abtars 0.3.4-alpha.7 → 0.3.4

package/bundle/{acp-raw-client-E6FM45NC.js → acp-raw-client-UCNK3OTU.js}

@@ -4,7 +4,7 @@ import {
   init_logger,
   logDebug,
   logWarn
-} from "./chunk-GWILHZPT.js";
+} from "./chunk-XRTXYN66.js";
 import "./chunk-GALQBVKO.js";
 import "./chunk-O7KQG6ME.js";
 import "./chunk-7K2YZTLD.js";
@@ -115,4 +115,4 @@ var AcpRawClient = class {
 export {
   AcpRawClient
 };
-//# sourceMappingURL=acp-raw-client-E6FM45NC.js.map
+//# sourceMappingURL=acp-raw-client-UCNK3OTU.js.map

package/bundle/{action-gate-G2V47NHW.js → action-gate-V4FCBHFB.js}

@@ -5,7 +5,7 @@ import {
   logError,
   logInfo,
   logWarn
-} from "./chunk-GWILHZPT.js";
+} from "./chunk-XRTXYN66.js";
 import "./chunk-GALQBVKO.js";
 import "./chunk-O7KQG6ME.js";
 import "./chunk-7K2YZTLD.js";
@@ -189,4 +189,4 @@ Authorize?`;
 export {
   ActionGate
 };
-//# sourceMappingURL=action-gate-G2V47NHW.js.map
+//# sourceMappingURL=action-gate-V4FCBHFB.js.map

package/bundle/{agent-api-adapter-YAHKQMMZ.js → agent-api-adapter-7HEPYSIN.js}

@@ -4,7 +4,7 @@ import {
   init_logger,
   logDebug,
   logInfo
-} from "./chunk-GWILHZPT.js";
+} from "./chunk-XRTXYN66.js";
 import "./chunk-GALQBVKO.js";
 import "./chunk-O7KQG6ME.js";
 import "./chunk-7K2YZTLD.js";
@@ -35,7 +35,7 @@ var AgentApiAdapter = class {
    * Returns the Orc's response (resolved when card completes).
    */
   async handlePeerMessage(peerId, sessionId, text, timeoutMs = 3e5) {
-    const { spin } = await import("./spin-TI3TSVVT.js");
+    const { spin } = await import("./spin-VHNGNWTD.js");
     logDebug(TAG, `-> ${peerId}/${sessionId}: ${text.slice(0, 100)}`);
     const { result } = await spin.dispatchAwait({
       type: "O",
@@ -52,4 +52,4 @@ var AgentApiAdapter = class {
 export {
   AgentApiAdapter
 };
-//# sourceMappingURL=agent-api-adapter-YAHKQMMZ.js.map
+//# sourceMappingURL=agent-api-adapter-7HEPYSIN.js.map

package/bundle/{agent-api-rate-limit-WCFXJMGY.js → agent-api-rate-limit-RZSAM3SW.js}

@@ -4,9 +4,9 @@ import {
   checkPeerPostLimit,
   checkRateLimit,
   init_agent_api_rate_limit
-} from "./chunk-DYBW4XXL.js";
-import "./chunk-65VCEC32.js";
-import "./chunk-GWILHZPT.js";
+} from "./chunk-467SRLLR.js";
+import "./chunk-6PA5JBUU.js";
+import "./chunk-XRTXYN66.js";
 import "./chunk-GALQBVKO.js";
 import "./chunk-O7KQG6ME.js";
 import "./chunk-7K2YZTLD.js";
@@ -15,4 +15,4 @@ export {
   checkPeerPostLimit,
   checkRateLimit
 };
-//# sourceMappingURL=agent-api-rate-limit-WCFXJMGY.js.map
+//# sourceMappingURL=agent-api-rate-limit-RZSAM3SW.js.map

package/bundle/{agent-registry-GI6CLT3Z.js → agent-registry-46A2R5KP.js}

@@ -3,13 +3,13 @@
 import {
   createAgentTransport,
   createSubagentTransport
-} from "./chunk-GXL7HJPT.js";
-import "./chunk-5QUTMUIK.js";
-import "./chunk-GRVWZO4C.js";
+} from "./chunk-EAX5ZZUL.js";
+import "./chunk-JXYWDAHD.js";
+import "./chunk-KOSFXW2S.js";
 import "./chunk-N5KN3LGD.js";
-import "./chunk-65VCEC32.js";
-import "./chunk-YSKCQH6E.js";
-import "./chunk-GWILHZPT.js";
+import "./chunk-6PA5JBUU.js";
+import "./chunk-2IYJ4I66.js";
+import "./chunk-XRTXYN66.js";
 import "./chunk-GALQBVKO.js";
 import "./chunk-O7KQG6ME.js";
 import "./chunk-7K2YZTLD.js";
@@ -17,4 +17,4 @@ export {
   createAgentTransport,
   createSubagentTransport
 };
-//# sourceMappingURL=agent-registry-GI6CLT3Z.js.map
+//# sourceMappingURL=agent-registry-46A2R5KP.js.map

package/bundle/{bootstrap-X2QYIZIJ.js → bootstrap-MIHJJSWU.js}

@@ -4,7 +4,7 @@ import {
   makeLocalBuildSource,
   makeNpmSource,
   syncSrcRepos
-} from "./chunk-SIFPBTI4.js";
+} from "./chunk-HGSHCQ5F.js";
 import {
   cleanStaleStaging
 } from "./chunk-5NY2YULC.js";
@@ -60,4 +60,4 @@ async function bootstrap(opts) {
 export {
   bootstrap
 };
-//# sourceMappingURL=bootstrap-X2QYIZIJ.js.map
+//# sourceMappingURL=bootstrap-MIHJJSWU.js.map

package/bundle/{bridge-lock-transport-4ZH7QTJP.js → bridge-lock-transport-7RSN7OLJ.js}

