abtars 0.3.4-alpha.8 → 0.3.4

package/bundle/{chunk-GRVWZO4C.js → chunk-KOSFXW2S.js}

@@ -7,13 +7,14 @@ import {
 import {
   init_log_and_swallow,
   logAndSwallow
-} from "./chunk-YSKCQH6E.js";
+} from "./chunk-2IYJ4I66.js";
 import {
   abtarsHome,
   init_paths
 } from "./chunk-GALQBVKO.js";
 import {
-  __esm
+  __esm,
+  __export
 } from "./chunk-7K2YZTLD.js";
 
 // src/components/atomic-write.ts
@@ -33,6 +34,25 @@ var init_atomic_write = __esm({
 });
 
 // src/components/transport/bridge-lock-transport.ts
+var bridge_lock_transport_exports = {};
+__export(bridge_lock_transport_exports, {
+  appendRestartTimestamp: () => appendRestartTimestamp,
+  initBridgeLock: () => initBridgeLock,
+  readAndClearAcpPids: () => readAndClearAcpPids,
+  readAndClearForceSleep: () => readAndClearForceSleep,
+  readAndClearRestartReason: () => readAndClearRestartReason,
+  readAndClearRestartRequested: () => readAndClearRestartRequested,
+  readBridgeLockField: () => readBridgeLockField,
+  readLastPromptAt: () => readLastPromptAt,
+  readRestartTimestamps: () => readRestartTimestamps,
+  trackAcpPid: () => trackAcpPid,
+  updateBridgeLockField: () => updateBridgeLockField,
+  updateLastHeartbeat: () => updateLastHeartbeat,
+  writeForceSleep: () => writeForceSleep,
+  writeRestartReason: () => writeRestartReason,
+  writeRestartRequested: () => writeRestartRequested,
+  writeSleepStatus: () => writeSleepStatus
+});
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
 function trackAcpPid(pid) {
@@ -173,6 +193,7 @@ export {
   readAndClearForceSleep,
   initBridgeLock,
   updateLastHeartbeat,
+  bridge_lock_transport_exports,
   init_bridge_lock_transport
 };
-//# sourceMappingURL=chunk-GRVWZO4C.js.map
+//# sourceMappingURL=chunk-KOSFXW2S.js.map

package/bundle/{chunk-GRVWZO4C.js.map → chunk-KOSFXW2S.js.map}

@@ -2,6 +2,6 @@
   "version": 3,
   "sources": ["../src/components/atomic-write.ts", "../src/components/transport/bridge-lock-transport.ts"],
   "sourcesContent": ["import { writeFileSync, renameSync, openSync, fsyncSync, closeSync, unlinkSync } from \"node:fs\";\n\n/** Atomic write: .tmp \u2192 fsync \u2192 rename. Crash-safe on POSIX. */\nexport function atomicWriteSync(path: string, data: string): void {\n  const tmp = path + \".tmp\";\n  writeFileSync(tmp, data, \"utf-8\");\n  const fd = openSync(tmp, \"r\");\n  fsyncSync(fd);\n  closeSync(fd);\n  renameSync(tmp, path);\n}\n\n/** Clean orphan .tmp files left by crashes. Call on boot. */\nexport function cleanOrphanTmp(path: string): void {\n  try { unlinkSync(path + \".tmp\"); } catch { /* no orphan */ }\n}\n", "/**\n * bridge.lock \u2014 single source of truth for bridge runtime state.\n * Fields: pid, startedAt, lastHeartbeat, lastPromptAt, version,\n *         sleepStatus, restartReason, restartRequested, forceSleep.\n */\nimport { logAndSwallow } from \"../log-and-swallow.js\";\nimport { readFileSync } from \"node:fs\";\nimport { atomicWriteSync } from \"../atomic-write.js\";\nimport { join } from \"node:path\";\nimport { abtarsHome } from \"../../paths.js\";\nimport { localISO } from \"../../utils/local-time.js\";\n\nexport type SleepStatus = \"awake\" | \"sleeping\" | \"hw_sleep\";\n\n/** Add an ACP child PID to bridge.lock tracking. */\nexport function trackAcpPid(pid: number): void {\n  const pids = readBridgeLockField<number[]>(\"acpPids\") ?? [];\n  pids.push(pid);\n  updateBridgeLockField(\"acpPids\", pids);\n}\n\n/** Read and clear stale ACP PIDs from bridge.lock. */\nexport function readAndClearAcpPids(): number[] {\n  const pids = readBridgeLockField<number[]>(\"acpPids\") ?? [];\n  if (pids.length) updateBridgeLockField(\"acpPids\", []);\n  return pids;\n}\n\n/** Read lastPromptAt from bridge.lock. Returns 0 if missing/unreadable. */\nexport function readLastPromptAt(): number {\n  try {\n    const lock = JSON.parse(readFileSync(join(abtarsHome(), \"bridge.lock\"), \"utf-8\"));\n    return typeof lock.lastPromptAt === \"number\" ? lock.lastPromptAt : 0;\n  } catch (err) { logAndSwallow(\"bridge_lock_transport\", \"readLastPromptAt\", err); return 0; }\n}\n\n/** Update a single field in bridge.lock (read-merge-write). */\nexport function updateBridgeLockField(key: string, value: unknown): void {\n  const p = join(abtarsHome(), \"bridge.lock\");\n  try {\n    const lock = JSON.parse(readFileSync(p, \"utf-8\"));\n    lock[key] = value;\n    atomicWriteSync(p, JSON.stringify(lock));\n  } catch (err) { logAndSwallow(\"bridge_lock_transport\", \"op\", err); }\n}\n\n/** Read a field from bridge.lock. Returns null if missing/unreadable. */\nexport function readBridgeLockField<T = unknown>(key: string): T | null {\n  try {\n    const lock = JSON.parse(readFileSync(join(abtarsHome(), \"bridge.lock\"), \"utf-8\"));\n    return lock[key] ?? null;\n  } catch (err) { logAndSwallow(\"bridge_lock_transport\", \"readBridgeLockField\", err); return null; }\n}\n\n/** Write restart reason to bridge.lock. */\nexport function writeRestartReason(reason: string): void {\n  updateBridgeLockField(\"restartReason\", `${localISO()} ${reason}`);\n}\n\n/** Read and clear restart reason from bridge.lock. */\nexport function readAndClearRestartReason(): string | null {\n  const reason = readBridgeLockField<string>(\"restartReason\");\n  if (reason) updateBridgeLockField(\"restartReason\", null);\n  return reason;\n}\n\n/** Write restart request to bridge.lock. */\nexport function writeRestartRequested(reason: string): void {\n  updateBridgeLockField(\"restartRequested\", `${localISO()} ${reason}`);\n}\n\n/** Read and clear restart request from bridge.lock. */\nexport function readAndClearRestartRequested(): string | null {\n  const req = readBridgeLockField<string>(\"restartRequested\");\n  if (req) updateBridgeLockField(\"restartRequested\", null);\n  return req;\n}\n\n/** Update sleep status in bridge.lock. */\nexport function writeSleepStatus(status: SleepStatus): void {\n  updateBridgeLockField(\"sleepStatus\", status);\n}\n\n/** Append a restart timestamp to bridge.lock (capped at 10). Used by in-process watchdog circuit breaker. */\nexport function appendRestartTimestamp(): void {\n  const ts = readBridgeLockField<number[]>(\"restartTimestamps\") ?? [];\n  ts.push(Date.now());\n  if (ts.length > 10) ts.splice(0, ts.length - 10);\n  updateBridgeLockField(\"restartTimestamps\", ts);\n}\n\n/** Read recent restart timestamps from bridge.lock. */\nexport function readRestartTimestamps(): number[] {\n  return readBridgeLockField<number[]>(\"restartTimestamps\") ?? [];\n}\n\n/** Request a forced sleep cycle on the next heartbeat tick.\n *  See src/capabilities/sleep/index.ts spawnSleep() + src/components/daily-cycle.ts isDailyCycleDue().\n *  Pattern mirrors writeRestartRequested/readAndClearRestartRequested. */\nexport function writeForceSleep(reason: string): void {\n  updateBridgeLockField(\"forceSleep\", `${localISO()} ${reason}`);\n}\n\n/** Read and clear the force-sleep request from bridge.lock.\n *  Sole deleter: spawnSleep. isDailyCycleDue peeks via readBridgeLockField. */\nexport function readAndClearForceSleep(): string | null {\n  const v = readBridgeLockField<string>(\"forceSleep\");\n  if (v) updateBridgeLockField(\"forceSleep\", null);\n  return v;\n}\n\n/** Initialize bridge.lock with full boot state. Single writer for initial creation. */\nexport interface PrevBridgeState { pid: number | null; lastHeartbeat: number | null }\n\nexport function initBridgeLock(opts: { pid: number; startedAt: number; version: string; argv: string[]; startReason?: string }): PrevBridgeState {\n  const p = join(abtarsHome(), \"bridge.lock\");\n  let prev: PrevBridgeState = { pid: null, lastHeartbeat: null };\n  try {\n    // Read existing state (may have watchdogPid from watchdog, or stale pid from previous bridge)\n    let existing: Record<string, unknown> = {};\n    try { existing = JSON.parse(readFileSync(p, \"utf-8\")); } catch { /* missing or corrupt \u2014 cold boot */ }\n    const prevPid = typeof existing.pid === \"number\" ? existing.pid : null;\n    prev = { pid: prevPid, lastHeartbeat: typeof existing.lastHeartbeat === \"number\" ? existing.lastHeartbeat : null };\n    // Classify boot type from previous heartbeat gap\n    let bootType = \"cold\";\n    if (prev.lastHeartbeat) {\n      const gapS = (Date.now() - prev.lastHeartbeat) / 1000;\n      if (gapS < 300) bootType = \"darkwake\";\n      else if (gapS <= 7200) bootType = \"short-outage\";\n      else bootType = \"long-outage\";\n    }\n    // Merge: preserve watchdogPid from watchdog or env var\n    const wdPid = Number(process.env.ABTARS_WATCHDOG_PID) || existing.watchdogPid || null;\n    atomicWriteSync(p, JSON.stringify({\n      pid: opts.pid, watchdogPid: wdPid, startedAt: opts.startedAt, version: opts.version,\n      sleepStatus: \"awake\", argv: opts.argv, lastHeartbeat: Date.now(), startReason: opts.startReason ?? \"unknown\", bootType,\n    }));\n  } catch (err) { logAndSwallow(\"bridge_lock_transport\", \"op\", err); }\n  return prev;\n}\n\n/** Update lastHeartbeat timestamp in bridge.lock (called every tick). */\nexport function updateLastHeartbeat(): void {\n  updateBridgeLockField(\"lastHeartbeat\", Date.now());\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;AAAA,SAAS,eAAe,YAAY,UAAU,WAAW,WAAW,kBAAkB;AAG/E,SAAS,gBAAgB,MAAc,MAAoB;AAChE,QAAM,MAAM,OAAO;AACnB,gBAAc,KAAK,MAAM,OAAO;AAChC,QAAM,KAAK,SAAS,KAAK,GAAG;AAC5B,YAAU,EAAE;AACZ,YAAU,EAAE;AACZ,aAAW,KAAK,IAAI;AACtB;AAVA;AAAA;AAAA;AAAA;AAAA;;;ACMA,SAAS,oBAAoB;AAE7B,SAAS,YAAY;AAOd,SAAS,YAAY,KAAmB;AAC7C,QAAM,OAAO,oBAA8B,SAAS,KAAK,CAAC;AAC1D,OAAK,KAAK,GAAG;AACb,wBAAsB,WAAW,IAAI;AACvC;AAGO,SAAS,sBAAgC;AAC9C,QAAM,OAAO,oBAA8B,SAAS,KAAK,CAAC;AAC1D,MAAI,KAAK,OAAQ,uBAAsB,WAAW,CAAC,CAAC;AACpD,SAAO;AACT;AAGO,SAAS,mBAA2B;AACzC,MAAI;AACF,UAAM,OAAO,KAAK,MAAM,aAAa,KAAK,WAAW,GAAG,aAAa,GAAG,OAAO,CAAC;AAChF,WAAO,OAAO,KAAK,iBAAiB,WAAW,KAAK,eAAe;AAAA,EACrE,SAAS,KAAK;AAAE,kBAAc,yBAAyB,oBAAoB,GAAG;AAAG,WAAO;AAAA,EAAG;AAC7F;AAGO,SAAS,sBAAsB,KAAa,OAAsB;AACvE,QAAM,IAAI,KAAK,WAAW,GAAG,aAAa;AAC1C,MAAI;AACF,UAAM,OAAO,KAAK,MAAM,aAAa,GAAG,OAAO,CAAC;AAChD,SAAK,GAAG,IAAI;AACZ,oBAAgB,GAAG,KAAK,UAAU,IAAI,CAAC;AAAA,EACzC,SAAS,KAAK;AAAE,kBAAc,yBAAyB,MAAM,GAAG;AAAA,EAAG;AACrE;AAGO,SAAS,oBAAiC,KAAuB;AACtE,MAAI;AACF,UAAM,OAAO,KAAK,MAAM,aAAa,KAAK,WAAW,GAAG,aAAa,GAAG,OAAO,CAAC;AAChF,WAAO,KAAK,GAAG,KAAK;AAAA,EACtB,SAAS,KAAK;AAAE,kBAAc,yBAAyB,uBAAuB,GAAG;AAAG,WAAO;AAAA,EAAM;AACnG;AAGO,SAAS,mBAAmB,QAAsB;AACvD,wBAAsB,iBAAiB,GAAG,SAAS,CAAC,IAAI,MAAM,EAAE;AAClE;AAGO,SAAS,4BAA2C;AACzD,QAAM,SAAS,oBAA4B,eAAe;AAC1D,MAAI,OAAQ,uBAAsB,iBAAiB,IAAI;AACvD,SAAO;AACT;AAGO,SAAS,sBAAsB,QAAsB;AAC1D,wBAAsB,oBAAoB,GAAG,SAAS,CAAC,IAAI,MAAM,EAAE;AACrE;AAGO,SAAS,+BAA8C;AAC5D,QAAM,MAAM,oBAA4B,kBAAkB;AAC1D,MAAI,IAAK,uBAAsB,oBAAoB,IAAI;AACvD,SAAO;AACT;AAGO,SAAS,iBAAiB,QAA2B;AAC1D,wBAAsB,eAAe,MAAM;AAC7C;AAGO,SAAS,yBAA+B;AAC7C,QAAM,KAAK,oBAA8B,mBAAmB,KAAK,CAAC;AAClE,KAAG,KAAK,KAAK,IAAI,CAAC;AAClB,MAAI,GAAG,SAAS,GAAI,IAAG,OAAO,GAAG,GAAG,SAAS,EAAE;AAC/C,wBAAsB,qBAAqB,EAAE;AAC/C;AAGO,SAAS,wBAAkC;AAChD,SAAO,oBAA8B,mBAAmB,KAAK,CAAC;AAChE;AAKO,SAAS,gBAAgB,QAAsB;AACpD,wBAAsB,cAAc,GAAG,SAAS,CAAC,IAAI,MAAM,EAAE;AAC/D;AAIO,SAAS,yBAAwC;AACtD,QAAM,IAAI,oBAA4B,YAAY;AAClD,MAAI,EAAG,uBAAsB,cAAc,IAAI;AAC/C,SAAO;AACT;AAKO,SAAS,eAAe,MAAkH;AAC/I,QAAM,IAAI,KAAK,WAAW,GAAG,aAAa;AAC1C,MAAI,OAAwB,EAAE,KAAK,MAAM,eAAe,KAAK;AAC7D,MAAI;AAEF,QAAI,WAAoC,CAAC;AACzC,QAAI;AAAE,iBAAW,KAAK,MAAM,aAAa,GAAG,OAAO,CAAC;AAAA,IAAG,QAAQ;AAAA,IAAuC;AACtG,UAAM,UAAU,OAAO,SAAS,QAAQ,WAAW,SAAS,MAAM;AAClE,WAAO,EAAE,KAAK,SAAS,eAAe,OAAO,SAAS,kBAAkB,WAAW,SAAS,gBAAgB,KAAK;AAEjH,QAAI,WAAW;AACf,QAAI,KAAK,eAAe;AACtB,YAAM,QAAQ,KAAK,IAAI,IAAI,KAAK,iBAAiB;AACjD,UAAI,OAAO,IAAK,YAAW;AAAA,eAClB,QAAQ,KAAM,YAAW;AAAA,UAC7B,YAAW;AAAA,IAClB;AAEA,UAAM,QAAQ,OAAO,QAAQ,IAAI,mBAAmB,KAAK,SAAS,eAAe;AACjF,oBAAgB,GAAG,KAAK,UAAU;AAAA,MAChC,KAAK,KAAK;AAAA,MAAK,aAAa;AAAA,MAAO,WAAW,KAAK;AAAA,MAAW,SAAS,KAAK;AAAA,MAC5E,aAAa;AAAA,MAAS,MAAM,KAAK;AAAA,MAAM,eAAe,KAAK,IAAI;AAAA,MAAG,aAAa,KAAK,eAAe;AAAA,MAAW;AAAA,IAChH,CAAC,CAAC;AAAA,EACJ,SAAS,KAAK;AAAE,kBAAc,yBAAyB,MAAM,GAAG;AAAA,EAAG;AACnE,SAAO;AACT;AAGO,SAAS,sBAA4B;AAC1C,wBAAsB,iBAAiB,KAAK,IAAI,CAAC;AACnD;AAhJA;AAAA;AAKA;AAEA;AAEA;AACA;AAAA;AAAA;",
+  "mappings": ";;;;;;;;;;;;;;;;;;;;AAAA,SAAS,eAAe,YAAY,UAAU,WAAW,WAAW,kBAAkB;AAG/E,SAAS,gBAAgB,MAAc,MAAoB;AAChE,QAAM,MAAM,OAAO;AACnB,gBAAc,KAAK,MAAM,OAAO;AAChC,QAAM,KAAK,SAAS,KAAK,GAAG;AAC5B,YAAU,EAAE;AACZ,YAAU,EAAE;AACZ,aAAW,KAAK,IAAI;AACtB;AAVA;AAAA;AAAA;AAAA;AAAA;;;ACAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,SAAS,oBAAoB;AAE7B,SAAS,YAAY;AAOd,SAAS,YAAY,KAAmB;AAC7C,QAAM,OAAO,oBAA8B,SAAS,KAAK,CAAC;AAC1D,OAAK,KAAK,GAAG;AACb,wBAAsB,WAAW,IAAI;AACvC;AAGO,SAAS,sBAAgC;AAC9C,QAAM,OAAO,oBAA8B,SAAS,KAAK,CAAC;AAC1D,MAAI,KAAK,OAAQ,uBAAsB,WAAW,CAAC,CAAC;AACpD,SAAO;AACT;AAGO,SAAS,mBAA2B;AACzC,MAAI;AACF,UAAM,OAAO,KAAK,MAAM,aAAa,KAAK,WAAW,GAAG,aAAa,GAAG,OAAO,CAAC;AAChF,WAAO,OAAO,KAAK,iBAAiB,WAAW,KAAK,eAAe;AAAA,EACrE,SAAS,KAAK;AAAE,kBAAc,yBAAyB,oBAAoB,GAAG;AAAG,WAAO;AAAA,EAAG;AAC7F;AAGO,SAAS,sBAAsB,KAAa,OAAsB;AACvE,QAAM,IAAI,KAAK,WAAW,GAAG,aAAa;AAC1C,MAAI;AACF,UAAM,OAAO,KAAK,MAAM,aAAa,GAAG,OAAO,CAAC;AAChD,SAAK,GAAG,IAAI;AACZ,oBAAgB,GAAG,KAAK,UAAU,IAAI,CAAC;AAAA,EACzC,SAAS,KAAK;AAAE,kBAAc,yBAAyB,MAAM,GAAG;AAAA,EAAG;AACrE;AAGO,SAAS,oBAAiC,KAAuB;AACtE,MAAI;AACF,UAAM,OAAO,KAAK,MAAM,aAAa,KAAK,WAAW,GAAG,aAAa,GAAG,OAAO,CAAC;AAChF,WAAO,KAAK,GAAG,KAAK;AAAA,EACtB,SAAS,KAAK;AAAE,kBAAc,yBAAyB,uBAAuB,GAAG;AAAG,WAAO;AAAA,EAAM;AACnG;AAGO,SAAS,mBAAmB,QAAsB;AACvD,wBAAsB,iBAAiB,GAAG,SAAS,CAAC,IAAI,MAAM,EAAE;AAClE;AAGO,SAAS,4BAA2C;AACzD,QAAM,SAAS,oBAA4B,eAAe;AAC1D,MAAI,OAAQ,uBAAsB,iBAAiB,IAAI;AACvD,SAAO;AACT;AAGO,SAAS,sBAAsB,QAAsB;AAC1D,wBAAsB,oBAAoB,GAAG,SAAS,CAAC,IAAI,MAAM,EAAE;AACrE;AAGO,SAAS,+BAA8C;AAC5D,QAAM,MAAM,oBAA4B,kBAAkB;AAC1D,MAAI,IAAK,uBAAsB,oBAAoB,IAAI;AACvD,SAAO;AACT;AAGO,SAAS,iBAAiB,QAA2B;AAC1D,wBAAsB,eAAe,MAAM;AAC7C;AAGO,SAAS,yBAA+B;AAC7C,QAAM,KAAK,oBAA8B,mBAAmB,KAAK,CAAC;AAClE,KAAG,KAAK,KAAK,IAAI,CAAC;AAClB,MAAI,GAAG,SAAS,GAAI,IAAG,OAAO,GAAG,GAAG,SAAS,EAAE;AAC/C,wBAAsB,qBAAqB,EAAE;AAC/C;AAGO,SAAS,wBAAkC;AAChD,SAAO,oBAA8B,mBAAmB,KAAK,CAAC;AAChE;AAKO,SAAS,gBAAgB,QAAsB;AACpD,wBAAsB,cAAc,GAAG,SAAS,CAAC,IAAI,MAAM,EAAE;AAC/D;AAIO,SAAS,yBAAwC;AACtD,QAAM,IAAI,oBAA4B,YAAY;AAClD,MAAI,EAAG,uBAAsB,cAAc,IAAI;AAC/C,SAAO;AACT;AAKO,SAAS,eAAe,MAAkH;AAC/I,QAAM,IAAI,KAAK,WAAW,GAAG,aAAa;AAC1C,MAAI,OAAwB,EAAE,KAAK,MAAM,eAAe,KAAK;AAC7D,MAAI;AAEF,QAAI,WAAoC,CAAC;AACzC,QAAI;AAAE,iBAAW,KAAK,MAAM,aAAa,GAAG,OAAO,CAAC;AAAA,IAAG,QAAQ;AAAA,IAAuC;AACtG,UAAM,UAAU,OAAO,SAAS,QAAQ,WAAW,SAAS,MAAM;AAClE,WAAO,EAAE,KAAK,SAAS,eAAe,OAAO,SAAS,kBAAkB,WAAW,SAAS,gBAAgB,KAAK;AAEjH,QAAI,WAAW;AACf,QAAI,KAAK,eAAe;AACtB,YAAM,QAAQ,KAAK,IAAI,IAAI,KAAK,iBAAiB;AACjD,UAAI,OAAO,IAAK,YAAW;AAAA,eAClB,QAAQ,KAAM,YAAW;AAAA,UAC7B,YAAW;AAAA,IAClB;AAEA,UAAM,QAAQ,OAAO,QAAQ,IAAI,mBAAmB,KAAK,SAAS,eAAe;AACjF,oBAAgB,GAAG,KAAK,UAAU;AAAA,MAChC,KAAK,KAAK;AAAA,MAAK,aAAa;AAAA,MAAO,WAAW,KAAK;AAAA,MAAW,SAAS,KAAK;AAAA,MAC5E,aAAa;AAAA,MAAS,MAAM,KAAK;AAAA,MAAM,eAAe,KAAK,IAAI;AAAA,MAAG,aAAa,KAAK,eAAe;AAAA,MAAW;AAAA,IAChH,CAAC,CAAC;AAAA,EACJ,SAAS,KAAK;AAAE,kBAAc,yBAAyB,MAAM,GAAG;AAAA,EAAG;AACnE,SAAO;AACT;AAGO,SAAS,sBAA4B;AAC1C,wBAAsB,iBAAiB,KAAK,IAAI,CAAC;AACnD;AAhJA;AAAA;AAKA;AAEA;AAEA;AACA;AAAA;AAAA;",
   "names": []
 }

