@weavecode/weave 0.1.8 → 0.1.9

package/node_modules/@modelcontextprotocol/sdk/node_modules/@hono/node-server/dist/index.cjs

@@ -169,16 +169,27 @@ const newHeadersFromIncoming = (incoming) => globalThis.Headers === GlobalHeader
 const reValidRequestUrl = /^\/[!#$&-;=?-\[\]_a-z~]*$/;
 const reDotSegment = /\/\.\.?(?:[/?#]|$)/;
 const reValidHost = /^[a-z0-9._-]+(?::(?:[1-5]\d{3,4}|[6-9]\d{3}))?$/;
+const validateRequestTarget = (target) => {
+	const backslash = target.indexOf("\\");
+	if (backslash !== -1) {
+		const query = target.indexOf("?");
+		if (query === -1 || backslash < query) throw new RequestError("Backslash in request path");
+	}
+};
 const buildUrl = (scheme, host, incomingUrl) => {
 	const url = `${scheme}://${host}${incomingUrl}`;
 	if (!reValidHost.test(host)) {
+		validateRequestTarget(incomingUrl);
 		const urlObj = new URL(url);
 		if (urlObj.hostname.length !== host.length && urlObj.hostname !== (host.includes(":") ? host.replace(/:\d+$/, "") : host).toLowerCase()) throw new RequestError("Invalid host header");
 		return urlObj.href;
 	} else if (incomingUrl.length === 0) return url + "/";
 	else {
 		if (incomingUrl.charCodeAt(0) !== 47) throw new RequestError("Invalid URL");
-		if (!reValidRequestUrl.test(incomingUrl) || reDotSegment.test(incomingUrl)) return new URL(url).href;
+		if (!reValidRequestUrl.test(incomingUrl) || reDotSegment.test(incomingUrl)) {
+			validateRequestTarget(incomingUrl);
+			return new URL(url).href;
+		}
 		return url;
 	}
 };
@@ -591,6 +602,7 @@ const newRequest = (incoming, defaultHostname) => {
 	if (incomingUrl[0] !== "/" && (incomingUrl.startsWith("http://") || incomingUrl.startsWith("https://"))) {
 		if (incoming instanceof node_http2.Http2ServerRequest) throw new RequestError("Absolute URL for :path is not allowed in HTTP/2");
 		try {
+			validateRequestTarget(incomingUrl);
 			req[urlKey] = new URL(incomingUrl).href;
 		} catch (e) {
 			throw new RequestError("Invalid absolute URL", { cause: e });
@@ -1143,6 +1155,7 @@ const appendResponseHeaders = (headers, responseHeaders) => {
 	});
 };
 const rejectUpgradeRequest = (socket, status, responseHeaders) => {
+	if (socket.destroyed) return;
 	const responseLines = ["Connection: close", "Content-Length: 0"];
 	appendResponseHeaders(responseLines, responseHeaders);
 	socket.end(`HTTP/1.1 ${status.toString()} ${node_http.STATUS_CODES[status] ?? ""}\r\n${responseLines.join("\r\n")}\r\n\r
@@ -1150,7 +1163,12 @@ const rejectUpgradeRequest = (socket, status, responseHeaders) => {
 };
 const createUpgradeRequest = (request) => {
 	const protocol = request.socket.encrypted ? "https" : "http";
-	const url = new URL(request.url ?? "/", `${protocol}://${request.headers.host ?? "localhost"}`);
+	const incomingUrl = request.url ?? "/";
+	let url;
+	if (incomingUrl[0] !== "/" && (incomingUrl.startsWith("http://") || incomingUrl.startsWith("https://"))) {
+		validateRequestTarget(incomingUrl);
+		url = new URL(incomingUrl).href;
+	} else url = buildUrl(protocol, request.headers.host ?? "localhost", incomingUrl);
 	const headers = new Headers();
 	for (const key in request.headers) {
 		const value = request.headers[key];
@@ -1187,6 +1205,10 @@ const setupWebSocket = (options) => {
 	};
 	server.on("upgrade", async (request, socket, head) => {
 		if (request.headers.upgrade?.toLowerCase() !== "websocket") return;
+		const ignoreSocketError = () => {};
+		const reclaimWaiterOnClose = () => rejectWaiter(request);
+		socket.on("error", ignoreSocketError);
+		socket.once("close", reclaimWaiterOnClose);
 		const env = {
 			incoming: request,
 			outgoing: void 0,
@@ -1201,8 +1223,12 @@ const setupWebSocket = (options) => {
 				status = response.status;
 				responseHeaders = response.headers;
 			}
-		} catch {
-			if (server.listenerCount("upgrade") === 1) rejectUpgradeRequest(socket, 500);
+		} catch (error) {
+			if (server.listenerCount("upgrade") === 1) rejectUpgradeRequest(socket, error instanceof RequestError ? 400 : 500);
+			return;
+		}
+		if (socket.destroyed) {
+			rejectWaiter(request);
 			return;
 		}
 		const waiter = waiterMap.get(request);
@@ -1214,12 +1240,11 @@ const setupWebSocket = (options) => {
 		const addResponseHeaders = (headers) => {
 			appendResponseHeaders(headers, responseHeaders);
 		};
-		const reclaimWaiterOnClose = () => rejectWaiter(request);
-		socket.once("close", reclaimWaiterOnClose);
 		wss.on("headers", addResponseHeaders);
 		try {
 			wss.handleUpgrade(request, socket, head, (ws) => {
 				socket.off("close", reclaimWaiterOnClose);
+				socket.off("error", ignoreSocketError);
 				wss.emit("connection", ws, request);
 			});
 		} finally {

package/node_modules/@modelcontextprotocol/sdk/node_modules/@hono/node-server/dist/index.mjs

@@ -168,16 +168,27 @@ const newHeadersFromIncoming = (incoming) => globalThis.Headers === GlobalHeader
 const reValidRequestUrl = /^\/[!#$&-;=?-\[\]_a-z~]*$/;
 const reDotSegment = /\/\.\.?(?:[/?#]|$)/;
 const reValidHost = /^[a-z0-9._-]+(?::(?:[1-5]\d{3,4}|[6-9]\d{3}))?$/;
+const validateRequestTarget = (target) => {
+	const backslash = target.indexOf("\\");
+	if (backslash !== -1) {
+		const query = target.indexOf("?");
+		if (query === -1 || backslash < query) throw new RequestError("Backslash in request path");
+	}
+};
 const buildUrl = (scheme, host, incomingUrl) => {
 	const url = `${scheme}://${host}${incomingUrl}`;
 	if (!reValidHost.test(host)) {
+		validateRequestTarget(incomingUrl);
 		const urlObj = new URL(url);
 		if (urlObj.hostname.length !== host.length && urlObj.hostname !== (host.includes(":") ? host.replace(/:\d+$/, "") : host).toLowerCase()) throw new RequestError("Invalid host header");
 		return urlObj.href;
 	} else if (incomingUrl.length === 0) return url + "/";
 	else {
 		if (incomingUrl.charCodeAt(0) !== 47) throw new RequestError("Invalid URL");
-		if (!reValidRequestUrl.test(incomingUrl) || reDotSegment.test(incomingUrl)) return new URL(url).href;
+		if (!reValidRequestUrl.test(incomingUrl) || reDotSegment.test(incomingUrl)) {
+			validateRequestTarget(incomingUrl);
+			return new URL(url).href;
+		}
 		return url;
 	}
 };
@@ -590,6 +601,7 @@ const newRequest = (incoming, defaultHostname) => {
 	if (incomingUrl[0] !== "/" && (incomingUrl.startsWith("http://") || incomingUrl.startsWith("https://"))) {
 		if (incoming instanceof Http2ServerRequest) throw new RequestError("Absolute URL for :path is not allowed in HTTP/2");
 		try {
+			validateRequestTarget(incomingUrl);
 			req[urlKey] = new URL(incomingUrl).href;
 		} catch (e) {
 			throw new RequestError("Invalid absolute URL", { cause: e });
@@ -1142,6 +1154,7 @@ const appendResponseHeaders = (headers, responseHeaders) => {
 	});
 };
 const rejectUpgradeRequest = (socket, status, responseHeaders) => {
+	if (socket.destroyed) return;
 	const responseLines = ["Connection: close", "Content-Length: 0"];
 	appendResponseHeaders(responseLines, responseHeaders);
 	socket.end(`HTTP/1.1 ${status.toString()} ${STATUS_CODES[status] ?? ""}\r\n${responseLines.join("\r\n")}\r\n\r
@@ -1149,7 +1162,12 @@ const rejectUpgradeRequest = (socket, status, responseHeaders) => {
 };
 const createUpgradeRequest = (request) => {
 	const protocol = request.socket.encrypted ? "https" : "http";
-	const url = new URL(request.url ?? "/", `${protocol}://${request.headers.host ?? "localhost"}`);
+	const incomingUrl = request.url ?? "/";
+	let url;
+	if (incomingUrl[0] !== "/" && (incomingUrl.startsWith("http://") || incomingUrl.startsWith("https://"))) {
+		validateRequestTarget(incomingUrl);
+		url = new URL(incomingUrl).href;
+	} else url = buildUrl(protocol, request.headers.host ?? "localhost", incomingUrl);
 	const headers = new Headers();
 	for (const key in request.headers) {
 		const value = request.headers[key];
@@ -1186,6 +1204,10 @@ const setupWebSocket = (options) => {
 	};
 	server.on("upgrade", async (request, socket, head) => {
 		if (request.headers.upgrade?.toLowerCase() !== "websocket") return;
+		const ignoreSocketError = () => {};
+		const reclaimWaiterOnClose = () => rejectWaiter(request);
+		socket.on("error", ignoreSocketError);
+		socket.once("close", reclaimWaiterOnClose);
 		const env = {
 			incoming: request,
 			outgoing: void 0,
@@ -1200,8 +1222,12 @@ const setupWebSocket = (options) => {
 				status = response.status;
 				responseHeaders = response.headers;
 			}
-		} catch {
-			if (server.listenerCount("upgrade") === 1) rejectUpgradeRequest(socket, 500);
+		} catch (error) {
+			if (server.listenerCount("upgrade") === 1) rejectUpgradeRequest(socket, error instanceof RequestError ? 400 : 500);
+			return;
+		}
+		if (socket.destroyed) {
+			rejectWaiter(request);
 			return;
 		}
 		const waiter = waiterMap.get(request);
@@ -1213,12 +1239,11 @@ const setupWebSocket = (options) => {
 		const addResponseHeaders = (headers) => {
 			appendResponseHeaders(headers, responseHeaders);
 		};
-		const reclaimWaiterOnClose = () => rejectWaiter(request);
-		socket.once("close", reclaimWaiterOnClose);
 		wss.on("headers", addResponseHeaders);
 		try {
 			wss.handleUpgrade(request, socket, head, (ws) => {
 				socket.off("close", reclaimWaiterOnClose);
+				socket.off("error", ignoreSocketError);
 				wss.emit("connection", ws, request);
 			});
 		} finally {

package/node_modules/@modelcontextprotocol/sdk/node_modules/@hono/node-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hono/node-server",
-  "version": "2.1.5",
+  "version": "2.1.6",
   "description": "Node.js Adapter for Hono",
   "main": "dist/index.mjs",
   "type": "module",

package/node_modules/@modelcontextprotocol/sdk/node_modules/express-rate-limit/dist/index.cjs

@@ -1061,7 +1061,7 @@ var rateLimit = (passedOptions) => {
           const retryAfter = await retrieveRetryAfter;
           setRetryAfterHeader(response, info, config.windowMs, retryAfter);
         }
-        config.handler(request, response, next, options);
+        await config.handler(request, response, next, options);
         return;
       }
       next();

package/node_modules/@modelcontextprotocol/sdk/node_modules/express-rate-limit/dist/index.mjs

@@ -1018,7 +1018,7 @@ var rateLimit = (passedOptions) => {
           const retryAfter = await retrieveRetryAfter;
           setRetryAfterHeader(response, info, config.windowMs, retryAfter);
         }
-        config.handler(request, response, next, options);
+        await config.handler(request, response, next, options);
         return;
       }
       next();

package/node_modules/@modelcontextprotocol/sdk/node_modules/express-rate-limit/node_modules/ip-address/README.md

