC among them,
+* which starts the sequences that clear the screen, move the cursor, or retitle the window: each
+* but tab and newline shows as its picture (`␛`), a C1 control as `�`, and a Windows line end as a
+* newline. `--json` prints what the board said, as it said it.
+*/
+const terminalText = (text) => text.replace(/\r\n/g, "\n").replace(/[\u0000-\u0008\u000b-\u001f\u007f-\u009f]/g, (char) => {
+	const code = char.charCodeAt(0);
+	return code < 32 ? String.fromCharCode(9216 + code) : code === 127 ? "␡" : "�";
+});
+const who = (me) => me.profile !== null && me.handle.includes("/") ? `${me.name} via ${me.handle.slice(0, me.handle.indexOf("/"))}` : me.name;
+function authorName(message) {
+	const author = message.author;
+	if (!author) return message.by.actor;
+	const slash = author.handle.indexOf("/");
+	if (message.by.profile !== null && slash !== -1) return `${author.name} via ${author.handle.slice(0, slash)}`;
+	if (author.person && author.person.handle !== author.handle) return `${author.name} (${author.person.handle})`;
+	return author.name;
+}
+function ago(iso, now = Date.now()) {
+	const seconds = Math.max(0, Math.round((now - Date.parse(iso)) / 1e3));
+	if (seconds < 60) return `${seconds}s`;
+	if (seconds < 3600) return `${Math.floor(seconds / 60)}m`;
+	if (seconds < 86400) return `${Math.floor(seconds / 3600)}h`;
+	return `${Math.floor(seconds / 86400)}d`;
+}
+const indent = (text, prefix) => text.split("\n").map((line) => `${prefix}${line}`).join("\n");
+function labels(message) {
+	const entries = Object.entries(message.labels);
+	return entries.length ? `  [${entries.map(([k, v]) => `${k}=${v}`).join(" ")}]` : "";
+}
+function reactions(message, names) {
+	const groups = Object.entries(message.reactions);
+	if (groups.length === 0) return "";
+	return groups.map(([emoji, actors]) => {
+		const shown = actors.slice(0, 3).map((id) => names.get(id) ?? id).join(", ");
+		return `${displayEmoji(emoji)} ${shown}${actors.length > 3 ? ` +${actors.length - 3}` : ""}`;
+	}).join("   ");
+}
+/** The actors a thread's reactions name on screen, for looking up the ones who didn't write in it. */
+function reactionNames(messages) {
+	return [...new Set(messages.flatMap((m) => Object.values(m.reactions).flatMap((actors) => actors.slice(0, 3))))];
+}
+/** An actor's display name from `/actors`, the way a message's author shows: `claude via julian`. */
+function actorName(actor) {
+	const slash = actor.handle.indexOf("/");
+	return slash === -1 ? actor.name : `${actor.name} via ${actor.handle.slice(0, slash)}`;
+}
+/** Lines of a linked message an embed shows before it trails off. */
+const EMBED_LINES = 12;
+/** A linked platform message, quoted under the message that links it, or why the board couldn't read it. */
+function embed(link, pad) {
+	if (!link.snapshot) return [`${pad}↪ ${link.url} (couldn't read it: ${link.unavailable ?? "unknown"})`];
+	const { author, text, files } = link.snapshot;
+	const lines = text.trim() ? text.trim().split("\n") : [];
+	const shown = lines.length > EMBED_LINES ? [...lines.slice(0, EMBED_LINES), "…"] : lines;
+	return [
+		`${pad}↪ ${author}${link.message !== null ? ` · #${link.message}` : ""} · ${link.url}`,
+		...shown.map((line) => `${pad}> ${line}`),
+		...files.map((file) => `${pad}> file ${file.name}${file.url ? ` ${file.url}` : ""}`)
+	];
+}
+/** One message as a block: header line, indented text, reactions. */
+function formatMessage(message, options = {}) {
+	const pad = options.reply ? "    " : "      ";
+	const head = `${options.reply ? "  ↳ " : ""}#${message.id}  ${authorName(message)} · ${ago(message.createdAt)}${message.editedAt ? " (edited)" : ""}${message.schedule ? ` · scheduled s${message.schedule.id}` : ""}${labels(message)}`;
+	const body = message.deleted ? `${pad}(message removed)` : indent(displayText(message.text, message.by.actor), pad);
+	const files = (message.attachments ?? []).map((a) => `${pad}file ${a.name} · ${a.type} · ${fileSize(a.size)} · ${a.id}`);
+	const links = message.deleted ? [] : (message.links ?? []).flatMap((link) => embed(link, pad));
+	const reacted = reactions(message, options.names ?? /* @__PURE__ */ new Map());
+	const undelivered = Object.entries(message.undelivered ?? {}).map(([target, error]) => `${pad}✗ didn't reach ${target}: ${error}`);
+	return [
+		head,
+		body,
+		...files,
+		...links,
+		...reacted ? [`${pad}${reacted}`] : [],
+		...undelivered
+	].join("\n");
+}
+/** Threads in order, each root followed by its replies. */
+function formatThreads(messages, known = /* @__PURE__ */ new Map()) {
+	const names = new Map([...known, ...messages.map((m) => [m.by.actor, authorName(m)])]);
+	const byRoot = /* @__PURE__ */ new Map();
+	const roots = [];
+	const orphans = [];
+	for (const message of messages) if (message.re === null) roots.push(message);
+	else (byRoot.get(message.re) ?? byRoot.set(message.re, []).get(message.re)).push(message);
+	const rootIds = new Set(roots.map((r) => r.id));
+	for (const [root, replies] of byRoot) if (!rootIds.has(root)) orphans.push(...replies);
+	const blocks = roots.map((root) => [formatMessage(root, { names }), ...(byRoot.get(root.id) ?? []).map((r) => formatMessage(r, {
+		reply: true,
+		names
+	}))].join("\n"));
+	for (const reply of orphans) blocks.push(`(in thread #${reply.re})\n${formatMessage(reply, {
+		reply: true,
+		names
+	})}`);
+	return blocks.join("\n\n");
+}
+/** A root's first line, cut to fit 80 columns under its header. */
+function firstLine(message) {
+	if (message.deleted) return "(message removed)";
+	const text = displayText(message.text, message.by.actor).trim();
+	const files = message.attachments?.length ?? 0;
+	if (!text) return files ? `(${files} ${files === 1 ? "file" : "files"})` : "(no text)";
+	const [line = "", ...rest] = text.split(/\r?\n/);
+	const shown = rest.length ? `${line.trimEnd()} …` : line;
+	return shown.length > 74 ? `${line.slice(0, 73)}…` : shown;
+}
+/**
+* One block per thread, for `read <channel>`: the root's header and first line,
+* then how many replies it has and who wrote the latest, and when.
+*/
+function formatThreadSummaries(threads, options = {}) {
+	const now = options.now ?? Date.now();
+	return threads.map(({ message, replies, last }) => {
+		const where = options.channel ? `${message.channel}  ` : "";
+		const head = `#${message.id}  ${where}${authorName(message)} · ${ago(message.createdAt, now)}${labels(message)}`;
+		const activity = last ? `${replies} ${replies === 1 ? "reply" : "replies"} · last #${last.id} ${authorName(last)} · ${ago(last.createdAt, now)}` : "no replies";
+		return [
+			head,
+			`      ${firstLine(message)}`,
+			`      ${activity}`
+		].join("\n");
+	}).join("\n\n");
+}
+/**
+* `/me`'s `can` as `whoami` rows, a pattern and its permissions each (`ci/  read
+* post`), or none for full access. `manage` brings everything, so it says `all`.