@@ -18,10 +18,10 @@ import {
   writeRestartReason,
   writeRestartRequested,
   writeSleepStatus
-} from "./chunk-GRVWZO4C.js";
+} from "./chunk-KOSFXW2S.js";
 import "./chunk-N5KN3LGD.js";
-import "./chunk-YSKCQH6E.js";
-import "./chunk-GWILHZPT.js";
+import "./chunk-2IYJ4I66.js";
+import "./chunk-XRTXYN66.js";
 import "./chunk-GALQBVKO.js";
 import "./chunk-O7KQG6ME.js";
 import "./chunk-7K2YZTLD.js";
@@ -44,4 +44,4 @@ export {
   writeRestartRequested,
   writeSleepStatus
 };
-//# sourceMappingURL=bridge-lock-transport-4ZH7QTJP.js.map
+//# sourceMappingURL=bridge-lock-transport-7RSN7OLJ.js.map

package/bundle/{browser-DMARZJIN.js → browser-F6BCWJWW.js}

@@ -2,15 +2,15 @@
  import { createRequire as __bundleCreateRequire } from 'node:module'; import { fileURLToPath as __bundleFileURLToPath } from 'node:url'; import { dirname as __bundleDirname } from 'node:path'; const require = __bundleCreateRequire(import.meta.url); const __chunk_filename = __bundleFileURLToPath(import.meta.url); const __chunk_dirname = __bundleDirname(__chunk_filename);
 import {
   register
-} from "./chunk-5B5B6EHL.js";
-import "./chunk-2KC5G3EA.js";
-import "./chunk-65VCEC32.js";
-import "./chunk-YSKCQH6E.js";
-import "./chunk-GWILHZPT.js";
+} from "./chunk-JLWYPGWI.js";
+import "./chunk-OWUO5RS3.js";
+import "./chunk-6PA5JBUU.js";
+import "./chunk-2IYJ4I66.js";
+import "./chunk-XRTXYN66.js";
 import "./chunk-GALQBVKO.js";
 import "./chunk-O7KQG6ME.js";
 import "./chunk-7K2YZTLD.js";
 export {
   register
 };
-//# sourceMappingURL=browser-DMARZJIN.js.map
+//# sourceMappingURL=browser-F6BCWJWW.js.map

package/bundle/{budget-45QOBDWA.js → budget-WUM3SPKW.js}

@@ -3,7 +3,7 @@
 import {
   init_logger,
   logWarn
-} from "./chunk-GWILHZPT.js";
+} from "./chunk-XRTXYN66.js";
 import {
   abtarsHome,
   init_paths
@@ -68,7 +68,7 @@ async function sendBudgetNotification(agent, reason) {
   const msg = `x Budget: ${agent} hit daily ${reason} limit (${detail}). Paused until midnight.`;
   logWarn("budget", msg);
   try {
-    const { sendToMainChat } = await import("./main-chat-ZNUZCTNS.js");
+    const { sendToMainChat } = await import("./main-chat-3H63REKK.js");
     await sendToMainChat({}, msg);
   } catch {
   }
@@ -89,4 +89,4 @@ export {
   incrementBudgetCounter,
   sendBudgetNotification
 };
-//# sourceMappingURL=budget-45QOBDWA.js.map
+//# sourceMappingURL=budget-WUM3SPKW.js.map

package/bundle/{capability-JFWX3IQF.js → capability-QVRKGRFC.js}

@@ -4,10 +4,10 @@ import {
   createCapabilityApi,
   createCapabilityRegistry,
   discoverCapabilities
-} from "./chunk-XX6BGTPO.js";
-import "./chunk-65VCEC32.js";
-import "./chunk-YSKCQH6E.js";
-import "./chunk-GWILHZPT.js";
+} from "./chunk-ZZZCJJEO.js";
+import "./chunk-6PA5JBUU.js";
+import "./chunk-2IYJ4I66.js";
+import "./chunk-XRTXYN66.js";
 import "./chunk-GALQBVKO.js";
 import "./chunk-O7KQG6ME.js";
 import "./chunk-7K2YZTLD.js";
@@ -16,4 +16,4 @@ export {
   createCapabilityRegistry,
   discoverCapabilities
 };
-//# sourceMappingURL=capability-JFWX3IQF.js.map
+//# sourceMappingURL=capability-QVRKGRFC.js.map

package/bundle/{chunk-YSKCQH6E.js → chunk-2IYJ4I66.js}

@@ -5,7 +5,7 @@ import {
   logError,
   logTrace,
   logWarn
-} from "./chunk-GWILHZPT.js";
+} from "./chunk-XRTXYN66.js";
 import {
   __esm
 } from "./chunk-7K2YZTLD.js";
@@ -29,4 +29,4 @@ export {
   logAndSwallow,
   init_log_and_swallow
 };
-//# sourceMappingURL=chunk-YSKCQH6E.js.map
+//# sourceMappingURL=chunk-2IYJ4I66.js.map