@@ -186,9 +186,9 @@ A few terms used throughout the API can be confusing if you haven't worked deepl
 - `static fromWildcard(input: string): Address6` — Construct an `Address6` from a wildcard pattern with trailing `*` groups. The number of trailing wildcards determines the prefix length: each `*` represents 16 bits. `::` is expanded to zero groups (not wildcards) before evaluating trailing wildcards. Only trailing whole-group wildcards are supported. Partial-group wildcards (e.g. `2001:db8::0*`) and interior wildcards (e.g. `*::1`) throw `AddressError`. [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L331)
 - `static fromAddress4(address: string): Address6` — Create an IPv6-mapped address given an IPv4 address [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L392)
 - `static fromArpa(arpaFormAddress: string): Address6` — Return an address from ip6.arpa form. A full 32-nibble name gives a /128 address; a shorter name, as used for a delegated reverse zone, gives the network it covers, with a subnet mask of four bits per nibble, so `fromArpa(x.reverseForm())` round-trips reverseForm for any prefix. [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L412)
-- `static fromAddress4Nat64(address: string, prefix?: string): Address6` — Embed an IPv4 address into a NAT64 IPv6 address using the encoding defined by [RFC 6052](https://datatracker.ietf.org/doc/html/rfc6052). The default prefix is the well-known prefix `64:ff9b::/96`. The prefix length must be one of 32, 40, 48, 56, 64, or 96; for prefixes shorter than /64 the IPv4 octets are split around the reserved bits 64–71. [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1119)
-- `static fromByteArray(bytes: number[]): Address6` — Convert a byte array to an Address6 object. Accepts unsigned bytes (0 to 255) or signed bytes (-128 to 127, as an `Int8Array` or a Java `byte[]` holds them), folding signed values to their unsigned equivalent. Throws `AddressError` unless given exactly 16 integers from -128 to 255. To convert from a Node.js `Buffer`, spread it: `Address6.fromByteArray([...buf])`. [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1234)
-- `static fromUnsignedByteArray(bytes: number[]): Address6` — Convert an unsigned byte array to an Address6 object. Throws `AddressError` unless given exactly 16 integers from 0 to 255. To convert from a Node.js `Buffer`, spread it: `Address6.fromUnsignedByteArray([...buf])`. [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1251)
+- `static fromAddress4Nat64(address: string, prefix?: string): Address6` — Embed an IPv4 address into a NAT64 IPv6 address using the encoding defined by [RFC 6052](https://datatracker.ietf.org/doc/html/rfc6052). The default prefix is the well-known prefix `64:ff9b::/96`. The prefix length must be one of 32, 40, 48, 56, 64, or 96; for prefixes shorter than /64 the IPv4 octets are split around the reserved bits 64–71. [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1122)
+- `static fromByteArray(bytes: number[]): Address6` — Convert a byte array to an Address6 object. Accepts unsigned bytes (0 to 255) or signed bytes (-128 to 127, as an `Int8Array` or a Java `byte[]` holds them), folding signed values to their unsigned equivalent. Throws `AddressError` unless given exactly 16 integers from -128 to 255. To convert from a Node.js `Buffer`, spread it: `Address6.fromByteArray([...buf])`. [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1237)
+- `static fromUnsignedByteArray(bytes: number[]): Address6` — Convert an unsigned byte array to an Address6 object. Throws `AddressError` unless given exactly 16 integers from 0 to 255. To convert from a Node.js `Buffer`, spread it: `Address6.fromUnsignedByteArray([...buf])`. [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1254)
 