+*/
+function formatAccess(access) {
+	const patterns = Object.keys(access);
+	if (patterns.length === 1 && patterns[0] === "*" && access["*"].includes("manage")) return [];
+	if (patterns.length === 0) return ["nothing"];
+	const width = Math.max(...patterns.map((pattern) => pattern.length));
+	return patterns.map((pattern) => {
+		const permissions = access[pattern];
+		return `${pattern.padEnd(width)}  ${permissions.includes("manage") ? "all" : permissions.length === 0 ? "nothing" : permissions.join(" ")}`;
+	});
+}
+/** `90m` → `1h30m`, `1d`: milliseconds as a duration flag would say them. */
+function span(ms) {
+	const parts = [];
+	let rest = Math.round(ms / 1e3);
+	for (const [unit, size] of [
+		["d", 86400],
+		["h", 3600],
+		["m", 60],
+		["s", 1]
+	]) {
+		if (rest >= size) parts.push(`${Math.floor(rest / size)}${unit}`);
+		rest %= size;
+	}
+	return parts.join("") || "0s";
+}
+/** `in 25m`, or `due` once it's past. */
+const until = (iso, now) => {
+	const ms = Date.parse(iso) - now;
+	if (ms <= 0) return "due";
+	return `in ${span(ms < 6e4 ? Math.ceil(ms / 1e3) * 1e3 : Math.ceil(ms / 6e4) * 6e4)}`;
+};
+/** One schedule: what it sends, when, where, and how it stops. */
+function formatSchedule(schedule, options = {}) {
+	const now = options.now ?? Date.now();
+	const pad = options.pad ?? "";
+	const where = schedule.re === null ? `new thread in ${schedule.channel}` : `#${schedule.re}`;
+	const repeat = schedule.every === null ? "once" : `every ${span(schedule.every)}`;
+	const stop = schedule.every === null ? "" : schedule.times !== null ? ` · ${schedule.times} times` : schedule.until !== null ? ` · until ${schedule.until}` : " · until canceled";
+	const when = schedule.state === "pending" ? `next ${until(schedule.next, now)} (${schedule.next})` : schedule.state === "canceled" ? schedule.canceled?.reason === "thread_deleted" ? "ended: the thread was deleted" : schedule.canceled?.reason === "dropped" ? "ended: the board dropped it" : schedule.canceled?.reason === "revoked" ? "ended: its creator can no longer post it" : "canceled" : "done";
+	const sent = schedule.sent > 0 ? ` · ${schedule.sent} sent` : "";
+	const files = schedule.attachments.length ? ` · ${schedule.attachments.length} ${schedule.attachments.length === 1 ? "file" : "files"}` : "";
+	const text = displayText(schedule.text, schedule.by.actor);
+	return [`${pad}s${schedule.id}  ${where} · ${repeat}${stop} · ${when}${sent}${files} · by ${authorName(schedule)}`, indent(text || "(no text)", `${pad}    `)].join("\n");
+}
+/** One line per live event, for `tail` and `wait`. */
+function formatEvent(event) {
+	const message = event.message;
+	if (!message) return `#${event.cursor}  ${event.type}`;
+	const where = message.re === null ? message.channel : `${message.channel} ↳ #${message.re}`;
+	const who = authorName(message);
+	switch (event.type) {
+		case "message.posted": {
+			const files = (message.attachments ?? []).map((a) => ` · file ${a.name}`).join("");
+			return `#${message.id}  ${where}  ${who}: ${displayText(message.text, message.by.actor)}${files}`;
+		}
+		case "message.edited": return `#${message.id}  ${where}  ${who} (edited): ${displayText(message.text, message.by.actor)}`;
+		case "message.deleted": return `#${message.id}  ${where}  (message removed)`;
+		case "message.linked": return `#${message.id}  ${where}  ↪ links ${(message.links ?? []).map((link) => link.message !== null ? `#${link.message}` : link.url).join(", ") || "nothing"}`;
+		case "reaction.added":
+		case "reaction.removed": return `#${message.id}  ${where}  ${displayEmoji(event.payload.emoji)} ${event.type === "reaction.added" ? "added" : "removed"} by ${event.actor?.name ?? event.payload.by.actor}`;
+		case "labels.changed": {
+			const set = Object.entries(event.payload.set).map(([k, v]) => `${k}=${v}`);
+			const unset = event.payload.unset.map((k) => `-${k}`);
+			return `#${message.id}  ${where}  labels ${[...set, ...unset].join(" ")}${event.actor ? ` by ${event.actor.name}` : ""}`;
+		}
+		case "message.sync_failed": return `#${message.id}  ${where}  ✗ didn't reach ${event.payload.target}: ${event.payload.error}`;
+		default: return `#${event.cursor}  ${event.type}`;
+	}
+}
+/**
+* A channel or thread read with `vb sources <key> read`: a header, then each message under its ID,
+* with the target that reads its thread when it has replies.
+*/
+function formatSourceRead(key, read, now = Date.now()) {
+	const where = `${key}:${read.channel}${read.name ? ` (#${read.name})` : ""}${read.thread ? `, thread ${read.thread}` : ""}`;
+	if (read.messages.length === 0) return `${where}\nno messages`;
+	const blocks = read.messages.map((message) => {
+		const reply = read.thread !== null && message.id !== read.thread;
+		const pad = reply ? "    " : "      ";
+		const when = message.createdAt ? ` · ${ago(message.createdAt, now)}` : "";
+		const replies = message.replies > 0 && read.thread === null ? `  (${message.replies} ${message.replies === 1 ? "reply" : "replies"}: vb sources ${key} read ${message.thread})` : "";
+		return [
+			`${reply ? "  ↳ " : ""}${message.id}  ${message.author}${when}${replies}`,
+			indent(message.text || "(no text)", pad),
+			...message.files.map((file) => `${pad}file ${file.name}${file.url ? ` ${file.url}` : ""}`)
+		].join("\n");
+	});
+	const more = read.more ? [`(${read.thread ? "later replies" : "older messages"} not shown: raise --limit, up to 200)`] : [];
+	return [
+		where,
+		...blocks,
+		...more
+	].join("\n");
+}
+/**
+* A conformance report: each group a heading, its checks under it, and why for one that failed
+* or was skipped, then the counts.
+*/
+function formatConformance(report) {
+	const blocks = [];
+	for (const group of [...new Set(report.checks.map((check) => check.group))]) {
+		const lines = [group];
+		for (const check of report.checks.filter((c) => c.group === group)) {
+			lines.push(`  ${check.status.padEnd(7)}  ${check.name}`);
+			if (check.detail) lines.push(`           ${check.detail}`);
+		}
+		blocks.push(lines.join("\n"));
+	}
+	const count = (status) => report.checks.filter((check) => check.status === status).length;
+	const counts = [
+		`${count("passed")} passed`,
+		...count("skipped") ? [`${count("skipped")} skipped`] : [],
+		...count("failed") ? [`${count("failed")} failed`] : []
+	];
+	return `${blocks.join("\n\n")}\n\n${counts.join(", ")}`;
+}
+//#endregion
+//#region src/cli/hooks.ts
+/**
+* Where each agent keeps hooks, and which of its events run ours. Claude Code
+* and Codex read `{ hooks: { Stop: [{ hooks: [entry] }] } }`; Cursor reads
+* `{ version: 1, hooks: { stop: [entry] } }`, and its stop can't block, so it's
+* reminded with a follow-up message instead. Pi has no hook files: its hook is
+* an extension we write whole (`piExtension`), in `$PI_CODING_AGENT_DIR/extensions`.
+*/
+const AGENTS = {
+	claude: {
+		name: "Claude Code",
+		shape: "nested",
+		event: "Stop",
+		file: () => join(process.env.CLAUDE_CONFIG_DIR || join(homedir(), ".claude"), "settings.json")
+	},
+	codex: {
+		name: "Codex",
+		shape: "nested",
+		event: "Stop",
+		file: () => join(process.env.CODEX_HOME || join(homedir(), ".codex"), "hooks.json")
+	},
+	cursor: {
+		name: "Cursor",
+		shape: "flat",
+		event: "stop",
+		file: () => join(homedir(), ".cursor", "hooks.json")
+	},
+	pi: {
+		name: "Pi",
+		shape: "extension",
+		event: "agent_before_settle",
+		file: () => join(process.env.PI_CODING_AGENT_DIR || join(homedir(), ".pi", "agent"), "extensions", "board.ts")
+	}
+};
+const ours = (entry) => / hook stop --agent /.test(entry.command ?? "");
+function readConfig(path) {
+	try {
+		return JSON.parse(readFileSync(path, "utf8"));
+	} catch (error) {
+		if (error.code === "ENOENT") return {};
+		throw new Error(`can't read ${path}: ${error.message}`);
+	}
+}
+/** Written to a sibling, then renamed: a crash never leaves an agent's settings half-written. */
+function writeConfig(path, config) {
+	mkdirSync(dirname(path), { recursive: true });
+	writeFileSync(`${path}.board-tmp`, `${JSON.stringify(config, null, 2)}\n`);
+	renameSync(`${path}.board-tmp`, path);
+}
+/** An event's entries without ours; a group left with no hooks goes too. */
+function without(entries, shape) {
+	if (shape === "flat") return entries.filter((entry) => !ours(entry));
+	return entries.map((group) => ({
+		...group,
+		hooks: (group.hooks ?? []).filter((h) => !ours(h))
+	})).filter((group) => group.hooks.length > 0);
+}
+/** The line of our Pi extension that holds the command it runs: how status finds it. */
+const PI_COMMAND = /^const COMMAND = (".*")$/m;
+/**
+* Pi's turn-end hook, as an extension. Before Pi settles a completed run, it
+* runs our command with what Claude Code's hook gets (the session, the
+* directory, and whether this hook made it continue); a reminder comes back
+* as a message, and Pi continues once to act on it. Pi's bash tool exports the
+* same session as `PI_SESSION_ID`, so the agent's `vb reply` or `vb post` counts for it.
+*/
+function piExtension(command) {
+	return `// Added by \`vb hooks install pi\`: reminds Pi, once per turn, to update the team's board.
+// \`vb hooks uninstall pi\` removes it; reinstalling replaces this file.
+import { spawn } from 'node:child_process'
+
+const COMMAND = ${JSON.stringify(command)}
+
+function run(cwd: string, input: string): Promise<string> {
+  return new Promise((resolve) => {
+    let out = ''
+    const child = spawn('/bin/sh', ['-c', COMMAND], { cwd, stdio: ['pipe', 'pipe', 'ignore'] })
+    const timer = setTimeout(() => child.kill(), 10_000)
+    child.stdout.on('data', (chunk) => (out += chunk))
+    child.on('error', () => resolve(''))
+    child.on('close', () => (clearTimeout(timer), resolve(out)))
+    child.stdin.on('error', () => {})
+    child.stdin.end(input)
+  })
+}
+
+export default function board(pi: any) {
+  let reminded = false
+  pi.on('agent_before_settle', async (event: any, ctx: any) => {
+    const continuing = reminded
+    reminded = false
+    if (event.outcome !== 'completed') return
+    try {
+      const input = JSON.stringify({ session_id: ctx.sessionManager.getSessionId(), cwd: ctx.cwd, stop_hook_active: continuing })
+      const reason = JSON.parse((await run(ctx.cwd, input)) || '{}').reason
+      if (typeof reason !== 'string' || !reason) return
+      reminded = true
+      return { entries: [...event.entries, { type: 'custom_message', customType: 'board', content: reason, display: true }], continue: true }
+    } catch {}
+  })
+}
+`;
+}
+/**
+* The command our hook runs. `|| true`: whatever `cli` turns out to be (an older board without
+* `hook` exits 2, which Claude Code and Codex read as "keep going"), the hook can't fail a turn.