package/bundle/{chunk-KTYGKPYM.js → chunk-2NLUT5S2.js}

@@ -3,20 +3,20 @@
 import {
   init_kanban_board,
   kanban_board_exports
-} from "./chunk-EQSG2CRM.js";
+} from "./chunk-FGYDIX54.js";
 import {
   init_lazy_require,
   resolveNativeDep
-} from "./chunk-GVM5YU5I.js";
+} from "./chunk-Z4FZPB42.js";
 import {
   init_nerve,
   nerve
-} from "./chunk-OXTSWQCX.js";
+} from "./chunk-5Y3FJ2Y7.js";
 import {
   init_logger,
   logInfo,
   logWarn
-} from "./chunk-GWILHZPT.js";
+} from "./chunk-XRTXYN66.js";
 import {
   abtarsHome,
   init_paths
@@ -180,7 +180,7 @@ function initChannelSync() {
   });
 }
 async function pushToRemote(peer, cardId, from, message) {
-  const { getPeerTransport } = await import("./peer-transport-I6JPLFZ2.js");
+  const { getPeerTransport } = await import("./peer-transport-SI7I72DB.js");
   const transport = getPeerTransport();
   const createdAt = (/* @__PURE__ */ new Date()).toISOString().replace("T", " ").slice(0, 19);
   await transport.pushChannelMessage(peer, cardId, from, message, createdAt);
@@ -212,4 +212,4 @@ export {
   kanban_channel_exports,
   init_kanban_channel
 };
-//# sourceMappingURL=chunk-KTYGKPYM.js.map
+//# sourceMappingURL=chunk-2NLUT5S2.js.map