package/bundle/{chunk-M3JEX6L4.js → chunk-L72RIPEC.js}

@@ -9,15 +9,15 @@ import {
   sessionType,
   typeAgent,
   typeLabel
-} from "./chunk-C7K6VZNY.js";
+} from "./chunk-BNXV7SZI.js";
 import {
   getMasterUserId,
   init_master_user
-} from "./chunk-AFREM7FX.js";
+} from "./chunk-CK7YTA2F.js";
 import {
   init_user_registry,
   loadUsers
-} from "./chunk-ZV4IWKDJ.js";
+} from "./chunk-E7XD5UGB.js";
 import {
   init_kanban_board,
   isUnblocked,
@@ -28,17 +28,17 @@ import {
   kanbanList,
   kanbanRetryOrFail,
   kanbanRunning
-} from "./chunk-EQSG2CRM.js";
+} from "./chunk-FGYDIX54.js";
 import {
   init_log_and_swallow,
   logAndSwallow
-} from "./chunk-YSKCQH6E.js";
+} from "./chunk-2IYJ4I66.js";
 import {
   init_logger,
   logDebug,
   logInfo,
   logWarn
-} from "./chunk-GWILHZPT.js";
+} from "./chunk-XRTXYN66.js";
 import {
   init_paths,
   paths_exports
@@ -380,7 +380,7 @@ __export(spin_exports, {
 });
 async function fireCallback(peerName, taskId, status, result, error, artifacts, tokensUsed) {
   try {
-    const { getPeerTransport } = await import("./peer-transport-5VKK2I7P.js");
+    const { getPeerTransport } = await import("./peer-transport-SI7I72DB.js");
     const transport = getPeerTransport();
     const payload = { action: "callback", task_id: taskId, status, result_summary: result, error, tokens_used: tokensUsed ?? 0 };
     if (artifacts?.length) payload.artifacts = artifacts;
@@ -1069,7 +1069,7 @@ var init_spin = __esm({
       async pollRemoteCards() {
         const remoteCards = kanbanList("running", "status").filter((c) => c.type === "remote");
         if (remoteCards.length === 0) return;
-        const { getPeerTransport } = await import("./peer-transport-5VKK2I7P.js");
+        const { getPeerTransport } = await import("./peer-transport-SI7I72DB.js");
         const transport = getPeerTransport();
         const REMOTE_MAX_AGE_MS = 15 * 60 * 1e3;
         for (const card of remoteCards) {
@@ -1119,4 +1119,4 @@ export {
   spin_exports,
   init_spin
 };
-//# sourceMappingURL=chunk-M3JEX6L4.js.map
+//# sourceMappingURL=chunk-L72RIPEC.js.map

package/bundle/{chunk-TEFZ4JA4.js → chunk-NHPLD3C7.js}

@@ -3,7 +3,7 @@
 import {
   init_log_and_swallow,
   logAndSwallow
-} from "./chunk-YSKCQH6E.js";
+} from "./chunk-2IYJ4I66.js";
 import {
   abtarsHome,
   init_paths
@@ -81,4 +81,4 @@ export {
   _getStats,
   _reset
 };
-//# sourceMappingURL=chunk-TEFZ4JA4.js.map
+//# sourceMappingURL=chunk-NHPLD3C7.js.map

package/bundle/{chunk-2KC5G3EA.js → chunk-OWUO5RS3.js}

@@ -3,17 +3,17 @@
 import {
   getEnv,
   init_env_schema
-} from "./chunk-65VCEC32.js";
+} from "./chunk-6PA5JBUU.js";
 import {
   init_log_and_swallow,
   logAndSwallow
-} from "./chunk-YSKCQH6E.js";
+} from "./chunk-2IYJ4I66.js";
 import {
   init_logger,
   logDebug,
   logInfo,
   logWarn
-} from "./chunk-GWILHZPT.js";
+} from "./chunk-XRTXYN66.js";
 import {
   abtarsHome,
   init_paths
@@ -362,7 +362,7 @@ var BrowserTool = class {
     if (getEnv().ssrfCheck) {
       try {
         const { hostname } = new URL(url);
-        const { isPrivateHost } = await import("./ssrf-guard-O6SHIK6Q.js");
+        const { isPrivateHost } = await import("./ssrf-guard-U2JA72TC.js");
         if (await isPrivateHost(hostname)) {
           return { success: false, error: `Blocked: "${hostname}" resolves to a private/internal IP address` };
         }
@@ -757,4 +757,4 @@ export {
   BrowserIpcServer,
   DomainAllowlist
 };
-//# sourceMappingURL=chunk-2KC5G3EA.js.map
+//# sourceMappingURL=chunk-OWUO5RS3.js.map

package/bundle/{chunk-4MULJ5SS.js → chunk-OY4Q6AMY.js}

@@ -1,11 +1,20 @@
 #!/usr/bin/env node
  import { createRequire as __bundleCreateRequire } from 'node:module'; import { fileURLToPath as __bundleFileURLToPath } from 'node:url'; import { dirname as __bundleDirname } from 'node:path'; const require = __bundleCreateRequire(import.meta.url); const __chunk_filename = __bundleFileURLToPath(import.meta.url); const __chunk_dirname = __bundleDirname(__chunk_filename);
+import {
+  init_peer_config,
+  peer_config_exports
+} from "./chunk-3BG3AIDP.js";
+import {
+  init_peer_auth,
+  peer_auth_exports
+} from "./chunk-WC5O5KOE.js";
 import {
   abtarsHome,
   init_paths
 } from "./chunk-GALQBVKO.js";
 import {
-  __require
+  __require,
+  __toCommonJS
 } from "./chunk-7K2YZTLD.js";
 
 // src/cli/commands/doctor-probes.ts
@@ -15,6 +24,7 @@ import { join } from "node:path";
 import { homedir } from "node:os";
 var home = abtarsHome();
 var configDir = join(home, "config");
+var TTL_MS = 18e4;
 function readJson(path) {
   try {
     return JSON.parse(readFileSync(path, "utf-8"));
@@ -219,9 +229,9 @@ async function probeSha() {
   if (existsSync(join(configDir, "sha-policy.json"))) return { name: "sha", status: "ok", detail: "rules loaded" };
   return { name: "sha", status: "skipped", detail: "no healer rules configured" };
 }
-async function probeAgentApi() {
+async function probeA2a() {
   const env = readEnv();
-  if (env.get("ENABLE_AGENT_API") !== "true") return { name: "agent-api", status: "skipped", detail: "not enabled" };
+  if (env.get("ENABLE_AGENT_API") !== "true") return { name: "a2a", status: "skipped", detail: "not enabled" };
   const port = parseInt(env.get("AGENT_API_PORT") || "7100", 10);
   try {
     const { createConnection } = await import("node:net");
@@ -236,68 +246,80 @@ async function probeAgentApi() {
         reject(new Error("timeout"));
       });
     });
-    return { name: "agent-api", status: "ok", detail: `:${port}` };
+    return { name: "a2a", status: "ok", detail: `${port}` };
   } catch {
-    return { name: "agent-api", status: "failed", detail: `:${port} not listening` };
+    return { name: "a2a", status: "failed", detail: `${port} not listening` };
   }
 }
 async function probePeers() {
   const peersPath = join(configDir, "peers.json");
   const peers = readJson(peersPath);
   if (!peers) return { name: "peers", status: "skipped", detail: "peers.json missing" };
-  const peerCount = Object.keys(peers.peers ?? {}).length;
-  if (peerCount === 0) return { name: "peers", status: "ok", detail: "no peers configured" };
-  const lock = readJson(join(home, "bridge.lock"));
-  const gossipAge = lock?.lastGossipBroadcast ? ago(Date.now() - lock.lastGossipBroadcast) : "unknown";
-  return { name: "peers", status: "ok", detail: `${peerCount} configured, gossip: ${gossipAge}` };
+  if (!peers.self?.signingKey) return { name: "peers", status: "failed", detail: "self.signingKey missing \u2014 run: abtars install" };
+  const peerEntries = Object.entries(peers.peers ?? {});
+  const peerCount = peerEntries.length;
+  if (peerCount === 0) return { name: "peers", status: "skipped", detail: "no peers (solo)" };
+  const missingKey = peerEntries.filter(([, e]) => !e.verifyKey).map(([n]) => n);
+  if (missingKey.length > 0) return { name: "peers", status: "failed", detail: `missing verifyKey: ${missingKey.join(", ")}` };
+  return { name: "peers", status: "ok", detail: `${peerCount} enrolled (all keys valid)` };
 }
-async function probeTls() {
+async function probeIdentity() {
   const env = readEnv();
-  if (env.get("ENABLE_AGENT_API") !== "true") return { name: "tls", status: "skipped", detail: "agent-api disabled" };
-  const certExists = existsSync(join(configDir, "identity.crt"));
-  const keyExists = existsSync(join(configDir, "identity.tls.key"));
-  if (certExists && keyExists) return { name: "tls", status: "ok", detail: "certs present" };
-  const missing = [!certExists && "identity.crt", !keyExists && "identity.tls.key"].filter(Boolean);
-  return { name: "tls", status: "failed", detail: `missing: ${missing.join(", ")}` };
-}
-async function probeA2a() {
-  const peersPath = join(configDir, "peers.json");
-  const peers = readJson(peersPath);
-  if (!peers?.self?.udpPort) return { name: "a2a", status: "skipped", detail: "no gossip port configured" };
-  const port = peers.self.udpPort;
+  if (env.get("ENABLE_AGENT_API") !== "true") return { name: "identity", status: "skipped", detail: "a2a disabled" };
+  const certPath = join(configDir, "identity.crt");
+  const keyPath = join(configDir, "identity.tls.key");
+  const certExists = existsSync(certPath);
+  const keyExists = existsSync(keyPath);
+  if (!certExists || !keyExists) {
+    const missing = [!certExists && "identity.crt", !keyExists && "identity.tls.key"].filter(Boolean);
+    return { name: "identity", status: "failed", detail: `missing: ${missing.join(", ")}` };
+  }
   try {
-    const dgram = await import("node:dgram");
-    const { createHmac } = await import("node:crypto");
-    const key = peers.gossipSecret ?? Object.values(peers.peers ?? {})[0]?.token ?? "default";
-    const payload = JSON.stringify({ type: "ping", name: "__doctor__" });
-    const sig = createHmac("sha256", key).update(payload).digest("base64url").slice(0, 16);
-    const ping = Buffer.from(`${payload}|${sig}`);
-    const alive = await new Promise((resolve) => {
-      const sock = dgram.createSocket("udp4");
-      const timer = setTimeout(() => {
-        sock.close();
-        resolve(false);
-      }, 500);
-      sock.on("message", () => {
-        clearTimeout(timer);
+    const { loadPeerConfig, deriveVerifyKey } = (init_peer_config(), __toCommonJS(peer_config_exports));
+    const { verifyServerCert } = (init_peer_auth(), __toCommonJS(peer_auth_exports));
+    const config = loadPeerConfig();
+    const expectedVerifyKey = deriveVerifyKey(config.self.signingKey);
+    const certPem = readFileSync(certPath, "utf-8");
+    if (!verifyServerCert(certPem, expectedVerifyKey)) {
+      return { name: "identity", status: "failed", detail: "cert pubkey mismatch \u2014 re-run: abtars install --force" };
+    }
+    return { name: "identity", status: "ok", detail: "cert matches signing key" };
+  } catch {
+    return { name: "identity", status: "ok", detail: "cert present (key-match skipped)" };
+  }
+}
+async function probeGossip() {
+  const env = readEnv();
+  if (env.get("ENABLE_AGENT_API") !== "true") return { name: "gossip", status: "skipped", detail: "a2a disabled" };
+  const peers = readJson(join(configDir, "peers.json"));
+  const peerCount = Object.keys(peers?.peers ?? {}).length;
+  if (peerCount === 0) return { name: "gossip", status: "skipped", detail: "no peers (solo)" };
+  if (!peers?.self?.signingKey) return { name: "gossip", status: "failed", detail: "self.signingKey missing \u2014 Ed25519 gossip requires identity" };
+  const port = parseInt(env.get("GOSSIP_PORT") || "5355", 10);
+  const inUse = await new Promise((resolve) => {
+    import("node:dgram").then(({ createSocket }) => {
+      const sock = createSocket("udp4");
+      sock.once("error", (err) => {
         sock.close();
-        resolve(true);
+        resolve(err.code === "EADDRINUSE");
       });
-      sock.on("error", () => {
-        clearTimeout(timer);
+      sock.bind(port, "0.0.0.0", () => {
         sock.close();
         resolve(false);
       });
-      sock.send(ping, port, "127.0.0.1");
-    });
-    return { name: "a2a", status: alive ? "ok" : "failed", detail: alive ? `UDP :${port} alive` : `UDP :${port} no response` };
-  } catch {
-    return { name: "a2a", status: "failed", detail: "UDP probe error" };
-  }
+    }).catch(() => resolve(false));
+  });
+  if (!inUse) return { name: "gossip", status: "failed", detail: `${port} not listening` };
+  const lock = readJson(join(home, "bridge.lock"));
+  const last = typeof lock?.lastGossipBroadcast === "number" ? lock.lastGossipBroadcast : 0;
+  if (!last) return { name: "gossip", status: "ok", detail: `${port} / no broadcast yet` };
+  const age = Date.now() - last;
+  if (age > TTL_MS) return { name: "gossip", status: "failed", detail: `${port} / stale (${ago(age)})` };
+  return { name: "gossip", status: "ok", detail: `${port} / last broadcast ${ago(age)}` };
 }
 async function probeMind() {
   try {
-    const { loadAbmind } = await import("./abmind-lazy-7Z44NODV.js");
+    const { loadAbmind } = await import("./abmind-lazy-E3YCFKQ5.js");
     const mod = await loadAbmind();
     if (!mod) return { name: "mind", status: "skipped", detail: "abmind not installed" };
     return { name: "mind", status: "ok", detail: "abmind loaded (in-process)" };
@@ -312,7 +334,7 @@ async function runAllProbes() {
     Promise.all([probeHeartbeat()].map((p) => timedProbe(() => p))),
     Promise.all([probeTransport(), probeSpin(), probeKanban(), probeSkills(), probeSha()].map((p) => timedProbe(() => p))),
     Promise.all([probeMind()].map((p) => timedProbe(() => p))),
-    Promise.all([probeAgentApi(), probePeers(), probeTls(), probeA2a()].map((p) => timedProbe(() => p)))
+    Promise.all([probeA2a(), probePeers(), probeIdentity(), probeGossip()].map((p) => timedProbe(() => p)))
   ]);
   return { version: "1.0", totalMs: Date.now() - start, layers: { body, heart, brain, soul, tribe } };
 }
@@ -501,4 +523,4 @@ export {
   renderHuman,
   renderJson
 };
-//# sourceMappingURL=chunk-4MULJ5SS.js.map
+//# sourceMappingURL=chunk-OY4Q6AMY.js.map

