agentinbox-cli 0.0.0 → 0.1.0-nightly.10

package/dist/mcpsetup-DJ7ebFGJ.js

@@ -0,0 +1,266 @@
+#!/usr/bin/env node
+import { i as safeText } from "./ui-B8Sd4Y7Y.js";
+import { c as isTooOpen, d as NPX, o as backupFile, u as writePrivateFile } from "./profile-CgGgJ4Dm.js";
+import { n as claudeServerEntry } from "./mcpheader-D9rrI-aa.js";
+import { r as mcpServerName } from "./recipes-UalOc_LB.js";
+import { chmodSync, existsSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { spawnSync } from "node:child_process";
+//#region server/listen/mcpsetup.ts
+const redact = (s, key) => s.split(key).join("aib_…(redacted)");
+/**
+* The MCP endpoint is always derived from the URL the user connected to (and transport-checked
+* there), never taken from the daemon: a daemon's advertised mcpUrl comes from its publicUrl setting,
+* which defaults to http://localhost:8425 and could also point the key somewhere else entirely.
+*/
+function mcpTarget(profileName, profile) {
+	return {
+		name: mcpServerName(profileName),
+		url: `${profile.url}/mcp`,
+		key: profile.apiKey,
+		profile: profileName
+	};
+}
+function setupMcp(tool, t, profileFile) {
+	switch (tool) {
+		case "claude-code": return setupClaude(t, t.profile ?? "default");
+		case "codex": return setupCodex(t, profileFile);
+		case "cursor": return setupCursor(t, profileFile);
+		case "hermes": return setupHermes(t, profileFile);
+		default: return {
+			ok: false,
+			message: "No automatic MCP setup for --tool other.",
+			manual: manualGeneric(t, profileFile)
+		};
+	}
+}
+function manualGeneric(t, profileFile) {
+	return [`MCP endpoint (streamable HTTP): ${t.url}`, `Header: Authorization: Bearer <key>. The key is the "apiKey" field in ${profileFile}; tools that run a header helper can use \`${NPX} mcp-header\`, which prints it as JSON to a pipe.`];
+}
+const claudeConfigFile = () => process.env.CLAUDE_CONFIG_DIR ? join(process.env.CLAUDE_CONFIG_DIR, ".claude.json") : join(homedir(), ".claude.json");
+function setupClaude(t, profile) {
+	const json = JSON.stringify(claudeServerEntry(t.url, profile));
+	const manual = [`claude mcp add-json --scope user ${t.name} '${json.replace(/'/g, `'"'"'`)}'`];
+	const probe = spawnSync("claude", ["--version"], { stdio: "ignore" });
+	if (probe.error || probe.status !== 0) return {
+		ok: false,
+		message: "The `claude` CLI was not found on PATH.",
+		manual
+	};
+	const file = claudeConfigFile();
+	const backup = backupFile(file);
+	spawnSync("claude", [
+		"mcp",
+		"remove",
+		t.name,
+		"--scope",
+		"user"
+	], { stdio: "ignore" });
+	const r = spawnSync("claude", [
+		"mcp",
+		"add-json",
+		"--scope",
+		"user",
+		t.name,
+		json
+	], {
+		encoding: "utf8",
+		stdio: [
+			"ignore",
+			"pipe",
+			"pipe"
+		]
+	});
+	if (r.status !== 0) {
+		const out = redact(`${r.stderr ?? ""}${r.stdout ?? ""}`, t.key).trim();
+		return {
+			ok: false,
+			message: `claude mcp add-json failed${out ? `: ${safeText(out, 300)}` : ""}`,
+			backup,
+			manual
+		};
+	}
+	if (existsSync(file) && isTooOpen(file)) chmodSync(file, 384);
+	return {
+		ok: true,
+		message: `Registered MCP server "${t.name}" in Claude Code (user scope). The key stays in your agentinbox profile; Claude Code asks for it through a header helper.`,
+		backup
+	};
+}
+const codexConfigFile = () => join(process.env.CODEX_HOME || join(homedir(), ".codex"), "config.toml");
+const escapeRe = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+const tomlString = (s) => JSON.stringify(s);
+/** Removes `[mcp_servers.<name>]` and its sub-tables from a TOML document, or returns null if it's defined in a form we won't rewrite safely. */
+function removeTomlServer(toml, name) {