+*/
+const hookCommand = (agent, cli, flags = "") => `${cli} hook stop --agent ${agent}${flags} 2>/dev/null || true`;
+/** Adds our hook, replacing an earlier one of ours; everything else in the file stays. Answers whether it changed. */
+function installHook(agent, cli, flags = "") {
+	const spec = AGENTS[agent];
+	const command = hookCommand(agent, cli, flags);
+	if (spec.shape === "extension") {
+		const source = piExtension(command);
+		let current = null;
+		try {
+			current = readFileSync(spec.file(), "utf8");
+		} catch {}
+		if (current === source) return false;
+		if (current !== null && !current.startsWith("// Added by `vb hooks install pi`")) throw new Error(`${spec.file()} isn't board's: move it, then install again`);
+		mkdirSync(dirname(spec.file()), { recursive: true });
+		writeFileSync(`${spec.file()}.board-tmp`, source);
+		renameSync(`${spec.file()}.board-tmp`, spec.file());
+		return true;
+	}
+	const config = readConfig(spec.file());
+	const entry = spec.shape === "flat" ? {
+		command,
+		timeout: 10
+	} : { hooks: [{
+		type: "command",
+		command,
+		timeout: 10
+	}] };
+	const hooks = {
+		...config.hooks,
+		[spec.event]: [...without(config.hooks?.[spec.event] ?? [], spec.shape), entry]
+	};
+	const next = {
+		...spec.shape === "flat" ? { version: 1 } : {},
+		...config,
+		hooks
+	};
+	if (JSON.stringify(next) === JSON.stringify(config)) return false;
+	writeConfig(spec.file(), next);
+	return true;
+}
+/** Removes our hook. A file that held only it (Cursor's, which we created) goes away with it. */
+function uninstallHook(agent) {
+	const spec = AGENTS[agent];
+	if (installedHook(agent) === null) return false;
+	if (spec.shape === "extension") return unlinkSync(spec.file()), true;
+	const config = readConfig(spec.file());
+	const hooks = { ...config.hooks };
+	const kept = without(hooks[spec.event] ?? [], spec.shape);
+	if (kept.length > 0) hooks[spec.event] = kept;
+	else delete hooks[spec.event];
+	if (Object.keys(config).filter((key) => key !== "hooks" && key !== "version").length === 0 && Object.keys(hooks).length === 0) unlinkSync(spec.file());
+	else writeConfig(spec.file(), {
+		...config,
+		hooks
+	});
+	return true;
+}
+/** The command our hook runs for `agent`, if it's installed. */
+function installedHook(agent) {
+	const spec = AGENTS[agent];
+	if (spec.shape === "extension") try {
+		const line = PI_COMMAND.exec(readFileSync(spec.file(), "utf8"));
+		return line ? JSON.parse(line[1]) : null;
+	} catch {
+		return null;
+	}
+	const entries = readConfig(spec.file()).hooks?.[spec.event] ?? [];
+	return (spec.shape === "flat" ? entries : entries.flatMap((group) => group.hooks ?? [])).find(ours)?.command ?? null;
+}
+/** A path under the home directory as `~/…`, the way people write it. */
+function tilde(path) {
+	const home = homedir();
+	return home && (path === home || path.startsWith(`${home}/`)) ? `~${path.slice(home.length)}` : path;
+}
+/** The CLI an installed hook runs: everything before ` hook stop`. */
+const cliOf = (command) => command.slice(0, command.indexOf(" hook stop "));
+/**
+* The reminder asks the agent to run `vb reply`, `vb post`, `vb read`, and `vb channels`;
+* where the agent keeps an allowlist, those run without a permission prompt.
+* Claude Code matches command prefixes; Cursor matches a command's name, so it
+* can allow only a `vb` on PATH. Codex has no command allowlist: its sandbox
+* decides (see `codexNetwork`).
+*/
+const REMINDED = [
+	"reply",
+	"post",
+	"read",
+	"channels"
+];
+/** Rules an earlier install added that this one doesn't: `vb update`, since removed. Uninstall drops them too. */
+function legacyRules(agent, cli) {
+	return agent === "claude" ? [`Bash(${cli} update:*)`] : [];
+}
+function allowRules(agent, cli) {
+	if (agent === "claude") return {
+		file: AGENTS.claude.file(),
+		rules: REMINDED.map((sub) => `Bash(${cli} ${sub}:*)`)
+	};
+	if (agent === "cursor" && cli === "vb") return {
+		file: join(homedir(), ".cursor", "cli-config.json"),
+		rules: ["Shell(vb)"]
+	};
+	return null;
+}
+/** Adds the rules a file doesn't have yet. Answers the ones it added. */
+function allow(file, rules) {
+	const config = readConfig(file);
+	const allowed = config.permissions?.allow ?? [];
+	const added = rules.filter((rule) => !allowed.includes(rule));
+	if (added.length > 0) writeConfig(file, {
+		...config,
+		permissions: {
+			...config.permissions,
+			allow: [...allowed, ...added]
+		}
+	});
+	return added;
+}
+/** Removes the rules a file has. Answers whether it removed any. */
+function disallow(file, rules) {
+	const config = readConfig(file);
+	const allowed = config.permissions?.allow;
+	if (!allowed?.some((rule) => rules.includes(rule))) return false;
+	writeConfig(file, {
+		...config,
+		permissions: {
+			...config.permissions,
+			allow: allowed.filter((rule) => !rules.includes(rule))
+		}
+	});
+	return true;
+}
+/**
+* Codex's default sandbox has no network, so `vb` can't reach the board. A
+* permission profile can allow just the board, and Vercel's API for its token.
+* In TOML a key after a `[table]` belongs to it, so `default_permissions` goes
+* at the top; the tables go anywhere (`[features]` merged into one that's there).
+*/
+function codexNetwork(boardHost) {
+	return {
+		top: "default_permissions = \"board\"",
+		tables: [
+			"[features]",
+			"network_proxy = true",
+			"",
+			"[permissions.board]",
+			"extends = \":workspace\"",
+			"",
+			"[permissions.board.network]",
+			"enabled = true",
+			"",
+			"[permissions.board.network.domains]",
+			...[boardHost ?? "<your board host>", "api.vercel.com"].map((host) => `"${host}" = "allow"`)
+		].join("\n")
+	};
+}
+/** Names in words: `a`, `a or b`, `a, b, or c`. */
+const either = (names) => names.length < 3 ? names.join(" or ") : `${names.slice(0, -1).join(", ")}, or ${names.at(-1)}`;
+/**
+* How an installed hook differs from what installing it again would write, as
+* short phrases (none when it's current): an older hook command or Pi
+* extension, rules for commands since removed, rules it doesn't have yet.
+* It keeps the CLI the hook runs, which `install` may choose differently.
+*/
+function outdated(agent, installed) {
+	const spec = AGENTS[agent];
+	const cli = cliOf(installed);
+	const problems = [];
+	if (installed !== hookCommand(agent, cli)) problems.push("runs an older hook command");
+	if (spec.shape === "extension") {
+		let source = "";
+		try {
+			source = readFileSync(spec.file(), "utf8");
+		} catch {}
+		if (source !== piExtension(installed)) problems.push("the extension is from another version");
+	}
+	const rules = allowRules(agent, cli);
+	if (rules) {
+		const allowed = readConfig(rules.file).permissions?.allow ?? [];
+		const sub = (rule) => {
+			const inner = /^\w+\((.*?)(?::\*)?\)$/.exec(rule)?.[1] ?? rule;
+			return inner.startsWith(`${cli} `) ? inner.slice(cli.length + 1) : inner;
+		};
+		const gone = legacyRules(agent, cli).filter((rule) => allowed.includes(rule));
+		const missing = rules.rules.filter((rule) => !allowed.includes(rule));
+		if (gone.length > 0) problems.push(`allows ${either(gone.map(sub))}, which ${gone.length === 1 ? "is" : "are"} gone`);
+		if (missing.length > 0) problems.push(`doesn't allow ${either(missing.map(sub))}`);
+	}
+	return problems;
+}
+/**
+* In the temp directory, which agents' sandboxes let commands write (Codex's
+* doesn't allow ~/.config): a marker only has to last a few turns, and the
+* system clears it with the rest of its temp files. `XDG_RUNTIME_DIR`, where
+* there is one, is the user's own.
+*/
+const turnsDir = () => join(process.env.XDG_RUNTIME_DIR || tmpdir(), `board-turns-${process.getuid?.() ?? "user"}`);
+const turnsFile = (session) => join(turnsDir(), `${session.replace(/[^A-Za-z0-9_.-]/g, "_")}.json`);
+function readTurns(session) {
+	try {
+		return JSON.parse(readFileSync(turnsFile(session), "utf8"));
+	} catch {
+		return {};
+	}
+}
+/** The marker directory, only if it's ours: in a shared /tmp, someone else could have made it first. */
+function ownTurnsDir() {
+	const dir = turnsDir();
+	mkdirSync(dir, {
+		recursive: true,
+		mode: 448
+	});
+	const { uid, mode } = statSync(dir);
+	if (process.getuid && uid !== process.getuid()) throw new Error(`${dir} belongs to someone else`);
+	if ((mode & 63) !== 0) chmodSync(dir, 448);
+	return dir;
+}
+function writeTurns(session, turns) {
+	ownTurnsDir();
+	writeFileSync(turnsFile(session), JSON.stringify(turns));
+}
+/** A write to the board from an agent session: this turn needs no reminder. Best effort: the write already happened. */
+function markPosted(session, now = Date.now()) {
+	try {
+		writeTurns(session, {
+			...readTurns(session),
+			posted: now
+		});
+	} catch {}
+}
+/**
+* The turn-end decision: let the agent stop, or remind it once to update the
+* board. It stops freely when it wrote to the board since its last turn
+* ended, when it was already reminded this turn, or when the agent says a
+* hook made it continue (`continuing`), so it can never loop.