package/bundle/chunk-OY4Q6AMY.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/cli/commands/doctor-probes.ts"],
+  "sourcesContent": ["/**\n * doctor-probes.ts \u2014 structured health probes grouped by subsystem layer.\n * Replaces scripts/doctor.sh entirely.\n */\n\nimport { existsSync, readFileSync, readdirSync, statSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { homedir } from \"node:os\";\nimport { abtarsHome } from \"../../paths.js\";\n\n// \u2500\u2500 Types \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nexport interface ProbeResult {\n  name: string;\n  status: \"ok\" | \"failed\" | \"skipped\";\n  detail?: string;\n  ms?: number;\n}\n\nexport interface FixResult {\n  probe: string;\n  action: string;\n  success: boolean;\n}\n\nexport type LayerName = \"body\" | \"heart\" | \"brain\" | \"soul\" | \"tribe\";\n\nexport interface DoctorOutput {\n  version: \"1.0\";\n  totalMs: number;\n  layers: Record<LayerName, ProbeResult[]>;\n  fixes?: FixResult[];\n}\n\n// \u2500\u2500 Helpers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nconst home = abtarsHome();\nconst configDir = join(home, \"config\");\nconst TTL_MS = 180_000; // gossip: 3 missed 60s broadcasts \u2192 stale (matches gossip.ts)\n\nfunction readJson(path: string): any | null {\n  try { return JSON.parse(readFileSync(path, \"utf-8\")); } catch { return null; }\n}\n\nfunction readEnv(): Map<string, string> {\n  const envPath = join(configDir, \".env\");\n  const map = new Map<string, string>();\n  if (!existsSync(envPath)) return map;\n  for (const line of readFileSync(envPath, \"utf-8\").split(\"\\n\")) {\n    const m = line.match(/^([A-Z_]+)=(.*)$/);\n    if (m) map.set(m[1]!, m[2]!.replace(/^[\"']|[\"']$/g, \"\"));\n  }\n  return map;\n}\n\nfunction pidAlive(pid: number): boolean {\n  try { process.kill(pid, 0); return true; } catch { return false; }\n}\n\nfunction ago(ms: number): string {\n  const s = Math.round(ms / 1000);\n  if (s < 60) return `${s}s ago`;\n  return `${Math.round(s / 60)}m ago`;\n}\n\nasync function timedProbe(fn: () => Promise<ProbeResult>): Promise<ProbeResult> {\n  const start = Date.now();\n  try {\n    const r = await fn();\n    r.ms = r.ms ?? (Date.now() - start);\n    return r;\n  } catch (err) {\n    return { name: \"unknown\", status: \"failed\", detail: String(err), ms: Date.now() - start };\n  }\n}\n\n// \u2500\u2500 Body Probes \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nasync function probePlatforms(): Promise<ProbeResult> {\n  const { readSecret, initSecretsKey } = await import(\"../../components/secrets.js\");\n  initSecretsKey();\n\n  const results: Array<{ name: string; status: \"ok\" | \"failed\" | \"skipped\"; detail: string }> = [];\n\n  // Telegram: read token, call getMe\n  const telegramToken = readSecret(\"TELEGRAM_BOT_TOKEN\") ?? readSecret(\"TELEGRAM_TOKEN\");\n  if (telegramToken) {\n    const r = await verifyTelegram(telegramToken);\n    results.push({ name: \"telegram\", ...r });\n  }\n\n  // Discord: read token, call gateway\n  const discordToken = readSecret(\"DISCORD_BOT_TOKEN\") ?? readSecret(\"DISCORD_TOKEN\");\n  if (discordToken) {\n    const r = await verifyDiscord(discordToken);\n    results.push({ name: \"discord\", ...r });\n  }\n\n  // IRC: skip real verification (connection-based), just check if configured\n  const ircServer = readSecret(\"IRC_SERVER\");\n  if (ircServer) {\n    results.push({ name: \"irc\", status: \"ok\", detail: \"server configured (connection not verified)\" });\n  }\n\n  if (results.length === 0) return { name: \"platforms\", status: \"skipped\", detail: \"no platform configured\" };\n\n  const failed = results.filter(r => r.status === \"failed\");\n  const skipped = results.filter(r => r.status === \"skipped\");\n  const allOk = failed.length === 0 && skipped.length === 0;\n  const status = allOk ? \"ok\" : failed.length > 0 ? \"failed\" : \"ok\";\n  const detail = results.map(r => `${r.name}: ${r.status}${r.detail ? ` (${r.detail})` : \"\"}`).join(\", \");\n  return { name: \"platforms\", status, detail };\n}\n\nasync function verifyTelegram(token: string): Promise<{ status: \"ok\" | \"failed\" | \"skipped\"; detail: string }> {\n  try {\n    const controller = new AbortController();\n    const timeout = setTimeout(() => controller.abort(), 5000);\n    const res = await fetch(`https://api.telegram.org/bot${token}/getMe`, { signal: controller.signal });\n    clearTimeout(timeout);\n    if (res.ok) return { status: \"ok\", detail: \"getMe ok\" };\n    if (res.status === 401 || res.status === 403) return { status: \"failed\", detail: \"invalid token\" };\n    return { status: \"skipped\", detail: `http ${res.status}` };\n  } catch {\n    return { status: \"skipped\", detail: \"unreachable\" };\n  }\n}\n\nasync function verifyDiscord(token: string): Promise<{ status: \"ok\" | \"failed\" | \"skipped\"; detail: string }> {\n  try {\n    const controller = new AbortController();\n    const timeout = setTimeout(() => controller.abort(), 5000);\n    const res = await fetch(\"https://discord.com/api/v10/users/@me\", {\n      headers: { \"Authorization\": `Bot ${token}` },\n      signal: controller.signal,\n    });\n    clearTimeout(timeout);\n    if (res.ok) return { status: \"ok\", detail: \"gateway ok\" };\n    if (res.status === 401 || res.status === 403) return { status: \"failed\", detail: \"invalid token\" };\n    return { status: \"skipped\", detail: `http ${res.status}` };\n  } catch {\n    return { status: \"skipped\", detail: \"unreachable\" };\n  }\n}\n\nasync function probeDashboard(): Promise<ProbeResult> {\n  const env = readEnv();\n  if (env.get(\"ENABLE_DASHBOARD\") !== \"true\") return { name: \"dashboard\", status: \"skipped\", detail: \"not enabled\" };\n  const port = env.get(\"DASHBOARD_PORT\") || env.get(\"WEB_PORT\") || \"3000\";\n  try {\n    const res = await fetch(`http://127.0.0.1:${port}/`, { signal: AbortSignal.timeout(3000) });\n    return { name: \"dashboard\", status: res.ok ? \"ok\" : \"failed\", detail: `:${port}` };\n  } catch {\n    return { name: \"dashboard\", status: \"failed\", detail: `:${port} unreachable` };\n  }\n}\n\nasync function probeSecurity(): Promise<ProbeResult> {\n  const env = readEnv();\n  const mode = env.get(\"SECURITY_MODE\") || \"off\";\n  const validModes = [\"off\", \"guardrails\", \"seatbelt\", \"docker\"];\n  if (!validModes.includes(mode)) return { name: \"security\", status: \"failed\", detail: `invalid mode: ${mode}` };\n\n  // Check secret file perms\n  const secretDir = join(home, \"secret\");\n  let permIssues = 0;\n  if (existsSync(secretDir)) {\n    for (const f of readdirSync(secretDir)) {\n      const st = statSync(join(secretDir, f));\n      if (st.isFile() && (st.mode & 0o777) !== 0o600) permIssues++;\n    }\n  }\n\n  const parts = [mode];\n  if (existsSync(join(home, \"auth\", \"rules.json\"))) parts.push(\"ActionGate\");\n  if (permIssues > 0) return { name: \"security\", status: \"failed\", detail: `${mode}, ${permIssues} file(s) not 600` };\n  return { name: \"security\", status: \"ok\", detail: parts.join(\", \") };\n}\n\nasync function probeWatchdog(): Promise<ProbeResult> {\n  const lock = readJson(join(home, \"bridge.lock\"));\n  if (!lock) return { name: \"watchdog\", status: \"failed\", detail: \"bridge.lock missing\" };\n\n  const bridgePid = lock.pid ?? 0;\n  const wdPid = lock.watchdogPid ?? 0;\n  const bridgeAlive = bridgePid > 0 && pidAlive(bridgePid);\n  const wdAlive = wdPid > 0 && pidAlive(wdPid);\n\n  if (bridgeAlive && wdAlive) return { name: \"watchdog\", status: \"ok\", detail: `bridge:${bridgePid}, wd:${wdPid}` };\n  if (!bridgeAlive && !wdAlive) return { name: \"watchdog\", status: \"failed\", detail: `bridge:${bridgePid} dead, wd:${wdPid} dead` };\n  if (!wdAlive) return { name: \"watchdog\", status: \"failed\", detail: `bridge:${bridgePid} alive, wd:${wdPid} dead (unprotected)` };\n  return { name: \"watchdog\", status: \"failed\", detail: `bridge:${bridgePid} dead, wd:${wdPid} alive (will restart)` };\n}\n\n// \u2500\u2500 Heart Probes \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nasync function probeHeartbeat(): Promise<ProbeResult> {\n  const lock = readJson(join(home, \"bridge.lock\"));\n  if (!lock?.lastHeartbeat) return { name: \"heartbeat\", status: \"skipped\", detail: \"no bridge.lock\" };\n  const ageMs = Date.now() - lock.lastHeartbeat;\n  if (ageMs > 120_000) return { name: \"heartbeat\", status: \"failed\", detail: `stale (${ago(ageMs)})` };\n  return { name: \"heartbeat\", status: \"ok\", detail: ago(ageMs) };\n}\n\n// #1261: single-bridge invariant \u2014 catches duplicate-bridge regressions at runtime.\n// pgrep counts the bridge processes. >1 means a second bridge is running (likely orphaned).\nasync function probeSingleBridge(): Promise<ProbeResult> {\n  const { spawnSync } = await import(\"node:child_process\");\n  const pgrep = spawnSync(\"pgrep\", [\"-f\", \"app/bundle/abtars.js\"], { encoding: \"utf-8\" });\n  const pids = pgrep.stdout ? pgrep.stdout.trim().split(\"\\n\").filter(Boolean) : [];\n  if (pids.length === 0) return { name: \"single-bridge\", status: \"skipped\", detail: \"no bridge running\" };\n  if (pids.length === 1) return { name: \"single-bridge\", status: \"ok\", detail: `pid:${pids[0]}` };\n  return { name: \"single-bridge\", status: \"failed\", detail: `${pids.length} bridges running: ${pids.join(\",\")}` };\n}\n\n// \u2500\u2500 Brain Probes \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nasync function probeTransport(): Promise<ProbeResult> {\n  const tPath = join(configDir, \"transport.json\");\n  const t = readJson(tPath);\n  if (!t) return { name: \"transport\", status: \"failed\", detail: \"transport.json missing or invalid\" };\n  const agents = Object.keys(t.agents ?? {});\n  if (agents.length === 0) return { name: \"transport\", status: \"failed\", detail: \"no agents configured\" };\n  return { name: \"transport\", status: \"ok\", detail: `${agents.length} agent(s): ${agents.join(\", \")}` };\n}\n\nasync function probeSpin(): Promise<ProbeResult> {\n  const lock = readJson(join(home, \"bridge.lock\"));\n  if (!lock?.pid || !pidAlive(lock.pid)) return { name: \"spin\", status: \"failed\", detail: \"bridge not running\" };\n  return { name: \"spin\", status: \"ok\", detail: \"bridge alive\" };\n}\n\nasync function probeKanban(): Promise<ProbeResult> {\n  const dbPath = join(home, \"kanban\", \"kanban.db\");\n  if (!existsSync(dbPath)) return { name: \"kanban\", status: \"skipped\", detail: \"kanban.db not found\" };\n  const sharedNm = join(homedir(), \".local\", \"lib\", \"node_modules\", \"better-sqlite3\");\n  if (!existsSync(sharedNm)) return { name: \"kanban\", status: \"skipped\", detail: \"better-sqlite3 not installed (run: abtars deps install)\" };\n  let Db: any;\n  try {\n    const { createRequire } = await import(\"node:module\");\n    const _require = createRequire(import.meta.url);\n    Db = _require(sharedNm);\n  } catch (err) {\n    return { name: \"kanban\", status: \"skipped\", detail: `better-sqlite3 not loadable: ${err instanceof Error ? err.message : String(err)}` };\n  }\n  try {\n    const db = new Db(dbPath, { readonly: true });\n    const row = db.prepare(\"SELECT COUNT(*) as cnt FROM kanban_board\").get() as { cnt: number };\n    const stuck = db.prepare(\"SELECT COUNT(*) as cnt FROM kanban_board WHERE status='running' AND updated_at < datetime('now', '-10 minutes')\").get() as { cnt: number };\n    db.close();\n    const detail = stuck.cnt > 0 ? `${row.cnt} cards, ${stuck.cnt} stuck` : `${row.cnt} cards`;\n    return { name: \"kanban\", status: stuck.cnt > 0 ? \"failed\" : \"ok\", detail };\n  } catch (err) {\n    return { name: \"kanban\", status: \"skipped\", detail: `kanban.db query failed: ${err instanceof Error ? err.message : String(err)}` };\n  }\n}\n\nasync function probeSkills(): Promise<ProbeResult> {\n  const catalog = join(home, \"skills\", \"skills_catalog.md\");\n  if (!existsSync(catalog)) return { name: \"skills\", status: \"failed\", detail: \"skills_catalog.md missing\" };\n  const content = readFileSync(catalog, \"utf-8\");\n  const count = (content.match(/^## /gm) || []).length;\n  if (count === 0) return { name: \"skills\", status: \"failed\", detail: \"catalog empty\" };\n  return { name: \"skills\", status: \"ok\", detail: `${count} loaded` };\n}\n\nasync function probeSha(): Promise<ProbeResult> {\n  // Check if healer skill exists in catalog\n  const catalog = join(home, \"skills\", \"skills_catalog.md\");\n  if (!existsSync(catalog)) return { name: \"sha\", status: \"skipped\", detail: \"no catalog\" };\n  const content = readFileSync(catalog, \"utf-8\");\n  if (/self.heal|healer|auto.fix/i.test(content)) return { name: \"sha\", status: \"ok\", detail: \"rules loaded\" };\n  // Check sha-policy.json\n  if (existsSync(join(configDir, \"sha-policy.json\"))) return { name: \"sha\", status: \"ok\", detail: \"rules loaded\" };\n  return { name: \"sha\", status: \"skipped\", detail: \"no healer rules configured\" };\n}\n\n// \u2500\u2500 Tribe Probes \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nasync function probeA2a(): Promise<ProbeResult> {\n  const env = readEnv();\n  if (env.get(\"ENABLE_AGENT_API\") !