+	const keyForms = `(?:${escapeRe(name)}|"${escapeRe(name)}"|'${escapeRe(name)}')`;
+	const header = new RegExp(`^\\s*\\[\\s*mcp_servers\\s*\\.\\s*${keyForms}\\s*(?:\\.[^\\]]*)?\\]\\s*(?:#.*)?$`);
+	const anyHeader = /^\s*\[/;
+	if (new RegExp(`^\\s*mcp_servers\\s*(?:=|\\.\\s*${keyForms}\\s*[.=])`, "m").test(toml)) return null;
+	const out = [];
+	let skipping = false;
+	for (const line of toml.split("\n")) {
+		if (anyHeader.test(line)) skipping = header.test(line);
+		if (!skipping && line.trim() !== CODEX_MARKER) out.push(line);
+	}
+	return out.join("\n").replace(/\n{3,}/g, "\n\n");
+}
+const CODEX_MARKER = "# Added by `agentinbox setup-mcp`. The key is also in your agentinbox profile; rotate it in the console.";
+function codexBlock(t) {
+	return [
+		CODEX_MARKER,
+		`[mcp_servers.${t.name}]`,
+		`url = ${tomlString(t.url)}`,
+		`http_headers = { Authorization = ${tomlString(`Bearer ${t.key}`)} }`,
+		`# codex exec never prompts: approve agentinbox tools up front (the grant's send mode still applies).`,
+		`default_tools_approval_mode = "approve"`,
+		""
+	].join("\n");
+}
+function setupCodex(t, profileFile) {
+	const file = codexConfigFile();
+	const manual = [
+		`Add to ${file}:`,
+		`  [mcp_servers.${t.name}]`,
+		`  url = "${t.url}"`,
+		`  http_headers = { Authorization = "Bearer <key>" }   # <key>: the apiKey field of ${profileFile}`,
+		`  default_tools_approval_mode = "approve"`
+	];
+	const without = removeTomlServer(existsSync(file) ? readFileSync(file, "utf8") : "", t.name);
+	if (without === null) return {
+		ok: false,
+		message: `${file} defines mcp_servers inline; not rewriting it automatically.`,
+		manual
+	};
+	const backup = backupFile(file);
+	const base = without.replace(/\s*$/, "");
+	writePrivateFile(file, `${base ? `${base}\n\n` : ""}${codexBlock(t)}`, { privateDir: false });
+	return {
+		ok: true,
+		message: `Added [mcp_servers.${t.name}] to ${file} (now mode 0600: it holds the key).`,
+		backup
+	};
+}
+const cursorConfigFile = () => join(homedir(), ".cursor", "mcp.json");
+function setupCursor(t, profileFile) {
+	const file = cursorConfigFile();
+	const manual = [`Add to ${file} under "mcpServers":`, `  "${t.name}": { "url": "${t.url}", "headers": { "Authorization": "Bearer <key>" } }   // <key>: the apiKey field of ${profileFile}`];
+	let doc = {};
+	if (existsSync(file)) {
+		const text = readFileSync(file, "utf8");
+		if (text.trim()) {
+			try {
+				doc = JSON.parse(text);
+			} catch {
+				return {
+					ok: false,
+					message: `${file} is not plain JSON (comments?); not rewriting it automatically.`,
+					manual
+				};
+			}
+			if (!doc || typeof doc !== "object" || Array.isArray(doc)) return {
+				ok: false,
+				message: `${file} is not a JSON object.`,
+				manual
+			};
+		}
+	}
+	const servers = doc.mcpServers && typeof doc.mcpServers === "object" && !Array.isArray(doc.mcpServers) ? doc.mcpServers : {};
+	servers[t.name] = {
+		url: t.url,
+		headers: { Authorization: `Bearer ${t.key}` }
+	};
+	doc.mcpServers = servers;
+	const backup = backupFile(file);
+	writePrivateFile(file, JSON.stringify(doc, null, 2) + "\n", { privateDir: false });
+	return {
+		ok: true,
+		message: `Added "${t.name}" to ${file} (now mode 0600: it holds the key). Cursor may ask you to enable it once.`,
+		backup
+	};
+}
+const hermesHome = () => process.env.HERMES_HOME || join(homedir(), ".hermes");
+const hermesEnvVar = (name) => name.toUpperCase().replace(/[^A-Z0-9]/g, "_") + "_API_KEY";
+/**
+* Inserts or replaces `mcp_servers.<name>` in a YAML document without a YAML library, handling the
+* common block-style layout. Returns null for anything unusual (flow style, anchors, odd indentation).