+*/
+function decideStop(session, continuing, now = Date.now()) {
+	const turns = readTurns(session);
+	const since = turns.settled ?? 0;
+	if (continuing || (turns.posted ?? 0) > since || (turns.asked ?? 0) > since) {
+		writeTurns(session, {
+			...turns,
+			settled: now
+		});
+		return "stop";
+	}
+	writeTurns(session, {
+		...turns,
+		asked: now
+	});
+	return "ask";
+}
+/**
+* The reminder, with the exact commands to run. It doesn't pick a channel: the
+* agent replies in a thread it's working in, or finds the channel that fits.
+* Finishing without a write is fine, since the hook asks only once a turn.
+*/
+function reminder(cli) {
+	return [
+		"You didn't update the team's board this turn.",
+		`If you changed anything or made progress, share a 1–3 sentence summary of what you did and what's next where the team will see it: ${cli} reply <id> "<text>" in a board thread you're working in, or ${cli} post <channel> "<text>" in the channel that fits (${cli} channels lists them, ${cli} read <channel> shows what's there). Add --attach <file> for proof, like a test log.`,
+		`If you want to store memory, you can post to brain-<username>. Channels are public, so never store sensitive information.`,
+		"If this turn changed nothing worth sharing (say, you just answered a question), just finish. Don't include the prompt, long output, or secrets."
+	].join(" ");
+}
+/** Marks the offer made for `board`. True only for the call that made it, and never when it can't be saved. */
+function claimLinkOffer(board) {
+	const file = join(configDir(), "link-offered", createHash("sha256").update(board).digest("hex").slice(0, 32));
+	try {
+		mkdirSync(dirname(file), {
+			recursive: true,
+			mode: 448
+		});
+		writeFileSync(file, "", { flag: "wx" });
+		return true;
+	} catch {
+		return false;
+	}
+}
+function linkOffer(cli) {
+	return [
+		`One more thing, this time only: run ${cli} identity.`,
+		"If it says some are not linked (say, slack or github), ask the person in one short question whether they'd like to link them, so the board knows their messages there are theirs and mentions reach them.",
+		`If they say yes, run ${cli} identity link <key> --no-wait for each and give them the sign-in URL or code it prints: only they should open or post it.`,
+		"If they say no, or there's nothing to link, drop it. This won't come up again."
+	].join(" ");
+}
+/**
+* The reminder as each agent reads it from the hook's stdout. Claude Code
+* shows a stop's `additionalContext` once, as hook feedback, and continues the
+* turn; a blocked stop would also show it as a hook error. Codex and Pi's
+* extension read a blocked stop's `reason`; Cursor, whose stop can't block,
+* a `followup_message`.
+*/
+function stopOutput(agent, text) {
+	if (agent === "claude") return { hookSpecificOutput: {
+		hookEventName: "Stop",
+		additionalContext: text
+	} };
+	if (agent === "cursor") return { followup_message: text };
+	return {
+		decision: "block",
+		reason: text
+	};
+}
+//#endregion
+//#region src/cli/main.ts
+const HELP = `board ${VERSION}: a message board you mount in one route
+
+usage: board <command> [options]      (also installed as \`vb\`)
+
+  whoami                                   who am I, on which board, with which token, and what I can do
+  link <url>                               link this project to a board (.board/config.json)
+  use <url>                                save the default board
+
+  channels                                 channels, grouped by path prefix
+  actors                                   actors and their handles
+  identity                                 your linked Slack and GitHub accounts
+  identity link <key> [--code] [--no-wait] link your account on sync entry <key> (e.g. slack): sign in, or post a code from it
+  identity unlink <account>                unlink one, by handle or actor ID
+
+  read [channel] [filters] [--limit N]     the latest threads, one each: root, replies, latest reply
+                                           (no channel: every channel)
+  read <id>                                one thread, every message (filters: the root and the replies that match)
+
+  post <channel|id> ["<text>"] [--label k=v]... [--attach <file>]... [--sync <target>]... [--no-sync] [--id <key>]
+                                           a new thread in a channel, or with an id, a reply in its thread
+  reply <id> ["<text>"] [--attach <file>]... [--id <key>] [--no-sync]
+  schedule <channel|id> ["<text>"] (--in 1d | --at <time> | --every 30m) [--until <time> | --for 24h | --times N]
+           [--label k=v]... [--attach <file>]... [--no-sync]
+                                           post later, as you: once, or repeating until a stop or until canceled
+  schedules [id] [--by <handle>] [--channel <c>] [--all]
+                                           pending schedules (a thread's, with an id); --all adds done and canceled
+  schedule cancel <schedule>               stop one, e.g. schedule cancel s12 (yours, or with manage)
+  edit <id> "<text>"
+  delete <id>
+  react <id> <emoji> [--remove]
+  label <id> k=v... [--unset k]...
+  typing <id> [status]                     show typing in the thread's synced platform threads (marks WhatsApp read);
+                                           Slack shows the status, if given, instead of "Typing…"
+  sync <id> <target>                       attach the thread to e.g. slack:#incidents, backfilling it
+  inbox <key> [channel] [--limit N]        raw platform events, for debugging sync
+  sources                                  the board's sources (its sync entries: slack, github, …)
+  sources <key> read <channel|thread|link> [--limit N]
+                                           read a source's channel, thread, or message link without syncing it,
+                                           e.g. sources slack read '#general', or a Slack permalink (full access only)
+  download <attachment> [path]             save an attachment (its name, here, by default; - for stdout)
+  conformance [--channel <c>]              check that the board speaks the protocol: posts to conformance,
+                                           kept on the board, and deletes what it posted (1 if a check fails)
+
+  hooks [install|uninstall|status] [claude|codex|cursor|pi]...
+                                           after a turn that didn't update the board, remind the agent to (linked projects only)
+
+  tail [channel] [filters] [--all]         live, until Ctrl-C
+  wait [channel] [filters] [--timeout 30m] block for the next match, print it, then exit (124 on timeout)
+
+  inspect [--port N] [--no-open]           the board in your browser, as you: read, post, react (local only)
+  serve [--port N] [--dir <dir>] [--no-inspect] [--no-open]
+                                           run a board on this machine (127.0.0.1:4100, no sync), link this
+                                           project to it, and open the inspector; its log lives in .board/,
+                                           and you're local:user:<your OS user> (or --handle)
+
+filters:  --re <id>  --by <handle>  --from <source>  --label k[=v|w]  --text <words>  --mentions [@handle]  --after <id>
+          labels match a message or its thread's root; repeated flags all must match
+global:   --url <url>  --as <profile>  --avatar <url>  --human  --handle <h>  --json
+json:     one object per line (JSONL): { message, replies, last } for read <channel>, a message for read <id>
+text:     pass "-" to read it from stdin; it may be left out when you --attach
+env:      BOARD_URL  BOARD_TOKEN  BOARD_AS  BOARD_AVATAR  BOARD_HANDLE`;
+var UsageError = class extends Error {};
+const OPTIONS = {
+	...FILTER_FLAGS,
+	url: { type: "string" },
+	as: { type: "string" },
+	avatar: { type: "string" },
+	human: { type: "boolean" },
+	handle: { type: "string" },
+	json: { type: "boolean" },
+	help: {
+		type: "boolean",
+		short: "h"
+	},
+	version: {
+		type: "boolean",
+		short: "v"
+	},
+	unset: {
+		type: "string",
+		multiple: true
+	},
+	id: { type: "string" },
+	"no-sync": { type: "boolean" },
+	sync: {
+		type: "string",
+		multiple: true
+	},
+	attach: {
+		type: "string",
+		multiple: true
+	},
+	channel: { type: "string" },
+	agent: { type: "string" },
+	remove: { type: "boolean" },
+	after: { type: "string" },
+	limit: { type: "string" },
+	all: { type: "boolean" },
+	timeout: { type: "string" },
+	port: { type: "string" },
+	"no-open": { type: "boolean" },
+	"no-inspect": { type: "boolean" },
+	dir: { type: "string" },
+	code: { type: "boolean" },
+	"no-wait": { type: "boolean" },
+	in: { type: "string" },
+	at: { type: "string" },
+	every: { type: "string" },
+	until: { type: "string" },
+	for: { type: "string" },
+	times: { type: "string" }
+};
+const MARK = "\0";
+/**
+* Attachment IDs are base64url, so boards minted some that start with `-`,
+* which `parseArgs` reads as a flag. Where `download` takes its ID, a token
+* shaped like one is the ID: this marks it to parse as a positional.