== \"true\") return { name: \"a2a\", status: \"skipped\", detail: \"not enabled\" };\n  const port = parseInt(env.get(\"AGENT_API_PORT\") || \"7100\", 10);\n  try {\n    const { createConnection } = await import(\"node:net\");\n    await new Promise<void>((resolve, reject) => {\n      const sock = createConnection({ port, host: \"127.0.0.1\" }, () => { sock.destroy(); resolve(); });\n      sock.on(\"error\", reject);\n      sock.setTimeout(2000, () => { sock.destroy(); reject(new Error(\"timeout\")); });\n    });\n    return { name: \"a2a\", status: \"ok\", detail: `${port}` };\n  } catch {\n    return { name: \"a2a\", status: \"failed\", detail: `${port} not listening` };\n  }\n}\n\nasync function probePeers(): Promise<ProbeResult> {\n  const peersPath = join(configDir, \"peers.json\");\n  const peers = readJson(peersPath) as { peers?: Record<string, { verifyKey?: string; trust?: number }>; self?: { signingKey?: string; tribeToken?: string } } | null;\n  if (!peers) return { name: \"peers\", status: \"skipped\", detail: \"peers.json missing\" };\n  if (!peers.self?.signingKey) return { name: \"peers\", status: \"failed\", detail: \"self.signingKey missing \u2014 run: abtars install\" };\n\n  const peerEntries = Object.entries(peers.peers ?? {});\n  const peerCount = peerEntries.length;\n  if (peerCount === 0) return { name: \"peers\", status: \"skipped\", detail: \"no peers (solo)\" };\n\n  // Check that all peers have verifyKey\n  const missingKey = peerEntries.filter(([, e]) => !e.verifyKey).map(([n]) => n);\n  if (missingKey.length > 0) return { name: \"peers\", status: \"failed\", detail: `missing verifyKey: ${missingKey.join(\", \")}` };\n\n  return { name: \"peers\", status: \"ok\", detail: `${peerCount} enrolled (all keys valid)` };\n}\n\nasync function probeIdentity(): Promise<ProbeResult> {\n  const env = readEnv();\n  if (env.get(\"ENABLE_AGENT_API\") !== \"true\") return { name: \"identity\", status: \"skipped\", detail: \"a2a disabled\" };\n\n  const certPath = join(configDir, \"identity.crt\");\n  const keyPath = join(configDir, \"identity.tls.key\");\n  const certExists = existsSync(certPath);\n  const keyExists = existsSync(keyPath);\n  if (!certExists || !keyExists) {\n    const missing = [!certExists && \"identity.crt\", !keyExists && \"identity.tls.key\"].filter(Boolean);\n    return { name: \"identity\", status: \"failed\", detail: `missing: ${missing.join(\", \")}` };\n  }\n\n  // Verify cert public key matches self.signingKey (#1293)\n  try {\n    const { loadPeerConfig, deriveVerifyKey } = require(\"../../components/peer-config.js\") as typeof import(\"../../components/peer-config.js\");\n    const { verifyServerCert } = require(\"../../components/peer-transport/peer-auth.js\") as typeof import(\"../../components/peer-transport/peer-auth.js\");\n    const config = loadPeerConfig();\n    const expectedVerifyKey = deriveVerifyKey(config.self.signingKey);\n    const certPem = readFileSync(certPath, \"utf-8\");\n    if (!verifyServerCert(certPem, expectedVerifyKey)) {\n      return { name: \"identity\", status: \"failed\", detail: \"cert pubkey mismatch \u2014 re-run: abtars install --force\" };\n    }\n    return { name: \"identity\", status: \"ok\", detail: \"cert matches signing key\" };\n  } catch {\n    return { name: \"identity\", status: \"ok\", detail: \"cert present (key-match skipped)\" };\n  }\n}\n\nasync function probeGossip(): Promise<ProbeResult> {\n  const env = readEnv();\n  if (env.get(\"ENABLE_AGENT_API\") !== \"true\") return { name: \"gossip\", status: \"skipped\", detail: \"a2a disabled\" };\n\n  const peers = readJson(join(configDir, \"peers.json\")) as { peers?: Record<string, unknown>; self?: { signingKey?: string } } | null;\n  const peerCount = Object.keys(peers?.peers ?? {}).length;\n  if (peerCount === 0) return { name: \"gossip\", status: \"skipped\", detail: \"no peers (solo)\" };\n  if (!peers?.self?.signingKey) return { name: \"gossip\", status: \"failed\", detail: \"self.signingKey missing \u2014 Ed25519 gossip requires identity\" };\n\n  const port = parseInt(env.get(\"GOSSIP_PORT\") || \"5355\", 10);\n\n  // Bind-test: if the port is already in use, gossip is live (EADDRINUSE = good).\n  // If we can bind it, nothing is listening \u2192 gossip not running.\n  const inUse = await new Promise<boolean>((resolve) => {\n    import(\"node:dgram\").then(({ createSocket }) => {\n      const sock = createSocket(\"udp4\");\n      sock.once(\"error\", (err: NodeJS.ErrnoException) => { sock.close(); resolve(err.code === \"EADDRINUSE\"); });\n      sock.bind(port, \"0.0.0.0\", () => { sock.close(); resolve(false); });\n    }).catch(() => resolve(false));\n  });\n  if (!inUse) return { name: \"gossip\", status: \"failed\", detail: `${port} not listening` };\n\n  // Live \u2014 report broadcast freshness.\n  const lock = readJson(join(home, \"bridge.lock\"));\n  const last = typeof lock?.lastGossipBroadcast === \"number\" ? lock.lastGossipBroadcast : 0;\n  if (!last) return { name: \"gossip\", status: \"ok\", detail: `${port} / no broadcast yet` };\n  const age = Date.now() - last;\n  if (age > TTL_MS) return { name: \"gossip\", status: \"failed\", detail: `${port} / stale (${ago(age)})` };\n  return { name: \"gossip\", status: \"ok\", detail: `${port} / last broadcast ${ago(age)}` };\n}\n\n// \u2500\u2500 Soul Probes \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nasync function probeMind(): Promise<ProbeResult> {\n  try {\n    const { loadAbmind } = await import(\"../../utils/abmind-lazy.js\");\n    const mod = await loadAbmind();\n    if (!mod) return { name: \"mind\", status: \"skipped\", detail: \"abmind not installed\" };\n    return { name: \"mind\", status: \"ok\", detail: \"abmind loaded (in-process)\" };\n  } catch {\n    return { name: \"mind\", status: \"skipped\", detail: \"abmind load failed\" };\n  }\n}\n\n// \u2500\u2500 Runner \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nexport async function runAllProbes(): Promise<DoctorOutput> {\n  const start = Date.now();\n\n  const [body, heart, brain, soul, tribe] = await Promise.all([\n    Promise.all([probePlatforms(), probeDashboard(), probeSecurity(), probeWatchdog(), probeSingleBridge()].map(p => timedProbe(() => p))),\n    Promise.all([probeHeartbeat()].map(p => timedProbe(() => p))),\n    Promise.all([probeTransport(), probeSpin(), probeKanban(), probeSkills(), probeSha()].map(p => timedProbe(() => p))),\n    Promise.all([probeMind()].map(p => timedProbe(() => p))),\n    Promise.all([probeA2a(), probePeers(), probeIdentity(), probeGossip()].map(p => timedProbe(() => p))),\n  ]);\n\n  return { version: \"1.0\", totalMs: Date.now() - start, layers: { body, heart, brain, soul, tribe } };\n}\n\n// \u2500\u2500 Fix Logic \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nexport async function runFixes(): Promise<FixResult[]> {\n  const { chmodSync, unlinkSync, mkdirSync, existsSync: ex, readdirSync: rd, statSync: st, readFileSync: rf, writeFileSync: wf } = await import(\"node:fs\");\n  const { spawnSync } = await import(\"node:child_process\");\n  const fixes: FixResult[] = [];\n\n  function fix(probe: string, action: string, fn: () => void): void {\n    try { fn(); fixes.push({ probe, action, success: true }); }\n    catch { fixes.push({ probe, action, success: false }); }\n  }\n\n  // 1. chmod 700 sensitive dirs\n  for (const dir of [\"config\", \"secret\", \"auth\", \"hooks\"]) {\n    const p = join(home, dir);\n    if (ex(p) && (st(p).mode & 0o777) !== 0o700) {\n      fix(\"security\", `${dir}/ \u2192 700`, () => chmodSync(p, 0o700));\n    }\n  }\n\n  // 2. chmod 600 secret files\n  const secretDir = join(home, \"secret\");\n  if (ex(secretDir)) {\n    for (const f of rd(secretDir)) {\n      const fp = join(secretDir, f);\n      if (st(fp).isFile() && (st(fp).mode & 0o777) !== 0o600) {\n        fix(\"security\", `${f} \u2192 600`, () => chmodSync(fp, 0o600));\n      }\n    }\n  }\n\n  // 3. chmod 600 config files\n  if (ex(configDir)) {\n    for (const f of rd(configDir)) {\n      const fp = join(configDir, f);\n      if (st(fp).isFile() && (st(fp).mode & 0o777) !== 0o600) {\n        fix(\"security\", `config/${f} \u2192 600`, () => chmodSync(fp, 0o600));\n      }\n    }\n  }\n\n  // 4. Stale deploy.lock\n  const deployLock = join(home, \"deploy.lock\");\n  if (ex(deployLock)) {\n    const lock = readJson(deployLock);\n    const lockAge = lock?.startedAt ? (Date.now() - new Date(lock.startedAt).getTime()) / 1000 : 9999;\n    const lockPid = lock?.pid ?? 0;\n    if (lockAge > 300 && (lockPid === 0 || !pidAlive(lockPid))) {\n      fix(\"watchdog\", \"removed stale deploy.lock\", () => unlinkSync(deployLock));\n    }\n  }\n\n  // 5. Stale .start-reason\n  const startReason = join(home, \".start-reason\");\n  if (ex(startReason)) {\n    const age = (Date.now() - st(startReason).mtimeMs) / 1000;\n    if (age > 300) fix(\"watchdog\", \"removed stale .start-reason\", () => unlinkSync(startReason));\n  }\n\n  // 6. Create missing dirs\n  for (const dir of [\"logs\", \"workspace\", \"overflow\", \"received\"]) {\n    const p = join(home, dir);\n    if (!ex(p)) fix(\"watchdog\", `created ${dir}/`, () => mkdirSync(p, { recursive: true }));\n  }\n\n  // 7. Kill orphan CLI processes\n  try {\n    const lock = readJson(join(home, \"bridge.lock\"));\n    const bridgePid = lock?.pid ?? 0;\n    const wdPid = lock?.watchdogPid ?? 0;\n\n    // Orphan kiro-cli\n    const kiro = spawnSync(\"pgrep\", [\"-f\", \"kiro-cli.*acp\"], { encoding: \"utf-8\" });\n    if (kiro.stdout) {\n      for (const pid of kiro.stdout.trim().split(\"\\n\").filter(Boolean).map(Number)) {\n        if (pid > 0 && pid !== bridgePid && pid !== wdPid && pid !