 **Instance methods**
 
@@ -215,39 +215,39 @@ A few terms used throughout the API can be confusing if you haven't worked deepl
 - `binaryZeroPad(): string` — Return a zero-padded base-2 string representation of the address [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L783)
 - `parse4in6(address: string): string` — Parses a v4-in-v6 string (e.g. `::ffff:192.168.0.1`) by extracting the trailing IPv4 address into `this.address4` / `this.parsedAddress4` and returning the address with the v4 portion converted to two v6 groups. Used internally by `parse()`. [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L797)
 - `parse(address: string): string[]` — Parses an IPv6 address string into its 8 hexadecimal groups (expanding any `::` elision and any trailing v4-in-v6 portion) and stores the result on `this.parsedAddress`. Called automatically by the constructor; you typically don't need to call it directly. Throws `AddressError` if the input is malformed. [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L854)
-- `canonicalForm(): string` — Returns the canonical (fully expanded) form of the address: all 8 groups, each padded to 4 hex digits, with no `::` collapsing (e.g. `2001:0db8:0000:0000:0000:0000:0000:0001`). Useful for sorting and byte-exact comparison. [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L934)
-- `decimal(): string` — Return the decimal form of the address [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L942)
-- `bigInt(): bigint` — Return the address as a BigInt [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L950)
-- `to4(): Address4` — Return the last two groups of this address as an IPv4 address string. If this address carries a CIDR prefix that covers the trailing 32 bits (i.e. `subnetMask >= 96`), the resulting `Address4` inherits the corresponding v4 prefix (`subnetMask - 96`); otherwise it defaults to `/32`. [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L965)
-- `to4in6(): string` — Return the v4-in-v6 form of the address [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L989)
-- `inspectTeredo(): TeredoProperties` — Decodes the Teredo tunneling fields embedded in this address. Returns the Teredo prefix, server IPv4, client IPv4, raw flag bits, cone-NAT flag, UDP port, and Microsoft-format flag breakdown (reserved, universal/local, group/individual, nonce). Only meaningful for addresses in `2001::/32`. [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1010)
-- `inspect6to4(): SixToFourProperties` — Decodes the 6to4 tunneling fields embedded in this address. Returns the 6to4 prefix and the embedded IPv4 gateway address. Only meaningful for addresses in `2002::/16`. [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1073)
-- `to6to4(): Address6 | null` — Return a v6 6to4 address from a v6 v4inv6 address [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1093)
-- `toAddress4Nat64(prefix?: string): Address4 | null` — Extract the embedded IPv4 address from a NAT64 IPv6 address using the encoding defined by [RFC 6052](https://datatracker.ietf.org/doc/html/rfc6052). The default prefix is the well-known prefix `64:ff9b::/96`. Returns `null` if this address is not contained within the given prefix. [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1162)
-- `toByteArray(): number[]` — Return a byte array. To get a Node.js `Buffer`, wrap the result: `Buffer.from(address.toByteArray())`. [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1197)
-- `toUnsignedByteArray(): number[]` — Return an unsigned byte array. To get a Node.js `Buffer`, wrap the result: `Buffer.from(address.toUnsignedByteArray())`. [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1216)
-- `isCanonical(): boolean` — Returns true if the address is in the canonical form, false otherwise [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1298)
-- `isLinkLocal(): boolean` — Returns true if the address is a link-local unicast address in `fe80::/10` ([RFC 4291 §2.4](https://datatracker.ietf.org/doc/html/rfc4291#section-2.4)) or an IPv4-mapped / NAT64 address whose embedded IPv4 address is link-local (`169.254.0.0/16`, e.g. `::ffff:169.254.169.254`), false otherwise. [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1309)
-- `isMulticast(): boolean` — Returns true if the address is a multicast address, false otherwise [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1322)
-- `is4(): boolean` — Returns true if the address was written in v4-in-v6 dotted-quad notation (e.g. `::ffff:127.0.0.1`), false otherwise. This is a notation-level flag and does not reflect whether the address bits lie in the IPv4-mapped (`::ffff:0:0/96`) subnet — for that, see isMapped4. [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1339)
-- `isMapped4(): boolean` — Returns true if the address is an IPv4-mapped IPv6 address in `::ffff:0:0/96` ([RFC 4291 §2.5.5.2](https://datatracker.ietf.org/doc/html/rfc4291#section-2.5.5.2)), false otherwise. Unlike is4, this checks the underlying address bits rather than the textual notation, so `::ffff:127.0.0.1` and `::ffff:7f00:1` both return true. [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1351)
-- `embeddedIPv4(): Address4 | null` — If this address embeds a routable IPv4 address — i.e. it is IPv4-mapped (`::ffff:0:0/96`) or sits in the NAT64 well-known prefix (`64:ff9b::/96`, [RFC 6052](https://datatracker.ietf.org/doc/html/rfc6052)) — return that embedded address as an Address4; otherwise return null. The special-property checks (`isLoopback`, `isLinkLocal`, `isMulticast`, `isUnspecified`, `isPrivate`, `isCGNAT`, `isBroadcast`) call this first and delegate to the embedded Address4 when present, so a literal such as `::ffff:127.0.0.1` is classified by what it actually reaches (loopback) rather than by its IPv6 wrapper (which `getType()` reports as IPv4-mapped). This matters wherever the checks back a trust-boundary decision (e.g. an SSRF allow/deny filter): without normalization, `::ffff:10.0.0.1`, `::ffff:169.254.169.254`, `64:ff9b::7f00:1`, etc. would all read as non-internal. [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1372)
-- `isTeredo(): boolean` — Returns true if the address is a Teredo address, false otherwise [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1384)
-- `is6to4(): boolean` — Returns true if the address is a 6to4 address, false otherwise [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1392)
-- `isLoopback(): boolean` — Returns true if the address is a loopback address, false otherwise [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1400)
-- `isULA(): boolean` — Returns true if the address is a Unique Local Address in `fc00::/7` ([RFC 4193](https://datatracker.ietf.org/doc/html/rfc4193)). ULAs are the IPv6 equivalent of IPv4 [RFC 1918](https://datatracker.ietf.org/doc/html/rfc1918) private addresses. [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1413)
-- `isPrivate(): boolean` — Returns true if the address is private, i.e. a Unique Local Address in `fc00::/7` ([RFC 4193](https://datatracker.ietf.org/doc/html/rfc4193)), an address in the NAT64 local-use range `64:ff9b:1::/48` ([RFC 8215](https://datatracker.ietf.org/doc/html/rfc8215)), or an IPv4-mapped / NAT64 well-known address whose embedded IPv4 address is in one of the [RFC 1918](https://datatracker.ietf.org/doc/html/rfc1918) private ranges (e.g. `::ffff:10.0.0.1`). This is the IPv6 counterpart to Address4.isPrivate; use it instead of isULA when you need to catch mapped RFC 1918 addresses as well as native ULAs. The local-use NAT64 range is reported private as a whole rather than by its embedded IPv4 address: an operator may carve a prefix of any RFC 6052 length out of `64:ff9b:1::/48`, so the same bits decode to different IPv4 addresses under different deployments and no single decoding is correct. Use toAddress4Nat64 with the deployment's prefix to decode one. [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1435)
-- `isCGNAT(): boolean` — Returns true if the address is an IPv4-mapped / NAT64 address whose embedded IPv4 address is in the carrier-grade NAT range `100.64.0.0/10` ([RFC 6598](https://datatracker.ietf.org/doc/html/rfc6598)), false otherwise. There is no native IPv6 CGNAT range, so this only ever returns true for an embedded IPv4 address (e.g. `::ffff:100.64.0.1`). [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1452)
-- `isBroadcast(): boolean` — Returns true if the address is an IPv4-mapped / NAT64 address whose embedded IPv4 address is the limited broadcast address `255.255.255.255` ([RFC 919](https://datatracker.ietf.org/doc/html/rfc919)), false otherwise. There is no IPv6 broadcast, so this only ever returns true for an embedded IPv4 address (e.g. `::ffff:255.255.255.255`). [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1469)
-- `isUnspecified(): boolean` — Returns true if the address is the unspecified address `::`. [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1482)
-- `isDocumentation(): boolean` — Returns true if the address is in the documentation prefix `2001:db8::/32` ([RFC 3849](https://datatracker.ietf.org/doc/html/rfc3849)). [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1495)
-- `isBenchmarking(): boolean` — Returns true if the address is in the benchmarking range `2001:2::/48` ([RFC 5180](https://datatracker.ietf.org/doc/html/rfc5180)) or is an IPv4-mapped / NAT64 address whose embedded IPv4 address is in `198.18.0.0/15`, false otherwise. [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1506)
-- `isGlobal(): boolean` — Returns true if the address is globally reachable: inside the global unicast allocation `2000::/3` (the only range the [IANA IPv6 Address Space Registry](https://www.iana.org/assignments/ipv6-address-space/) assigns for global unicast; everything else is reserved, ULA, link-local, or multicast) and not in any block the [IANA IPv6 Special-Purpose Address Registry](https://www.iana.org/assignments/iana-ipv6-special-registry/) marks as not globally reachable. An IPv4-mapped or NAT64 well-known address answers for its embedded IPv4 address, so `::ffff:10.0.0.1` and `64:ff9b::7f00:1` are not global. Teredo (`2001::/32`) and 6to4 (`2002::/16`) are not global either: the registry lists them as N/A and a packet to one needs a relay. This covers everything the individual classifiers name and the blocks they do not: the discard-only prefix `100::/64`, the IETF protocol assignments in `2001::/23`, the deprecated site-local `fec0::/10` and IPv4-compatible `::/96` ranges, and unallocated space such as `4000::/3`. It is the single predicate to use where a request must not reach an internal or special-purpose destination; see SECURITY.md. [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1535)
-- `href(optionalPort?: string | number): string` — Returns the address as an HTTP URL with the host bracketed, e.g. `http://[2001:db8::1]/`. If `optionalPort` is provided it is appended, e.g. `http://[2001:db8::1]:8080/`. [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1554)
-- `link(options?: { className?: string; prefix?: string; v4?: boolean }): string` — Returns an HTML `<a>` element whose `href` encodes the address in a URL hash fragment (default prefix `/#address=`). Useful for linking between pages of an address-inspector UI. [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1572)
-- `group(): string` — Groups an address. Returns an HTML fragment: each group is wrapped in a `<span>` carrying the group classes an address-inspector UI hovers on. The address content is HTML-escaped; anything you concatenate around it is your responsibility. [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1617)
-- `regularExpressionString(substringSearch?: boolean): string` — Generate a regular expression string that can be used to find or validate all variations of this address [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1669)
-- `regularExpression(substringSearch?: boolean): RegExp` — Generate a regular expression that can be used to find or validate all variations of this address. [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1723)
+- `canonicalForm(): string` — Returns the canonical (fully expanded) form of the address: all 8 groups, each padded to 4 hex digits, with no `::` collapsing (e.g. `2001:0db8:0000:0000:0000:0000:0000:0001`). Useful for sorting and byte-exact comparison. [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L937)
+- `decimal(): string` — Return the decimal form of the address [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L945)
+- `bigInt(): bigint` — Return the address as a BigInt [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L953)
+- `to4(): Address4` — Return the last two groups of this address as an IPv4 address string. If this address carries a CIDR prefix that covers the trailing 32 bits (i.e. `subnetMask >= 96`), the resulting `Address4` inherits the corresponding v4 prefix (`subnetMask - 96`); otherwise it defaults to `/32`. [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L968)
+- `to4in6(): string` — Return the v4-in-v6 form of the address [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L992)
+- `inspectTeredo(): TeredoProperties` — Decodes the Teredo tunneling fields embedded in this address. Returns the Teredo prefix, server IPv4, client IPv4, raw flag bits, cone-NAT flag, UDP port, and Microsoft-format flag breakdown (reserved, universal/local, group/individual, nonce). Only meaningful for addresses in `2001::/32`. [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1013)
+- `inspect6to4(): SixToFourProperties` — Decodes the 6to4 tunneling fields embedded in this address. Returns the 6to4 prefix and the embedded IPv4 gateway address. Only meaningful for addresses in `2002::/16`. [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1076)
+- `to6to4(): Address6 | null` — Return a v6 6to4 address from a v6 v4inv6 address [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1096)
+- `toAddress4Nat64(prefix?: string): Address4 | null` — Extract the embedded IPv4 address from a NAT64 IPv6 address using the encoding defined by [RFC 6052](https://datatracker.ietf.org/doc/html/rfc6052). The default prefix is the well-known prefix `64:ff9b::/96`. Returns `null` if this address is not contained within the given prefix. [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1165)
+- `toByteArray(): number[]` — Return a byte array. To get a Node.js `Buffer`, wrap the result: `Buffer.from(address.toByteArray())`. [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1200)
+- `toUnsignedByteArray(): number[]` — Return an unsigned byte array. To get a Node.js `Buffer`, wrap the result: `Buffer.from(address.toUnsignedByteArray())`. [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1219)
+- `isCanonical(): boolean` — Returns true if the address is in the canonical form, false otherwise [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1301)
+- `isLinkLocal(): boolean` — Returns true if the address is a link-local unicast address in `fe80::/10` ([RFC 4291 §2.4](https://datatracker.ietf.org/doc/html/rfc4291#section-2.4)) or an IPv4-mapped / NAT64 address whose embedded IPv4 address is link-local (`169.254.0.0/16`, e.g. `::ffff:169.254.169.254`), false otherwise. [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1312)
+- `isMulticast(): boolean` — Returns true if the address is a multicast address, false otherwise [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1325)
+- `is4(): boolean` — Returns true if the address was written in v4-in-v6 dotted-quad notation (e.g. `::ffff:127.0.0.1`), false otherwise. This is a notation-level flag and does not reflect whether the address bits lie in the IPv4-mapped (`::ffff:0:0/96`) subnet — for that, see isMapped4. [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1342)
+- `isMapped4(): boolean` — Returns true if the address is an IPv4-mapped IPv6 address in `::ffff:0:0/96` ([RFC 4291 §2.5.5.2](https://datatracker.ietf.org/doc/html/rfc4291#section-2.5.5.2)), false otherwise. Unlike is4, this checks the underlying address bits rather than the textual notation, so `::ffff:127.0.0.1` and `::ffff:7f00:1` both return true. [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1354)
+- `embeddedIPv4(): Address4 | null` — If this address embeds a routable IPv4 address — i.e. it is IPv4-mapped (`::ffff:0:0/96`) or sits in the NAT64 well-known prefix (`64:ff9b::/96`, [RFC 6052](https://datatracker.ietf.org/doc/html/rfc6052)) — return that embedded address as an Address4; otherwise return null. The special-property checks (`isLoopback`, `isLinkLocal`, `isMulticast`, `isUnspecified`, `isPrivate`, `isCGNAT`, `isBroadcast`) call this first and delegate to the embedded Address4 when present, so a literal such as `::ffff:127.0.0.1` is classified by what it actually reaches (loopback) rather than by its IPv6 wrapper (which `getType()` reports as IPv4-mapped). This matters wherever the checks back a trust-boundary decision (e.g. an SSRF allow/deny filter): without normalization, `::ffff:10.0.0.1`, `::ffff:169.254.169.254`, `64:ff9b::7f00:1`, etc. would all read as non-internal. [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1375)
+- `isTeredo(): boolean` — Returns true if the address is a Teredo address, false otherwise [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1387)
+- `is6to4(): boolean` — Returns true if the address is a 6to4 address, false otherwise [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1395)
+- `isLoopback(): boolean` — Returns true if the address is a loopback address, false otherwise [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1403)
+- `isULA(): boolean` — Returns true if the address is a Unique Local Address in `fc00::/7` ([RFC 4193](https://datatracker.ietf.org/doc/html/rfc4193)). ULAs are the IPv6 equivalent of IPv4 [RFC 1918](https://datatracker.ietf.org/doc/html/rfc1918) private addresses. [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1416)
+- `isPrivate(): boolean` — Returns true if the address is private, i.e. a Unique Local Address in `fc00::/7` ([RFC 4193](https://datatracker.ietf.org/doc/html/rfc4193)), an address in the NAT64 local-use range `64:ff9b:1::/48` ([RFC 8215](https://datatracker.ietf.org/doc/html/rfc8215)), or an IPv4-mapped / NAT64 well-known address whose embedded IPv4 address is in one of the [RFC 1918](https://datatracker.ietf.org/doc/html/rfc1918) private ranges (e.g. `::ffff:10.0.0.1`). This is the IPv6 counterpart to Address4.isPrivate; use it instead of isULA when you need to catch mapped RFC 1918 addresses as well as native ULAs. The local-use NAT64 range is reported private as a whole rather than by its embedded IPv4 address: an operator may carve a prefix of any RFC 6052 length out of `64:ff9b:1::/48`, so the same bits decode to different IPv4 addresses under different deployments and no single decoding is correct. Use toAddress4Nat64 with the deployment's prefix to decode one. [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1438)
+- `isCGNAT(): boolean` — Returns true if the address is an IPv4-mapped / NAT64 address whose embedded IPv4 address is in the carrier-grade NAT range `100.64.0.0/10` ([RFC 6598](https://datatracker.ietf.org/doc/html/rfc6598)), false otherwise. There is no native IPv6 CGNAT range, so this only ever returns true for an embedded IPv4 address (e.g. `::ffff:100.64.0.1`). [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1455)
+- `isBroadcast(): boolean` — Returns true if the address is an IPv4-mapped / NAT64 address whose embedded IPv4 address is the limited broadcast address `255.255.255.255` ([RFC 919](https://datatracker.ietf.org/doc/html/rfc919)), false otherwise. There is no IPv6 broadcast, so this only ever returns true for an embedded IPv4 address (e.g. `::ffff:255.255.255.255`). [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1472)
+- `isUnspecified(): boolean` — Returns true if the address is the unspecified address `::`. [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1485)
+- `isDocumentation(): boolean` — Returns true if the address is in the documentation prefix `2001:db8::/32` ([RFC 3849](https://datatracker.ietf.org/doc/html/rfc3849)). [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1498)
+- `isBenchmarking(): boolean` — Returns true if the address is in the benchmarking range `2001:2::/48` ([RFC 5180](https://datatracker.ietf.org/doc/html/rfc5180)) or is an IPv4-mapped / NAT64 address whose embedded IPv4 address is in `198.18.0.0/15`, false otherwise. [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1509)
+- `isGlobal(): boolean` — Returns true if the address is globally reachable: inside the global unicast allocation `2000::/3` (the only range the [IANA IPv6 Address Space Registry](https://www.iana.org/assignments/ipv6-address-space/) assigns for global unicast; everything else is reserved, ULA, link-local, or multicast) and not in any block the [IANA IPv6 Special-Purpose Address Registry](https://www.iana.org/assignments/iana-ipv6-special-registry/) marks as not globally reachable. An IPv4-mapped or NAT64 well-known address answers for its embedded IPv4 address, so `::ffff:10.0.0.1` and `64:ff9b::7f00:1` are not global. Teredo (`2001::/32`) and 6to4 (`2002::/16`) are not global either: the registry lists them as N/A and a packet to one needs a relay. This covers everything the individual classifiers name and the blocks they do not: the discard-only prefix `100::/64`, the IETF protocol assignments in `2001::/23`, the deprecated site-local `fec0::/10` and IPv4-compatible `::/96` ranges, and unallocated space such as `4000::/3`. It is the single predicate to use where a request must not reach an internal or special-purpose destination; see SECURITY.md. [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1538)
+- `href(optionalPort?: string | number): string` — Returns the address as an HTTP URL with the host bracketed, e.g. `http://[2001:db8::1]/`. If `optionalPort` is provided it is appended, e.g. `http://[2001:db8::1]:8080/`. [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1557)
+- `link(options?: { className?: string; prefix?: string; v4?: boolean }): string` — Returns an HTML `<a>` element whose `href` encodes the address in a URL hash fragment (default prefix `/#address=`). Useful for linking between pages of an address-inspector UI. [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1575)
+- `group(): string` — Groups an address. Returns an HTML fragment: each group is wrapped in a `<span>` carrying the group classes an address-inspector UI hovers on. The address content is HTML-escaped; anything you concatenate around it is your responsibility. [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1620)
+- `regularExpressionString(substringSearch?: boolean): string` — Generate a regular expression string that can be used to find or validate all variations of this address [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1672)
+- `regularExpression(substringSearch?: boolean): RegExp` — Generate a regular expression that can be used to find or validate all variations of this address. [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1726)
 