package/bundle/chunk-3BG3AIDP.js

@@ -0,0 +1,191 @@
+#!/usr/bin/env node
+ import { createRequire as __bundleCreateRequire } from 'node:module'; import { fileURLToPath as __bundleFileURLToPath } from 'node:url'; import { dirname as __bundleDirname } from 'node:path'; const require = __bundleCreateRequire(import.meta.url); const __chunk_filename = __bundleFileURLToPath(import.meta.url); const __chunk_dirname = __bundleDirname(__chunk_filename);
+import {
+  PEERS_SCHEMA,
+  init_config_validator,
+  validateShape
+} from "./chunk-5RVOEFGT.js";
+import {
+  init_peer_auth,
+  peer_auth_exports
+} from "./chunk-WC5O5KOE.js";
+import {
+  init_logger,
+  logInfo,
+  logWarn
+} from "./chunk-XRTXYN66.js";
+import {
+  abtarsHome,
+  init_paths
+} from "./chunk-GALQBVKO.js";
+import {
+  __esm,
+  __export,
+  __require,
+  __toCommonJS
+} from "./chunk-7K2YZTLD.js";
+
+// src/components/peer-config.ts
+var peer_config_exports = {};
+__export(peer_config_exports, {
+  bootstrapIdentity: () => bootstrapIdentity,
+  clearPeerConfigCache: () => clearPeerConfigCache,
+  deriveVerifyKey: () => deriveVerifyKey,
+  loadPeerConfig: () => loadPeerConfig
+});
+import { existsSync, readFileSync, writeFileSync, chmodSync } from "node:fs";
+import { join } from "node:path";
+import { generateKeyPairSync, randomBytes, createPrivateKey, createPublicKey } from "node:crypto";
+function generateSigningKey() {
+  const { privateKey } = generateKeyPairSync("ed25519");
+  return privateKey.export({ type: "pkcs8", format: "der" }).toString("base64");
+}
+function deriveVerifyKey(signingKey) {
+  const priv = createPrivateKey({ key: Buffer.from(signingKey, "base64"), format: "der", type: "pkcs8" });
+  const pubKey = createPublicKey(priv);
+  return pubKey.export({ type: "spki", format: "der" }).toString("base64");
+}
+function generateTribeToken() {
+  return randomBytes(32).toString("base64");
+}
+function bootstrapIdentity() {
+  const p = join(abtarsHome(), "config", "peers.json");
+  let raw = {};
+  if (existsSync(p)) {
+    try {
+      raw = JSON.parse(readFileSync(p, "utf-8"));
+    } catch {
+      raw = {};
+    }
+  }
+  const self = raw.self && typeof raw.self === "object" ? raw.self : {};
+  let changed = false;
+  if (typeof self.signingKey !== "string" || !self.signingKey) {
+    self.signingKey = generateSigningKey();
+    logInfo(TAG, "Generated new Ed25519 identity keypair");
+    changed = true;
+  }
+  if (typeof self.tribeToken !== "string" || !self.tribeToken) {
+    self.tribeToken = generateTribeToken();
+    logInfo(TAG, "Generated new tribe token (solo tribe of one)");
+    changed = true;
+  }
+  if (changed) {
+    raw.self = self;
+    if (!raw.peers) raw.peers = {};
+    if (typeof raw.maxHops !== "number") raw.maxHops = DEFAULTS.maxHops;
+    if (typeof raw.timeoutMs !== "number") raw.timeoutMs = DEFAULTS.timeoutMs;
+    const serialized = JSON.stringify(raw, null, 2) + "\n";
+    writeFileSync(p, serialized, { encoding: "utf-8" });
+    try {
+      chmodSync(p, 384);
+    } catch {
+    }
+  }
+  const certPath = join(abtarsHome(), "config", "identity.crt");
+  const keyPath = join(abtarsHome(), "config", "identity.tls.key");
+  if (!existsSync(certPath) || !existsSync(keyPath)) {
+    try {
+      const { hostname } = __require("node:os");
+      const { generateTlsCert } = (init_peer_auth(), __toCommonJS(peer_auth_exports));
+      const cn = typeof self.name === "string" && self.name ? self.name : hostname();
+      const signingKey = self.signingKey;
+      const { key: tlsKeyPem, cert: certPem } = generateTlsCert(signingKey, cn);
+      writeFileSync(keyPath, tlsKeyPem, { encoding: "utf-8" });
+      writeFileSync(certPath, certPem, { encoding: "utf-8" });
+      try {
+        chmodSync(keyPath, 384);
+      } catch {
+      }
+      logInfo(TAG, "Generated TLS identity cert (10yr self-signed)");
+    } catch (err) {
+      logWarn(TAG, `TLS cert generation failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+}
+function loadPeerConfig() {
+  if (_config) return _config;
+  const p = join(abtarsHome(), "config", "peers.json");
+  bootstrapIdentity();
+  if (!existsSync(p)) {
+    _config = {
+      self: { name: "default", signingKey: generateSigningKey(), tribeToken: generateTribeToken() },
+      peers: {},
+      ...DEFAULTS
+    };
+    return _config;
+  }
+  try {
+    const raw = JSON.parse(readFileSync(p, "utf-8"));
+    validateShape(raw, PEERS_SCHEMA, "peers.json");
+    const peers = {};
+    if (raw.peers && typeof raw.peers === "object") {
+      for (const [name, entry] of Object.entries(raw.peers)) {
+        const e = entry;
+        if (typeof e.host === "string" && typeof e.port === "number" && typeof e.verifyKey === "string") {
+          peers[name] = {
+            host: e.host,
+            port: e.port,
+            verifyKey: e.verifyKey,
+            ...typeof e.trust === "number" ? { trust: e.trust } : {},
+            ...e.mode === "signed" ? { mode: "signed" } : {},
+            ...Array.isArray(e.allowedTools) ? { allowedTools: e.allowedTools } : {},
+            ...Array.isArray(e.allowedRead) ? { allowedRead: e.allowedRead } : {},
+            ...Array.isArray(e.allowedWrite) ? { allowedWrite: e.allowedWrite } : {},
+            ...e.transport === "ws-outbound" ? { transport: "ws-outbound" } : {},
+            ...typeof e.udpPort === "number" ? { udpPort: e.udpPort } : {}
+          };
+        } else {
+          logWarn(TAG, `Skipped peer '${name}' \u2014 missing host/port/verifyKey`);
+        }
+      }
+    }
+    const selfRaw = raw.self;
+    _config = {
+      self: {
+        name: typeof selfRaw?.name === "string" ? selfRaw.name : "default",
+        signingKey: selfRaw?.signingKey,
+        tribeToken: selfRaw?.tribeToken,
+        ...typeof selfRaw?.udpPort === "number" ? { udpPort: selfRaw.udpPort } : {}
+      },
+      peers,
+      maxHops: typeof raw.maxHops === "number" ? raw.maxHops : DEFAULTS.maxHops,
+      timeoutMs: typeof raw.timeoutMs === "number" ? raw.timeoutMs : DEFAULTS.timeoutMs
+    };
+    const names = Object.keys(peers);
+    if (names.length > 0) logInfo(TAG, `Loaded ${names.length} peer(s): ${names.join(", ")} (self: ${_config.self.name})`);
+    return _config;
+  } catch (err) {
+    logWarn(TAG, `Failed to parse peers.json: ${err instanceof Error ? err.message : String(err)}`);
+    _config = {
+      self: { name: "default", signingKey: generateSigningKey(), tribeToken: generateTribeToken() },
+      peers: {},
+      ...DEFAULTS
+    };
+    return _config;
+  }
+}
+function clearPeerConfigCache() {
+  _config = null;
+}
+var TAG, DEFAULTS, _config;
+var init_peer_config = __esm({
+  "src/components/peer-config.ts"() {
+    init_paths();
+    init_logger();
+    init_config_validator();
+    TAG = "peer-config";
+    DEFAULTS = { maxHops: 12, timeoutMs: 6e4 };
+    _config = null;
+  }
+});
+
+export {
+  deriveVerifyKey,
+  bootstrapIdentity,
+  loadPeerConfig,
+  clearPeerConfigCache,
+  peer_config_exports,
+  init_peer_config
+};
+//# sourceMappingURL=chunk-3BG3AIDP.js.map