+*/
+function upsertYamlServer(yaml, name, entry) {
+	const lines = yaml.split("\n");
+	const top = lines.findIndex((l) => /^mcp_servers\s*:/.test(l));
+	const block = (indent) => [`${indent}${name}:`, ...entry.map((e) => `${indent}${indent}${e}`)];
+	if (top < 0) {
+		const base = yaml.replace(/\s*$/, "");
+		return `${base ? `${base}\n\n` : ""}mcp_servers:\n${block("  ").join("\n")}\n`;
+	}
+	const rest = lines[top].replace(/^mcp_servers\s*:/, "").replace(/#.*$/, "").trim();
+	if (rest && rest !== "{}" && rest !== "null" && rest !== "~") return null;
+	if (rest) lines[top] = "mcp_servers:";
+	let end = top + 1;
+	while (end < lines.length && (lines[end].trim() === "" || /^\s/.test(lines[end]))) end++;
+	const body = lines.slice(top + 1, end);
+	const firstChild = body.find((l) => l.trim() && !l.trimStart().startsWith("#"));
+	const indent = firstChild ? firstChild.match(/^(\s*)/)[1] : "  ";
+	if (!indent || /\t/.test(indent)) return null;
+	const kept = [];
+	let skipping = false;
+	for (const l of body) {
+		const own = l.match(/^(\s*)/)[1].length;
+		if (l.trim() && own === indent.length) skipping = new RegExp(`^${escapeRe(indent)}["']?${escapeRe(name)}["']?\\s*:`).test(l);
+		else if (l.trim() && own < indent.length) return null;
+		if (!skipping) kept.push(l);
+	}
+	const insert = block(indent);
+	return [
+		...lines.slice(0, top + 1),
+		...insert,
+		...kept,
+		...lines.slice(end)
+	].join("\n");
+}
+function upsertEnvLine(text, key, value) {
+	const line = `${key}=${value}`;
+	const re = new RegExp(`^\\s*(?:export\\s+)?${escapeRe(key)}\\s*=.*$`, "m");
+	if (re.test(text)) return text.replace(re, line);
+	const base = text.replace(/\s*$/, "");
+	return `${base ? `${base}\n` : ""}${line}\n`;
+}
+function setupHermes(t, profileFile) {
+	const home = hermesHome();
+	const configFile = join(home, "config.yaml");
+	const envFile = join(home, ".env");
+	const envVar = hermesEnvVar(t.name);
+	const entry = [
+		`url: ${JSON.stringify(t.url)}`,
+		`headers:`,
+		`  Authorization: "Bearer \${${envVar}}"`
+	];
+	const manual = [
+		`Add to ${configFile}:`,
+		`  mcp_servers:`,
+		`    ${t.name}:`,
+		...entry.map((e) => `      ${e}`),
+		`and to ${envFile}:  ${envVar}=<key>   (<key>: the apiKey field of ${profileFile})`,
+		`then check it with: hermes mcp test ${t.name}`
+	];
+	const next = upsertYamlServer(existsSync(configFile) ? readFileSync(configFile, "utf8") : "", t.name, entry);
+	if (next === null) return {
+		ok: false,
+		message: `${configFile} uses a layout we won't rewrite automatically.`,
+		manual
+	};
+	const envCurrent = existsSync(envFile) ? readFileSync(envFile, "utf8") : "";
+	const backup = backupFile(configFile);
+	const envBackup = backupFile(envFile);
+	writePrivateFile(envFile, upsertEnvLine(envCurrent, envVar, t.key), { privateDir: false });
+	writePrivateFile(configFile, next.endsWith("\n") ? next : `${next}\n`, { privateDir: false });
+	return {
+		ok: true,
+		message: `Added "${t.name}" to ${configFile}; the key is in ${envFile} as ${envVar} (0600). Check it with: hermes mcp test ${t.name}`,
+		backup: [backup, envBackup].filter(Boolean).join(", ") || null
+	};
+}
+//#endregion
+export { hermesEnvVar as a, removeTomlServer as c, cursorConfigFile as i, setupMcp as l, codexBlock as n, hermesHome as o, codexConfigFile as r, mcpTarget as s, claudeConfigFile as t, upsertYamlServer as u };
+
+//# sourceMappingURL=mcpsetup-DJ7ebFGJ.js.map