 **Properties**
 
@@ -265,9 +265,9 @@ A few terms used throughout the API can be confusing if you haven't worked deepl
 - `subnetMask: number` — [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L108)
 - `v4: boolean` — [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L109)
 - `zone: string` — [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L110)
-- `isInSubnet: (address: Address4 | Address6) => boolean` — Returns true if the given address is in the subnet of the current address. An `Address4` is never in the subnet of an `Address6`; convert with `Address6.fromAddress4()` or `to4()` to compare across families. [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1274)
-- `isHostInSubnet: (address: Address4 | Address6) => boolean` — Returns true if this address's host bits fall inside the given subnet, ignoring this address's own subnet mask. Prefer this over `isInSubnet` when classifying a single address, so the answer doesn't change with the CIDR suffix the caller happened to write — notably when the address came from untrusted input and the result backs a trust-boundary decision. An `Address4` is never in the subnet of an `Address6`; convert with `Address6.fromAddress4()` or `to4()` to compare across families. [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1286)
-- `isCorrect: () => boolean` — Returns true if the address is correct, false otherwise [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1292)
+- `isInSubnet: (address: Address4 | Address6) => boolean` — Returns true if the given address is in the subnet of the current address. An `Address4` is never in the subnet of an `Address6`; convert with `Address6.fromAddress4()` or `to4()` to compare across families. [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1277)
+- `isHostInSubnet: (address: Address4 | Address6) => boolean` — Returns true if this address's host bits fall inside the given subnet, ignoring this address's own subnet mask. Prefer this over `isInSubnet` when classifying a single address, so the answer doesn't change with the CIDR suffix the caller happened to write — notably when the address came from untrusted input and the result backs a trust-boundary decision. An `Address4` is never in the subnet of an `Address6`; convert with `Address6.fromAddress4()` or `to4()` to compare across families. [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1289)
+- `isCorrect: () => boolean` — Returns true if the address is correct, false otherwise [src](https://github.com/beaugunderson/ip-address/blob/main/src/ipv6.ts#L1295)
 
 </details>
 

package/node_modules/@modelcontextprotocol/sdk/node_modules/express-rate-limit/node_modules/ip-address/dist/ipv6.js

@@ -733,7 +733,7 @@ class Address6 {
         address = this.parse4in6(address);
         const badCharacters = address.match(constants6.RE_BAD_CHARACTERS);
         if (badCharacters) {
-            throw new address_error_1.AddressError(`Bad character${badCharacters.length > 1 ? 's' : ''} detected in address: ${badCharacters.join('')}`, address.replace(constants6.RE_BAD_CHARACTERS, '<span class="parse-error">$1</span>'));
+            throw new address_error_1.AddressError(`Bad character${badCharacters.length > 1 ? 's' : ''} detected in address: ${badCharacters.join('')}`, address.replace(constants6.RE_BAD_CHARACTERS, (character) => `<span class="parse-error">${helpers.escapeHtml(character)}</span>`));
         }
         const badAddress = address.match(constants6.RE_BAD_ADDRESS);
         if (badAddress) {

package/node_modules/@modelcontextprotocol/sdk/node_modules/express-rate-limit/node_modules/ip-address/package.json

@@ -16,7 +16,7 @@
     "bigint",
     "browser"
   ],
-  "version": "10.7.5",
+  "version": "10.7.6",
   "author": "Beau Gunderson <beau@beaugunderson.com> (https://beaugunderson.com/)",
   "license": "MIT",
   "main": "dist/ip-address.js",

package/node_modules/@modelcontextprotocol/sdk/node_modules/express-rate-limit/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "express-rate-limit",
-	"version": "8.7.2",
+	"version": "8.7.3",
 	"description": "Basic IP rate-limiting middleware for Express. Use to limit repeated requests to public APIs and/or endpoints such as password reset.",
 	"author": {
 		"name": "Nathan Friedly",

package/node_modules/@weavecode/cli/dist/cli.js

@@ -1,4 +1,4 @@
-import{CommandParser as p}from"./parser.js";import{initCommand as f}from"./commands/init.js";import{statusCommand as g}from"./commands/status.js";import{daemonCommand as h}from"./commands/daemon.js";import{dashboardCommand as u}from"./commands/dashboard.js";import{scanCommand as C}from"./commands/scan.js";import{chpassCommand as b}from"./commands/chpass.js";import{doctorCommand as x}from"./commands/doctor.js";import{uninstallCommand as $}from"./commands/uninstall.js";import{initCliLocale as E,t as e}from"./i18n/index.js";import{WEAVE_VERSION as S}from"@weavecode/server";const w=process.emitWarning.bind(process);process.emitWarning=(n,...r)=>{if(!(typeof n=="string"?n:String(n)).includes("SQLite is an experimental feature"))return w(n,...r)};const l=()=>S;function v(n){if(n.description){console.log(`  ${n.name.padEnd(12)}${e(n.description)}`);for(const r of n.subcommands??[]){const o=[r.name,...r.aliases??[]].join(", "),s=r.description?e(r.description):"";console.log(`    ${o.padEnd(12)}${s}`)}}}function a(n){const r=l();console.log(`${e("help.tagline",{version:r})}
-`),console.log(`${e("help.usage")}
-`),console.log(e("help.commands"));for(const o of n.getAllCommands())v(o);console.log(`
-${e("help.globalOptions")}`);for(const o of n.getGlobalOptions()){const s=o.short?`-${o.short}, --${o.name}`:`    --${o.name}`;console.log(`  ${s.padEnd(20)}${e(o.description)}`)}}function L(n){console.error(e("help.subcommands"));for(const r of n.subcommands??[]){const o=[r.name,...r.aliases??[]].join(", "),s=r.description?e(r.description):"";console.error(`  ${o.padEnd(12)}${s}`)}}export class CLI{parser;constructor(){this.parser=new p,this.registerCommands()}registerCommands(){this.parser.registerCommand(f),this.parser.registerCommand($),this.parser.registerCommand(g),this.parser.registerCommand(h),this.parser.registerCommand(u),this.parser.registerCommand(C),this.parser.registerCommand(b),this.parser.registerCommand(x)}async run(r=process.argv.slice(2)){delete process.env.CLAUDE_CODE_CHILD_SESSION,await E();const o=this.parser.parse(r);if(o.flags.version){console.log(l());return}if(o.flags.help||o.command.length===0){a(this.parser);return}let s;for(const t of o.command)s=(s?s.subcommands?.find(c=>c.name===t||c.aliases?.includes(t)):this.parser.getCommand(t))??s;if(!s?.action){if(s?.subcommands?.length){const t=o.positional[0];console.error(t?e("cli.unknownSubcommand",{command:s.name,subcommand:t}):e("cli.missingSubcommand",{command:s.name})),L(s),process.exit(1)}console.error(e("cli.unknownCommand",{command:o.command.join(" ")})),a(this.parser),process.exit(1)}const i=s.maxPositionals??0;if(o.positional.length>i){const t=o.command.join(" ");console.error(e("cli.unexpectedPositional",{command:t,arg:o.positional[i]})),a(this.parser),process.exit(1)}const m=this.parser.validateFlags(o.flags,s);if(m.length>0){for(const t of m)console.error(e("cli.error",{error:t}));process.exit(1)}const d={commandPath:o.command,flags:o.flags,positional:o.positional,raw:o.raw};await s.action(d)}}
+import{CommandParser as p}from"./parser.js";import{initCommand as f}from"./commands/init.js";import{statusCommand as g}from"./commands/status.js";import{daemonCommand as h}from"./commands/daemon.js";import{dashboardCommand as C}from"./commands/dashboard.js";import{scanCommand as u}from"./commands/scan.js";import{chpassCommand as $}from"./commands/chpass.js";import{doctorCommand as b}from"./commands/doctor.js";import{uninstallCommand as E}from"./commands/uninstall.js";import{initCliLocale as x,t as a}from"./i18n/index.js";import{WEAVE_VERSION as S}from"@weavecode/server";const w=process.emitWarning.bind(process);process.emitWarning=(n,...r)=>{if(!(typeof n=="string"?n:String(n)).includes("SQLite is an experimental feature"))return w(n,...r)};const l=()=>S;function v(n){if(n.description){console.log(`  ${n.name.padEnd(12)}${a(n.description)}`);for(const r of n.subcommands??[]){const o=[r.name,...r.aliases??[]].join(", "),s=r.description?a(r.description):"";console.log(`    ${o.padEnd(12)}${s}`)}}}function i(n){const r=l();console.log(`${a("help.tagline",{version:r})}
+`),console.log(`${a("help.usage")}
+`),console.log(a("help.commands"));for(const o of n.getAllCommands())v(o);console.log(`
+${a("help.globalOptions")}`);for(const o of n.getGlobalOptions()){const s=o.short?`-${o.short}, --${o.name}`:`    --${o.name}`;console.log(`  ${s.padEnd(20)}${a(o.description)}`)}}function L(n){console.error(a("help.subcommands"));for(const r of n.subcommands??[]){const o=[r.name,...r.aliases??[]].join(", "),s=r.description?a(r.description):"";console.error(`  ${o.padEnd(12)}${s}`)}}export class CLI{parser;constructor(){this.parser=new p,this.registerCommands()}registerCommands(){this.parser.registerCommand(f),this.parser.registerCommand(E),this.parser.registerCommand(g),this.parser.registerCommand(h),this.parser.registerCommand(C),this.parser.registerCommand(u),this.parser.registerCommand($),this.parser.registerCommand(b)}async run(r=process.argv.slice(2)){delete process.env.CLAUDE_CODE_CHILD_SESSION,await x();const o=this.parser.parse(r);if(o.flags.version){console.log(l());return}if(o.flags.help||o.command.length===0){i(this.parser);return}let s;for(const e of o.command)s=(s?s.subcommands?.find(c=>c.name===e||c.aliases?.includes(e)):this.parser.getCommand(e))??s;if(!s?.action){if(s?.subcommands?.length){const e=o.positional[0];console.error(e?a("cli.unknownSubcommand",{command:s.name,subcommand:e}):a("cli.missingSubcommand",{command:s.name})),L(s),process.exit(1)}console.error(a("cli.unknownCommand",{command:o.command.join(" ")})),i(this.parser),process.exit(1)}const m=s.maxPositionals??0;if(o.positional.length>m){const e=o.command.join(" ");console.error(a("cli.unexpectedPositional",{command:e,arg:o.positional[m]})),i(this.parser),process.exit(1)}const t=this.parser.validateFlags(o.flags,s);if(t.length>0){for(const e of t)console.error(a("cli.error",{error:e}));process.exit(1)}const d={commandPath:o.command,flags:o.flags,positional:o.positional,raw:o.raw};await s.action(d)}}

package/node_modules/@weavecode/cli/dist/commands/chpass.js

@@ -1 +1 @@
-import{DAEMON_HOST as c}from"@weavecode/server";import{logger as s}from"@weavecode/core";import{t as r}from"../i18n/index.js";import{ensureDaemonRunning as i}from"./daemon.js";import{localTokenHeader as p}from"./daemon-auth.js";const m=6;async function h(n){const t=n.positional[0];if(typeof t!="string"||t.length<m){s.warn(r("out.chpass.usage")),process.exitCode=1;return}const a=await i();try{const o=await fetch(`http://${c}:${a.port}/auth/password`,{method:"PUT",headers:{"content-type":"application/json",...p()},body:JSON.stringify({next:t})}),e=await o.json().catch(()=>({}));if(!o.ok)throw new Error(typeof e.error=="string"?e.error:`HTTP ${o.status}`);s.success(r("out.chpass.ok"))}catch(o){s.warn(r("out.chpass.fail",{error:o instanceof Error?o.message:String(o)})),process.exitCode=1}}export const chpassCommand={name:"chpass",description:"cmd.chpass.desc",action:h,maxPositionals:1};
+import{DAEMON_HOST as c}from"@weavecode/server";import{logger as s}from"@weavecode/core";import{t as r}from"../i18n/index.js";import{ensureDaemonRunning as i}from"./daemon.js";import{localTokenHeader as p}from"./daemon-auth.js";const m=6;async function h(n){const t=n.positional[0];if(typeof t!="string"||t.length<m){s.warn(r("out.chpass.usage")),process.exitCode=1;return}const e=await i();try{const o=await fetch(`http://${c}:${e.port}/auth/password`,{method:"PUT",headers:{"content-type":"application/json",...p()},body:JSON.stringify({next:t})}),a=await o.json().catch(()=>({}));if(!o.ok)throw new Error(typeof a.error=="string"?a.error:`HTTP ${o.status}`);s.success(r("out.chpass.ok"))}catch(o){s.warn(r("out.chpass.fail",{error:o instanceof Error?o.message:String(o)})),process.exitCode=1}}export const chpassCommand={name:"chpass",description:"cmd.chpass.desc",action:h,maxPositionals:1};