+*/
+function markAttachmentId(args) {
+	const positionals = [];
+	for (let i = 0; i < args.length; i++) {
+		const arg = args[i];
+		if (arg === "--") break;
+		if (!arg.startsWith("-") || arg === "-") positionals.push(arg);
+		else if (positionals.length === 1 && positionals[0] === "download" && AttachmentId.safeParse(arg).success) return [
+			...args.slice(0, i),
+			`${MARK}${arg}`,
+			...args.slice(i + 1)
+		];
+		else if (!arg.includes("=") && OPTIONS[arg.slice(2)]?.type === "string") i++;
+	}
+	return args;
+}
+/** Commands that are gone, and what to run instead. Their flags don't matter: an old hook's `vb update --skip` gets this too. */
+const REMOVED = {
+	update: "`vb update` is gone: reply in the thread you're working in (vb reply <id>), or post where it fits (vb post <channel>)",
+	stuck: "`vb stuck` is gone: a board on a2() keeps its dead letters in A2, on the backend's `servers`"
+};
+/** The command word: the first argument that isn't a flag or a string flag's value. */
+function commandWord(args) {
+	for (let i = 0; i < args.length; i++) {
+		const arg = args[i];
+		if (arg === "--") return args[i + 1];
+		if (!arg.startsWith("-") || arg === "-") return arg;
+		if (!arg.includes("=") && OPTIONS[arg.slice(2)]?.type === "string") i++;
+	}
+}
+const parsed = (() => {
+	const args = withMentions(process.argv.slice(2));
+	const removed = REMOVED[commandWord(args) ?? ""];
+	try {
+		if (removed) throw new UsageError(removed);
+		return parseArgs({
+			args: markAttachmentId(args),
+			allowPositionals: true,
+			options: OPTIONS
+		});
+	} catch (error) {
+		const unknown = error.code === "ERR_PARSE_ARGS_UNKNOWN_OPTION" && /'([^']+)'/.exec(error.message)?.[1];
+		process.stderr.write(terminalText(`error: ${unknown ? `unknown option: ${unknown} (run \`board help\`; text starting with - goes after --, as in -- "${unknown}")` : error.message}`) + "\n");
+		return null;
+	}
+})();
+const { values: flags, positionals: marked } = parsed ?? {
+	values: {},
+	positionals: []
+};
+const positionals = marked.map((arg) => arg.startsWith(MARK) ? arg.slice(1) : arg);
+const out = (text) => process.stdout.write(`${terminalText(text)}\n`);
+const printJson = (value) => process.stdout.write(`${JSON.stringify(value)}\n`);
+/** A message's ID as you'd write it: `#812` or `812`. It's passed to the board as it is. */
+function messageId(value, what = "message id") {
+	const id = value?.replace(/^#/, "") ?? "";
+	if (!/^[^\s/]+$/.test(id)) throw new UsageError(`expected a ${what}, got: ${value ?? "(nothing)"}`);
+	return id;
+}
+/** Whether an argument names a message rather than a channel: `#<id>`, or a bare number. */
+const isMessageRef = (value) => /^#[^\s/]+$/.test(value) || /^\d+$/.test(value);
+function labelPairs(values) {
+	const pairs = {};
+	for (const value of values ?? []) {
+		const at = value.indexOf("=");
+		if (at <= 0) throw new UsageError(`labels look like key=value, got: ${value}`);
+		pairs[value.slice(0, at)] = value.slice(at + 1);
+	}
+	return pairs;
+}
+async function text(value) {
+	if (value === void 0) throw new UsageError("missing message text");
+	if (value !== "-") return value;
+	const chunks = [];
+	for await (const chunk of process.stdin) chunks.push(chunk);
+	return Buffer.concat(chunks).toString("utf8").replace(/\n$/, "");
+}
+/** Uploads each `--attach` file, checking them all before sending any. */
+async function attachments(board) {
+	const paths = flags.attach ?? [];
+	for (const path of paths) {
+		const info = await stat(path).catch(() => null);
+		if (!info?.isFile()) throw new UsageError(`no such file: ${path}`);
+		if (info.size > 104857600) throw new UsageError(`${path} is over ${DIRECT_UPLOAD_BYTES_MAX / 1024 / 1024} MB, the most an attachment can be`);
+	}
+	const uploaded = [];
+	for (const path of paths) uploaded.push(await board.upload({
+		data: new Uint8Array(await readFile(path)),
+		name: basename(path)
+	}));
+	return uploaded;
+}
+/** `s12` or `12`. */
+function scheduleId(value) {
+	const id = value?.replace(/^s(?=\d)/i, "") ?? "";
+	if (!/^[^\s/]+$/.test(id)) throw new UsageError(`expected a schedule id like s12, got: ${value ?? "(nothing)"}`);
+	return id;
+}
+/** A time flag: anything `Date` reads, as ISO. */
+function instant(flag, value) {
+	const time = new Date(value);
+	if (Number.isNaN(time.getTime())) throw new UsageError(`--${flag} takes a time like 2026-10-08T09:00:00Z, got: ${value}`);
+	return time.toISOString();
+}
+function filters(channel) {
+	return {
+		...channel ? { channel } : {},
+		...flags.re ? { re: messageId(flags.re) } : {},
+		...flags.by ? { by: flags.by.replace(/^@/, "") } : {},
+		...flags.mentions ? { mentions: flags.mentions.replace(/^@/, "") } : {},
+		...flags.label?.length ? { label: flags.label } : {},
+		...flags.from ? { from: flags.from } : {},
+		...flags.text ? { text: flags.text } : {},
+		...flags.after !== void 0 ? { after: flags.after.replace(/^#/, "") } : {}
+	};
+}
+/**
+* The board this command talks to, `--url`'s or the one the environment points at, as `--as`
+* says: a handle on it, and how it reaches it (the credentials `vb` finds, `--handle`'s handle).
+*/
+function connection(url = flags.url, options = {}) {
+	const at = (url ?? boardUrl()).replace(/\/+$/, "");
+	const handle = options.handle ?? flags.handle;
+	const transport = connect(at, {
+		...options.token !== void 0 ? { token: options.token } : {},
+		...handle ? { handle } : {}
+	});
+	const board$1 = board({ backend: http(at, { fetch: transport.fetch }) });
+	const profile = flags.human ? null : flags.as ? flags.avatar ? {
+		name: flags.as,
+		avatar: flags.avatar
+	} : flags.as : void 0;
+	return {
+		url: at,
+		transport,
+		board: profile !== void 0 ? board$1.as(profile) : board$1
+	};
+}
+/** A handle on the board this command talks to. */
+const client = () => connection().board;
+/**
+* What names an agent's turns, for the turn-end hook: its session, or for
+* Cursor, whose shell has no session ID, the project it works in.
+*/
+const turnKey = (agent, session) => session ?? (agent === "cursor" ? `cursor@${projectDir()}` : null);
+/** A write from an agent session counts as this turn's board update. */
+function wrote() {
+	const detected = flags.human ? null : detectAgent();
+	const key = detected ? turnKey(detected.profile, detected.session) : null;
+	if (key) markPosted(key);
+}
+const fromNpx = (path) => /[\\/]_npx[\\/]/.test(path);
+/** The first `vb` on PATH outside npx's cache, which is gone once npx exits. */
+function globalVb() {
+	for (const dir of (process.env.PATH ?? "").split(delimiter)) {
+		const candidate = join(dir, "vb");
+		if (existsSync(candidate) && !fromNpx(realpathSync(candidate))) return candidate;
+	}
+	return null;
+}
+/**
+* Whether `bin` runs the CLI at `self`: a symlink to it (npm), or a shell
+* shim that execs node on it (pnpm, through `$basedir`- or `$basedir_abs`-relative paths).
+*/
+function runsCli(bin, self) {
+	try {
+		const real = realpathSync(bin);
+		if (real === self) return true;
+		if (statSync(real).size > 65536) return false;
+		const script = readFileSync(real, "utf8");
+		if (!script.startsWith("#!")) return false;
+		const basedir = dirname(bin);
+		const paths = [...[...script.matchAll(/"([^"\n]+)"/g)].map(([, quoted]) => quoted.replace(/^\$(?:\{basedir(?:_abs)?\}|basedir(?:_abs)?)(?=\/)/, basedir)), ...[...script.matchAll(/^# cmd-shim-target=(.+)$/gm)].map(([, target]) => target.trim())];
+		for (const path of paths) if (isAbsolute(path) && existsSync(path) && realpathSync(path) === self) return true;
+	} catch {}
+	return false;
+}
+/**
+* How an agent's hook should run this CLI, long after this command exits:
+* `vb` when that's this CLI; under npx, a global `vb` of this version, else
+* this version through npx; otherwise this CLI's full path.
+*/
+function cliCommand() {
+	const self = realpathSync(process.argv[1]);
+	const installed = globalVb();
+	if (!fromNpx(self)) {
+		if (installed && runsCli(installed, self)) return { command: "vb" };
+		const quote = (part) => /^[\w./-]+$/.test(part) ? part : `'${part.replace(/'/g, `'\\''`)}'`;
+		return { command: [process.execPath, self].map(quote).join(" ") };
+	}
+	let version = "";
+	try {
+		version = installed ? execFileSync(installed, ["--version"], {
+			encoding: "utf8",
+			timeout: 5e3,
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			]
+		}).trim() : "";
+	} catch {}
+	if (version === VERSION) return { command: "vb" };
+	return {
+		command: `npx -y @vercel/board@${VERSION}`,
+		note: `the hook runs board ${VERSION} through npx${installed ? ` (your vb is ${version || "older"})` : ""}; \`npm i -g @vercel/board\` makes it start faster`
+	};
+}
+/**
+* The board version a hook's CLI runs: pinned in an npx command, else what it
+* answers to `--version` (the first `vb` on PATH, for plain `vb`). Null when
+* it doesn't answer with one.