== process.pid) {\n          fix(\"brain\", `killed orphan kiro-cli ${pid}`, () => process.kill(pid, \"SIGTERM\"));\n        }\n      }\n    }\n\n    // Orphan abtars-sleep\n    const sleep = spawnSync(\"pgrep\", [\"-f\", \"abtars-sleep\"], { encoding: \"utf-8\" });\n    if (sleep.stdout) {\n      for (const pid of sleep.stdout.trim().split(\"\\n\").filter(Boolean).map(Number)) {\n        if (pid > 0 && pid !== bridgePid) {\n          fix(\"brain\", `killed orphan abtars-sleep ${pid}`, () => process.kill(pid, \"SIGTERM\"));\n        }\n      }\n    }\n  } catch { /* pgrep not available or no orphans */ }\n\n  // 8. Stale locks/sockets\n  for (const f of [\"sleep.lock\", \"memory.sock\"]) {\n    const p = join(home, f);\n    if (ex(p)) {\n      const age = (Date.now() - st(p).mtimeMs) / 1000;\n      const lock = readJson(join(home, \"bridge.lock\"));\n      if (age > 600 && (!lock?.pid || !pidAlive(lock.pid))) {\n        fix(\"watchdog\", `removed stale ${f}`, () => unlinkSync(p));\n      }\n    }\n  }\n\n  // 9. Retention: delete old logs/overflow/media\n  const LOGS_KEEP_DAYS = 7;\n  const DATA_KEEP_DAYS = 30;\n  try {\n    const cutoffLogs = Date.now() - LOGS_KEEP_DAYS * 86400_000;\n    const cutoffData = Date.now() - DATA_KEEP_DAYS * 86400_000;\n\n    for (const [dir, cutoff] of [[join(home, \"logs\"), cutoffLogs], [join(home, \"overflow\"), cutoffData], [join(home, \"received\", \"media\"), cutoffLogs]] as const) {\n      if (!ex(dir)) continue;\n      let deleted = 0;\n      for (const f of rd(dir)) {\n        const fp = join(dir, f);\n        if (st(fp).isFile() && st(fp).mtimeMs < cutoff) { unlinkSync(fp); deleted++; }\n      }\n      if (deleted > 0) fixes.push({ probe: \"retention\", action: `deleted ${deleted} stale file(s) from ${dir.split(\"/\").pop()}`, success: true });\n    }\n\n    // Truncate audit.jsonl if >10MB\n    const auditPath = join(home, \"auth\", \"audit.jsonl\");\n    if (ex(auditPath) && st(auditPath).size > 10_000_000) {\n      const lines = rf(auditPath, \"utf-8\").split(\"\\n\");\n      wf(auditPath, lines.slice(-1000).join(\"\\n\"));\n      fixes.push({ probe: \"retention\", action: \"truncated audit.jsonl\", success: true });\n    }\n  } catch { /* retention errors non-fatal */ }\n\n  // 10. Kill duplicate bridges\n  try {\n    const lock = readJson(join(home, \"bridge.lock\"));\n    const expectedPid = lock?.pid ?? 0;\n    const pgrep = spawnSync(\"pgrep\", [\"-f\", \"abtars.*main\"], { encoding: \"utf-8\" });\n    if (pgrep.stdout) {\n      for (const pid of pgrep.stdout.trim().split(\"\\n\").filter(Boolean).map(Number)) {\n        if (pid > 0 && pid !== expectedPid && pid !== process.pid) {\n          fix(\"watchdog\", `killed duplicate bridge ${pid}`, () => process.kill(pid, \"SIGTERM\"));\n        }\n      }\n    }\n  } catch { /* non-fatal */ }\n\n  // 11. Hooks dir perms\n  const hooksDir = join(home, \"hooks\");\n  if (ex(hooksDir) && (st(hooksDir).mode & 0o777) !== 0o700) {\n    fix(\"security\", \"hooks/ \u2192 700\", () => chmodSync(hooksDir, 0o700));\n  }\n\n  // 12. Install watchdog service if missing\n  try {\n    const manifest = readJson(join(home, \"manifest.json\"));\n    if (manifest?.installMode === \"daemon\") {\n      const { platform } = await import(\"node:os\");\n      if (platform() === \"darwin\") {\n        const plist = `${home}/com.abtars.watchdog.plist`;\n        const dst = `${process.env[\"HOME\"]}/Library/LaunchAgents/com.abtars.watchdog.plist`;\n        if (ex(plist) && !ex(dst)) {\n          fix(\"watchdog\", \"installed LaunchAgent\", () => {\n            const { copyFileSync } = require(\"node:fs\");\n            copyFileSync(plist, dst);\n            spawnSync(\"launchctl\", [\"load\", dst]);\n          });\n        }\n      } else {\n        const svc = `${home}/abtars-watchdog.service`;\n        const dst = `${process.env[\"HOME\"]}/.config/systemd/user/abtars-watchdog.service`;\n        if (ex(svc) && !ex(dst)) {\n          fix(\"watchdog\", \"installed systemd unit\", () => {\n            mkdirSync(join(process.env[\"HOME\"]!, \".config\", \"systemd\", \"user\"), { recursive: true });\n            const { copyFileSync } = require(\"node:fs\");\n            copyFileSync(svc, dst);\n            spawnSync(\"systemctl\", [\"--user\", \"enable\", \"--now\", \"abtars-watchdog.service\"]);\n          });\n        }\n      }\n    }\n  } catch { /* non-fatal */ }\n\n  return fixes;\n}\n\n// \u2500\u2500 Renderer \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nconst ICON = { ok: \"\u2713\", failed: \"\u2717\", skipped: \"~\" } as const;\n\nexport function renderHuman(output: DoctorOutput): string {\n  const lines: string[] = [];\n  for (const [layer, probes] of Object.entries(output.layers) as [string, ProbeResult[]][]) {\n    lines.push(`${layer.charAt(0).toUpperCase() + layer.slice(1)}:`);\n    for (const p of probes) {\n      const ms = p.ms && p.ms > 500 ? ` (${p.ms}ms)` : \"\";\n      const detail = p.detail ? ` \u2014 ${p.detail}` : \"\";\n      lines.push(`  ${ICON[p.status]} ${p.name}${ms}${detail}`);\n    }\n  }\n  const total = Object.values(output.layers).flat();\n  const okCount = total.filter(r => r.status === \"ok\").length;\n  lines.push(`\\n${okCount}/${total.length} ok (${(output.totalMs / 1000).toFixed(1)}s)`);\n  return lines.join(\"\\n\");\n}\n\nexport function renderJson(output: DoctorOutput): string {\n  return JSON.stringify(output, null, 2);\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;AAQA;AAHA,SAAS,YAAY,cAAc,aAAa,gBAAgB;AAChE,SAAS,YAAY;AACrB,SAAS,eAAe;AA6BxB,IAAM,OAAO,WAAW;AACxB,IAAM,YAAY,KAAK,MAAM,QAAQ;AACrC,IAAM,SAAS;AAEf,SAAS,SAAS,MAA0B;AAC1C,MAAI;AAAE,WAAO,KAAK,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,EAAG,QAAQ;AAAE,WAAO;AAAA,EAAM;AAC/E;AAEA,SAAS,UAA+B;AACtC,QAAM,UAAU,KAAK,WAAW,MAAM;AACtC,QAAM,MAAM,oBAAI,IAAoB;AACpC,MAAI,CAAC,WAAW,OAAO,EAAG,QAAO;AACjC,aAAW,QAAQ,aAAa,SAAS,OAAO,EAAE,MAAM,IAAI,GAAG;AAC7D,UAAM,IAAI,KAAK,MAAM,kBAAkB;AACvC,QAAI,EAAG,KAAI,IAAI,EAAE,CAAC,GAAI,EAAE,CAAC,EAAG,QAAQ,gBAAgB,EAAE,CAAC;AAAA,EACzD;AACA,SAAO;AACT;AAEA,SAAS,SAAS,KAAsB;AACtC,MAAI;AAAE,YAAQ,KAAK,KAAK,CAAC;AAAG,WAAO;AAAA,EAAM,QAAQ;AAAE,WAAO;AAAA,EAAO;AACnE;AAEA,SAAS,IAAI,IAAoB;AAC/B,QAAM,IAAI,KAAK,MAAM,KAAK,GAAI;AAC9B,MAAI,IAAI,GAAI,QAAO,GAAG,CAAC;AACvB,SAAO,GAAG,KAAK,MAAM,IAAI,EAAE,CAAC;AAC9B;AAEA,eAAe,WAAW,IAAsD;AAC9E,QAAM,QAAQ,KAAK,IAAI;AACvB,MAAI;AACF,UAAM,IAAI,MAAM,GAAG;AACnB,MAAE,KAAK,EAAE,MAAO,KAAK,IAAI,IAAI;AAC7B,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,WAAO,EAAE,MAAM,WAAW,QAAQ,UAAU,QAAQ,OAAO,GAAG,GAAG,IAAI,KAAK,IAAI,IAAI,MAAM;AAAA,EAC1F;AACF;AAIA,eAAe,iBAAuC;AACpD,QAAM,EAAE,YAAY,eAAe,IAAI,MAAM,OAAO,uBAA6B;AACjF,iBAAe;AAEf,QAAM,UAAwF,CAAC;AAG/F,QAAM,gBAAgB,WAAW,oBAAoB,KAAK,WAAW,gBAAgB;AACrF,MAAI,eAAe;AACjB,UAAM,IAAI,MAAM,eAAe,aAAa;AAC5C,YAAQ,KAAK,EAAE,MAAM,YAAY,GAAG,EAAE,CAAC;AAAA,EACzC;AAGA,QAAM,eAAe,WAAW,mBAAmB,KAAK,WAAW,eAAe;AAClF,MAAI,cAAc;AAChB,UAAM,IAAI,MAAM,cAAc,YAAY;AAC1C,YAAQ,KAAK,EAAE,MAAM,WAAW,GAAG,EAAE,CAAC;AAAA,EACxC;AAGA,QAAM,YAAY,WAAW,YAAY;AACzC,MAAI,WAAW;AACb,YAAQ,KAAK,EAAE,MAAM,OAAO,QAAQ,MAAM,QAAQ,8CAA8C,CAAC;AAAA,EACnG;AAEA,MAAI,QAAQ,WAAW,EAAG,QAAO,EAAE,MAAM,aAAa,QAAQ,WAAW,QAAQ,yBAAyB;AAE1G,QAAM,SAAS,QAAQ,OAAO,OAAK,EAAE,WAAW,QAAQ;AACxD,QAAM,UAAU,QAAQ,OAAO,OAAK,EAAE,WAAW,SAAS;AAC1D,QAAM,QAAQ,OAAO,WAAW,KAAK,QAAQ,WAAW;AACxD,QAAM,SAAS,QAAQ,OAAO,OAAO,SAAS,IAAI,WAAW;AAC7D,QAAM,SAAS,QAAQ,IAAI,OAAK,GAAG,EAAE,IAAI,KAAK,EAAE,MAAM,GAAG,EAAE,SAAS,KAAK,EAAE,MAAM,MAAM,EAAE,EAAE,EAAE,KAAK,IAAI;AACtG,SAAO,EAAE,MAAM,aAAa,QAAQ,OAAO;AAC7C;AAEA,eAAe,eAAe,OAAiF;AAC7G,MAAI;AACF,UAAM,aAAa,IAAI,gBAAgB;AACvC,UAAM,UAAU,WAAW,MAAM,WAAW,MAAM,GAAG,GAAI;AACzD,UAAM,MAAM,MAAM,MAAM,+BAA+B,KAAK,UAAU,EAAE,QAAQ,WAAW,OAAO,CAAC;AACnG,iBAAa,OAAO;AACpB,QAAI,IAAI,GAAI,QAAO,EAAE,QAAQ,MAAM,QAAQ,WAAW;AACtD,QAAI,IAAI,WAAW,OAAO,IAAI,WAAW,IAAK,QAAO,EAAE,QAAQ,UAAU,QAAQ,gBAAgB;AACjG,WAAO,EAAE,QAAQ,WAAW,QAAQ,QAAQ,IAAI,MAAM,GAAG;AAAA,EAC3D,QAAQ;AACN,WAAO,EAAE,QAAQ,WAAW,QAAQ,cAAc;AAAA,EACpD;AACF;AAEA,eAAe,cAAc,OAAiF;AAC5G,MAAI;AACF,UAAM,aAAa,IAAI,gBAAgB;AACvC,UAAM,UAAU,WAAW,MAAM,WAAW,MAAM,GAAG,GAAI;AACzD,UAAM,MAAM,MAAM,MAAM,yCAAyC;AAAA,MAC/D,SAAS,EAAE,iBAAiB,OAAO,KAAK,GAAG;AAAA,MAC3C,QAAQ,WAAW;AAAA,IACrB,CAAC;AACD,iBAAa,OAAO;AACpB,QAAI,IAAI,GAAI,QAAO,EAAE,QAAQ,MAAM,QAAQ,aAAa;AACxD,QAAI,IAAI,WAAW,OAAO,IAAI,WAAW,IAAK,QAAO,EAAE,QAAQ,UAAU,QAAQ,gBAAgB;AACjG,WAAO,EAAE,QAAQ,WAAW,QAAQ,QAAQ,IAAI,MAAM,GAAG;AAAA,EAC3D,QAAQ;AACN,WAAO,EAAE,QAAQ,WAAW,QAAQ,cAAc;AAAA,EACpD;AACF;AAEA,eAAe,iBAAuC;AACpD,QAAM,MAAM,QAAQ;AACpB,MAAI,IAAI,IAAI,kBAAkB,MAAM,OAAQ,QAAO,EAAE,MAAM,aAAa,QAAQ,WAAW,QAAQ,cAAc;AACjH,QAAM,OAAO,IAAI,IAAI,gBAAgB,KAAK,IAAI,IAAI,UAAU,KAAK;AACjE,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,oBAAoB,IAAI,KAAK,EAAE,QAAQ,YAAY,QAAQ,GAAI,EAAE,CAAC;AAC1F,WAAO,EAAE,MAAM,aAAa,QAAQ,IAAI,KAAK,OAAO,UAAU,QAAQ,IAAI,IAAI,GAAG;AAAA,EACnF,QAAQ;AACN,WAAO,EAAE,MAAM,aAAa,QAAQ,UAAU,QAAQ,IAAI,IAAI,eAAe;AAAA,EAC/E;AACF;AAEA,eAAe,gBAAsC;AACnD,QAAM,MAAM,QAAQ;AACpB,QAAM,OAAO,IAAI,IAAI,eAAe,KAAK;AACzC,QAAM,aAAa,CAAC,OAAO,cAAc,YAAY,QAAQ;AAC7D,MAAI,CAAC,WAAW,SAAS,IAAI,EAAG,QAAO,EAAE,MAAM,YAAY,QAAQ,UAAU,QAAQ,iBAAiB,IAAI,GAAG;AAG7G,QAAM,YAAY,KAAK,MAAM,QAAQ;AACrC,MAAI,aAAa;AACjB,MAAI,WAAW,SAAS,GAAG;AACzB,eAAW,KAAK,YAAY,SAAS,GAAG;AACtC,YAAM,KAAK,SAAS,KAAK,WAAW,CAAC,CAAC;AACtC,UAAI,GAAG,OAAO,MAAM,GAAG,OAAO,SAAW,IAAO;AAAA,IAClD;AAAA,EACF;AAEA,QAAM,QAAQ,CAAC,IAAI;AACnB,MAAI,WAAW,KAAK,MAAM,QAAQ,YAAY,CAAC,EAAG,OAAM,KAAK,YAAY;AACzE,MAAI,aAAa,EAAG,QAAO,EAAE,MAAM,YAAY,QAAQ,UAAU,QAAQ,GAAG,IAAI,KAAK,UAAU,mBAAmB;AAClH,SAAO,EAAE,MAAM,YAAY,QAAQ,MAAM,QAAQ,MAAM,KAAK,IAAI,EAAE;AACpE;AAEA,eAAe,gBAAsC;AACnD,QAAM,OAAO,SAAS,KAAK,MAAM,aAAa,CAAC;AAC/C,MAAI,CAAC,KAAM,QAAO,EAAE,MAAM,YAAY,QAAQ,UAAU,QAAQ,sBAAsB;AAEtF,QAAM,YAAY,KAAK,OAAO;AAC9B,QAAM,QAAQ,KAAK,eAAe;AAClC,QAAM,cAAc,YAAY,KAAK,SAAS,SAAS;AACvD,QAAM,UAAU,QAAQ,KAAK,SAAS,KAAK;AAE3C,MAAI,eAAe,QAAS,QAAO,EAAE,MAAM,YAAY,QAAQ,MAAM,QAAQ,UAAU,SAAS,QAAQ,KAAK,GAAG;AAChH,MAAI,CAAC,eAAe,CAAC,QAAS,QAAO,EAAE,MAAM,YAAY,QAAQ,UAAU,QAAQ,UAAU,SAAS,aAAa,KAAK,QAAQ;AAChI,MAAI,CAAC,QAAS,QAAO,EAAE,MAAM,YAAY,QAAQ,UAAU,QAAQ,UAAU,SAAS,cAAc,KAAK,sBAAsB;AAC/H,SAAO,EAAE,MAAM,YAAY,QAAQ,UAAU,QAAQ,UAAU,SAAS,aAAa,KAAK,wBAAwB;AACpH;AAIA,eAAe,iBAAuC;AACpD,QAAM,OAAO,SAAS,KAAK,MAAM,aAAa,CAAC;AAC/C,MAAI,CAAC,MAAM,cAAe,QAAO,EAAE,MAAM,aAAa,QAAQ,WAAW,QAAQ,iBAAiB;AAClG,QAAM,QAAQ,KAAK,IAAI,IAAI,KAAK;AAChC,MAAI,QAAQ,KAAS,QAAO,EAAE,MAAM,aAAa,QAAQ,UAAU,QAAQ,UAAU,IAAI,KAAK,CAAC,IAAI;AACnG,SAAO,EAAE,MAAM,aAAa,QAAQ,MAAM,QAAQ,IAAI,KAAK,EAAE;AAC/D;AAIA,eAAe,oBAA0C;AACvD,QAAM,EAAE,UAAU,IAAI,MAAM,OAAO,oBAAoB;AACvD,QAAM,QAAQ,UAAU,SAAS,CAAC,MAAM,sBAAsB,GAAG,EAAE,UAAU,QAAQ,CAAC;AACtF,QAAM,OAAO,MAAM,SAAS,MAAM,OAAO,KAAK,EAAE,MAAM,IAAI,EAAE,OAAO,OAAO,IAAI,CAAC;AAC/E,MAAI,KAAK,WAAW,EAAG,QAAO,EAAE,MAAM,iBAAiB,QAAQ,WAAW,QAAQ,oBAAoB;AACtG,MAAI,KAAK,WAAW,EAAG,QAAO,EAAE,MAAM,iBAAiB,QAAQ,MAAM,QAAQ,OAAO,KAAK,CAAC,CAAC,GAAG;AAC9F,SAAO,EAAE,MAAM,iBAAiB,QAAQ,UAAU,QAAQ,GAAG,KAAK,MAAM,qBAAqB,KAAK,KAAK,GAAG,CAAC,GAAG;AAChH;AAIA,eAAe,iBAAuC;AACpD,QAAM,QAAQ,KAAK,WAAW,gBAAgB;AAC9C,QAAM,IAAI,SAAS,KAAK;AACxB,MAAI,CAAC,EAAG,QAAO,EAAE,MAAM,aAAa,QAAQ,UAAU,QAAQ,oCAAoC;AAClG,QAAM,SAAS,OAAO,KAAK,EAAE,UAAU,CAAC,CAAC;AACzC,MAAI,OAAO,WAAW,EAAG,QAAO,EAAE,MAAM,aAAa,QAAQ,UAAU,QAAQ,uBAAuB;AACtG,SAAO,EAAE,MAAM,aAAa,QAAQ,MAAM,QAAQ,GAAG,OAAO,MAAM,cAAc,OAAO,KAAK,IAAI,CAAC,GAAG;AACtG;AAEA,eAAe,YAAkC;AAC/C,QAAM,OAAO,SAAS,KAAK,MAAM,aAAa,CAAC;AAC/C,MAAI,CAAC,MAAM,OAAO,CAAC,SAAS,KAAK,GAAG,EAAG,QAAO,EAAE,MAAM,QAAQ,QAAQ,UAAU,QAAQ,qBAAqB;AAC7G,SAAO,EAAE,MAAM,QAAQ,QAAQ,MAAM,QAAQ,eAAe;AAC9D;AAEA,eAAe,cAAoC;AACjD,QAAM,SAAS,KAAK,MAAM,UAAU,WAAW;AAC/C,MAAI,CAAC,WAAW,MAAM,EAAG,QAAO,EAAE,MAAM,UAAU,QAAQ,WAAW,QAAQ,sBAAsB;AACnG,QAAM,WAAW,KAAK,QAAQ,GAAG,UAAU,OAAO,gBAAgB,gBAAgB;AAClF,MAAI,CAAC,WAAW,QAAQ,EAAG,QAAO,EAAE,MAAM,UAAU,