package/node_modules/@weavecode/cli/dist/commands/daemon-auth.js

@@ -1 +1 @@
-import{existsSync as e,readFileSync as o,rmSync as n}from"node:fs";import{getAuthPath as a,getInitialPasswordPath as i}from"@weavecode/server";import{logger as c}from"@weavecode/core";import{t as l}from"../i18n/index.js";export function localTokenHeader(){try{const t=JSON.parse(o(a(),"utf8"));return typeof t.localToken=="string"&&t.localToken?{"x-weave-local":t.localToken}:{}}catch{return{}}}export function announceInitialPassword(){const t=i();if(!e(t))return;let r;try{r=o(t,"utf8").trim()}catch{return}n(t,{force:!0}),r&&c.info(l("out.dash.initialPassword",{password:r}))}
+import{existsSync as a,readFileSync as r,rmSync as e}from"node:fs";import{getAuthPath as n,getInitialPasswordPath as s}from"@weavecode/server";import{logger as i}from"@weavecode/core";import{t as c}from"../i18n/index.js";export function localTokenHeader(){try{const t=JSON.parse(r(n(),"utf8"));return typeof t.localToken=="string"&&t.localToken?{"x-weave-local":t.localToken}:{}}catch{return{}}}export function announceInitialPassword(){const t=s();if(!a(t))return;let o;try{o=r(t,"utf8").trim()}catch{return}e(t,{force:!0}),o&&i.info(c("out.dash.initialPassword",{password:o}))}

package/node_modules/@weavecode/cli/dist/commands/daemon.js

@@ -1,2 +1,2 @@
-import{spawn as f}from"node:child_process";import{DEFAULT_PORT as c,DAEMON_HOST as u,isPortFree as h,findFreePort as y,readDaemonState as p,writeDaemonState as $,clearDaemonState as g,resolveDaemonEntry as D,accessUrls as P}from"@weavecode/server";import{logger as a}from"@weavecode/core";import{t as r}from"../i18n/index.js";export async function probeDaemon(t){try{const e=await fetch(`http://${u}:${t}/health`);return e.ok?(await e.json()).service==="weave-daemon":!1}catch{return!1}}export async function waitForDaemon(t,e=1e4){const o=Date.now()+e;for(;!await probeDaemon(t);){if(Date.now()>=o)return!1;await new Promise(n=>setTimeout(n,100))}return!0}async function x(t,e){if(process.platform!=="win32")return!1;const o=i=>/\s/.test(i)?`"${i}"`:i,n=i=>`'${i.replace(/'/g,"''")}'`,s=`$ErrorActionPreference='Stop';$su=[wmiclass]'Win32_ProcessStartup';$psi=$su.CreateInstance();$psi.ShowWindow=0;$proc=[wmiclass]'Win32_Process';$r=$proc.Create(${n([t,...e].map(o).join(" "))},${n(process.cwd())},$psi);if($r.ReturnValue -ne 0){exit 1}`,d=Buffer.from(s,"utf16le").toString("base64");return new Promise(i=>{const m=f("powershell.exe",["-NoProfile","-NonInteractive","-EncodedCommand",d],{windowsHide:!0,stdio:"ignore"});m.on("error",()=>i(!1)),m.on("exit",w=>i(w===0))})}export async function ensureDaemonRunning(){const t=p();if(t&&await probeDaemon(t.port))return{port:t.port,started:!1,ready:!0};if(await probeDaemon(c))return{port:c,started:!1,ready:!0};const e=await h(c)?c:await y(c+1);$({pid:0,port:e,startedAt:new Date().toISOString()});const o=D(),n=o.isTs?["--import","tsx",o.path]:[o.path];await x(process.execPath,n)||f(process.execPath,n,{detached:!0,stdio:"ignore"}).unref();const s=await waitForDaemon(e);return{port:e,started:!0,ready:s}}async function S(){const t=await ensureDaemonRunning();if(!t.started){a.info(r("out.daemon.alreadyRunning",{port:t.port}));return}t.ready?a.success(r("out.daemon.started",{host:u,port:t.port})):a.warn(r("out.daemon.startUnconfirmed",{port:t.port}))}async function l(t){return await(await fetch(`http://${u}:${t}/health`)).json()}async function A(){const t=p(),e=t?.port??c;let o=t?.pid;if(await probeDaemon(e))o=(await l(e)).pid;else if(!t){a.info(r("out.daemon.statusNotRunning"));return}let n;if(o)try{process.kill(o),n=o}catch{}g(),n!==void 0?(await R(n,e),a.success(r("out.daemon.stopped",{pid:n}))):a.warn(r("out.daemon.statusStale",{pid:o??0,port:e}))}async function R(t,e,o=5e3){const n=Date.now()+o;for(;;){let s;try{process.kill(t,0),s=!0}catch{s=!1}if(!s&&!await probeDaemon(e)||Date.now()>=n)return;await new Promise(d=>setTimeout(d,100))}}async function T(){const t=p(),e=t?.port??c;if(await probeDaemon(e)){const o=await l(e);a.info(r("out.daemon.statusRunning",{pid:o.pid,port:o.port,uptime:Math.round(o.uptimeMs/1e3)}));const n=P(e,t?.tlsPort??0);n.length>0&&(a.dim(r("out.daemon.urlsTitle")),a.dim(n.map(s=>`  ${s.url}`).join(`
-`)))}else t?a.warn(r("out.daemon.statusStale",{pid:t.pid,port:t.port})):a.info(r("out.daemon.statusNotRunning"))}export const daemonCommand={name:"daemon",description:"cmd.daemon.desc",subcommands:[{name:"start",description:"cmd.daemon.start.desc",action:S},{name:"stop",description:"cmd.daemon.stop.desc",action:A},{name:"status",description:"cmd.daemon.status.desc",action:T}]};
+import{spawn as w}from"node:child_process";import{DEFAULT_PORT as c,DAEMON_HOST as d,isPortFree as h,findFreePort as y,readDaemonState as u,writeDaemonState as $,clearDaemonState as g,resolveDaemonEntry as D,accessUrls as P}from"@weavecode/server";import{logger as n}from"@weavecode/core";import{localTokenHeader as S}from"./daemon-auth.js";import{t as r}from"../i18n/index.js";export async function probeDaemon(t){try{const e=await fetch(`http://${d}:${t}/health`);return e.ok?(await e.json()).service==="weave-daemon":!1}catch{return!1}}export async function waitForDaemon(t,e=1e4){const o=Date.now()+e;for(;!await probeDaemon(t);){if(Date.now()>=o)return!1;await new Promise(a=>setTimeout(a,100))}return!0}async function x(t,e){if(process.platform!=="win32")return!1;const o=i=>/\s/.test(i)?`"${i}"`:i,a=i=>`'${i.replace(/'/g,"''")}'`,s=`$ErrorActionPreference='Stop';$su=[wmiclass]'Win32_ProcessStartup';$psi=$su.CreateInstance();$psi.ShowWindow=0;$proc=[wmiclass]'Win32_Process';$r=$proc.Create(${a([t,...e].map(o).join(" "))},${a(process.cwd())},$psi);if($r.ReturnValue -ne 0){exit 1}`,p=Buffer.from(s,"utf16le").toString("base64");return new Promise(i=>{const m=w("powershell.exe",["-NoProfile","-NonInteractive","-EncodedCommand",p],{windowsHide:!0,stdio:"ignore"});m.on("error",()=>i(!1)),m.on("exit",l=>i(l===0))})}export async function ensureDaemonRunning(){const t=u();if(t&&await probeDaemon(t.port))return{port:t.port,started:!1,ready:!0};if(await probeDaemon(c))return{port:c,started:!1,ready:!0};const e=await h(c)?c:await y(c+1);$({pid:0,port:e,startedAt:new Date().toISOString()});const o=D(),a=o.isTs?["--import","tsx",o.path]:[o.path];await x(process.execPath,a)||w(process.execPath,a,{detached:!0,stdio:"ignore"}).unref();const s=await waitForDaemon(e);return{port:e,started:!0,ready:s}}async function T(){const t=await ensureDaemonRunning();if(!t.started){n.info(r("out.daemon.alreadyRunning",{port:t.port}));return}t.ready?n.success(r("out.daemon.started",{host:d,port:t.port})):n.warn(r("out.daemon.startUnconfirmed",{port:t.port}))}async function f(t){return await(await fetch(`http://${d}:${t}/health`)).json()}async function R(t){const e=S();if(!e["x-weave-local"])return!1;const o=new AbortController,a=setTimeout(()=>o.abort(),2e3);try{return(await fetch(`http://${d}:${t}/daemon/shutdown`,{method:"POST",headers:e,signal:o.signal})).ok}catch{return!1}finally{clearTimeout(a)}}async function v(){const t=u(),e=t?.port??c;let o=t?.pid;if(await probeDaemon(e))o=(await f(e)).pid;else if(!t){n.info(r("out.daemon.statusNotRunning"));return}let a;if(o)if(await R(e))a=o;else try{process.kill(o),a=o}catch{}g(),a!==void 0?(await b(a,e),n.success(r("out.daemon.stopped",{pid:a}))):n.warn(r("out.daemon.statusStale",{pid:o??0,port:e}))}async function b(t,e,o=5e3){const a=Date.now()+o;for(;;){let s;try{process.kill(t,0),s=!0}catch{s=!1}if(!s&&!await probeDaemon(e)||Date.now()>=a)return;await new Promise(p=>setTimeout(p,100))}}async function A(){const t=u(),e=t?.port??c;if(await probeDaemon(e)){const o=await f(e);n.info(r("out.daemon.statusRunning",{pid:o.pid,port:o.port,uptime:Math.round(o.uptimeMs/1e3)}));const a=P(e,t?.tlsPort??0);a.length>0&&(n.dim(r("out.daemon.urlsTitle")),n.dim(a.map(s=>`  ${s.url}`).join(`
+`)))}else t?n.warn(r("out.daemon.statusStale",{pid:t.pid,port:t.port})):n.info(r("out.daemon.statusNotRunning"))}export const daemonCommand={name:"daemon",description:"cmd.daemon.desc",subcommands:[{name:"start",description:"cmd.daemon.start.desc",action:T},{name:"stop",description:"cmd.daemon.stop.desc",action:v},{name:"status",description:"cmd.daemon.status.desc",action:A}]};

package/node_modules/@weavecode/cli/dist/commands/dashboard.js

@@ -1,2 +1,2 @@
-import{spawn as p}from"node:child_process";import{accessUrls as m,DAEMON_HOST as d,readDaemonState as c,resolveStaticDir as l}from"@weavecode/server";import{logger as o}from"@weavecode/core";import{t as n}from"../i18n/index.js";import{ensureDaemonRunning as u}from"./daemon.js";import{announceInitialPassword as f}from"./daemon-auth.js";export function openBrowser(r){const[e,t]=process.platform==="win32"?["cmd",["/c","start","",r]]:process.platform==="darwin"?["open",[r]]:["xdg-open",[r]],a=p(e,t,{detached:!0,stdio:"ignore"});a.on("error",()=>{o.dim(n("out.dash.browserFailed"))}),a.unref()}export function dashboardUrl(r){return`http://${d}:${r}/`}async function h(r){const e=!!r.flags.noOpen,t=await u();t.started?t.ready?(o.success(n("out.daemon.started",{host:d,port:t.port})),o.dim(n("out.dash.stopHint"))):o.warn(n("out.daemon.startUnconfirmed",{port:t.port})):o.info(n("out.daemon.alreadyRunning",{port:t.port})),l()||(o.warn(n("out.dash.noBundle")),o.dim(n("out.dash.buildHint")));const a=dashboardUrl(t.port);o.info(n("out.dash.url",{url:a}));const s=m(t.port,c()?.tlsPort??0);if(s.length>0&&(o.dim(n("out.daemon.urlsTitle")),o.dim(s.map(i=>`  ${i.url}`).join(`
-`))),f(),e){o.dim(n("out.dash.noOpen"));return}openBrowser(a)}export const dashboardCommand={name:"dashboard",aliases:["dash"],description:"cmd.dashboard.desc",options:[{name:"no-open",description:"flag.dashboard.noOpen",type:"boolean",default:!1}],action:h};
+import{spawn as p}from"node:child_process";import{accessUrls as m,DAEMON_HOST as d,readDaemonState as u,resolveStaticDir as c}from"@weavecode/server";import{logger as o}from"@weavecode/core";import{t as r}from"../i18n/index.js";import{ensureDaemonRunning as l}from"./daemon.js";import{announceInitialPassword as f}from"./daemon-auth.js";export function openBrowser(a){const[s,t]=process.platform==="win32"?["cmd",["/c","start","",a]]:process.platform==="darwin"?["open",[a]]:["xdg-open",[a]],n=p(s,t,{detached:!0,stdio:"ignore"});n.on("error",()=>{o.dim(r("out.dash.browserFailed"))}),n.unref()}export function dashboardUrl(a){return`http://${d}:${a}/`}async function h(a){const s=!!a.flags.noOpen,t=await l();t.started?t.ready?(o.success(r("out.daemon.started",{host:d,port:t.port})),o.dim(r("out.dash.stopHint"))):o.warn(r("out.daemon.startUnconfirmed",{port:t.port})):o.info(r("out.daemon.alreadyRunning",{port:t.port})),c()||(o.warn(r("out.dash.noBundle")),o.dim(r("out.dash.buildHint")));const n=dashboardUrl(t.port);o.info(r("out.dash.url",{url:n}));const e=m(t.port,u()?.tlsPort??0);if(e.length>0&&(o.dim(r("out.daemon.urlsTitle")),o.dim(e.map(i=>`  ${i.url}`).join(`
+`))),f(),s){o.dim(r("out.dash.noOpen"));return}openBrowser(n)}export const dashboardCommand={name:"dashboard",aliases:["dash"],description:"cmd.dashboard.desc",options:[{name:"no-open",description:"flag.dashboard.noOpen",type:"boolean",default:!1}],action:h};