+*/
+function hookVersion(cli) {
+	const pinned = /^npx -y @vercel\/board@(\S+)$/.exec(cli);
+	if (pinned) return pinned[1];
+	try {
+		const answer = execFileSync("/bin/sh", ["-c", `${cli} --version`], {
+			encoding: "utf8",
+			timeout: 5e3,
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			]
+		}).trim();
+		return /^\d+\.\d+\.\d+\S*$/.test(answer) ? answer : null;
+	} catch {
+		return null;
+	}
+}
+/** Whether version `a` comes before `b`, by major, minor, and patch. */
+function olderVersion(a, b) {
+	const parts = (version) => version.split(/[.-]/).slice(0, 3).map(Number);
+	const [x, y] = [parts(a), parts(b)];
+	for (let i = 0; i < 3; i++) if (x[i] !== y[i]) return (x[i] ?? 0) < (y[i] ?? 0);
+	return false;
+}
+async function readStdin() {
+	const chunks = [];
+	for await (const chunk of process.stdin) chunks.push(chunk);
+	return Buffer.concat(chunks).toString("utf8");
+}
+function hookAgents(names) {
+	const known = Object.keys(AGENTS);
+	for (const name of names) if (!known.includes(name)) throw new UsageError(`unknown agent: ${name} (known: ${known.join(", ")})`);
+	return names.length ? names : known;
+}
+/** A write went through, but some handles in it matched no one: they stayed plain text. */
+function warnUnknownMentions(handles) {
+	if (!handles?.length) return;
+	const names = handles.map((handle) => `@${handle}`);
+	const list = names.length === 1 ? names[0] : `${names.slice(0, -1).join(", ")} and ${names.at(-1)}`;
+	const one = names.length === 1;
+	process.stderr.write(terminalText(`warning: ${list} ${one ? "matches" : "match"} no one on the board, so ${one ? "it stays" : "they stay"} plain text and ${one ? "notifies" : "notify"} no one`) + "\n");
+}
+function printMessage(message) {
+	if (flags.json) printJson(message);
+	else out(String(message.id));
+}
+function printEvent(event) {
+	if (flags.json) printJson(event);
+	else out(formatEvent(event));
+}
+/** Best-effort: the URL is printed either way. */
+/** `url`, when it's an http or https URL as `new URL` reads it: the only kind the CLI opens, so a board can't hand the opener a flag or another scheme. */
+function browsable(url) {
+	try {
+		const parsed = new URL(url);
+		return parsed.protocol === "https:" || parsed.protocol === "http:" ? parsed.href : null;
+	} catch {
+		return null;
+	}
+}
+/** Opens an http(s) URL in the browser, as one argument to the opener: no shell reads it, Windows' included. */
+function openBrowser(url) {
+	const at = browsable(url);
+	if (at === null) return;
+	const [command, ...args] = process.platform === "darwin" ? ["open", at] : process.platform === "win32" ? [
+		"rundll32",
+		"url.dll,FileProtocolHandler",
+		at
+	] : ["xdg-open", at];
+	const child = spawn(command, args, {
+		detached: true,
+		stdio: "ignore"
+	});
+	child.on("error", () => {});
+	child.unref();
+}
+/** Writes the board link: the project's `.board/` (kept out of Git), or the saved default when `root` is null. */
+async function saveLink(root, url, extra = {}) {
+	const directory = root === null ? configDir() : join(root, ".board");
+	if (root !== null) {
+		const path = join(root, ".gitignore");
+		const ignore = await readFile(path, "utf8").catch((error) => {
+			if (error.code === "ENOENT") return "";
+			throw error;
+		});
+		if (!ignore.split(/\r?\n/).some((line) => /^\/?\.board\/?$/.test(line))) await appendFile(path, `${ignore && !ignore.endsWith("\n") ? "\n" : ""}.board/\n`);
+	}
+	await mkdir(directory, {
+		recursive: true,
+		mode: 448
+	});
+	await writeFile(join(directory, "config.json"), `${JSON.stringify({
+		url,
+		...extra
+	}, null, 2)}\n`, { mode: 384 });
+}
+/** Whether the project's link was written by `vb serve` (`"serve": true`), so a new run may move it. */
+function linkedByServe(root) {
+	try {
+		return JSON.parse(readFileSync(join(root, ".board", "config.json"), "utf8")).serve === true;
+	} catch {
+		return false;
+	}
+}
+function portFlag() {
+	const port = flags.port === void 0 ? void 0 : Number(flags.port);
+	if (port !== void 0 && !(Number.isInteger(port) && port >= 0 && port <= 65535)) throw new UsageError(`expected a port, got: ${flags.port}`);
+	return port;
+}
+/** How long `identity link` waits for the sign-in or the code. */
+const LINK_WAIT_MS = 6e5;
+async function identity(args) {
+	const board = client();
+	const [sub, target] = args;
+	if (sub === void 0) {
+		const view = await board.identity();
+		if (flags.json) return printJson(view), 0;
+		if (view.links.length === 0) out("no linked accounts");
+		for (const link of view.links) out(`${link.handle ? `@${link.handle}  ` : ""}${link.actor}  by ${link.method === "code" ? "code" : "sign-in"} · ${link.at}`);
+		if (view.unlinked?.length) out(`not linked  ${view.unlinked.join(", ")}  (vb identity link <key>)`);
+		return 0;
+	}
+	if (sub === "unlink") {
+		if (!target || args.length !== 2) throw new UsageError("usage: board identity unlink <account>   (a handle or actor ID from `vb identity`)");
+		const result = await board.unlinkAccount(target);
+		if (flags.json) printJson(result);
+		else out(`unlinked ${result.actor}`);
+		return 0;
+	}
+	if (sub !== "link" || !target || args.length !== 2) throw new UsageError("usage: board identity [link <key> [--code] [--no-wait] | unlink <account>]");
+	const before = new Set((await board.identity()).links.map((link) => `${link.actor}|${link.at}`));
+	const platform = (await board.discovery().catch(() => null))?.sync.find((entry) => entry.key === target)?.platform ?? target;
+	const { code, expiresAt, signIn } = await board.syncCode(target);
+	const consent = signIn !== void 0 && !flags.code;
+	if (consent && browsable(signIn) === null) throw new Error(`the board's sign-in isn't an http or https URL: ${JSON.stringify(signIn)}`);
+	if (flags.json) printJson({
+		sync: target,
+		platform,
+		code,
+		expiresAt,
+		...signIn !== void 0 ? { signIn } : {}
+	});
+	const until = Date.now() + LINK_WAIT_MS;
+	const sleep = () => new Promise((resolve) => setTimeout(resolve, 2e3));
+	/** An account linked on that platform since this run began: where the code or the sign-in landed. */
+	const linkedSince = async () => (await board.identity()).links.find((link) => link.actor.startsWith(`${platform}:user:`) && !before.has(`${link.actor}|${link.at}`));
+	if (consent) {
+		if (!flags.json) {
+			out(`Sign in to ${platform} as yourself to link it (and to post as you there):\n\n  ${signIn}\n`);
+			out(`Only open it yourself: whoever completes it links their account to you.`);
+		}
+		if (!flags["no-open"] && !flags.json) openBrowser(signIn);
+	} else if (!flags.json) {
+		const minutes = Math.round((Date.parse(expiresAt) - Date.now()) / 6e4);
+		out(`From your ${platform} account, post this as a message anywhere the board syncs, within ${minutes} minutes:\n\n  ${code}\n`);
+	}
+	if (flags["no-wait"]) return 0;
+	while (Date.now() < Math.min(until, consent ? Infinity : Date.parse(expiresAt))) {
+		await sleep();
+		const linked = await linkedSince();
+		if (linked) {
+			if (flags.json) printJson(linked);
+			else out(`linked ${linked.handle ? `@${linked.handle} ` : ""}(${linked.actor})`);
+			return 0;
+		}
+	}
+	process.stderr.write("timed out\n");
+	return 124;
+}
+async function run(command, args) {
+	switch (command) {
+		case void 0:
+		case "help":
+			out(HELP);
+			return 0;
+		case "link":
+		case "use": {
+			const url = args[0];
+			if (!url || args.length !== 1) throw new UsageError(`usage: board ${command} <url>`);
+			const discovery = await connection(url).board.discovery();
+			const root = command === "link" ? projectDir() : null;
+			await saveLink(root, discovery.url);
+			out(root === null ? `using ${discovery.url}` : `linked ${root} to ${discovery.url}`);
+			return 0;
+		}
+		case "whoami": {
+			const { board, url, transport } = connection();
+			const me = await board.me();
+			const source = transport.source();
+			if (flags.json) {
+				printJson({
+					...me,
+					board: url,
+					source
+				});
+				return 0;
+			}
+			const name = me.profile !== null ? `${me.name} via ${me.handle.split("/")[0]}` : me.name;
+			out(`${name} (${me.actor})`);
+			const rows = [["board", url]];
+			if (source) rows.push(["source", source]);
+			if (me.expiresAt) {
+				const minutes = Math.max(0, Math.round((Date.parse(me.expiresAt) - Date.now()) / 6e4));
+				rows.push(["token", `expires in ${Math.floor(minutes / 60)}h ${minutes % 60}m`]);
+			}
+			if (me.session) rows.push(["session", me.session]);
+			(me.can === void 0 ? [] : formatAccess(me.can)).forEach((line, index) => rows.push([index === 0 ? "can" : "", line]));
+			const width = Math.max(...rows.map(([subject]) => subject.length));
+			for (const [subject, value] of rows) out(`${subject.padEnd(width)}  ${value}`);
+			return 0;
+		}
+		case "conformance": {
+			if (args.length > 0) throw new UsageError("usage: board conformance [--channel <c>]");
+			const report = await conformance(client(), flags.channel ? { channel: flags.channel } : {});
+			if (flags.json) printJson(report);
+			else out(formatConformance(report));
+			return report.ok ? 0 : 1;
+		}
+		case "channels": {
+			const channels = await client().channels();
+			if (flags.json) return channels.forEach(printJson), 0;
+			if (channels.length === 0) return out("no channels yet"), 0;
+			let group = "";
+			for (const channel of channels) {
+				const prefix = channel.path.includes("/") ? channel.path.slice(0, channel.path.lastIndexOf("/") + 1) : "";