package/bundle/chunk-3BG3AIDP.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/components/peer-config.ts"],
+  "sourcesContent": ["/**\n * peer-config.ts \u2014 load, validate, and bootstrap ~/.abtars/config/peers.json (#1293).\n *\n * Schema change: identity is now Ed25519 keypair (self.signingKey) + tribe token\n * (self.tribeToken). Per-peer auth is verifyKey (Ed25519 pubkey). Legacy fields\n * token/gossipSecret/certPem/certFingerprint are deleted.\n *\n * Boot bootstrap: if self.signingKey or self.tribeToken are missing, they are\n * generated and persisted automatically (zero-config solo tribe of one).\n */\n\nimport { existsSync, readFileSync, writeFileSync, chmodSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { generateKeyPairSync, randomBytes, createPrivateKey, createPublicKey } from \"node:crypto\";\nimport { abtarsHome } from \"../paths.js\";\nimport { logInfo, logWarn } from \"./logger.js\";\nimport { validateShape, PEERS_SCHEMA } from \"./config-validator.js\";\n\nconst TAG = \"peer-config\";\n\nexport interface PeerEntry {\n  host: string;\n  port: number;\n  verifyKey: string;                    // Ed25519 public key (base64 SPKI DER) \u2014 auth + TLS anchor\n  trust?: number;                       // default 0; 1=enrolled, 2=trusted, >=3=owner\n  mode?: \"signed\";                      // require body-sig for relayed content\n  allowedTools?: string[];\n  allowedRead?: string[];\n  allowedWrite?: string[];\n  transport?: \"http\" | \"ws-outbound\";\n  udpPort?: number;\n}\n\nexport interface PeerSelf {\n  name: string;\n  signingKey: string;                   // Ed25519 private key (base64 PKCS8 DER) \u2014 only secret\n  tribeToken: string;                   // tribe membership secret (base64, 256-bit random)\n  udpPort?: number;\n}\n\nexport interface PeerConfig {\n  self: PeerSelf;\n  peers: Record<string, PeerEntry>;\n  maxHops: number;\n  timeoutMs: number;\n}\n\nconst DEFAULTS: Omit<PeerConfig, \"peers\" | \"self\"> = { maxHops: 12, timeoutMs: 60000 };\n\nlet _config: PeerConfig | null = null;\n\n/** Generate an Ed25519 private key as base64-encoded PKCS8 DER. */\nfunction generateSigningKey(): string {\n  const { privateKey } = generateKeyPairSync(\"ed25519\");\n  return privateKey.export({ type: \"pkcs8\", format: \"der\" }).toString(\"base64\");\n}\n\n/** Derive the Ed25519 public key from a base64 PKCS8 DER private key. Returns base64 SPKI DER. */\nexport function deriveVerifyKey(signingKey: string): string {\n  const priv = createPrivateKey({ key: Buffer.from(signingKey, \"base64\"), format: \"der\", type: \"pkcs8\" });\n  const pubKey = createPublicKey(priv);\n  return (pubKey.export({ type: \"spki\", format: \"der\" }) as Buffer).toString(\"base64\");\n}\n\n/** Generate a 256-bit random tribe token as base64. */\nfunction generateTribeToken(): string {\n  return randomBytes(32).toString(\"base64\");\n}\n\n/**\n * Bootstrap: ensure self.signingKey and self.tribeToken exist in peers.json.\n * Generates and persists them if missing. Creates peers.json if it doesn't exist.\n */\nexport function bootstrapIdentity(): void {\n  const p = join(abtarsHome(), \"config\", \"peers.json\");\n  let raw: Record<string, unknown> = {};\n  if (existsSync(p)) {\n    try { raw = JSON.parse(readFileSync(p, \"utf-8\")); } catch { raw = {}; }\n  }\n\n  const self = (raw.self && typeof raw.self === \"object\") ? raw.self as Record<string, unknown> : {};\n  let changed = false;\n\n  if (typeof self.signingKey !== \"string\" || !self.signingKey) {\n    self.signingKey = generateSigningKey();\n    logInfo(TAG, \"Generated new Ed25519 identity keypair\");\n    changed = true;\n  }\n  if (typeof self.tribeToken !== \"string\" || !self.tribeToken) {\n    self.tribeToken = generateTribeToken();\n    logInfo(TAG, \"Generated new tribe token (solo tribe of one)\");\n    changed = true;\n  }\n\n  if (changed) {\n    raw.self = self;\n    if (!raw.peers) raw.peers = {};\n    if (typeof raw.maxHops !== \"number\") raw.maxHops = DEFAULTS.maxHops;\n    if (typeof raw.timeoutMs !== \"number\") raw.timeoutMs = DEFAULTS.timeoutMs;\n    const serialized = JSON.stringify(raw, null, 2) + \"\\n\";\n    writeFileSync(p, serialized, { encoding: \"utf-8\" });\n    try { chmodSync(p, 0o600); } catch { /* best effort */ }\n  }\n\n  // Lazy-generate TLS cert from identity key if missing (idempotent).