package/node_modules/@weavecode/cli/dist/commands/doctor.js

@@ -1 +1 @@
-import{existsSync as m,readFileSync as w}from"node:fs";import l from"node:path";import{DAEMON_HOST as S,DEFAULT_PORT as x,getDbPath as y,ensureDataLayout as T,openDatabase as N,ProjectRepository as b,readDaemonState as P}from"@weavecode/server";import{formatTable as p,logger as r}from"@weavecode/core";import{checkHarness as E}from"../init/harness-checks.js";import{probeDaemon as D}from"./daemon.js";import{localTokenHeader as C}from"./daemon-auth.js";import{t as o}from"../i18n/index.js";const q={"no-mechanism":"out.doctor.reason.noMechanism","no-credentials":"out.doctor.reason.noCredentials","auth-token-required":"out.doctor.reason.authTokenRequired","no-peer-name":"out.doctor.reason.noPeerName","no-backend":"out.doctor.reason.noBackend","no-pane-env":"out.doctor.reason.noPaneEnv","pane-env-conflict":"out.doctor.reason.paneEnvConflict"},R={"no-hook-script":"out.doctor.hint.noHookScript","hook-script-not-weave":"out.doctor.hint.hookScriptNotWeave","hook-script-stale":"out.doctor.hint.hookScriptStale","no-events":"out.doctor.hint.noEvents","no-inbox-credentials":"out.doctor.hint.noInboxCredentials","inbox-token-required":"out.doctor.hint.inboxTokenRequired","no-peer-name":"out.doctor.hint.noPeerName","terminal-no-backend":"out.doctor.hint.terminalNoBackend","terminal-no-pane-env":"out.doctor.hint.terminalNoPaneEnv","terminal-pane-env-conflict":"out.doctor.hint.terminalPaneEnvConflict","not-running":"out.doctor.hint.notRunning",queued:"out.doctor.hint.queued",stalled:"out.doctor.hint.stalled"};function k(n,e){if(!e)return"";const i=n[e];return i?o(i):e}function H(n){if(!n||!n.present)return o("out.doctor.diagScriptNone");const e=n.source==="user"?o("out.doctor.diagSourceUser"):n.source==="project"?o("out.doctor.diagSourceProject"):o("out.doctor.diagSourceNone");if(!n.weaveOwned)return o("out.doctor.diagScriptNotOwned",{source:e});const i=o("out.doctor.diagYes");return o("out.doctor.diagScriptValue",{harness:n.harness,source:e,version:n.generatedVersion??o("out.doctor.diagMissing"),inbox:n.reportsInbox?i:o("out.doctor.diagNo"),pane:n.reportsPaneEnv?i:o("out.doctor.diagNo")})}function g(n){const e=k(q,n.reason);return n.status==="ready"?o("out.doctor.diagReady"):n.status==="unknown"?o("out.doctor.diagUnknown",{reason:e}):o("out.doctor.diagUnavailable",{reason:e})}async function O(n,e){let i;try{const t=await fetch(`http://${S}:${n}/messaging/diagnostics?project=${e}`,{headers:C()});if(!t.ok)throw new Error(`HTTP ${t.status}`);try{i=await t.json()}catch{throw new Error(`HTTP ${t.status}`)}}catch(t){r.warn(o("out.doctor.diagFailed",{error:t instanceof Error?t.message:String(t)}));return}const{daemon:a}=i,s=i.projects.find(t=>t.id===e)?.captures[0]??null;if(console.log(),r.info(o("out.doctor.diagHeader",{id:e})),console.log(p([[o("out.doctor.diagDaemon"),o("out.doctor.diagDaemonValue",{version:a.version,platform:a.platform,preset:a.terminalPreset,channel:o(a.terminalTextChannel?"out.doctor.diagChannelOn":"out.doctor.diagChannelOff")})],[o("out.doctor.diagScript"),H(s)]])),i.sessions.length===0){r.dim(o("out.doctor.diagNoSessions"));return}const d=t=>t===null?o("out.doctor.diagUnknownAlive"):o(t?"out.doctor.diagYes":"out.doctor.diagNo");for(const t of i.sessions)console.log(),console.log("  "+o("out.doctor.diagSession",{id:t.sessionId.slice(0,8),title:t.title??o("out.doctor.diagUntitled"),alive:d(t.alive),events:t.eventCount,last:t.lastEventType??o("out.doctor.diagMissing")})),console.log("    "+o("out.doctor.diagChannels",{inbox:g(t.channels.inbox),queue:g(t.channels.queue),relay:g(t.channels.relay),terminal:g(t.channels.terminal)})),console.log("    "+o("out.doctor.diagQueue",{pending:t.queue.pending,stalled:o(t.queue.stalled?"out.doctor.diagYes":"out.doctor.diagNo")})),t.hints.length>0&&r.dim("    "+o("out.doctor.diagHints",{hints:t.hints.map(c=>k(R,c)).join("\uFF1B")}))}const v=n=>{const e=l.resolve(n);return process.platform==="win32"?e.toLowerCase():e};function j(n){if(!m(y()))return null;const e=N();try{const i=new b(e),a=v(n),s=[...i.list(),...i.listArchived()].find(d=>v(d.path)===a);return s?{id:s.id,source:s.source,archived:s.archivedAt!==null,token:s.token}:null}finally{e.close()}}function A(n){const e=l.join(n,".weave","token");return m(e)?w(e,"utf-8").trim():null}export const doctorCommand={name:"doctor",description:"cmd.doctor.desc",options:[{name:"dir",short:"d",description:"flag.dir",type:"string",default:process.cwd()}],async action(n){T();const e=l.resolve(String(n.flags.dir??process.cwd())),i=m(l.join(e,".weave","config.yaml")),s=P()?.port??x,d=await D(s),t=j(e),c=A(e);let u;c===null?u=o("out.doctor.tokenMissing"):t?c===t.token?u=o("out.doctor.tokenOk"):u=o("out.doctor.tokenStale"):u=o("out.doctor.tokenUnregistered"),r.info(o("out.doctor.header")),console.log(p([[o("out.doctor.dir"),e],[o("out.doctor.initialized"),i?o("out.doctor.yes"):o("out.doctor.no")],[o("out.doctor.daemon"),d?o("out.doctor.daemonRunning",{port:s}):o("out.doctor.daemonStopped")],[o("out.doctor.registered"),t?o(t.archived?"out.doctor.registeredArchived":"out.doctor.registeredYes",{id:t.id,source:t.source}):o("out.doctor.registeredNo")],[o("out.doctor.token"),u]])),console.log();const f=await E(e);if(f.length>0){r.warn(o("out.status.issuesFound",{count:f.length}));for(const h of f)r.warn(o("out.status.issue",{message:h.message})),r.dim(o("out.status.fix",{fix:h.fix}));console.log()}if(d&&t&&!t.archived&&await O(s,t.id),!t){r.warn(o("out.doctor.warnNotRegistered")),r.dim(o("out.doctor.fixInit")),i||r.dim(o("out.doctor.fixScan",{dir:e}));return}if(t.archived){r.warn(o("out.doctor.warnArchived"));return}if(c===null){r.warn(o("out.doctor.warnTokenMissing")),r.dim(o("out.doctor.fixInit"));return}if(c!==t.token){r.warn(o("out.doctor.warnTokenStale")),r.dim(o("out.doctor.fixInit"));return}r.success(o("out.doctor.ok")),d||r.dim(o("out.doctor.fixDaemon"))}};
+import{existsSync as m,readFileSync as k}from"node:fs";import u from"node:path";import{DAEMON_HOST as w,DEFAULT_PORT as S,getDbPath as x,ensureDataLayout as y,openDatabase as N,ProjectRepository as b,readDaemonState as T}from"@weavecode/server";import{formatTable as f,logger as r}from"@weavecode/core";import{checkHarness as P}from"../init/harness-checks.js";import{probeDaemon as E}from"./daemon.js";import{localTokenHeader as C}from"./daemon-auth.js";import{t as o}from"../i18n/index.js";const q={"no-mechanism":"out.doctor.reason.noMechanism","no-credentials":"out.doctor.reason.noCredentials","auth-token-required":"out.doctor.reason.authTokenRequired","no-peer-name":"out.doctor.reason.noPeerName","no-backend":"out.doctor.reason.noBackend","no-pane-env":"out.doctor.reason.noPaneEnv","pane-env-conflict":"out.doctor.reason.paneEnvConflict"},D={"no-hook-script":"out.doctor.hint.noHookScript","hook-script-not-weave":"out.doctor.hint.hookScriptNotWeave","hook-script-stale":"out.doctor.hint.hookScriptStale","no-events":"out.doctor.hint.noEvents","no-inbox-credentials":"out.doctor.hint.noInboxCredentials","inbox-token-required":"out.doctor.hint.inboxTokenRequired","no-peer-name":"out.doctor.hint.noPeerName","terminal-no-backend":"out.doctor.hint.terminalNoBackend","terminal-no-pane-env":"out.doctor.hint.terminalNoPaneEnv","terminal-pane-env-conflict":"out.doctor.hint.terminalPaneEnvConflict","not-running":"out.doctor.hint.notRunning",queued:"out.doctor.hint.queued",stalled:"out.doctor.hint.stalled"};function p(n,e){if(!e)return"";const i=n[e];return i?o(i):e}function j(n){if(!n||!n.present)return o("out.doctor.diagScriptNone");const e=n.source==="user"?o("out.doctor.diagSourceUser"):n.source==="project"?o("out.doctor.diagSourceProject"):o("out.doctor.diagSourceNone");if(!n.weaveOwned)return o("out.doctor.diagScriptNotOwned",{source:e});const i=o("out.doctor.diagYes");return o("out.doctor.diagScriptValue",{harness:n.harness,source:e,version:n.generatedVersion??o("out.doctor.diagMissing"),inbox:n.reportsInbox?i:o("out.doctor.diagNo"),pane:n.reportsPaneEnv?i:o("out.doctor.diagNo")})}function l(n){const e=p(q,n.reason);return n.status==="ready"?o("out.doctor.diagReady"):n.status==="unknown"?o("out.doctor.diagUnknown",{reason:e}):o("out.doctor.diagUnavailable",{reason:e})}async function H(n,e){let i;try{const t=await fetch(`http://${w}:${n}/messaging/diagnostics?project=${e}`,{headers:C()});if(!t.ok)throw new Error(`HTTP ${t.status}`);try{i=await t.json()}catch{throw new Error(`HTTP ${t.status}`)}}catch(t){r.warn(o("out.doctor.diagFailed",{error:t instanceof Error?t.message:String(t)}));return}const{daemon:d}=i,s=i.projects.find(t=>t.id===e)?.captures[0]??null;if(console.log(),r.info(o("out.doctor.diagHeader",{id:e})),console.log(f([[o("out.doctor.diagDaemon"),o("out.doctor.diagDaemonValue",{version:d.version,platform:d.platform,preset:d.terminalPreset,channel:o(d.terminalTextChannel?"out.doctor.diagChannelOn":"out.doctor.diagChannelOff")})],[o("out.doctor.diagScript"),j(s)]])),i.sessions.length===0){r.dim(o("out.doctor.diagNoSessions"));return}const a=t=>t===null?o("out.doctor.diagUnknownAlive"):o(t?"out.doctor.diagYes":"out.doctor.diagNo");for(const t of i.sessions)console.log(),console.log("  "+o("out.doctor.diagSession",{id:t.sessionId.slice(0,8),title:t.title??o("out.doctor.diagUntitled"),alive:a(t.alive),events:t.eventCount,last:t.lastEventType??o("out.doctor.diagMissing")})),console.log("    "+o("out.doctor.diagChannels",{inbox:l(t.channels.inbox),queue:l(t.channels.queue),relay:l(t.channels.relay),terminal:l(t.channels.terminal)})),console.log("    "+o("out.doctor.diagQueue",{pending:t.queue.pending,stalled:o(t.queue.stalled?"out.doctor.diagYes":"out.doctor.diagNo")})),t.hints.length>0&&r.dim("    "+o("out.doctor.diagHints",{hints:t.hints.map(c=>p(D,c)).join("\uFF1B")}))}const v=n=>{const e=u.resolve(n);return process.platform==="win32"?e.toLowerCase():e};function O(n){if(!m(x()))return null;const e=N();try{const i=new b(e),d=v(n),s=[...i.list(),...i.listArchived()].find(a=>v(a.path)===d);return s?{id:s.id,source:s.source,archived:s.archivedAt!==null,token:s.token}:null}finally{e.close()}}function R(n){const e=u.join(n,".weave","token");return m(e)?k(e,"utf-8").trim():null}export const doctorCommand={name:"doctor",description:"cmd.doctor.desc",options:[{name:"dir",short:"d",description:"flag.dir",type:"string",default:process.cwd()}],async action(n){y();const e=u.resolve(String(n.flags.dir??process.cwd())),i=m(u.join(e,".weave","config.yaml")),d=T()?.port??S,s=await E(d),a=O(e),t=R(e);let c;t===null?c=o("out.doctor.tokenMissing"):a?t===a.token?c=o("out.doctor.tokenOk"):c=o("out.doctor.tokenStale"):c=o("out.doctor.tokenUnregistered"),r.info(o("out.doctor.header")),console.log(f([[o("out.doctor.dir"),e],[o("out.doctor.initialized"),i?o("out.doctor.yes"):o("out.doctor.no")],[o("out.doctor.daemon"),s?o("out.doctor.daemonRunning",{port:d}):o("out.doctor.daemonStopped")],[o("out.doctor.registered"),a?o(a.archived?"out.doctor.registeredArchived":"out.doctor.registeredYes",{id:a.id,source:a.source}):o("out.doctor.registeredNo")],[o("out.doctor.token"),c]])),console.log();const g=await P(e);if(g.length>0){r.warn(o("out.status.issuesFound",{count:g.length}));for(const h of g)r.warn(o("out.status.issue",{message:h.message})),r.dim(o("out.status.fix",{fix:h.fix}));console.log()}if(s&&a&&!a.archived&&await H(d,a.id),!a){r.warn(o("out.doctor.warnNotRegistered")),r.dim(o("out.doctor.fixInit")),i||r.dim(o("out.doctor.fixScan",{dir:e}));return}if(a.archived){r.warn(o("out.doctor.warnArchived"));return}if(t===null){r.warn(o("out.doctor.warnTokenMissing")),r.dim(o("out.doctor.fixInit"));return}if(t!==a.token){r.warn(o("out.doctor.warnTokenStale")),r.dim(o("out.doctor.fixInit"));return}r.success(o("out.doctor.ok")),s||r.dim(o("out.doctor.fixDaemon"))}};