+				if (prefix !== group) {
+					if (prefix) out(prefix);
+					group = prefix;
+				}
+				const count = (n, one, many) => `${n} ${n === 1 ? one : many}`;
+				out(`${prefix ? "  " : ""}${channel.path}  ${count(channel.threads, "thread", "threads")} · ${count(channel.messages, "message", "messages")} · last #${channel.lastIndex}`);
+			}
+			return 0;
+		}
+		case "actors": {
+			const actors = await client().actors();
+			if (flags.json) return actors.forEach(printJson), 0;
+			for (const actor of actors) out(`@${actor.handle}  ${actor.name}  ${actor.id}${actor.person ? `  → @${actor.person.handle}` : ""}`);
+			return 0;
+		}
+		case "identity": return identity(args);
+		case "read": {
+			const target = args[0];
+			const board = client();
+			if (target && isMessageRef(target)) {
+				const thread = await board.thread(messageId(target));
+				const narrowed = Object.keys(filters()).length > 0;
+				const replies = narrowed ? (await board.messages({
+					...filters(),
+					re: thread.message.id,
+					limit: 500
+				})).messages.filter((m) => m.re !== null) : thread.replies;
+				if (flags.json) return [thread.message, ...replies].forEach(printJson), 0;
+				const authors = new Set([thread.message, ...replies].map((m) => m.by.actor));
+				const unnamed = reactionNames([thread.message, ...replies]).filter((id) => !authors.has(id));
+				const known = unnamed.length ? new Map((await board.actors().catch(() => [])).filter((a) => unnamed.includes(a.id)).map((a) => [a.id, actorName(a)])) : /* @__PURE__ */ new Map();
+				out(formatThreads([thread.message, ...replies], known));
+				if (!narrowed) for (const schedule of thread.schedules ?? []) out(formatSchedule(schedule, { pad: "  " }));
+				return 0;
+			}
+			const query = {
+				...filters(target),
+				...flags.limit ? { limit: Number(flags.limit) } : {}
+			};
+			const old = /* @__PURE__ */ new Error("this board can't list threads: update board where the board is deployed");
+			const page = await board.threads(query).catch((error) => {
+				throw error instanceof BoardError && error.status === 404 ? old : error;
+			});
+			if (!Array.isArray(page.threads)) throw old;
+			if (!page.threads.length && target && !(await board.channels()).some((c) => c.path === target || c.path.startsWith(target.replace(/\/?$/, "/")))) throw new Error(`no channel ${target}: board channels lists them`);
+			if (flags.json) return page.threads.forEach(printJson), 0;
+			const count = `${page.threads.length} ${page.threads.length === 1 ? "thread" : "threads"}`;
+			out(`${target ?? "all channels"} · ${count} · cursor ${page.cursor}${page.threads.length ? "\n" : ""}`);
+			if (page.threads.length) out(formatThreadSummaries(page.threads, { channel: !target || target.endsWith("/") }));
+			return 0;
+		}
+		case "post": {
+			const [target, body] = args;
+			if (!target) throw new UsageError("usage: board post <channel|id> \"<text>\"");
+			const re = isMessageRef(target) ? messageId(target) : void 0;
+			if (re !== void 0 && flags.sync?.length) throw new UsageError("--sync attaches whole threads: post to a channel, or use vb sync <id> <target>");
+			if (flags.sync?.length && flags["no-sync"]) throw new UsageError("--sync and --no-sync contradict each other");
+			const board = client();
+			const content = body === void 0 && flags.attach?.length ? "" : await text(body);
+			const files = await attachments(board);
+			const options = {
+				text: content,
+				...files.length ? { attachments: files } : {},
+				...flags.label?.length ? { labels: labelPairs(flags.label) } : {},
+				...flags.id ? { id: flags.id } : {},
+				...flags["no-sync"] ? { noSync: true } : {}
+			};
+			const message = re === void 0 ? await board.post(target, {
+				...options,
+				...flags.sync?.length ? { sync: flags.sync } : {}
+			}) : await board.reply(re, options);
+			wrote();
+			warnUnknownMentions(message.unknownMentions);
+			printMessage(message);
+			return 0;
+		}
+		case "reply": {
+			const id = messageId(args[0]);
+			const board = client();
+			const content = args[1] === void 0 && flags.attach?.length ? "" : await text(args[1]);
+			const files = await attachments(board);
+			const message = await board.reply(id, {
+				text: content,
+				...files.length ? { attachments: files } : {},
+				...flags.id ? { id: flags.id } : {},
+				...flags["no-sync"] ? { noSync: true } : {}
+			});
+			wrote();
+			warnUnknownMentions(message.unknownMentions);
+			printMessage(message);
+			return 0;
+		}
+		case "schedule": {
+			if (args[0] === "cancel" && args.length === 2) {
+				const { schedule, canceled } = await client().cancelSchedule(scheduleId(args[1]));
+				if (flags.json) printJson(schedule);
+				else out(canceled ? `canceled s${schedule.id}` : `s${schedule.id} is already ${schedule.state}`);
+				return 0;
+			}
+			const [target, body] = args;
+			if (!target) throw new UsageError("usage: board schedule <channel|id> \"<text>\" (--in 1d | --at <time> | --every 30m)");
+			if (!flags.in && !flags.at && !flags.every) throw new UsageError("say when: --in 1d, --at <time>, or --every 30m");
+			if (flags.sync?.length) throw new UsageError("a schedule posts where you point it: --sync is for post");
+			const times = flags.times === void 0 ? void 0 : Number(flags.times);
+			if (times !== void 0 && !(Number.isInteger(times) && times > 0)) throw new UsageError(`--times takes a count, got: ${flags.times}`);
+			const board = client();
+			const content = body === void 0 && flags.attach?.length ? "" : await text(body);
+			const files = await attachments(board);
+			const where = isMessageRef(target) ? { re: messageId(target) } : target;
+			const schedule = await board.schedule(where, {
+				text: content,
+				...files.length ? { attachments: files } : {},
+				...flags.label?.length ? { labels: labelPairs(flags.label) } : {},
+				...flags["no-sync"] ? { noSync: true } : {},
+				...flags.in ? { in: flags.in } : {},
+				...flags.at ? { at: instant("at", flags.at) } : {},
+				...flags.every ? { every: flags.every } : {},
+				...flags.until ? { until: instant("until", flags.until) } : {},
+				...flags.for ? { for: flags.for } : {},
+				...times !== void 0 ? { times } : {}
+			});
+			wrote();
+			warnUnknownMentions(schedule.unknownMentions);
+			if (flags.json) printJson(schedule);
+			else out(formatSchedule(schedule));
+			return 0;
+		}
+		case "schedules": {
+			const list = await client().schedules({
+				...args[0] ? { re: messageId(args[0]) } : {},
+				...flags.by ? { by: flags.by.replace(/^@/, "") } : {},
+				...flags.channel ? { channel: flags.channel } : {},
+				...flags.all ? { all: true } : {}
+			});
+			if (flags.json) return list.forEach(printJson), 0;
+			if (list.length === 0) return out(flags.all ? "no schedules" : "no pending schedules"), 0;
+			out(list.map((schedule) => formatSchedule(schedule)).join("\n"));
+			return 0;
+		}
+		case "hooks": {
+			const [action = "status", ...names] = args;
+			const agents = hookAgents(names);
+			const width = Math.max(...agents.map((agent) => AGENTS[agent].name.length));
+			const row = (agent, ...cells) => out([AGENTS[agent].name.padEnd(width), ...cells].join("  ").trimEnd());
+			if (action === "status") {
+				const versions = /* @__PURE__ */ new Map();
+				for (const agent of agents) {
+					const installed = installedHook(agent);
+					if (installed === null) {
+						row(agent, "not installed");
+						continue;
+					}
+					const cli = cliOf(installed);
+					const problems = outdated(agent, installed);
+					if (!versions.has(cli)) versions.set(cli, hookVersion(cli));
+					const version = versions.get(cli);
+					const behind = version != null && olderVersion(version, VERSION);
+					if (behind) problems.push(`runs board ${version}, not ${VERSION}`);
+					row(agent, (problems.length ? "outdated" : "installed").padEnd(9), tilde(AGENTS[agent].file()));
+					if (problems.length === 0) continue;
+					for (const problem of problems) out(`  ${problem}`);
+					const global = behind && cli === "vb";
+					const fixes = [...global ? ["npm i -g @vercel/board"] : [], ...problems.length > (global ? 1 : 0) ? [`vb hooks install ${agent}`] : []];
+					out(`  fix with ${fixes.join(", then ")}`);
+				}
+				return 0;
+			}
+			if (action === "uninstall") {
+				for (const agent of agents) {
+					const installed = installedHook(agent);
+					const cli = installed ? cliOf(installed) : null;
+					const rules = cli ? allowRules(agent, cli) : null;
+					if (rules) disallow(rules.file, [...rules.rules, ...legacyRules(agent, cli)]);
+					row(agent, uninstallHook(agent) ? "removed" : "not installed", installed ? tilde(AGENTS[agent].file()) : "");
+				}
+				return 0;
+			}
+			if (action !== "install") throw new UsageError("usage: board hooks [install|uninstall|status] [claude|codex|cursor|pi]...");
+			const { command: cli, note } = cliCommand();
+			for (const agent of agents) {
+				const had = installedHook(agent) !== null;
+				const changed = installHook(agent, cli);
+				const rules = allowRules(agent, cli);
+				const added = rules ? allow(rules.file, rules.rules) : [];
+				const dropped = rules ? disallow(rules.file, legacyRules(agent, cli)) : false;
+				out(`${AGENTS[agent].name}  ${tilde(AGENTS[agent].file())}`);
+				out(`  ${!had ? "added the turn-end hook" : changed || added.length > 0 || dropped ? "updated" : "already installed"}`);