\n  // Must run AFTER signingKey is ensured so the cert derives from the stable key.\n  const certPath = join(abtarsHome(), \"config\", \"identity.crt\");\n  const keyPath = join(abtarsHome(), \"config\", \"identity.tls.key\");\n  if (!existsSync(certPath) || !existsSync(keyPath)) {\n    try {\n      const { hostname } = require(\"node:os\") as typeof import(\"node:os\");\n      const { generateTlsCert } = require(\"./peer-transport/peer-auth.js\") as typeof import(\"./peer-transport/peer-auth.js\");\n      const cn = (typeof self.name === \"string\" && self.name) ? self.name : hostname();\n      const signingKey = self.signingKey as string;\n      const { key: tlsKeyPem, cert: certPem } = generateTlsCert(signingKey, cn);\n      writeFileSync(keyPath, tlsKeyPem, { encoding: \"utf-8\" });\n      writeFileSync(certPath, certPem, { encoding: \"utf-8\" });\n      try { chmodSync(keyPath, 0o600); } catch { /* best effort */ }\n      logInfo(TAG, \"Generated TLS identity cert (10yr self-signed)\");\n    } catch (err) {\n      logWarn(TAG, `TLS cert generation failed: ${err instanceof Error ? err.message : String(err)}`);\n    }\n  }\n}\n\nexport function loadPeerConfig(): PeerConfig {\n  if (_config) return _config;\n  const p = join(abtarsHome(), \"config\", \"peers.json\");\n\n  // Ensure identity exists before loading\n  bootstrapIdentity();\n\n  if (!existsSync(p)) {\n    // Should not happen after bootstrap, but guard defensively\n    _config = {\n      self: { name: \"default\", signingKey: generateSigningKey(), tribeToken: generateTribeToken() },\n      peers: {},\n      ...DEFAULTS,\n    };\n    return _config;\n  }\n\n  try {\n    const raw = JSON.parse(readFileSync(p, \"utf-8\"));\n    validateShape(raw, PEERS_SCHEMA, \"peers.json\");\n\n    const peers: Record<string, PeerEntry> = {};\n    if (raw.peers && typeof raw.peers === \"object\") {\n      for (const [name, entry] of Object.entries(raw.peers)) {\n        const e = entry as Record<string, unknown>;\n        if (typeof e.host === \"string\" && typeof e.port === \"number\" && typeof e.verifyKey === \"string\") {\n          peers[name] = {\n            host: e.host,\n            port: e.port,\n            verifyKey: e.verifyKey,\n            ...(typeof e.trust === \"number\" ? { trust: e.trust } : {}),\n            ...(e.mode === \"signed\" ? { mode: \"signed\" as const } : {}),\n            ...(Array.isArray(e.allowedTools) ? { allowedTools: e.allowedTools as string[] } : {}),\n            ...(Array.isArray(e.allowedRead) ? { allowedRead: e.allowedRead as string[] } : {}),\n            ...(Array.isArray(e.allowedWrite) ? { allowedWrite: e.allowedWrite as string[] } : {}),\n            ...(e.transport === \"ws-outbound\" ? { transport: \"ws-outbound\" as const } : {}),\n            ...(typeof e.udpPort === \"number\" ? { udpPort: e.udpPort } : {}),\n          };\n        } else {\n          logWarn(TAG, `Skipped peer '${name}' \u2014 missing host/port/verifyKey`);\n        }\n      }\n    }\n\n    const selfRaw = raw.self as Record<string, unknown>;\n    _config = {\n      self: {\n        name: typeof selfRaw?.name === \"string\" ? selfRaw.name : \"default\",\n        signingKey: selfRaw?.signingKey as string,\n        tribeToken: selfRaw?.tribeToken as string,\n        ...(typeof selfRaw?.udpPort === \"number\" ? { udpPort: selfRaw.udpPort } : {}),\n      },\n      peers,\n      maxHops: typeof raw.maxHops === \"number\" ? raw.maxHops : DEFAULTS.maxHops,\n      timeoutMs: typeof raw.timeoutMs === \"number\" ? raw.timeoutMs : DEFAULTS.timeoutMs,\n    };\n\n    const names = Object.keys(peers);\n    if (names.length > 0) logInfo(TAG, `Loaded ${names.length} peer(s): ${names.join(\", \")} (self: ${_config.self.name})`);\n    return _config;\n  } catch (err) {\n    logWarn(TAG, `Failed to parse peers.json: ${err instanceof Error ? err.message : String(err)}`);\n    _config = {\n      self: { name: \"default\", signingKey: generateSigningKey(), tribeToken: generateTribeToken() },\n      peers: {},\n      ...DEFAULTS,\n    };\n    return _config;\n  }\n}\n\nexport function clearPeerConfigCache(): void { _config = null; }\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAWA,SAAS,YAAY,cAAc,eAAe,iBAAiB;AACnE,SAAS,YAAY;AACrB,SAAS,qBAAqB,aAAa,kBAAkB,uBAAuB;AAuCpF,SAAS,qBAA6B;AACpC,QAAM,EAAE,WAAW,IAAI,oBAAoB,SAAS;AACpD,SAAO,WAAW,OAAO,EAAE,MAAM,SAAS,QAAQ,MAAM,CAAC,EAAE,SAAS,QAAQ;AAC9E;AAGO,SAAS,gBAAgB,YAA4B;AAC1D,QAAM,OAAO,iBAAiB,EAAE,KAAK,OAAO,KAAK,YAAY,QAAQ,GAAG,QAAQ,OAAO,MAAM,QAAQ,CAAC;AACtG,QAAM,SAAS,gBAAgB,IAAI;AACnC,SAAQ,OAAO,OAAO,EAAE,MAAM,QAAQ,QAAQ,MAAM,CAAC,EAAa,SAAS,QAAQ;AACrF;AAGA,SAAS,qBAA6B;AACpC,SAAO,YAAY,EAAE,EAAE,SAAS,QAAQ;AAC1C;AAMO,SAAS,oBAA0B;AACxC,QAAM,IAAI,KAAK,WAAW,GAAG,UAAU,YAAY;AACnD,MAAI,MAA+B,CAAC;AACpC,MAAI,WAAW,CAAC,GAAG;AACjB,QAAI;AAAE,YAAM,KAAK,MAAM,aAAa,GAAG,OAAO,CAAC;AAAA,IAAG,QAAQ;AAAE,YAAM,CAAC;AAAA,IAAG;AAAA,EACxE;AAEA,QAAM,OAAQ,IAAI,QAAQ,OAAO,IAAI,SAAS,WAAY,IAAI,OAAkC,CAAC;AACjG,MAAI,UAAU;AAEd,MAAI,OAAO,KAAK,eAAe,YAAY,CAAC,KAAK,YAAY;AAC3D,SAAK,aAAa,mBAAmB;AACrC,YAAQ,KAAK,wCAAwC;AACrD,cAAU;AAAA,EACZ;AACA,MAAI,OAAO,KAAK,eAAe,YAAY,CAAC,KAAK,YAAY;AAC3D,SAAK,aAAa,mBAAmB;AACrC,YAAQ,KAAK,+CAA+C;AAC5D,cAAU;AAAA,EACZ;AAEA,MAAI,SAAS;AACX,QAAI,OAAO;AACX,QAAI,CAAC,IAAI,MAAO,KAAI,QAAQ,CAAC;AAC7B,QAAI,OAAO,IAAI,YAAY,SAAU,KAAI,UAAU,SAAS;AAC5D,QAAI,OAAO,IAAI,cAAc,SAAU,KAAI,YAAY,SAAS;AAChE,UAAM,aAAa,KAAK,UAAU,KAAK,MAAM,CAAC,IAAI;AAClD,kBAAc,GAAG,YAAY,EAAE,UAAU,QAAQ,CAAC;AAClD,QAAI;AAAE,gBAAU,GAAG,GAAK;AAAA,IAAG,QAAQ;AAAA,IAAoB;AAAA,EACzD;AAIA,QAAM,WAAW,KAAK,WAAW,GAAG,UAAU,cAAc;AAC5D,QAAM,UAAU,KAAK,WAAW,GAAG,UAAU,kBAAkB;AAC/D,MAAI,CAAC,WAAW,QAAQ,KAAK,CAAC,WAAW,OAAO,GAAG;AACjD,QAAI;AACF,YAAM,EAAE,SAAS,IAAI,UAAQ,SAAS;AACtC,YAAM,EAAE,gBAAgB,IAAI;AAC5B,YAAM,KAAM,OAAO,KAAK,SAAS,YAAY,KAAK,OAAQ,KAAK,OAAO,SAAS;AAC/E,YAAM,aAAa,KAAK;AACxB,YAAM,EAAE,KAAK,WAAW,MAAM,QAAQ,IAAI,gBAAgB,YAAY,EAAE;AACxE,oBAAc,SAAS,WAAW,EAAE,UAAU,QAAQ,CAAC;AACvD,oBAAc,UAAU,SAAS,EAAE,UAAU,QAAQ,CAAC;AACtD,UAAI;AAAE,kBAAU,SAAS,GAAK;AAAA,MAAG,QAAQ;AAAA,MAAoB;AAC7D,cAAQ,KAAK,gDAAgD;AAAA,IAC/D,SAAS,KAAK;AACZ,cAAQ,KAAK,+BAA+B,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AAAA,IAChG;AAAA,EACF;AACF;AAEO,SAAS,iBAA6B;AAC3C,MAAI,QAAS,QAAO;AACpB,QAAM,IAAI,KAAK,WAAW,GAAG,UAAU,YAAY;AAGnD,oBAAkB;AAElB,MAAI,CAAC,WAAW,CAAC,GAAG;AAElB,cAAU;AAAA,MACR,MAAM,EAAE,MAAM,WAAW,YAAY,mBAAmB,GAAG,YAAY,mBAAmB,EAAE;AAAA,MAC5F,OAAO,CAAC;AAAA,MACR,GAAG;AAAA,IACL;AACA,WAAO;AAAA,EACT;AAEA,MAAI;AACF,UAAM,MAAM,KAAK,MAAM,aAAa,GAAG,OAAO,CAAC;AAC/C,kBAAc,KAAK,cAAc,YAAY;AAE7C,UAAM,QAAmC,CAAC;AAC1C,QAAI,IAAI,SAAS,OAAO,IAAI,UAAU,UAAU;AAC9C,iBAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,IAAI,KAAK,GAAG;AACrD,cAAM,IAAI;AACV,YAAI,OAAO,EAAE,SAAS,YAAY,OAAO,EAAE,SAAS,YAAY,OAAO,EAAE,cAAc,UAAU;AAC/F,gBAAM,IAAI,IAAI;AAAA,YACZ,MAAM,EAAE;AAAA,YACR,MAAM,EAAE;AAAA,YACR,WAAW,EAAE;AAAA,YACb,GAAI,OAAO,EAAE,UAAU,WAAW,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAAA,YACxD,GAAI,EAAE,SAAS,WAAW,EAAE,MAAM,SAAkB,IAAI,CAAC;AAAA,YACzD,GAAI,MAAM,QAAQ,EAAE,YAAY,IAAI,EAAE,cAAc,EAAE,aAAyB,IAAI,CAAC;AAAA,YACpF,GAAI,MAAM,QAAQ,EAAE,WAAW,IAAI,EAAE,aAAa,EAAE,YAAwB,IAAI,CAAC;AAAA,YACjF,GAAI,MAAM,QAAQ,EAAE,YAAY,IAAI,EAAE,cAAc,EAAE,aAAyB,IAAI,CAAC;AAAA,YACpF,GAAI,EAAE,cAAc,gBAAgB,EAAE,WAAW,cAAuB,IAAI,CAAC;AAAA,YAC7E,GAAI,OAAO,EAAE,YAAY,WAAW,EAAE,SAAS,EAAE,QAAQ,IAAI,CAAC;AAAA,UAChE;AAAA,QACF,OAAO;AACL,kBAAQ,KAAK,iBAAiB,IAAI,sCAAiC;AAAA,QACrE;AAAA,MACF;AAAA,IACF;AAEA,UAAM,UAAU,IAAI;AACpB,cAAU;AAAA,MACR,MAAM;AAAA,QACJ,MAAM,OAAO,SAAS,SAAS,WAAW,QAAQ,OAAO;AAAA,QACzD,YAAY,SAAS;AAAA,QACrB,YAAY,SAAS;AAAA,QACrB,GAAI,OAAO,SAAS,YAAY,WAAW,EAAE,SAAS,QAAQ,QAAQ,IAAI,CAAC;AAAA,MAC7E;AAAA,MACA;AAAA,MACA,SAAS,OAAO,IAAI,YAAY,WAAW,IAAI,UAAU,SAAS;AAAA,MAClE,WAAW,OAAO,IAAI,cAAc,WAAW,IAAI,YAAY,SAAS;AAAA,IAC1E;AAEA,UAAM,QAAQ,OAAO,KAAK,KAAK;AAC/B,QAAI,MAAM,SAAS,EAAG,SAAQ,KAAK,UAAU,MAAM,MAAM,aAAa,MAAM,KAAK,IAAI,CAAC,WAAW,QAAQ,KAAK,IAAI,GAAG;AACrH,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,YAAQ,KAAK,+BAA+B,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AAC9F,cAAU;AAAA,MACR,MAAM,EAAE,MAAM,WAAW,YAAY,mBAAmB,GAAG,YAAY,mBAAmB,EAAE;AAAA,MAC5F,OAAO,CAAC;AAAA,MACR,GAAG;AAAA,IACL;AACA,WAAO;AAAA,EACT;AACF;AAEO,SAAS,uBAA6B;AAAE,YAAU;AAAM;AApM/D,IAkBM,KA6BA,UAEF;AAjDJ;AAAA;AAcA;AACA;AACA;AAEA,IAAM,MAAM;AA6BZ,IAAM,WAA+C,EAAE,SAAS,IAAI,WAAW,IAAM;AAErF,IAAI,UAA6B;AAAA;AAAA;",
+  "names": []
+}