QAAQ,WAAW,QAAQ,0DAA0D;AACzI,MAAI;AACJ,MAAI;AACF,UAAM,EAAE,cAAc,IAAI,MAAM,OAAO,aAAa;AACpD,UAAM,WAAW,cAAc,YAAY,GAAG;AAC9C,SAAK,SAAS,QAAQ;AAAA,EACxB,SAAS,KAAK;AACZ,WAAO,EAAE,MAAM,UAAU,QAAQ,WAAW,QAAQ,gCAAgC,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,GAAG;AAAA,EACzI;AACA,MAAI;AACF,UAAM,KAAK,IAAI,GAAG,QAAQ,EAAE,UAAU,KAAK,CAAC;AAC5C,UAAM,MAAM,GAAG,QAAQ,0CAA0C,EAAE,IAAI;AACvE,UAAM,QAAQ,GAAG,QAAQ,iHAAiH,EAAE,IAAI;AAChJ,OAAG,MAAM;AACT,UAAM,SAAS,MAAM,MAAM,IAAI,GAAG,IAAI,GAAG,WAAW,MAAM,GAAG,WAAW,GAAG,IAAI,GAAG;AAClF,WAAO,EAAE,MAAM,UAAU,QAAQ,MAAM,MAAM,IAAI,WAAW,MAAM,OAAO;AAAA,EAC3E,SAAS,KAAK;AACZ,WAAO,EAAE,MAAM,UAAU,QAAQ,WAAW,QAAQ,2BAA2B,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,GAAG;AAAA,EACpI;AACF;AAEA,eAAe,cAAoC;AACjD,QAAM,UAAU,KAAK,MAAM,UAAU,mBAAmB;AACxD,MAAI,CAAC,WAAW,OAAO,EAAG,QAAO,EAAE,MAAM,UAAU,QAAQ,UAAU,QAAQ,4BAA4B;AACzG,QAAM,UAAU,aAAa,SAAS,OAAO;AAC7C,QAAM,SAAS,QAAQ,MAAM,QAAQ,KAAK,CAAC,GAAG;AAC9C,MAAI,UAAU,EAAG,QAAO,EAAE,MAAM,UAAU,QAAQ,UAAU,QAAQ,gBAAgB;AACpF,SAAO,EAAE,MAAM,UAAU,QAAQ,MAAM,QAAQ,GAAG,KAAK,UAAU;AACnE;AAEA,eAAe,WAAiC;AAE9C,QAAM,UAAU,KAAK,MAAM,UAAU,mBAAmB;AACxD,MAAI,CAAC,WAAW,OAAO,EAAG,QAAO,EAAE,MAAM,OAAO,QAAQ,WAAW,QAAQ,aAAa;AACxF,QAAM,UAAU,aAAa,SAAS,OAAO;AAC7C,MAAI,6BAA6B,KAAK,OAAO,EAAG,QAAO,EAAE,MAAM,OAAO,QAAQ,MAAM,QAAQ,eAAe;AAE3G,MAAI,WAAW,KAAK,WAAW,iBAAiB,CAAC,EAAG,QAAO,EAAE,MAAM,OAAO,QAAQ,MAAM,QAAQ,eAAe;AAC/G,SAAO,EAAE,MAAM,OAAO,QAAQ,WAAW,QAAQ,6BAA6B;AAChF;AAIA,eAAe,WAAiC;AAC9C,QAAM,MAAM,QAAQ;AACpB,MAAI,IAAI,IAAI,kBAAkB,MAAM,OAAQ,QAAO,EAAE,MAAM,OAAO,QAAQ,WAAW,QAAQ,cAAc;AAC3G,QAAM,OAAO,SAAS,IAAI,IAAI,gBAAgB,KAAK,QAAQ,EAAE;AAC7D,MAAI;AACF,UAAM,EAAE,iBAAiB,IAAI,MAAM,OAAO,UAAU;AACpD,UAAM,IAAI,QAAc,CAAC,SAAS,WAAW;AAC3C,YAAM,OAAO,iBAAiB,EAAE,MAAM,MAAM,YAAY,GAAG,MAAM;AAAE,aAAK,QAAQ;AAAG,gBAAQ;AAAA,MAAG,CAAC;AAC/F,WAAK,GAAG,SAAS,MAAM;AACvB,WAAK,WAAW,KAAM,MAAM;AAAE,aAAK,QAAQ;AAAG,eAAO,IAAI,MAAM,SAAS,CAAC;AAAA,MAAG,CAAC;AAAA,IAC/E,CAAC;AACD,WAAO,EAAE,MAAM,OAAO,QAAQ,MAAM,QAAQ,GAAG,IAAI,GAAG;AAAA,EACxD,QAAQ;AACN,WAAO,EAAE,MAAM,OAAO,QAAQ,UAAU,QAAQ,GAAG,IAAI,iBAAiB;AAAA,EAC1E;AACF;AAEA,eAAe,aAAmC;AAChD,QAAM,YAAY,KAAK,WAAW,YAAY;AAC9C,QAAM,QAAQ,SAAS,SAAS;AAChC,MAAI,CAAC,MAAO,QAAO,EAAE,MAAM,SAAS,QAAQ,WAAW,QAAQ,qBAAqB;AACpF,MAAI,CAAC,MAAM,MAAM,WAAY,QAAO,EAAE,MAAM,SAAS,QAAQ,UAAU,QAAQ,qDAAgD;AAE/H,QAAM,cAAc,OAAO,QAAQ,MAAM,SAAS,CAAC,CAAC;AACpD,QAAM,YAAY,YAAY;AAC9B,MAAI,cAAc,EAAG,QAAO,EAAE,MAAM,SAAS,QAAQ,WAAW,QAAQ,kBAAkB;AAG1F,QAAM,aAAa,YAAY,OAAO,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;AAC7E,MAAI,WAAW,SAAS,EAAG,QAAO,EAAE,MAAM,SAAS,QAAQ,UAAU,QAAQ,sBAAsB,WAAW,KAAK,IAAI,CAAC,GAAG;AAE3H,SAAO,EAAE,MAAM,SAAS,QAAQ,MAAM,QAAQ,GAAG,SAAS,6BAA6B;AACzF;AAEA,eAAe,gBAAsC;AACnD,QAAM,MAAM,QAAQ;AACpB,MAAI,IAAI,IAAI,kBAAkB,MAAM,OAAQ,QAAO,EAAE,MAAM,YAAY,QAAQ,WAAW,QAAQ,eAAe;AAEjH,QAAM,WAAW,KAAK,WAAW,cAAc;AAC/C,QAAM,UAAU,KAAK,WAAW,kBAAkB;AAClD,QAAM,aAAa,WAAW,QAAQ;AACtC,QAAM,YAAY,WAAW,OAAO;AACpC,MAAI,CAAC,cAAc,CAAC,WAAW;AAC7B,UAAM,UAAU,CAAC,CAAC,cAAc,gBAAgB,CAAC,aAAa,kBAAkB,EAAE,OAAO,OAAO;AAChG,WAAO,EAAE,MAAM,YAAY,QAAQ,UAAU,QAAQ,YAAY,QAAQ,KAAK,IAAI,CAAC,GAAG;AAAA,EACxF;AAGA,MAAI;AACF,UAAM,EAAE,gBAAgB,gBAAgB,IAAI;AAC5C,UAAM,EAAE,iBAAiB,IAAI;AAC7B,UAAM,SAAS,eAAe;AAC9B,UAAM,oBAAoB,gBAAgB,OAAO,KAAK,UAAU;AAChE,UAAM,UAAU,aAAa,UAAU,OAAO;AAC9C,QAAI,CAAC,iBAAiB,SAAS,iBAAiB,GAAG;AACjD,aAAO,EAAE,MAAM,YAAY,QAAQ,UAAU,QAAQ,6DAAwD;AAAA,IAC/G;AACA,WAAO,EAAE,MAAM,YAAY,QAAQ,MAAM,QAAQ,2BAA2B;AAAA,EAC9E,QAAQ;AACN,WAAO,EAAE,MAAM,YAAY,QAAQ,MAAM,QAAQ,mCAAmC;AAAA,EACtF;AACF;AAEA,eAAe,cAAoC;AACjD,QAAM,MAAM,QAAQ;AACpB,MAAI,IAAI,IAAI,kBAAkB,MAAM,OAAQ,QAAO,EAAE,MAAM,UAAU,QAAQ,WAAW,QAAQ,eAAe;AAE/G,QAAM,QAAQ,SAAS,KAAK,WAAW,YAAY,CAAC;AACpD,QAAM,YAAY,OAAO,KAAK,OAAO,SAAS,CAAC,CAAC,EAAE;AAClD,MAAI,cAAc,EAAG,QAAO,EAAE,MAAM,UAAU,QAAQ,WAAW,QAAQ,kBAAkB;AAC3F,MAAI,CAAC,OAAO,MAAM,WAAY,QAAO,EAAE,MAAM,UAAU,QAAQ,UAAU,QAAQ,kEAA6D;AAE9I,QAAM,OAAO,SAAS,IAAI,IAAI,aAAa,KAAK,QAAQ,EAAE;AAI1D,QAAM,QAAQ,MAAM,IAAI,QAAiB,CAAC,YAAY;AACpD,WAAO,YAAY,EAAE,KAAK,CAAC,EAAE,aAAa,MAAM;AAC9C,YAAM,OAAO,aAAa,MAAM;AAChC,WAAK,KAAK,SAAS,CAAC,QAA+B;AAAE,aAAK,MAAM;AAAG,gBAAQ,IAAI,SAAS,YAAY;AAAA,MAAG,CAAC;AACxG,WAAK,KAAK,MAAM,WAAW,MAAM;AAAE,aAAK,MAAM;AAAG,gBAAQ,KAAK;AAAA,MAAG,CAAC;AAAA,IACpE,CAAC,EAAE,MAAM,MAAM,QAAQ,KAAK,CAAC;AAAA,EAC/B,CAAC;AACD,MAAI,CAAC,MAAO,QAAO,EAAE,MAAM,UAAU,QAAQ,UAAU,QAAQ,GAAG,IAAI,iBAAiB;AAGvF,QAAM,OAAO,SAAS,KAAK,MAAM,aAAa,CAAC;AAC/C,QAAM,OAAO,OAAO,MAAM,wBAAwB,WAAW,KAAK,sBAAsB;AACxF,MAAI,CAAC,KAAM,QAAO,EAAE,MAAM,UAAU,QAAQ,MAAM,QAAQ,GAAG,IAAI,sBAAsB;AACvF,QAAM,MAAM,KAAK,IAAI,IAAI;AACzB,MAAI,MAAM,OAAQ,QAAO,EAAE,MAAM,UAAU,QAAQ,UAAU,QAAQ,GAAG,IAAI,aAAa,IAAI,GAAG,CAAC,IAAI;AACrG,SAAO,EAAE,MAAM,UAAU,QAAQ,MAAM,QAAQ,GAAG,IAAI,qBAAqB,IAAI,GAAG,CAAC,GAAG;AACxF;AAIA,eAAe,YAAkC;AAC/C,MAAI;AACF,UAAM,EAAE,WAAW,IAAI,MAAM,OAAO,2BAA4B;AAChE,UAAM,MAAM,MAAM,WAAW;AAC7B,QAAI,CAAC,IAAK,QAAO,EAAE,MAAM,QAAQ,QAAQ,WAAW,QAAQ,uBAAuB;AACnF,WAAO,EAAE,MAAM,QAAQ,QAAQ,MAAM,QAAQ,6BAA6B;AAAA,EAC5E,QAAQ;AACN,WAAO,EAAE,MAAM,QAAQ,QAAQ,WAAW,QAAQ,qBAAqB;AAAA,EACzE;AACF;AAIA,eAAsB,eAAsC;AAC1D,QAAM,QAAQ,KAAK,IAAI;AAEvB,QAAM,CAAC,MAAM,OAAO,OAAO,MAAM,KAAK,IAAI,MAAM,QAAQ,IAAI;AAAA,IAC1D,QAAQ,IAAI,CAAC,eAAe,GAAG,eAAe,GAAG,cAAc,GAAG,cAAc,GAAG,kBAAkB,CAAC,EAAE,IAAI,OAAK,WAAW,MAAM,CAAC,CAAC,CAAC;AAAA,IACrI,QAAQ,IAAI,CAAC,eAAe,CAAC,EAAE,IAAI,OAAK,WAAW,MAAM,CAAC,CAAC,CAAC;AAAA,IAC5D,QAAQ,IAAI,CAAC,eAAe,GAAG,UAAU,GAAG,YAAY,GAAG,YAAY,GAAG,SAAS,CAAC,EAAE,IAAI,OAAK,WAAW,MAAM,CAAC,CAAC,CAAC;AAAA,IACnH,QAAQ,IAAI,CAAC,UAAU,CAAC,EAAE,IAAI,OAAK,WAAW,MAAM,CAAC,CAAC,CAAC;AAAA,IACvD,QAAQ,IAAI,CAAC,SAAS,GAAG,WAAW,GAAG,cAAc,GAAG,YAAY,CAAC,EAAE,IAAI,OAAK,WAAW,MAAM,CAAC,CAAC,CAAC;AAAA,EACtG,CAAC;AAED,SAAO,EAAE,SAAS,OAAO,SAAS,KAAK,IAAI,IAAI,OAAO,QAAQ,EAAE,MAAM,OAAO,OAAO,MAAM,MAAM,EAAE;AACpG;AAIA,eAAsB,WAAiC;AACrD,QAAM,EAAE,WAAW,YAAY,WAAW,YAAY,IAAI,aAAa,IAAI,UAAU,IAAI,cAAc,IAAI,eAAe,GAAG,IAAI,MAAM,OAAO,SAAS;AACvJ,QAAM,EAAE,UAAU,IAAI,MAAM,OAAO,oBAAoB;AACvD,QAAM,QAAqB,CAAC;AAE5B,WAAS,IAAI,OAAe,QAAgB,IAAsB;AAChE,QAAI;AAAE,SAAG;AAAG,YAAM,KAAK,EAAE,OAAO,QAAQ,SAAS,KAAK,CAAC;AAAA,IAAG,QACpD;AAAE,YAAM,KAAK,EAAE,OAAO,QAAQ,SAAS,MAAM,CAAC;AAAA,IAAG;AAAA,EACzD;AAGA,aAAW,OAAO,CAAC,UAAU,UAAU,QAAQ,OAAO,GAAG;AACvD,UAAM,IAAI,KAAK,MAAM,GAAG;AACxB,QAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,OAAO,SAAW,KAAO;AAC3C,UAAI,YAAY,GAAG,GAAG,gBAAW,MAAM,UAAU,GAAG,GAAK,CAAC;AAAA,IAC5D;AAAA,EACF;AAGA,QAAM,YAAY,KAAK,MAAM,QAAQ;AACrC,MAAI,GAAG,SAAS,GAAG;AACjB,eAAW,KAAK,GAAG,SAAS,GAAG;AAC7B,YAAM,KAAK,KAAK,WAAW,CAAC;AAC5B,UAAI,GAAG,EAAE,EAAE,OAAO,MAAM,GAAG,EAAE,EAAE,OAAO,SAAW,KAAO;AACtD,YAAI,YAAY,GAAG,CAAC,eAAU,MAAM,UAAU,IAAI,GAAK,CAAC;AAAA,MAC1D;AAAA,IACF;AAAA,EACF;AAGA,MAAI,GAAG,SAAS,GAAG;AACjB,eAAW,KAAK,GAAG,SAAS,GAAG;AAC7B,YAAM,KAAK,KAAK,WAAW,CAAC;AAC5B,UAAI,GAAG,EAAE,EAAE,OAAO,MAAM,GAAG,EAAE,EAAE,OAAO,SAAW,KAAO;AACtD,YAAI,YAAY,UAAU,CAAC,eAAU,MAAM,UAAU,IAAI,GAAK,CAAC;AAAA,MACjE;AAAA,IACF;AAAA,EACF;AAGA,QAAM,aAAa,KAAK,MAAM,aAAa;AAC3C,MAAI,GAAG,UAAU,GAAG;AAClB,UAAM,OAAO,SAAS,UAAU;AAChC,UAAM,UAAU,MAAM,aAAa,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,QAAQ,KAAK,MAAO;AAC7F,UAAM,UAAU,MAAM,OAAO;AAC7B,QAAI,UAAU,QAAQ,YAAY,KAAK,CAAC,SAAS,OAAO,IAAI;AAC1D,UAAI,YAAY,6BAA6B,MAAM,WAAW,UAAU,CAAC;AAAA,IAC3E;AAAA,EACF;AAGA,QAAM,cAAc,KAAK,MAAM,eAAe;AAC9C,MAAI,GAAG,WAAW,GAAG;AACnB,UAAM,OAAO,KAAK,IAAI,IAAI,GAAG,WAAW,EAAE,WAAW;AACrD,QAAI,MAAM,IAAK,KAAI,YAAY,+BAA+B,MAAM,WAAW,WAAW,CAAC;AAAA,EAC7F;AAGA,aAAW,OAAO,CAAC,QAAQ,aAAa,YAAY,UAAU,GAAG;AAC/D,UAAM,IAAI,KAAK,MAAM,GAAG;AACxB,QAAI,CAAC,GAAG,CAAC,EAAG,KAAI,YAAY,WAAW,GAAG,KAAK,MAAM,UAAU,GAAG,EAAE,WAAW,KAAK,CAAC,CAAC;AAAA,EACxF;AAGA,MAAI;AACF,UAAM,OAAO,SAAS,KAAK,MAAM,aAAa,CAAC;AAC/C,UAAM,YAAY,MAAM,OAAO;AAC/B,UAAM,QAAQ,MAAM,eAAe;AAGnC,UAAM,OAAO,UAAU,SAAS,CAAC,MAAM,eAAe,GAAG,EAAE,UAAU,QAAQ,CAAC;AAC9E,QAAI,KAAK,QAAQ;AACf,iBAAW,OAAO,KAAK,OAAO,KAAK,EAAE,MAAM,IAAI,EAAE,OAAO,OAAO,EAAE,IAAI,MAAM,GAAG;AAC5E,YAAI,MAAM,KAAK,QAAQ,aAAa,QAAQ,SAAS,QAAQ,QAAQ,KAAK;AACxE,cAAI,SAAS,0BAA0B,GAAG,IAAI,MAAM,QAAQ,KAAK,KAAK,SAAS,CAAC;AAAA,QAClF;AAAA,MACF;AAAA,IACF;AAGA,UAAM,QAAQ,UAAU,SAAS,CAAC,MAAM,cAAc,GAAG,EAAE,UAAU,QAAQ,CAAC;AAC9E,QAAI,MAAM,QAAQ;AAChB,iBAAW,OAAO,MAAM,OAAO,KAAK,EAAE,MAAM,IAAI,EAAE,OAAO,OAAO,EAAE,IAAI,MAAM,GAAG;AAC7E,YAAI,MAAM,KAAK,QAAQ,WAAW;AAChC,cAAI,SAAS,8BAA8B,GAAG,IAAI,MAAM,QAAQ,KAAK,KAAK,SAAS,CAAC;AAAA,QACtF;AAAA,MACF;AAAA,IACF;AAAA,EACF,QAAQ;AAAA,EAA0C;AAGlD,aAAW,KAAK,CAAC,cAAc,aAAa,GAAG;AAC7C,UAAM,IAAI,KAAK,MAAM,CAAC;AACtB,QAAI,GAAG,CAAC,GAAG;AACT,YAAM,OAAO,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,WAAW;AAC3C,YAAM,OAAO,SAAS,KAAK,MAAM,aAAa,CAAC;AAC/C,UAAI,MAAM,QAAQ,CAAC,MAAM,OAAO,CAAC,SAAS,KAAK,GAAG,IAAI;AACpD,YAAI,YAAY,iBAAiB,CAAC,IAAI,MAAM,WAAW,CAAC,CAAC;AAAA,MAC3D;AAAA,IACF;AAAA,EACF;AAGA,QAAM,iBAAiB;AACvB,QAAM,iBAAiB;AACvB,MAAI;AACF,UAAM,aAAa,KAAK,IAAI,IAAI,iBAAiB;AACjD,UAAM,aAAa,KAAK,IAAI,IAAI,iBAAiB;AAEjD,eAAW,CAAC,KAAK,MAAM,KAAK,CAAC,CAAC,KAAK,MAAM,MAAM,GAAG,UAAU,GAAG,CAAC,KAAK,MAAM,UAAU,GAAG,UAAU,GAAG,CAAC,KAAK,MAAM,YAAY,OAAO,GAAG,UAAU,CAAC,GAAY;AAC5J,UAAI,CAAC,GAAG,GAAG,EAAG;AACd,UAAI,UAAU;AACd,iBAAW,KAAK,GAAG,GAAG,GAAG;AACvB,cAAM,KAAK,KAAK,KAAK,CAAC;AACtB,YAAI,GAAG,EAAE,EAAE,OAAO,KAAK,GAAG,EAAE,EAAE,UAAU,QAAQ;AAAE,qBAAW,EAAE;AAAG;AAAA,QAAW;AAAA,MAC/E;AACA,UAAI,UAAU,EAAG,OAAM,KAAK,EAAE,OAAO,aAAa,QAAQ,WAAW,OAAO,uBAAuB,IAAI,MAAM,GAAG,EAAE,IAAI,CAAC,IAAI,SAAS,KAAK,CAAC;AAAA,IAC5I;AAGA,UAAM,YAAY,KAAK,MAAM,QAAQ,aAAa;AAClD,QAAI,GAAG,SAAS,KAAK,GAAG,SAAS,EAAE,OAAO,KAAY;AACpD,YAAM,QAAQ,GAAG,WAAW,OAAO,EAAE,MAAM,IAAI;AAC/C,SAAG,WAAW,MAAM,MAAM,IAAK,EAAE,KAAK,IAAI,CAAC;AAC3C,YAAM,KAAK,EAAE,OAAO,aAAa,QAAQ,yBAAyB,SAAS,KAAK,CAAC;AAAA,IACnF;AAAA,EACF,QAAQ;AAAA,EAAmC;AAG3C,MAAI;AACF,UAAM,OAAO,SAAS,KAAK,MAAM,aAAa,CAAC;AAC/C,UAAM,cAAc,MAAM,OAAO;AACjC,UAAM,QAAQ,UAAU,SAAS,CAAC,MAAM,cAAc,GAAG,EAAE,UAAU,QAAQ,CAAC;AAC9E,QAAI,MAAM,QAAQ;AAChB,iBAAW,OAAO,MAAM,OAAO,KAAK,EAAE,MAAM,IAAI,EAAE,OAAO,OAAO,EAAE,IAAI,MAAM,GAAG;AAC7E,YAAI,MAAM,KAAK,QAAQ,eAAe,QAAQ,QAAQ,KAAK;AACzD,cAAI,YAAY,2BAA2B,GAAG,IAAI,MAAM,QAAQ,KAAK,KAAK,SAAS,CAAC;AAAA,QACtF;AAAA,MACF;AAAA,IACF;AAAA,EACF,QAAQ;AAAA,EAAkB;AAG1B,QAAM,WAAW,KAAK,MAAM,OAAO;AACnC,MAAI,GAAG,QAAQ,MAAM,GAAG,QAAQ,EAAE,OAAO,SAAW,KAAO;AACzD,QAAI,YAAY,qBAAgB,MAAM,UAAU,UAAU,GAAK,CAAC;AAAA,EAClE;AAGA,MAAI;AACF,UAAM,WAAW,SAAS,KAAK,MAAM,eAAe,CAAC;AACrD,QAAI,UAAU,gBAAgB,UAAU;AACtC,YAAM,EAAE,SAAS,IAAI,MAAM,OAAO,SAAS;AAC3C,UAAI,SAAS,MAAM,UAAU;AAC3B,cAAM,QAAQ,GAAG,IAAI;AACrB,cAAM,MAAM,GAAG,QAAQ,IAAI,MAAM,CAAC;AAClC,YAAI,GAAG,KAAK,KAAK,CAAC,GAAG,GAAG,GAAG;AACzB,cAAI,YAAY,yBAAyB,MAAM;AAC7C,kBAAM,EAAE,aAAa,IAAI,UAAQ,SAAS;AAC1C,yBAAa,OAAO,GAAG;AACvB,sBAAU,aAAa,CAAC,QAAQ,GAAG,CAAC;AAAA,UACtC,CAAC;AAAA,QACH;AAAA,MACF,OAAO;AACL,cAAM,MAAM,GAAG,IAAI;AACnB,cAAM,MAAM,GAAG,QAAQ,IAAI,MAAM,CAAC;AAClC,YAAI,GAAG,GAAG,KAAK,CAAC,GAAG,GAAG,GAAG;AACvB,cAAI,YAAY,0BAA0B,MAAM;AAC9C,sBAAU,KAAK,QAAQ,IAAI,MAAM,GAAI,WAAW,WAAW,MAAM,GAAG,EAAE,WAAW,KAAK,CAAC;AACvF,kBAAM,EAAE,aAAa,IAAI,UAAQ,SAAS;AAC1C,yBAAa,KAAK,GAAG;AACrB,sBAAU,aAAa,CAAC,UAAU,UAAU,SAAS,yBAAyB,CAAC;AAAA,UACjF,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,EACF,QAAQ;AAAA,EAAkB;AAE1B,SAAO;AACT;AAIA,IAAM,OAAO,EAAE,IAAI,UAAK,QAAQ,UAAK,SAAS,IAAI;AAE3C,SAAS,YAAY,QAA8B;AACxD,QAAM,QAAkB,CAAC;AACzB,aAAW,CAAC,OAAO,MAAM,KAAK,OAAO,QAAQ,OAAO,MAAM,GAAgC;AACxF,UAAM,KAAK,GAAG,MAAM,OAAO,CAAC,EAAE,YAAY,IAAI,MAAM,MAAM,CAAC,CAAC,GAAG;AAC/D,eAAW,KAAK,QAAQ;AACtB,YAAM,KAAK,EAAE,MAAM,EAAE,KAAK,MAAM,KAAK,EAAE,EAAE,QAAQ;AACjD,YAAM,SAAS,EAAE,SAAS,WAAM,EAAE,MAAM,KAAK;AAC7C,YAAM,KAAK,KAAK,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,GAAG,EAAE,GAAG,MAAM,EAAE;AAAA,IAC1D;AAAA,EACF;AACA,QAAM,QAAQ,OAAO,OAAO,OAAO,MAAM,EAAE,KAAK;AAChD,QAAM,UAAU,MAAM,OAAO,OAAK,EAAE,WAAW,IAAI,EAAE;AACrD,QAAM,KAAK;AAAA,EAAK,OAAO,IAAI,MAAM,MAAM,SAAS,OAAO,UAAU,KAAM,QAAQ,CAAC,CAAC,IAAI;AACrF,SAAO,MAAM,KAAK,IAAI;AACxB;AAEO,SAAS,WAAW,QAA8B;AACvD,SAAO,KAAK,UAAU,QAAQ,MAAM,CAAC;AACvC;",
+  "names": []
+}