+				if (added.length > 0) out(`  ${agent === "claude" ? "reply, post, read, and channels run without asking" : "vb runs without asking"}`);
+				if (agent === "cursor" && !rules) out("  npm i -g @vercel/board lets Cursor run vb without asking");
+				if (agent === "codex") {
+					if (changed) out("  approve it once in Codex with /hooks");
+					let host = null;
+					try {
+						const url = process.env.BOARD_URL || projectUrl();
+						host = url ? new URL(url).hostname : null;
+					} catch {}
+					const config = join(process.env.CODEX_HOME || join(homedir(), ".codex"), "config.toml");
+					const profile = codexNetwork(host);
+					out(`  to let vb reach the board from Codex's sandbox, add to ${tilde(config)}:`);
+					out("");
+					out([
+						"# a permission profile (beta) that opens the network to just the board",
+						"",
+						"# at the top, before any [table]",
+						profile.top,
+						"",
+						"# anywhere (merge [features] into yours)",
+						profile.tables
+					].join("\n").replace(/^(?=.)/gm, "    "));
+				}
+				out("");
+			}
+			if (note) out(`${note[0].toUpperCase()}${note.slice(1)}.`);
+			out("The hooks remind once per turn without a board update.");
+			out("They stay quiet outside projects linked with `vb link <url>`.");
+			return 0;
+		}
+		case "hook": {
+			if (args[0] !== "stop") throw new UsageError("usage: board hook stop --agent <agent>   (run by an agent's turn-end hook)");
+			const agent = flags.agent ?? "agent";
+			try {
+				const payload = JSON.parse(await readStdin());
+				const cwd = payload.cwd ?? payload.workspace_roots?.[0];
+				if (cwd && existsSync(cwd)) process.chdir(cwd);
+				const session = turnKey(agent, agent === "cursor" ? null : payload.session_id ?? null);
+				const boardUrl = process.env.BOARD_URL || projectUrl();
+				if (!session || !boardUrl) return 0;
+				if (payload.status && payload.status !== "completed") return 0;
+				if (decideStop(session, payload.stop_hook_active === true || (payload.loop_count ?? 0) > 0) === "ask") {
+					const cli = cliCommand().command;
+					const text = claimLinkOffer(boardUrl) ? `${reminder(cli)}\n\n${linkOffer(cli)}` : reminder(cli);
+					printJson(stopOutput(agent, text));
+				}
+			} catch {}
+			return 0;
+		}
+		case "edit": {
+			const { unknownMentions } = await client().edit(messageId(args[0]), await text(args[1]));
+			warnUnknownMentions(unknownMentions);
+			return 0;
+		}
+		case "delete":
+			await client().delete(messageId(args[0]));
+			return 0;
+		case "react": {
+			const id = messageId(args[0]);
+			if (!args[1]) throw new UsageError("usage: board react <id> <emoji> [--remove]");
+			let emoji;
+			try {
+				emoji = normalizeEmoji(args[1]);
+			} catch (error) {
+				throw new UsageError(error.message);
+			}
+			await client().react(id, emoji, flags.remove ? { remove: true } : {});
+			return 0;
+		}
+		case "label": {
+			const id = messageId(args[0]);
+			const set = labelPairs(args.slice(1));
+			const unset = flags.unset ?? [];
+			if (Object.keys(set).length === 0 && unset.length === 0) throw new UsageError("usage: board label <id> k=v... [--unset k]...");
+			await client().label(id, {
+				set,
+				unset
+			});
+			return 0;
+		}
+		case "typing": {
+			const id = messageId(args[0]);
+			const status = args.slice(1).join(" ").trim();
+			const targets = await client().typing(id, status || void 0);
+			if (flags.json) printJson({ targets });
+			return 0;
+		}
+		case "sync": {
+			const id = messageId(args[0]);
+			if (!args[1]) throw new UsageError("usage: board sync <id> <target>   (e.g. slack:#incidents)");
+			const result = await client().sync(id, args[1]);
+			if (flags.json) printJson(result);
+			else out(result.attached ? `synced with ${result.target}` : `already synced with ${result.target}`);
+			return 0;
+		}
+		case "download": {
+			const id = args[0];
+			if (!id) throw new UsageError("usage: board download <attachment> [path]   (the id `vb read` shows on a file line)");
+			const response = await client().download(id);
+			const data = new Uint8Array(await response.arrayBuffer());
+			if (args[1] === "-") return process.stdout.write(data), 0;
+			const disposition = response.headers.get("content-disposition") ?? "";
+			const named = /filename\*=UTF-8''([^;]+)/.exec(disposition)?.[1];
+			const path = args[1] ?? basename(named ? decodeURIComponent(named) : id);
+			await writeFile(path, data);
+			out(path);
+			return 0;
+		}
+		case "inbox": {
+			const key = args[0];
+			if (!key) throw new UsageError("usage: board inbox <key> [channel] [--limit N]");
+			const events = await client().inbox(key, {
+				...args[1] ? { channel: args[1] } : {},
+				...flags.limit ? { limit: Number(flags.limit) } : {}
+			});
+			if (flags.json) return events.forEach(printJson), 0;
+			if (events.length === 0) return out("no events"), 0;
+			for (const entry of events) {
+				const event = entry.event;
+				const detail = event.text ?? event.type ?? event.emoji ?? "";
+				out(`${entry.createdAt}  ${entry.channel}  ${event.kind}  ${event.author?.handle ?? ""}  ${detail.split("\n")[0]}`);
+			}
+			return 0;
+		}
+		case "sources": {
+			const [key, sub, target] = args;
+			if (!key) {
+				const { sync } = await client().discovery();
+				if (flags.json) return sync.forEach(printJson), 0;
+				if (sync.length === 0) return out("no sources: this board has no sync configured"), 0;
+				for (const entry of sync) out(`${entry.key}  ${entry.platform}`);
+				return 0;
+			}
+			if (sub !== "read" || !target) throw new UsageError("usage: board sources <key> read <channel|thread|link> [--limit N]");
+			const read = await client().readSource(key, target, flags.limit ? { limit: Number(flags.limit) } : {});
+			if (flags.json) return printJson(read), 0;
+			return out(formatSourceRead(key, read)), 0;
+		}
+		case "tail": {
+			const controller = new AbortController();
+			process.once("SIGINT", () => controller.abort());
+			for await (const event of client().events({
+				...filters(args[0]),
+				...flags.all ? { all: true } : {}
+			}, { signal: controller.signal })) printEvent(event);
+			return 0;
+		}
+		case "wait": {
+			const controller = new AbortController();
+			process.once("SIGINT", () => controller.abort());
+			const event = await client().wait(filters(args[0]), {
+				timeout: flags.timeout ?? "30m",
+				signal: controller.signal
+			});
+			if (!event) {
+				if (!controller.signal.aborted) process.stderr.write("timed out\n");
+				return 124;
+			}
+			printEvent(event);
+			return 0;
+		}
+		case "serve": {
+			if (args.length > 0) throw new UsageError("usage: board serve [--port N] [--dir <dir>] [--no-inspect] [--no-open]");
+			const port = portFlag();
+			const root = projectDir();
+			const { localHandle, serveLocal } = await import("./serve-Ccbb2LSb.mjs");
+			const handle = flags.handle ?? process.env.BOARD_HANDLE;
+			const local = await serveLocal({
+				dir: flags.dir ?? join(root, ".board"),
+				...port !== void 0 ? { port } : {},
+				...handle ? { handle: localHandle(handle) } : {}
+			});
+			let inspector = null;
+			try {
+				const linked = projectUrl();
+				if (linked === void 0 || linked === local.url || linkedByServe(root)) {
+					await saveLink(root, local.url, { serve: true });
+					if (linked !== local.url) out(`linked ${root} to ${local.url}`);
+				} else out(`${root} stays linked to ${linked}; reach this board with BOARD_URL=${local.url}`);
+				out(`serving a local board at ${local.url} as ${local.principal}, its log in ${local.dir}  (Ctrl-C to stop)`);
+				if (!flags["no-inspect"]) {
+					const { board } = connection(local.url, {
+						token: local.token,
+						handle: local.handle
+					});
+					inspector = await startInspector({ client: board.as(null) });
+					out(`inspector at ${inspector.url}`);
+					if (!flags["no-open"]) openBrowser(inspector.url);
+				}
+				await new Promise((resolve) => {
+					process.once("SIGINT", resolve);
+					process.once("SIGTERM", resolve);
+				});
+			} finally {
+				await inspector?.close();
+				await local.close();
+			}
+			return 0;
+		}
+		case "inspect": {
+			const port = portFlag();
+			const inspector = await startInspector({
+				client: client(),
+				...port !== void 0 ? { port } : {}
+			});
+			out(`inspecting ${inspector.board} as ${who(inspector.me)} at ${inspector.url}  (Ctrl-C to stop)`);
+			if (!flags["no-open"]) openBrowser(inspector.url);
+			await new Promise((resolve) => {
+				process.once("SIGINT", resolve);
+				process.once("SIGTERM", resolve);
+			});
+			await inspector.close();
+			return 0;
+		}
+		default: throw new UsageError(`unknown command: ${command} (run \`board help\`)`);
+	}
+}
+if (parsed === null) exit(2);
+else if (flags.version) out(VERSION);
+else if (flags.help) out(HELP);
+else {
+	const [command, ...args] = positionals;
+	run(command, args).then((code) => exit(code), (error) => {
+		process.stderr.write(`${terminalText(`error: ${error.message}`)}\n`);
+		exit(error instanceof UsageError ? 2 : 1);
+	});
+}
+/**
+* Exits once stdout and stderr have flushed. On a pipe, writes can still be
+* queued when a command returns, and `process.exit` would drop them: a long
+* `read <id> --json` would reach a slow reader cut off.
+*/
+function exit(code) {
+	let pending = 2;
+	const done = () => --pending === 0 && process.exit(code);
+	process.stdout.write("", done);
+	process.stderr.write("", done);
+}
+//#endregion
+export {};