package/dist/mcpsetup-DJ7ebFGJ.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcpsetup-DJ7ebFGJ.js","names":[],"sources":["../server/listen/mcpsetup.ts"],"sourcesContent":["import { spawnSync } from \"node:child_process\";\nimport { chmodSync, existsSync, readFileSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { join } from \"node:path\";\nimport type { AgentTool } from \"../../shared/agent-api.ts\";\nimport { backupFile, isTooOpen, writePrivateFile } from \"./fsutil.ts\";\nimport { claudeServerEntry } from \"./mcpheader.ts\";\nimport type { Profile } from \"./profile.ts\";\nimport { mcpServerName } from \"./recipes.ts\";\nimport { NPX } from \"./version.ts\";\nimport { safeText } from \"./ui.ts\";\n\n/**\n * `--setup-mcp`: registers the agentinbox MCP server in the agent's own tool without the key ever\n * being shown or pasted. Every file we modify is backed up first; the key is redacted from any\n * output we relay.\n */\n\nexport interface McpSetupResult {\n  ok: boolean;\n  /** What happened, safe to print (never contains the key). */\n  message: string;\n  backup?: string | null;\n  /** Manual steps when automatic setup isn't possible. Never contains the key. */\n  manual?: string[];\n}\n\nexport interface McpSetupTarget {\n  name: string;\n  url: string;\n  key: string;\n}\n\nconst redact = (s: string, key: string) => s.split(key).join(\"aib_…(redacted)\");\n\n/**\n * The MCP endpoint is always derived from the URL the user connected to (and transport-checked\n * there), never taken from the daemon: a daemon's advertised mcpUrl comes from its publicUrl setting,\n * which defaults to http://localhost:8425 and could also point the key somewhere else entirely.\n */\nexport function mcpTarget(profileName: string, profile: Profile): McpSetupTarget & { profile: string } {\n  return { name: mcpServerName(profileName), url: `${profile.url}/mcp`, key: profile.apiKey, profile: profileName };\n}\n\nexport function setupMcp(tool: AgentTool, t: McpSetupTarget & { profile?: string }, profileFile: string): McpSetupResult {\n  switch (tool) {\n    case \"claude-code\":\n      return setupClaude(t, t.profile ?? \"default\");\n    case \"codex\":\n      return setupCodex(t, profileFile);\n    case \"cursor\":\n      return setupCursor(t, profileFile);\n    case \"hermes\":\n      return setupHermes(t, profileFile);\n    default:\n      return { ok: false, message: \"No automatic MCP setup for --tool other.\", manual: manualGeneric(t, profileFile) };\n  }\n}\n\nfunction manualGeneric(t: McpSetupTarget, profileFile: string): string[] {\n  return [\n    `MCP endpoint (streamable HTTP): ${t.url}`,\n    `Header: Authorization: Bearer <key>. The key is the \"apiKey\" field in ${profileFile}; tools that run a header helper can use \\`${NPX} mcp-header\\`, which prints it as JSON to a pipe.`,\n  ];\n}\n\n// ───────────── Claude Code ─────────────\n\nexport const claudeConfigFile = () => (process.env.CLAUDE_CONFIG_DIR ? join(process.env.CLAUDE_CONFIG_DIR, \".claude.json\") : join(homedir(), \".claude.json\"));\n\nfunction setupClaude(t: McpSetupTarget, profile: string): McpSetupResult {\n  // headersHelper: Claude Code asks our helper for the header at connect time, so the key is never in\n  // argv (visible in `ps`), in ~/.claude.json, or on screen.