package/bundle/{chunk-WBTJ2E62.js → chunk-P3NODAHF.js}

@@ -3,7 +3,7 @@
 import {
   init_log_and_swallow,
   logAndSwallow
-} from "./chunk-YSKCQH6E.js";
+} from "./chunk-2IYJ4I66.js";
 import {
   abmindHome,
   abtarsHome,
@@ -70,9 +70,6 @@ function buildPolicy(source, config) {
     case "peer":
       base = { allowedTools: [], allowedRead: [], allowedWrite: [], canExecuteBash: false };
       break;
-    case "guest":
-      base = { allowedTools: ["web_fetch"], allowedRead: [], allowedWrite: [], canExecuteBash: false };
-      break;
   }
   if (config) base = { ...base, ...config };
   return Object.freeze(base);
@@ -128,4 +125,4 @@ export {
   auditDeny,
   ToolLoopGuard
 };
-//# sourceMappingURL=chunk-WBTJ2E62.js.map
+//# sourceMappingURL=chunk-P3NODAHF.js.map

package/bundle/{chunk-WBTJ2E62.js.map → chunk-P3NODAHF.js.map}

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/components/tool-sandbox.ts"],
-  "sourcesContent": ["/**\n * tool-sandbox.ts \u2014 unified policy enforcement for tool access and path restrictions.\n * Provides SandboxPolicy interface, check functions, loop guardrails, and audit logging.\n */\n\nimport { resolve } from \"node:path\";\nimport { realpathSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { appendFileSync, mkdirSync } from \"node:fs\";\nimport { createHash } from \"node:crypto\";\nimport { join } from \"node:path\";\nimport { abtarsHome, abmindHome } from \"../paths.js\";\nimport { logAndSwallow } from \"./log-and-swallow.js\";\n\nexport interface SandboxPolicy {\n  readonly allowedTools: string[];\n  readonly allowedRead: string[];\n  readonly allowedWrite: string[];\n  readonly canExecuteBash: boolean;\n}\n\nexport interface CheckResult {\n  allowed: boolean;\n  reason?: string;\n}\n\nconst PATH_BLACKLIST: readonly string[] = [\n  resolve(abtarsHome(), \"config\"),\n  resolve(abtarsHome(), \"secret\"),\n  resolve(abmindHome()),\n];\n\nconst AUDIT_DIR = join(abtarsHome(), \"logs\");\nconst AUDIT_PATH = join(AUDIT_DIR, \"audit.jsonl\");\ntry { mkdirSync(AUDIT_DIR, { recursive: true }); } catch (err) { logAndSwallow(\"tool-sandbox\", \"mkdirSync\", err); }\n\nexport function checkTool(name: string, policy: SandboxPolicy): CheckResult {\n  if (policy.allowedTools.length === 1 && policy.allowedTools[0] === \"*\") return { allowed: true };\n  if (policy.allowedTools.length === 0) return { allowed: false, reason: `Tool '${name}' not available in this session` };\n  if (name === \"execute_bash\" && !policy.canExecuteBash) return { allowed: false, reason: `Tool '${name}' not available in this session` };\n  if (policy.allowedTools.includes(name)) return { allowed: true };\n  return { allowed: false, reason: `Tool '${name}' not available in this session` };\n}\n\nexport function checkPath(filePath: string, mode: \"read\" | \"write\", policy: SandboxPolicy): CheckResult {\n  // Resolve ~, normalize .., and resolve symlinks to prevent traversal attacks\n  const expanded = filePath.replace(/^~/, homedir());\n  const normalized = resolve(expanded);\n  let abs: string;\n  try { abs = realpathSync(normalized); } catch { abs = normalized; /* file may not exist yet (write) */ }\n\n  const list = mode === \"read\" ? policy.allowedRead : policy.allowedWrite;\n  // If wildcard, skip blacklist (owner sessions)\n  if (list.length === 1 && list[0] === \"*\") return { allowed: true };\n  // Blacklist always enforced for explicit path lists\n  for (const blocked of PATH_BLACKLIST) {\n    if (abs === blocked || abs.startsWith(blocked + \"/\")) {\n      return { allowed: false, reason: `Path '${filePath}' is restricted` };\n    }\n  }\n  if (list.length === 0) return { allowed: false, reason: `No ${mode} access in this session` };\n  for (const prefix of list) {\n    const absPrefix = resolve(prefix.replace(/^~/, homedir()));\n    if (abs === absPrefix || abs.startsWith(absPrefix + \"/\")) return { allowed: true };\n  }\n  return { allowed: false, reason: `Path '${filePath}' not in allowed ${mode} paths` };\n}\n\nexport function buildPolicy(source: \"owner\" | \"peer\" | \"guest\", config?: Partial<SandboxPolicy>): Readonly<SandboxPolicy> {\n  let base: SandboxPolicy;\n  switch (source) {\n    case \"owner\":\n      base = { allowedTools: [\"*\"], allowedRead: [\"*\"], allowedWrite: [\"*\"], canExecuteBash: true };\n      break;\n    case \"peer\":\n      base = { allowedTools: [], allowedRead: [], allowedWrite: [], canExecuteBash: false };\n      break;\n    case \"guest\":\n      base = { allowedTools: [\"web_fetch\"], allowedRead: [], allowedWrite: [], canExecuteBash: false };\n      break;\n  }\n  if (config) base = { ...base, ...config };\n  return Object.freeze(base);\n}\n\nexport function auditDeny(tool: string, path: string | undefined, policy: string, reason: string): void {\n  const entry = { ts: Date.now(), event: \"sandbox_deny\", tool, path, policy, reason };\n  try { appendFileSync(AUDIT_PATH, JSON.stringify(entry) + \"\\n\"); } catch (err) { logAndSwallow(\"tool-sandbox\", \"audit write\", err); }\n}\n\n// \u2500\u2500 Tool Loop Guard \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nconst IDEMPOTENT_TOOLS = new Set([\"file_read\", \"web_fetch\", \"web_browse\", \"memory_recall\"]);\n\nfunction argsHash(name: string, args: Record<string, unknown>): string {\n  return createHash(\"sha256\").update(name + JSON.stringify(args)).digest(\"hex\");\n}\n\nexport class ToolLoopGuard {\n  private failCounts = new Map<string, number>();\n  private resultCounts = new Map<string, number>();\n\n  beforeCall(name: string, args: Record<string, unknown>): CheckResult {\n    const hash = argsHash(name, args);\n    const fails = this.failCounts.get(hash) ?? 0;\n    if (fails >= 4) return { allowed: false, reason: `Tool '${name}' blocked: repeated identical failure (${fails} times)` };\n    if (IDEMPOTENT_TOOLS.has(name)) {\n      const repeats = this.resultCounts.get(hash) ?? 0;\n      if (repeats >= 4) return { allowed: false, reason: `Tool '${name}' blocked: same result returned ${repeats} times \u2014 stuck loop` };\n    }\n    return { allowed: true };\n  }\n\n  afterCall(name: string, args: Record<string, unknown>, _result: string, failed: boolean): string | undefined {\n    const hash = argsHash(name, args);\n    if (failed) {\n      const count = (this.failCounts.get(hash) ?? 0) + 1;\n      this.failCounts.set(hash, count);\n      if (count === 2) return \"This tool call failed twice with identical arguments. Consider changing your approach.\";\n    } else if (IDEMPOTENT_TOOLS.has(name)) {\n      const count = (this.resultCounts.get(hash) ?? 0) + 1;\n      this.resultCounts.set(hash, count);\n      if (count === 2) return \"Same result returned twice for identical query. Use the result or change the query.\";\n    }\n    return undefined;\n  }\n\n  resetForTurn(): void {\n    this.failCounts.clear();\n    this.resultCounts.clear();\n  }\n}\n"],
-  "mappings": ";;;;;;;;;;;;;AAWA;AACA;AAPA,SAAS,eAAe;AACxB,SAAS,oBAAoB;AAC7B,SAAS,eAAe;AACxB,SAAS,gBAAgB,iBAAiB;AAC1C,SAAS,kBAAkB;AAC3B,SAAS,YAAY;AAgBrB,IAAM,iBAAoC;AAAA,EACxC,QAAQ,WAAW,GAAG,QAAQ;AAAA,EAC9B,QAAQ,WAAW,GAAG,QAAQ;AAAA,EAC9B,QAAQ,WAAW,CAAC;AACtB;AAEA,IAAM,YAAY,KAAK,WAAW,GAAG,MAAM;AAC3C,IAAM,aAAa,KAAK,WAAW,aAAa;AAChD,IAAI;AAAE,YAAU,WAAW,EAAE,WAAW,KAAK,CAAC;AAAG,SAAS,KAAK;AAAE,gBAAc,gBAAgB,aAAa,GAAG;AAAG;AAE3G,SAAS,UAAU,MAAc,QAAoC;AAC1E,MAAI,OAAO,aAAa,WAAW,KAAK,OAAO,aAAa,CAAC,MAAM,IAAK,QAAO,EAAE,SAAS,KAAK;AAC/F,MAAI,OAAO,aAAa,WAAW,EAAG,QAAO,EAAE,SAAS,OAAO,QAAQ,SAAS,IAAI,kCAAkC;AACtH,MAAI,SAAS,kBAAkB,CAAC,OAAO,eAAgB,QAAO,EAAE,SAAS,OAAO,QAAQ,SAAS,IAAI,kCAAkC;AACvI,MAAI,OAAO,aAAa,SAAS,IAAI,EAAG,QAAO,EAAE,SAAS,KAAK;AAC/D,SAAO,EAAE,SAAS,OAAO,QAAQ,SAAS,IAAI,kCAAkC;AAClF;AAEO,SAAS,UAAU,UAAkB,MAAwB,QAAoC;AAEtG,QAAM,WAAW,SAAS,QAAQ,MAAM,QAAQ,CAAC;AACjD,QAAM,aAAa,QAAQ,QAAQ;AACnC,MAAI;AACJ,MAAI;AAAE,UAAM,aAAa,UAAU;AAAA,EAAG,QAAQ;AAAE,UAAM;AAAA,EAAiD;AAEvG,QAAM,OAAO,SAAS,SAAS,OAAO,cAAc,OAAO;AAE3D,MAAI,KAAK,WAAW,KAAK,KAAK,CAAC,MAAM,IAAK,QAAO,EAAE,SAAS,KAAK;AAEjE,aAAW,WAAW,gBAAgB;AACpC,QAAI,QAAQ,WAAW,IAAI,WAAW,UAAU,GAAG,GAAG;AACpD,aAAO,EAAE,SAAS,OAAO,QAAQ,SAAS,QAAQ,kBAAkB;AAAA,IACtE;AAAA,EACF;AACA,MAAI,KAAK,WAAW,EAAG,QAAO,EAAE,SAAS,OAAO,QAAQ,MAAM,IAAI,0BAA0B;AAC5F,aAAW,UAAU,MAAM;AACzB,UAAM,YAAY,QAAQ,OAAO,QAAQ,MAAM,QAAQ,CAAC,CAAC;AACzD,QAAI,QAAQ,aAAa,IAAI,WAAW,YAAY,GAAG,EAAG,QAAO,EAAE,SAAS,KAAK;AAAA,EACnF;AACA,SAAO,EAAE,SAAS,OAAO,QAAQ,SAAS,QAAQ,oBAAoB,IAAI,SAAS;AACrF;AAEO,SAAS,YAAY,QAAoC,QAA0D;AACxH,MAAI;AACJ,UAAQ,QAAQ;AAAA,IACd,KAAK;AACH,aAAO,EAAE,cAAc,CAAC,GAAG,GAAG,aAAa,CAAC,GAAG,GAAG,cAAc,CAAC,GAAG,GAAG,gBAAgB,KAAK;AAC5F;AAAA,IACF,KAAK;AACH,aAAO,EAAE,cAAc,CAAC,GAAG,aAAa,CAAC,GAAG,cAAc,CAAC,GAAG,gBAAgB,MAAM;AACpF;AAAA,IACF,KAAK;AACH,aAAO,EAAE,cAAc,CAAC,WAAW,GAAG,aAAa,CAAC,GAAG,cAAc,CAAC,GAAG,gBAAgB,MAAM;AAC/F;AAAA,EACJ;AACA,MAAI,OAAQ,QAAO,EAAE,GAAG,MAAM,GAAG,OAAO;AACxC,SAAO,OAAO,OAAO,IAAI;AAC3B;AAEO,SAAS,UAAU,MAAc,MAA0B,QAAgB,QAAsB;AACtG,QAAM,QAAQ,EAAE,IAAI,KAAK,IAAI,GAAG,OAAO,gBAAgB,MAAM,MAAM,QAAQ,OAAO;AAClF,MAAI;AAAE,mBAAe,YAAY,KAAK,UAAU,KAAK,IAAI,IAAI;AAAA,EAAG,SAAS,KAAK;AAAE,kBAAc,gBAAgB,eAAe,GAAG;AAAA,EAAG;AACrI;AAIA,IAAM,mBAAmB,oBAAI,IAAI,CAAC,aAAa,aAAa,cAAc,eAAe,CAAC;AAE1F,SAAS,SAAS,MAAc,MAAuC;AACrE,SAAO,WAAW,QAAQ,EAAE,OAAO,OAAO,KAAK,UAAU,IAAI,CAAC,EAAE,OAAO,KAAK;AAC9E;AAEO,IAAM,gBAAN,MAAoB;AAAA,EACjB,aAAa,oBAAI,IAAoB;AAAA,EACrC,eAAe,oBAAI,IAAoB;AAAA,EAE/C,WAAW,MAAc,MAA4C;AACnE,UAAM,OAAO,SAAS,MAAM,IAAI;AAChC,UAAM,QAAQ,KAAK,WAAW,IAAI,IAAI,KAAK;AAC3C,QAAI,SAAS,EAAG,QAAO,EAAE,SAAS,OAAO,QAAQ,SAAS,IAAI,0CAA0C,KAAK,UAAU;AACvH,QAAI,iBAAiB,IAAI,IAAI,GAAG;AAC9B,YAAM,UAAU,KAAK,aAAa,IAAI,IAAI,KAAK;AAC/C,UAAI,WAAW,EAAG,QAAO,EAAE,SAAS,OAAO,QAAQ,SAAS,IAAI,mCAAmC,OAAO,2BAAsB;AAAA,IAClI;AACA,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB;AAAA,EAEA,UAAU,MAAc,MAA+B,SAAiB,QAAqC;AAC3G,UAAM,OAAO,SAAS,MAAM,IAAI;AAChC,QAAI,QAAQ;AACV,YAAM,SAAS,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK;AACjD,WAAK,WAAW,IAAI,MAAM,KAAK;AAC/B,UAAI,UAAU,EAAG,QAAO;AAAA,IAC1B,WAAW,iBAAiB,IAAI,IAAI,GAAG;AACrC,YAAM,SAAS,KAAK,aAAa,IAAI,IAAI,KAAK,KAAK;AACnD,WAAK,aAAa,IAAI,MAAM,KAAK;AACjC,UAAI,UAAU,EAAG,QAAO;AAAA,IAC1B;AACA,WAAO;AAAA,EACT;AAAA,EAEA,eAAqB;AACnB,SAAK,WAAW,MAAM;AACtB,SAAK,aAAa,MAAM;AAAA,EAC1B;AACF;",