package/node_modules/@weavecode/cli/dist/commands/init.js

@@ -1 +1 @@
-import{PresetSchema as f,HARNESS_KEYS as m,logger as i,formatTable as p,resolveComponents as g}from"@weavecode/core";import{executeInit as u}from"../init/executor.js";import{registerProject as h,WEAVE_VERSION as S}from"@weavecode/server";import{t as e}from"../i18n/index.js";const d=["preToolUse","postToolUse","userPromptSubmit","sessionStart","stop","stopFailure","subagentStop","subagentStart","notification","postToolUseFailure","permissionRequest","permissionDenied","preCompact","sessionEnd","preModelSwitch"];function k(r){const s=r.trim();if(!s)return{};const c=Object.fromEntries(d.map(n=>[n,!1]));if(s==="none")return c;const a=new Set(s.split(",").map(n=>n.trim()).filter(Boolean)),o=[...a].filter(n=>!d.includes(n));return o.length>0&&i.warn(e("init.hooksUnknownKeys",{keys:o.join(", ")})),Object.fromEntries(d.map(n=>[n,a.has(n)]))}export function parseHarnessFlag(r){const s=r.trim();if(!s)return;const c=s.split(",").map(n=>n.trim().toLowerCase()).filter(Boolean),a=[...new Set(c.filter(n=>m.includes(n)))],o=c.filter(n=>!m.includes(n));return o.length>0&&i.warn(e("init.harnessUnknownKeys",{keys:o.join(", ")})),a.length>0?a:["claude"]}export const initCommand={name:"init",description:"cmd.init.desc",options:[{name:"preset",short:"p",description:"flag.init.preset",type:"string",default:"default",choices:["minimal","default","full"]},{name:"force",short:"f",description:"flag.init.force",type:"boolean",default:!1},{name:"no-interactive",description:"flag.init.noInteractive",type:"boolean",default:!1},{name:"dir",short:"d",description:"flag.dir",type:"string",default:process.cwd()},{name:"hooks",description:"flag.init.hooks",type:"string",default:""},{name:"harness",description:"flag.init.harness",type:"string",default:""}],async action(r){const s=f.parse(r.flags.preset??"default"),c=!!r.flags.force,a=r.flags.noInteractive!==!0&&r.flags.interactive!==!1,o=String(r.flags.dir??process.cwd());i.info(e("init.banner",{version:S})),i.dim(e("init.presetTarget",{preset:s,target:o}));const n=g(s);let t;try{t=await u({targetDir:o,force:c,interactive:a,preset:s,harnesses:parseHarnessFlag(String(r.flags.harness??"")),components:n,hooks:k(String(r.flags.hooks??"")),skills:{},commands:{},agents:{},mcp:{}})}catch(l){i.error(e("init.failed",{error:l instanceof Error?l.message:String(l)})),process.exit(1)}if(t.success){h(o,"init"),i.success(e("init.complete"));const l=[[e("init.table.directories"),String(t.created.directories.length)],[e("init.table.filesCreated"),String(t.created.files.length)],[e("init.table.filesMerged"),String(t.merged.length)],[e("init.table.weaveUpdated"),String(t.updated.length)],[e("init.table.skills"),String(t.summary.skillsCount)],[e("init.table.commands"),String(t.summary.commandsCount)],[e("init.table.agents"),String(t.summary.agentsCount)]];console.log(p(l)),console.log(),t.merged.length>0&&i.dim(e("init.merged",{count:t.merged.length})),t.updated.length>0&&i.dim(e("init.refreshed",{count:t.updated.length})),t.removed.length>0&&i.dim(e("init.removed",{count:t.removed.length})),t.skipped.length>0&&i.dim(e("init.skipped",{count:t.skipped.length}))}else{i.error(e("init.completedWithErrors"));for(const l of t.errors)i.error(e("init.errorLine",{error:l}))}}};
+import{PresetSchema as p,HARNESS_KEYS as m,logger as n,formatTable as g,resolveComponents as f}from"@weavecode/core";import{executeInit as u}from"../init/executor.js";import{registerProject as h,WEAVE_VERSION as S}from"@weavecode/server";import{t as e}from"../i18n/index.js";const d=["preToolUse","postToolUse","userPromptSubmit","sessionStart","stop","stopFailure","subagentStop","subagentStart","notification","postToolUseFailure","permissionRequest","permissionDenied","preCompact","sessionEnd","preModelSwitch"];function b(r){const s=r.trim();if(!s)return{};const c=Object.fromEntries(d.map(i=>[i,!1]));if(s==="none")return c;const a=new Set(s.split(",").map(i=>i.trim()).filter(Boolean)),o=[...a].filter(i=>!d.includes(i));return o.length>0&&n.warn(e("init.hooksUnknownKeys",{keys:o.join(", ")})),Object.fromEntries(d.map(i=>[i,a.has(i)]))}export function parseHarnessFlag(r){const s=r.trim();if(!s)return;const c=s.split(",").map(i=>i.trim().toLowerCase()).filter(Boolean),a=[...new Set(c.filter(i=>m.includes(i)))],o=c.filter(i=>!m.includes(i));return o.length>0&&n.warn(e("init.harnessUnknownKeys",{keys:o.join(", ")})),a.length>0?a:["claude"]}export const initCommand={name:"init",description:"cmd.init.desc",options:[{name:"preset",short:"p",description:"flag.init.preset",type:"string",default:"default",choices:["minimal","default","full"]},{name:"force",short:"f",description:"flag.init.force",type:"boolean",default:!1},{name:"no-interactive",description:"flag.init.noInteractive",type:"boolean",default:!1},{name:"dir",short:"d",description:"flag.dir",type:"string",default:process.cwd()},{name:"hooks",description:"flag.init.hooks",type:"string",default:""},{name:"harness",description:"flag.init.harness",type:"string",default:""}],async action(r){const s=p.parse(r.flags.preset??"default"),c=!!r.flags.force,a=r.flags.noInteractive!==!0&&r.flags.interactive!==!1,o=String(r.flags.dir??process.cwd());n.info(e("init.banner",{version:S})),n.dim(e("init.presetTarget",{preset:s,target:o}));const i=f(s);let t;try{t=await u({targetDir:o,force:c,interactive:a,preset:s,harnesses:parseHarnessFlag(String(r.flags.harness??"")),components:i,hooks:b(String(r.flags.hooks??"")),skills:{},commands:{},agents:{},mcp:{}})}catch(l){n.error(e("init.failed",{error:l instanceof Error?l.message:String(l)})),process.exit(1)}if(t.success){h(o,"init"),n.success(e("init.complete"));const l=[[e("init.table.directories"),String(t.created.directories.length)],[e("init.table.filesCreated"),String(t.created.files.length)],[e("init.table.filesMerged"),String(t.merged.length)],[e("init.table.weaveUpdated"),String(t.updated.length)],[e("init.table.skills"),String(t.summary.skillsCount)],[e("init.table.commands"),String(t.summary.commandsCount)],[e("init.table.agents"),String(t.summary.agentsCount)]];console.log(g(l)),console.log(),t.merged.length>0&&n.dim(e("init.merged",{count:t.merged.length})),t.updated.length>0&&n.dim(e("init.refreshed",{count:t.updated.length})),t.removed.length>0&&n.dim(e("init.removed",{count:t.removed.length})),t.skipped.length>0&&n.dim(e("init.skipped",{count:t.skipped.length}))}else{n.error(e("init.completedWithErrors"));for(const l of t.errors)n.error(e("init.errorLine",{error:l}))}}};