\n  const json = JSON.stringify(claudeServerEntry(t.url, profile));\n  const manual = [`claude mcp add-json --scope user ${t.name} '${json.replace(/'/g, `'\"'\"'`)}'`];\n  const probe = spawnSync(\"claude\", [\"--version\"], { stdio: \"ignore\" });\n  if (probe.error || probe.status !== 0) return { ok: false, message: \"The `claude` CLI was not found on PATH.\", manual };\n  const file = claudeConfigFile();\n  const backup = backupFile(file);\n  // `add-json` refuses an existing name, so replace it. argv arrays only, and nothing secret in them.\n  spawnSync(\"claude\", [\"mcp\", \"remove\", t.name, \"--scope\", \"user\"], { stdio: \"ignore\" });\n  const r = spawnSync(\"claude\", [\"mcp\", \"add-json\", \"--scope\", \"user\", t.name, json], { encoding: \"utf8\", stdio: [\"ignore\", \"pipe\", \"pipe\"] });\n  if (r.status !== 0) {\n    const out = redact(`${r.stderr ?? \"\"}${r.stdout ?? \"\"}`, t.key).trim();\n    return { ok: false, message: `claude mcp add-json failed${out ? `: ${safeText(out, 300)}` : \"\"}`, backup, manual };\n  }\n  if (existsSync(file) && isTooOpen(file)) chmodSync(file, 0o600);\n  return { ok: true, message: `Registered MCP server \"${t.name}\" in Claude Code (user scope). The key stays in your agentinbox profile; Claude Code asks for it through a header helper.`, backup };\n}\n\n// ───────────── Codex (~/.codex/config.toml) ─────────────\n\nexport const codexConfigFile = () => join(process.env.CODEX_HOME || join(homedir(), \".codex\"), \"config.toml\");\n\nconst escapeRe = (s: string) => s.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\");\nconst tomlString = (s: string) => JSON.stringify(s);\n\n/** Removes `[mcp_servers.<name>]` and its sub-tables from a TOML document, or returns null if it's defined in a form we won't rewrite safely. */\nexport function removeTomlServer(toml: string, name: string): string | null {\n  const keyForms = `(?:${escapeRe(name)}|\"${escapeRe(name)}\"|'${escapeRe(name)}')`;\n  const header = new RegExp(`^\\\\s*\\\\[\\\\s*mcp_servers\\\\s*\\\\.\\\\s*${keyForms}\\\\s*(?:\\\\.[^\\\\]]*)?\\\\]\\\\s*(?:#.*)?$`);\n  const anyHeader = /^\\s*\\[/;\n  // Inline or dotted definitions (`mcp_servers = { … }`, `mcp_servers.agentinbox.url = …`): leave to the human.\n  if (new RegExp(`^\\\\s*mcp_servers\\\\s*(?:=|\\\\.\\\\s*${keyForms}\\\\s*[.=])`, \"m\").test(toml)) return null;\n  const out: string[] = [];\n  let skipping = false;\n  for (const line of toml.split(\"\\n\")) {\n    if (anyHeader.test(line)) skipping = header.test(line);\n    // Our own marker comment sits just above the table: drop it too, so re-running doesn't pile them up.\n    if (!skipping && line.trim() !== CODEX_MARKER) out.push(line);\n  }\n  return out.join(\"\\n\").replace(/\\n{3,}/g, \"\\n\\n\");\n}\n\nconst CODEX_MARKER = \"# Added by `agentinbox setup-mcp`. The key is also in your agentinbox profile; rotate it in the console.\";\n\nexport function codexBlock(t: McpSetupTarget): string {\n  return [\n    CODEX_MARKER,\n    `[mcp_servers.${t.name}]`,\n    `url = ${tomlString(t.url)}`,\n    `http_headers = { Authorization = ${tomlString(`Bearer ${t.key}`)} }`,\n    `# codex exec never prompts: approve agentinbox tools up front (the grant's send mode still applies).`,\n    `default_tools_approval_mode = \"approve\"`,\n    \"\",\n  ].join(\"\\n\");\n}\n\nfunction setupCodex(t: McpSetupTarget, profileFile: string): McpSetupResult {\n  const file = codexConfigFile();\n  const manual = [\n    `Add to ${file}:`,\n    `  [mcp_servers.