+  "sourcesContent": ["/**\n * tool-sandbox.ts \u2014 unified policy enforcement for tool access and path restrictions.\n * Provides SandboxPolicy interface, check functions, loop guardrails, and audit logging.\n */\n\nimport { resolve } from \"node:path\";\nimport { realpathSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { appendFileSync, mkdirSync } from \"node:fs\";\nimport { createHash } from \"node:crypto\";\nimport { join } from \"node:path\";\nimport { abtarsHome, abmindHome } from \"../paths.js\";\nimport { logAndSwallow } from \"./log-and-swallow.js\";\n\nexport interface SandboxPolicy {\n  readonly allowedTools: string[];\n  readonly allowedRead: string[];\n  readonly allowedWrite: string[];\n  readonly canExecuteBash: boolean;\n}\n\nexport interface CheckResult {\n  allowed: boolean;\n  reason?: string;\n}\n\nconst PATH_BLACKLIST: readonly string[] = [\n  resolve(abtarsHome(), \"config\"),\n  resolve(abtarsHome(), \"secret\"),\n  resolve(abmindHome()),\n];\n\nconst AUDIT_DIR = join(abtarsHome(), \"logs\");\nconst AUDIT_PATH = join(AUDIT_DIR, \"audit.jsonl\");\ntry { mkdirSync(AUDIT_DIR, { recursive: true }); } catch (err) { logAndSwallow(\"tool-sandbox\", \"mkdirSync\", err); }\n\nexport function checkTool(name: string, policy: SandboxPolicy): CheckResult {\n  if (policy.allowedTools.length === 1 && policy.allowedTools[0] === \"*\") return { allowed: true };\n  if (policy.allowedTools.length === 0) return { allowed: false, reason: `Tool '${name}' not available in this session` };\n  if (name === \"execute_bash\" && !policy.canExecuteBash) return { allowed: false, reason: `Tool '${name}' not available in this session` };\n  if (policy.allowedTools.includes(name)) return { allowed: true };\n  return { allowed: false, reason: `Tool '${name}' not available in this session` };\n}\n\nexport function checkPath(filePath: string, mode: \"read\" | \"write\", policy: SandboxPolicy): CheckResult {\n  // Resolve ~, normalize .., and resolve symlinks to prevent traversal attacks\n  const expanded = filePath.replace(/^~/, homedir());\n  const normalized = resolve(expanded);\n  let abs: string;\n  try { abs = realpathSync(normalized); } catch { abs = normalized; /* file may not exist yet (write) */ }\n\n  const list = mode === \"read\" ? policy.allowedRead : policy.allowedWrite;\n  // If wildcard, skip blacklist (owner sessions)\n  if (list.length === 1 && list[0] === \"*\") return { allowed: true };\n  // Blacklist always enforced for explicit path lists\n  for (const blocked of PATH_BLACKLIST) {\n    if (abs === blocked || abs.startsWith(blocked + \"/\")) {\n      return { allowed: false, reason: `Path '${filePath}' is restricted` };\n    }\n  }\n  if (list.length === 0) return { allowed: false, reason: `No ${mode} access in this session` };\n  for (const prefix of list) {\n    const absPrefix = resolve(prefix.replace(/^~/, homedir()));\n    if (abs === absPrefix || abs.startsWith(absPrefix + \"/\")) return { allowed: true };\n  }\n  return { allowed: false, reason: `Path '${filePath}' not in allowed ${mode} paths` };\n}\n\nexport function buildPolicy(source: \"owner\" | \"peer\", config?: Partial<SandboxPolicy>): Readonly<SandboxPolicy> {\n  let base: SandboxPolicy;\n  switch (source) {\n    case \"owner\":\n      base = { allowedTools: [\"*\"], allowedRead: [\"*\"], allowedWrite: [\"*\"], canExecuteBash: true };\n      break;\n    case \"peer\":\n      base = { allowedTools: [], allowedRead: [], allowedWrite: [], canExecuteBash: false };\n      break;\n  }\n  if (config) base = { ...base, ...config };\n  return Object.freeze(base);\n}\n\nexport function auditDeny(tool: string, path: string | undefined, policy: string, reason: string): void {\n  const entry = { ts: Date.now(), event: \"sandbox_deny\", tool, path, policy, reason };\n  try { appendFileSync(AUDIT_PATH, JSON.stringify(entry) + \"\\n\"); } catch (err) { logAndSwallow(\"tool-sandbox\", \"audit write\", err); }\n}\n\n// \u2500\u2500 Tool Loop Guard \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nconst IDEMPOTENT_TOOLS = new Set([\"file_read\", \"web_fetch\", \"web_browse\", \"memory_recall\"]);\n\nfunction argsHash(name: string, args: Record<string, unknown>): string {\n  return createHash(\"sha256\").update(name + JSON.stringify(args)).digest(\"hex\");\n}\n\nexport class ToolLoopGuard {\n  private failCounts = new Map<string, number>();\n  private resultCounts = new Map<string, number>();\n\n  beforeCall(name: string, args: Record<string, unknown>): CheckResult {\n    const hash = argsHash(name, args);\n    const fails = this.failCounts.get(hash) ?? 0;\n    if (fails >= 4) return { allowed: false, reason: `Tool '${name}' blocked: repeated identical failure (${fails} times)` };\n    if (IDEMPOTENT_TOOLS.has(name)) {\n      const repeats = this.resultCounts.get(hash) ?? 0;\n      if (repeats >= 4) return { allowed: false, reason: `Tool '${name}' blocked: same result returned ${repeats} times \u2014 stuck loop` };\n    }\n    return { allowed: true };\n  }\n\n  afterCall(name: string, args: Record<string, unknown>, _result: string, failed: boolean): string | undefined {\n    const hash = argsHash(name, args);\n    if (failed) {\n      const count = (this.failCounts.get(hash) ?? 0) + 1;\n      this.failCounts.set(hash, count);\n      if (count === 2) return \"This tool call failed twice with identical arguments. Consider changing your approach.\";\n    } else if (IDEMPOTENT_TOOLS.has(name)) {\n      const count = (this.resultCounts.get(hash) ?? 0) + 1;\n      this.resultCounts.set(hash, count);\n      if (count === 2) return \"Same result returned twice for identical query. Use the result or change the query.\";\n    }\n    return undefined;\n  }\n\n  resetForTurn(): void {\n    this.failCounts.clear();\n    this.resultCounts.clear();\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;AAWA;AACA;AAPA,SAAS,eAAe;AACxB,SAAS,oBAAoB;AAC7B,SAAS,eAAe;AACxB,SAAS,gBAAgB,iBAAiB;AAC1C,SAAS,kBAAkB;AAC3B,SAAS,YAAY;AAgBrB,IAAM,iBAAoC;AAAA,EACxC,QAAQ,WAAW,GAAG,QAAQ;AAAA,EAC9B,QAAQ,WAAW,GAAG,QAAQ;AAAA,EAC9B,QAAQ,WAAW,CAAC;AACtB;AAEA,IAAM,YAAY,KAAK,WAAW,GAAG,MAAM;AAC3C,IAAM,aAAa,KAAK,WAAW,aAAa;AAChD,IAAI;AAAE,YAAU,WAAW,EAAE,WAAW,KAAK,CAAC;AAAG,SAAS,KAAK;AAAE,gBAAc,gBAAgB,aAAa,GAAG;AAAG;AAE3G,SAAS,UAAU,MAAc,QAAoC;AAC1E,MAAI,OAAO,aAAa,WAAW,KAAK,OAAO,aAAa,CAAC,MAAM,IAAK,QAAO,EAAE,SAAS,KAAK;AAC/F,MAAI,OAAO,aAAa,WAAW,EAAG,QAAO,EAAE,SAAS,OAAO,QAAQ,SAAS,IAAI,kCAAkC;AACtH,MAAI,SAAS,kBAAkB,CAAC,OAAO,eAAgB,QAAO,EAAE,SAAS,OAAO,QAAQ,SAAS,IAAI,kCAAkC;AACvI,MAAI,OAAO,aAAa,SAAS,IAAI,EAAG,QAAO,EAAE,SAAS,KAAK;AAC/D,SAAO,EAAE,SAAS,OAAO,QAAQ,SAAS,IAAI,kCAAkC;AAClF;AAEO,SAAS,UAAU,UAAkB,MAAwB,QAAoC;AAEtG,QAAM,WAAW,SAAS,QAAQ,MAAM,QAAQ,CAAC;AACjD,QAAM,aAAa,QAAQ,QAAQ;AACnC,MAAI;AACJ,MAAI;AAAE,UAAM,aAAa,UAAU;AAAA,EAAG,QAAQ;AAAE,UAAM;AAAA,EAAiD;AAEvG,QAAM,OAAO,SAAS,SAAS,OAAO,cAAc,OAAO;AAE3D,MAAI,KAAK,WAAW,KAAK,KAAK,CAAC,MAAM,IAAK,QAAO,EAAE,SAAS,KAAK;AAEjE,aAAW,WAAW,gBAAgB;AACpC,QAAI,QAAQ,WAAW,IAAI,WAAW,UAAU,GAAG,GAAG;AACpD,aAAO,EAAE,SAAS,OAAO,QAAQ,SAAS,QAAQ,kBAAkB;AAAA,IACtE;AAAA,EACF;AACA,MAAI,KAAK,WAAW,EAAG,QAAO,EAAE,SAAS,OAAO,QAAQ,MAAM,IAAI,0BAA0B;AAC5F,aAAW,UAAU,MAAM;AACzB,UAAM,YAAY,QAAQ,OAAO,QAAQ,MAAM,QAAQ,CAAC,CAAC;AACzD,QAAI,QAAQ,aAAa,IAAI,WAAW,YAAY,GAAG,EAAG,QAAO,EAAE,SAAS,KAAK;AAAA,EACnF;AACA,SAAO,EAAE,SAAS,OAAO,QAAQ,SAAS,QAAQ,oBAAoB,IAAI,SAAS;AACrF;AAEO,SAAS,YAAY,QAA0B,QAA0D;AAC9G,MAAI;AACJ,UAAQ,QAAQ;AAAA,IACd,KAAK;AACH,aAAO,EAAE,cAAc,CAAC,GAAG,GAAG,aAAa,CAAC,GAAG,GAAG,cAAc,CAAC,GAAG,GAAG,gBAAgB,KAAK;AAC5F;AAAA,IACF,KAAK;AACH,aAAO,EAAE,cAAc,CAAC,GAAG,aAAa,CAAC,GAAG,cAAc,CAAC,GAAG,gBAAgB,MAAM;AACpF;AAAA,EACJ;AACA,MAAI,OAAQ,QAAO,EAAE,GAAG,MAAM,GAAG,OAAO;AACxC,SAAO,OAAO,OAAO,IAAI;AAC3B;AAEO,SAAS,UAAU,MAAc,MAA0B,QAAgB,QAAsB;AACtG,QAAM,QAAQ,EAAE,IAAI,KAAK,IAAI,GAAG,OAAO,gBAAgB,MAAM,MAAM,QAAQ,OAAO;AAClF,MAAI;AAAE,mBAAe,YAAY,KAAK,UAAU,KAAK,IAAI,IAAI;AAAA,EAAG,SAAS,KAAK;AAAE,kBAAc,gBAAgB,eAAe,GAAG;AAAA,EAAG;AACrI;AAIA,IAAM,mBAAmB,oBAAI,IAAI,CAAC,aAAa,aAAa,cAAc,eAAe,CAAC;AAE1F,SAAS,SAAS,MAAc,MAAuC;AACrE,SAAO,WAAW,QAAQ,EAAE,OAAO,OAAO,KAAK,UAAU,IAAI,CAAC,EAAE,OAAO,KAAK;AAC9E;AAEO,IAAM,gBAAN,MAAoB;AAAA,EACjB,aAAa,oBAAI,IAAoB;AAAA,EACrC,eAAe,oBAAI,IAAoB;AAAA,EAE/C,WAAW,MAAc,MAA4C;AACnE,UAAM,OAAO,SAAS,MAAM,IAAI;AAChC,UAAM,QAAQ,KAAK,WAAW,IAAI,IAAI,KAAK;AAC3C,QAAI,SAAS,EAAG,QAAO,EAAE,SAAS,OAAO,QAAQ,SAAS,IAAI,0CAA0C,KAAK,UAAU;AACvH,QAAI,iBAAiB,IAAI,IAAI,GAAG;AAC9B,YAAM,UAAU,KAAK,aAAa,IAAI,IAAI,KAAK;AAC/C,UAAI,WAAW,EAAG,QAAO,EAAE,SAAS,OAAO,QAAQ,SAAS,IAAI,mCAAmC,OAAO,2BAAsB;AAAA,IAClI;AACA,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB;AAAA,EAEA,UAAU,MAAc,MAA+B,SAAiB,QAAqC;AAC3G,UAAM,OAAO,SAAS,MAAM,IAAI;AAChC,QAAI,QAAQ;AACV,YAAM,SAAS,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK;AACjD,WAAK,WAAW,IAAI,MAAM,KAAK;AAC/B,UAAI,UAAU,EAAG,QAAO;AAAA,IAC1B,WAAW,iBAAiB,IAAI,IAAI,GAAG;AACrC,YAAM,SAAS,KAAK,aAAa,IAAI,IAAI,KAAK,KAAK;AACnD,WAAK,aAAa,IAAI,MAAM,KAAK;AACjC,UAAI,UAAU,EAAG,QAAO;AAAA,IAC1B;AACA,WAAO;AAAA,EACT;AAAA,EAEA,eAAqB;AACnB,SAAK,WAAW,MAAM;AACtB,SAAK,aAAa,MAAM;AAAA,EAC1B;AACF;",
   "names": []
 }