package/node_modules/@weavecode/cli/dist/commands/msg.js

@@ -1,2 +1,2 @@
-import{DAEMON_HOST as h}from"@weavecode/server";import{logger as a}from"@weavecode/core";import{createRuntimeRegistry as y}from"@weavecode/harness";import{ensureDaemonRunning as d}from"./daemon.js";import{t as i}from"../i18n/index.js";async function u(s,o,e){const t=await fetch(`http://${h}:${s}${o}`,e),n=await t.json().catch(()=>({}));if(!t.ok)throw new Error(String(n.error??`HTTP ${t.status}`));return n}export function resolveSessionRef(s,o){const e=o.toLowerCase(),t=s.filter(c=>c.sessionId.toLowerCase()===e);if(t.length===1)return{row:t[0]};const n=s.filter(c=>c.sessionId.toLowerCase().startsWith(e));if(n.length===1)return{row:n[0]};const r=s.filter(c=>c.title!=null&&c.title.toLowerCase().includes(e));if(r.length===1)return{row:r[0]};const g=n.length>0?n:r;return g.length>1?{error:"ambiguous",rows:g}:{error:"not-found"}}export function currentSessionId(s,o){for(const e of o){if(!e)continue;const t=s[e];if(typeof t=="string"&&t!=="")return t}return null}export function pickReplyTarget(s,o){for(let e=s.length-1;e>=0;e--){const t=s[e];if(t.toSessionId===o&&t.fromSessionId!=null)return t.fromSessionId}return null}function I(s){const o=s[0].map((e,t)=>Math.max(...s.map(n=>n[t].length)));return s.map(e=>e.map((t,n)=>t.padEnd(o[n])).join("  ").trimEnd()).join(`
-`)}const l=s=>s.slice(0,8);function f(s,o){return u(s,"/sessions").then(({sessions:e})=>{const t=resolveSessionRef(e,o);if("row"in t)return t.row;throw t.error==="ambiguous"?new Error(i("out.msg.ambiguous",{ref:o,candidates:t.rows.map(n=>`${l(n.sessionId)}${n.title?` (${n.title})`:""}`).join(", ")})):new Error(i("out.msg.notFound",{ref:o}))})}function p(){const s=y().byCapability("messaging").flatMap(o=>o.messaging?.sessionEnv?[o.messaging.sessionEnv]:[]);return currentSessionId(process.env,s)}async function w(s,o,e,t,n){const r=await f(s,o),g=await u(s,`/sessions/${encodeURIComponent(r.sessionId)}/messages`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({text:e,mode:t,fromKind:"cli",fromSessionId:n})});a.success(i("out.msg.sendOk",{target:r.title??l(r.sessionId),id:g.messageId,status:g.status}))}async function S(s,o){const{sessions:e}=await u(s,"/sessions");if(!o){const{capabilities:r}=await u(s,"/messaging/capabilities"),g=new Set(r.filter(m=>m.discovery).map(m=>m.harness)),c=e.map(m=>[l(m.sessionId),m.title??"",m.harness??"-",m.turnOpen===void 0?"-":m.turnOpen?i("out.msg.busy"):i("out.msg.idle"),m.harness!=null&&g.has(m.harness)?"\u2713":"\u2014"]);if(c.length===0){a.info(i("out.msg.noSessions"));return}a.info(i("out.msg.sessionHeader",{n:c.length})),console.log(I([[i("out.msg.col.session"),i("out.msg.col.title"),i("out.msg.col.harness"),i("out.msg.col.state"),i("out.msg.col.msg")],...c]));return}const t=await f(s,o),{messages:n}=await u(s,`/sessions/${encodeURIComponent(t.sessionId)}/messages`);a.info(i("out.msg.threadHeader",{session:t.title??t.sessionId,n:n.length}));for(const r of n){const g=r.fromSessionId===t.sessionId?"\u25B6":"\u25C0",c=r.fromKind==="dashboard"?"dashboard":r.fromKind==="cli"?"cli":r.fromSessionId??"?";console.log(`${r.createdAt.slice(11,19)} ${g} ${c} [${r.status}] ${r.text.slice(0,80)}`)}}async function C(s,o,e){const t=await f(s,o),n=p(),r=await u(s,`/sessions/${encodeURIComponent(t.sessionId)}/watch`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({watcherSessionId:n,notify:e??null})});a.success(i("out.msg.watchOk",{target:t.title??l(t.sessionId),id:r.watchId,via:n??i("out.msg.watchViaDashboard")}))}async function x(s,o){const e=p();if(!e){a.warn(i("out.msg.replyNoSession")),process.exitCode=1;return}const{messages:t}=await u(s,`/sessions/${encodeURIComponent(e)}/messages`),n=pickReplyTarget(t,e);if(!n){a.warn(i("out.msg.replyNothing")),process.exitCode=1;return}await w(s,n,o,"inject",e)}export const msgCommand={name:"msg",description:"cmd.msg.desc",subcommands:[{name:"ls",description:"cmd.msg.ls.desc",async action(s){const o=await d();try{await S(o.port,s.positional[0])}catch(e){a.warn(i("out.msg.failed",{error:e instanceof Error?e.message:String(e)})),process.exitCode=1}}},{name:"send",description:"cmd.msg.send.desc",options:[{name:"mode",short:"m",description:"flag.msg.mode",type:"string",choices:["auto","inject","headless"],default:"inject"}],async action(s){const o=s.positional[0],e=s.positional.slice(1).join(" ");if(!o||!e){a.warn(i("out.msg.sendUsage")),process.exitCode=1;return}const t=await d();try{await w(t.port,o,e,String(s.flags.mode??"inject"),p())}catch(n){a.warn(i("out.msg.sendFail",{error:n instanceof Error?n.message:String(n)})),process.exitCode=1}}},{name:"watch",description:"cmd.msg.watch.desc",options:[{name:"notify",description:"flag.msg.notify",type:"string"}],async action(s){const o=s.positional[0];if(!o){a.warn(i("out.msg.watchUsage")),process.exitCode=1;return}const e=await d();try{await C(e.port,o,s.flags.notify==null?void 0:String(s.flags.notify))}catch(t){a.warn(i("out.msg.watchFail",{error:t instanceof Error?t.message:String(t)})),process.exitCode=1}}},{name:"reply",description:"cmd.msg.reply.desc",async action(s){const o=s.positional.join(" ");if(!o){a.warn(i("out.msg.replyUsage")),process.exitCode=1;return}const e=await d();try{await x(e.port,o)}catch(t){a.warn(i("out.msg.sendFail",{error:t instanceof Error?t.message:String(t)})),process.exitCode=1}}}]};
+import{DAEMON_HOST as h}from"@weavecode/server";import{logger as a}from"@weavecode/core";import{createRuntimeRegistry as y}from"@weavecode/harness";import{ensureDaemonRunning as u}from"./daemon.js";import{t as i}from"../i18n/index.js";async function g(s,o,e){const t=await fetch(`http://${h}:${s}${o}`,e),n=await t.json().catch(()=>({}));if(!t.ok)throw new Error(String(n.error??`HTTP ${t.status}`));return n}export function resolveSessionRef(s,o){const e=o.toLowerCase(),t=s.filter(c=>c.sessionId.toLowerCase()===e);if(t.length===1)return{row:t[0]};const n=s.filter(c=>c.sessionId.toLowerCase().startsWith(e));if(n.length===1)return{row:n[0]};const r=s.filter(c=>c.title!=null&&c.title.toLowerCase().includes(e));if(r.length===1)return{row:r[0]};const m=n.length>0?n:r;return m.length>1?{error:"ambiguous",rows:m}:{error:"not-found"}}export function currentSessionId(s,o){for(const e of o){if(!e)continue;const t=s[e];if(typeof t=="string"&&t!=="")return t}return null}export function pickReplyTarget(s,o){for(let e=s.length-1;e>=0;e--){const t=s[e];if(t.toSessionId===o&&t.fromSessionId!=null)return t.fromSessionId}return null}function I(s){const o=s[0].map((e,t)=>Math.max(...s.map(n=>n[t].length)));return s.map(e=>e.map((t,n)=>t.padEnd(o[n])).join("  ").trimEnd()).join(`
+`)}const l=s=>s.slice(0,8);function f(s,o){return g(s,"/sessions").then(({sessions:e})=>{const t=resolveSessionRef(e,o);if("row"in t)return t.row;throw t.error==="ambiguous"?new Error(i("out.msg.ambiguous",{ref:o,candidates:t.rows.map(n=>`${l(n.sessionId)}${n.title?` (${n.title})`:""}`).join(", ")})):new Error(i("out.msg.notFound",{ref:o}))})}function p(){const s=y().byCapability("messaging").flatMap(o=>o.messaging?.sessionEnv?[o.messaging.sessionEnv]:[]);return currentSessionId(process.env,s)}async function w(s,o,e,t,n){const r=await f(s,o),m=await g(s,`/sessions/${encodeURIComponent(r.sessionId)}/messages`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({text:e,mode:t,fromKind:"cli",fromSessionId:n})});a.success(i("out.msg.sendOk",{target:r.title??l(r.sessionId),id:m.messageId,status:m.status}))}async function S(s,o){const{sessions:e}=await g(s,"/sessions");if(!o){const{capabilities:r}=await g(s,"/messaging/capabilities"),m=new Set(r.filter(d=>d.discovery).map(d=>d.harness)),c=e.map(d=>[l(d.sessionId),d.title??"",d.harness??"-",d.turnOpen===void 0?"-":d.turnOpen?i("out.msg.busy"):i("out.msg.idle"),d.harness!=null&&m.has(d.harness)?"\u2713":"\u2014"]);if(c.length===0){a.info(i("out.msg.noSessions"));return}a.info(i("out.msg.sessionHeader",{n:c.length})),console.log(I([[i("out.msg.col.session"),i("out.msg.col.title"),i("out.msg.col.harness"),i("out.msg.col.state"),i("out.msg.col.msg")],...c]));return}const t=await f(s,o),{messages:n}=await g(s,`/sessions/${encodeURIComponent(t.sessionId)}/messages`);a.info(i("out.msg.threadHeader",{session:t.title??t.sessionId,n:n.length}));for(const r of n){const m=r.fromSessionId===t.sessionId?"\u25B6":"\u25C0",c=r.fromKind==="dashboard"?"dashboard":r.fromKind==="cli"?"cli":r.fromSessionId??"?";console.log(`${r.createdAt.slice(11,19)} ${m} ${c} [${r.status}] ${r.text.slice(0,80)}`)}}async function C(s,o,e){const t=await f(s,o),n=p(),r=await g(s,`/sessions/${encodeURIComponent(t.sessionId)}/watch`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({watcherSessionId:n,notify:e??null})});a.success(i("out.msg.watchOk",{target:t.title??l(t.sessionId),id:r.watchId,via:n??i("out.msg.watchViaDashboard")}))}async function x(s,o){const e=p();if(!e){a.warn(i("out.msg.replyNoSession")),process.exitCode=1;return}const{messages:t}=await g(s,`/sessions/${encodeURIComponent(e)}/messages`),n=pickReplyTarget(t,e);if(!n){a.warn(i("out.msg.replyNothing")),process.exitCode=1;return}await w(s,n,o,"inject",e)}export const msgCommand={name:"msg",description:"cmd.msg.desc",subcommands:[{name:"ls",description:"cmd.msg.ls.desc",async action(s){const o=await u();try{await S(o.port,s.positional[0])}catch(e){a.warn(i("out.msg.failed",{error:e instanceof Error?e.message:String(e)})),process.exitCode=1}}},{name:"send",description:"cmd.msg.send.desc",options:[{name:"mode",short:"m",description:"flag.msg.mode",type:"string",choices:["auto","inject","headless"],default:"inject"}],async action(s){const o=s.positional[0],e=s.positional.slice(1).join(" ");if(!o||!e){a.warn(i("out.msg.sendUsage")),process.exitCode=1;return}const t=await u();try{await w(t.port,o,e,String(s.flags.mode??"inject"),p())}catch(n){a.warn(i("out.msg.sendFail",{error:n instanceof Error?n.message:String(n)})),process.exitCode=1}}},{name:"watch",description:"cmd.msg.watch.desc",options:[{name:"notify",description:"flag.msg.notify",type:"string"}],async action(s){const o=s.positional[0];if(!o){a.warn(i("out.msg.watchUsage")),process.exitCode=1;return}const e=await u();try{await C(e.port,o,s.flags.notify==null?void 0:String(s.flags.notify))}catch(t){a.warn(i("out.msg.watchFail",{error:t instanceof Error?t.message:String(t)})),process.exitCode=1}}},{name:"reply",description:"cmd.msg.reply.desc",async action(s){const o=s.positional.join(" ");if(!o){a.warn(i("out.msg.replyUsage")),process.exitCode=1;return}const e=await u();try{await x(e.port,o)}catch(t){a.warn(i("out.msg.sendFail",{error:t instanceof Error?t.message:String(t)})),process.exitCode=1}}}]};