${t.name}]`,\n    `  url = \"${t.url}\"`,\n    `  http_headers = { Authorization = \"Bearer <key>\" }   # <key>: the apiKey field of ${profileFile}`,\n    `  default_tools_approval_mode = \"approve\"`,\n  ];\n  const current = existsSync(file) ? readFileSync(file, \"utf8\") : \"\";\n  const without = removeTomlServer(current, t.name);\n  if (without === null) return { ok: false, message: `${file} defines mcp_servers inline; not rewriting it automatically.`, manual };\n  const backup = backupFile(file);\n  const base = without.replace(/\\s*$/, \"\");\n  writePrivateFile(file, `${base ? `${base}\\n\\n` : \"\"}${codexBlock(t)}`, { privateDir: false });\n  return { ok: true, message: `Added [mcp_servers.${t.name}] to ${file} (now mode 0600: it holds the key).`, backup };\n}\n\n// ───────────── Cursor (~/.cursor/mcp.json) ─────────────\n\nexport const cursorConfigFile = () => join(homedir(), \".cursor\", \"mcp.json\");\n\nfunction setupCursor(t: McpSetupTarget, profileFile: string): McpSetupResult {\n  const file = cursorConfigFile();\n  const manual = [\n    `Add to ${file} under \"mcpServers\":`,\n    `  \"${t.name}\": { \"url\": \"${t.url}\", \"headers\": { \"Authorization\": \"Bearer <key>\" } }   // <key>: the apiKey field of ${profileFile}`,\n  ];\n  let doc: Record<string, unknown> = {};\n  if (existsSync(file)) {\n    const text = readFileSync(file, \"utf8\");\n    if (text.trim()) {\n      try {\n        doc = JSON.parse(text) as Record<string, unknown>;\n      } catch {\n        return { ok: false, message: `${file} is not plain JSON (comments?); not rewriting it automatically.`, manual };\n      }\n      if (!doc || typeof doc !== \"object\" || Array.isArray(doc)) return { ok: false, message: `${file} is not a JSON object.`, manual };\n    }\n  }\n  const servers = doc.mcpServers && typeof doc.mcpServers === \"object\" && !Array.isArray(doc.mcpServers) ? (doc.mcpServers as Record<string, unknown>) : {};\n  servers[t.name] = { url: t.url, headers: { Authorization: `Bearer ${t.key}` } };\n  doc.mcpServers = servers;\n  const backup = backupFile(file);\n  writePrivateFile(file, JSON.stringify(doc, null, 2) + \"\\n\", { privateDir: false });\n  return { ok: true, message: `Added \"${t.name}\" to ${file} (now mode 0600: it holds the key). Cursor may ask you to enable it once.`, backup };\n}\n\n// ───────────── Hermes (~/.hermes/config.yaml + ~/.hermes/.env) ─────────────\n\nexport const hermesHome = () => process.env.HERMES_HOME || join(homedir(), \".hermes\");\nexport const hermesEnvVar = (name: string) => name.toUpperCase().replace(/[^A-Z0-9]/g, \"_\") + \"_API_KEY\";\n\n/**\n * Inserts or replaces `mcp_servers.<name>` in a YAML document without a YAML library, handling the\n * common block-style layout. Returns null for anything unusual (flow style, anchors, odd indentation).\n */\nexport function upsertYamlServer(yaml: string, name: string, entry: string[]): string | null {\n  const lines = yaml.split(\"\\n\");\n  const top = lines.findIndex((l) => /^mcp_servers\\s*:/.test(l));\n  const block = (indent: string) => [`${indent}${name}:`, ...entry.map((e) => `${indent}${indent}${e}`)];\n  if (top < 0) {\n    const base = yaml.replace(/\\s*$/, \"\");\n    return `${base ? `${base}\\n\\n` : \"\"}mcp_servers:\\n${block(\"  \").join(\"\\n\")}\\n`;\n  }\n  const rest = lines[top]!.replace(/^mcp_servers\\s*:/, \"\").replace(/#.