package/bundle/{chunk-OKAQICWY.js → chunk-3GQX34S2.js}

@@ -3,12 +3,12 @@
 import {
   init_log_and_swallow,
   logAndSwallow
-} from "./chunk-YSKCQH6E.js";
+} from "./chunk-2IYJ4I66.js";
 import {
   init_logger,
   logDebug,
   logInfo
-} from "./chunk-GWILHZPT.js";
+} from "./chunk-XRTXYN66.js";
 
 // src/components/stt.ts
 init_logger();
@@ -56,4 +56,4 @@ export {
   LANGUAGE_HINT_PROMPT,
   transcribeAudio
 };
-//# sourceMappingURL=chunk-OKAQICWY.js.map
+//# sourceMappingURL=chunk-3GQX34S2.js.map

package/bundle/{chunk-QROWBWLL.js → chunk-3XZ773BS.js}

@@ -3,7 +3,7 @@
 import {
   init_logger,
   logInfo
-} from "./chunk-GWILHZPT.js";
+} from "./chunk-XRTXYN66.js";
 import {
   init_paths,
   resolveReleasesDir
@@ -102,4 +102,4 @@ export {
   reconcile,
   migrate
 };
-//# sourceMappingURL=chunk-QROWBWLL.js.map
+//# sourceMappingURL=chunk-3XZ773BS.js.map

package/bundle/{chunk-DYBW4XXL.js → chunk-467SRLLR.js}

@@ -3,7 +3,7 @@
 import {
   getEnv,
   init_env_schema
-} from "./chunk-65VCEC32.js";
+} from "./chunk-6PA5JBUU.js";
 import {
   __esm,
   __export
@@ -60,4 +60,4 @@ export {
   agent_api_rate_limit_exports,
   init_agent_api_rate_limit
 };
-//# sourceMappingURL=chunk-DYBW4XXL.js.map
+//# sourceMappingURL=chunk-467SRLLR.js.map