*$/, \"\").trim();\n  if (rest && rest !== \"{}\" && rest !== \"null\" && rest !== \"~\") return null;\n  if (rest) lines[top] = \"mcp_servers:\";\n  // The block runs until the next non-blank line at column 0.\n  let end = top + 1;\n  while (end < lines.length && (lines[end]!.trim() === \"\" || /^\\s/.test(lines[end]!))) end++;\n  const body = lines.slice(top + 1, end);\n  const firstChild = body.find((l) => l.trim() && !l.trimStart().startsWith(\"#\"));\n  const indent = firstChild ? firstChild.match(/^(\\s*)/)![1]! : \"  \";\n  if (!indent || /\\t/.test(indent)) return null;\n  const kept: string[] = [];\n  let skipping = false;\n  for (const l of body) {\n    const own = l.match(/^(\\s*)/)![1]!.length;\n    if (l.trim() && own === indent.length) skipping = new RegExp(`^${escapeRe(indent)}[\"']?${escapeRe(name)}[\"']?\\\\s*:`).test(l);\n    else if (l.trim() && own < indent.length) return null;\n    if (!skipping) kept.push(l);\n  }\n  const insert = block(indent);\n  return [...lines.slice(0, top + 1), ...insert, ...kept, ...lines.slice(end)].join(\"\\n\");\n}\n\nfunction upsertEnvLine(text: string, key: string, value: string): string {\n  const line = `${key}=${value}`;\n  const re = new RegExp(`^\\\\s*(?:export\\\\s+)?${escapeRe(key)}\\\\s*=.*$`, \"m\");\n  if (re.test(text)) return text.replace(re, line);\n  const base = text.replace(/\\s*$/, \"\");\n  return `${base ? `${base}\\n` : \"\"}${line}\\n`;\n}\n\nfunction setupHermes(t: McpSetupTarget, profileFile: string): McpSetupResult {\n  const home = hermesHome();\n  const configFile = join(home, \"config.yaml\");\n  const envFile = join(home, \".env\");\n  const envVar = hermesEnvVar(t.name);\n  const entry = [`url: ${JSON.stringify(t.url)}`, `headers:`, `  Authorization: \"Bearer \\${${envVar}}\"`];\n  const manual = [\n    `Add to ${configFile}:`,\n    `  mcp_servers:`,\n    `    ${t.name}:`,\n    ...entry.map((e) => `      ${e}`),\n    `and to ${envFile}:  ${envVar}=<key>   (<key>: the apiKey field of ${profileFile})`,\n    `then check it with: hermes mcp test ${t.name}`,\n  ];\n  const current = existsSync(configFile) ? readFileSync(configFile, \"utf8\") : \"\";\n  const next = upsertYamlServer(current, t.name, entry);\n  if (next === null) return { ok: false, message: `${configFile} uses a layout we won't rewrite automatically.`, manual };\n  const envCurrent = existsSync(envFile) ? readFileSync(envFile, \"utf8\") : \"\";\n  const backup = backupFile(configFile);\n  const envBackup = backupFile(envFile);\n  writePrivateFile(envFile, upsertEnvLine(envCurrent, envVar, t.key), { privateDir: false });\n  writePrivateFile(configFile, next.endsWith(\"\\n\") ? next : `${next}\\n`, { privateDir: false });\n  return {\n    ok: true,\n    message: `Added \"${t.name}\" to ${configFile}; the key is in ${envFile} as ${envVar} (0600). Check it with: hermes mcp test ${t.name}`,\n    backup: [backup, envBackup].filter(Boolean).join(\", \") || null,\n  };\n}\n"],"mappings":";;;;;;;;;;AAiCA,MAAM,UAAU,GAAW,QAAgB,EAAE,MAAM,GAAG,CAAC,CAAC,KAAK,iBAAiB;;;;;;AAO9E,SAAgB,UAAU,aAAqB,SAAwD;CACrG,OAAO;EAAE,MAAM,cAAc,WAAW;EAAG,KAAK,GAAG,QAAQ,IAAI;EAAO,KAAK,QAAQ;EAAQ,SAAS;CAAY;AAClH;AAEA,SAAgB,SAAS,MAAiB,GAA0C,aAAqC;CACvH,QAAQ,MAAR;EACE,KAAK,eACH,OAAO,YAAY,GAAG,EAAE,WAAW,SAAS;EAC9C,KAAK,SACH,OAAO,WAAW,GAAG,WAAW;EAClC,KAAK,UACH,OAAO,YAAY,GAAG,WAAW;EACnC,KAAK,UACH,OAAO,YAAY,GAAG,WAAW;EACnC,SACE,OAAO;GAAE,IAAI;GAAO,SAAS;GAA4C,QAAQ,cAAc,GAAG,WAAW;EAAE;CACnH;AACF;AAEA,SAAS,cAAc,GAAmB,aAA+B;CACvE,OAAO,CACL,mCAAmC,EAAE,OACrC,yEAAyE,YAAY,6CAA6C,IAAI,kDACxI;AACF;AAIA,MAAa,yBAA0B,QAAQ,IAAI,oBAAoB,KAAK,QAAQ,IAAI,mBAAmB,cAAc,IAAI,KAAK,QAAQ,GAAG,cAAc;AAE3J,SAAS,YAAY,GAAmB,SAAiC;CAGvE,MAAM,OAAO,KAAK,UAAU,kBAAkB,EAAE,KAAK,OAAO,CAAC;CAC7D,MAAM,SAAS,CAAC,oCAAoC,EAAE,KAAK,IAAI,KAAK,QAAQ,MAAM,OAAO,EAAE,EAAE;CAC7F,MAAM,QAAQ,UAAU,UAAU,CAAC,WAAW,GAAG,EAAE,OAAO,SAAS,CAAC;CACpE,IAAI,MAAM,SAAS,MAAM,WAAW,GAAG,OAAO;EAAE,IAAI;EAAO,SAAS;EAA2C;CAAO;CACtH,MAAM,OAAO,iBAAiB;CAC9B,MAAM,SAAS,WAAW,IAAI;CAE9B,UAAU,UAAU;EAAC;EAAO;EAAU,EAAE;EAAM;EAAW;CAAM,GAAG,EAAE,OAAO,SAAS,CAAC;CACrF,MAAM,IAAI,UAAU,UAAU;EAAC;EAAO;EAAY;EAAW;EAAQ,EAAE;EAAM;CAAI,GAAG;EAAE,UAAU;EAAQ,OAAO;GAAC;GAAU;GAAQ;EAAM;CAAE,CAAC;CAC3I,IAAI,EAAE,WAAW,GAAG;EAClB,MAAM,MAAM,OAAO,GAAG,EAAE,UAAU,KAAK,EAAE,UAAU,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK;EACrE,OAAO;GAAE,IAAI;GAAO,SAAS,6BAA6B,MAAM,KAAK,SAAS,KAAK,GAAG,MAAM;GAAM;GAAQ;EAAO;CACnH;CACA,IAAI,WAAW,IAAI,KAAK,UAAU,IAAI,GAAG,UAAU,MAAM,GAAK;CAC9D,OAAO;EAAE,IAAI;EAAM,SAAS,0BAA0B,EAAE,KAAK;EAA4H;CAAO;AAClM;AAIA,MAAa,wBAAwB,KAAK,QAAQ,IAAI,cAAc,KAAK,QAAQ,GAAG,QAAQ,GAAG,aAAa;AAE5G,MAAM,YAAY,MAAc,EAAE,QAAQ,uBAAuB,MAAM;AACvE,MAAM,cAAc,MAAc,KAAK,UAAU,CAAC;;AAGlD,SAAgB,iBAAiB,MAAc,MAA6B;CAC1E,MAAM,WAAW,MAAM,SAAS,IAAI,EAAE,IAAI,SAAS,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE;CAC7E,MAAM,SAAS,IAAI,OAAO,qCAAqC,SAAS,oCAAoC;CAC5G,MAAM,YAAY;CAElB,IAAI,IAAI,OAAO,mCAAmC,SAAS,YAAY,GAAG,CAAC,CAAC,KAAK,IAAI,GAAG,OAAO;CAC/F,MAAM,MAAgB,CAAC;CACvB,IAAI,WAAW;CACf,KAAK,MAAM,QAAQ,KAAK,MAAM,IAAI,GAAG;EACnC,IAAI,UAAU,KAAK,IAAI,GAAG,WAAW,OAAO,KAAK,IAAI;EAErD,IAAI,CAAC,YAAY,KAAK,KAAK,MAAM,cAAc,IAAI,KAAK,IAAI;CAC9D;CACA,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,QAAQ,WAAW,MAAM;AACjD;AAEA,MAAM,eAAe;AAErB,SAAgB,WAAW,GAA2B;CACpD,OAAO;EACL;EACA,gBAAgB,EAAE,KAAK;EACvB,SAAS,WAAW,EAAE,GAAG;EACzB,oCAAoC,WAAW,UAAU,EAAE,KAAK,EAAE;EAClE;EACA;EACA;CACF,CAAC,CAAC,KAAK,IAAI;AACb;AAEA,SAAS,WAAW,GAAmB,aAAqC;CAC1E,MAAM,OAAO,gBAAgB;CAC7B,MAAM,SAAS;EACb,UAAU,KAAK;EACf,kBAAkB,EAAE,KAAK;EACzB,YAAY,EAAE,IAAI;EAClB,sFAAsF;EACtF;CACF;CAEA,MAAM,UAAU,iBADA,WAAW,IAAI,IAAI,aAAa,MAAM,MAAM,IAAI,IACtB,EAAE,IAAI;CAChD,IAAI,YAAY,MAAM,OAAO;EAAE,IAAI;EAAO,SAAS,GAAG,KAAK;EAA+D;CAAO;CACjI,MAAM,SAAS,WAAW,IAAI;CAC9B,MAAM,OAAO,QAAQ,QAAQ,QAAQ,EAAE;CACvC,iBAAiB,MAAM,GAAG,OAAO,GAAG,KAAK,QAAQ,KAAK,WAAW,CAAC,KAAK,EAAE,YAAY,MAAM,CAAC;CAC5F,OAAO;EAAE,IAAI;EAAM,SAAS,sBAAsB,EAAE,KAAK,OAAO,KAAK;EAAsC;CAAO;AACpH;AAIA,MAAa,yBAAyB,KAAK,QAAQ,GAAG,WAAW,UAAU;AAE3E,SAAS,YAAY,GAAmB,aAAqC;CAC3E,MAAM,OAAO,iBAAiB;CAC9B,MAAM,SAAS,CACb,UAAU,KAAK,uBACf,MAAM,EAAE,KAAK,eAAe,EAAE,IAAI,sFAAsF,aAC1H;CACA,IAAI,MAA+B,CAAC;CACpC,IAAI,WAAW,IAAI,GAAG;EACpB,MAAM,OAAO,aAAa,MAAM,MAAM;EACtC,IAAI,KAAK,KAAK,GAAG;GACf,IAAI;IACF,MAAM,KAAK,MAAM,IAAI;GACvB,QAAQ;IACN,OAAO;KAAE,IAAI;KAAO,SAAS,GAAG,KAAK;KAAkE;IAAO;GAChH;GACA,IAAI,CAAC,OAAO,OAAO,QAAQ,YAAY,MAAM,QAAQ,GAAG,GAAG,OAAO;IAAE,IAAI;IAAO,SAAS,GAAG,KAAK;IAAyB;GAAO;EAClI;CACF;CACA,MAAM,UAAU,IAAI,cAAc,OAAO,IAAI,eAAe,YAAY,CAAC,MAAM,QAAQ,IAAI,UAAU,IAAK,IAAI,aAAyC,CAAC;CACxJ,QAAQ,EAAE,QAAQ;EAAE,KAAK,EAAE;EAAK,SAAS,EAAE,eAAe,UAAU,EAAE,MAAM;CAAE;CAC9E,IAAI,aAAa;CACjB,MAAM,SAAS,WAAW,IAAI;CAC9B,iBAAiB,MAAM,KAAK,UAAU,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,YAAY,MAAM,CAAC;CACjF,OAAO;EAAE,IAAI;EAAM,SAAS,UAAU,EAAE,KAAK,OAAO,KAAK;EAA4E;CAAO;AAC9I;AAIA,MAAa,mBAAmB,QAAQ,IAAI,eAAe,KAAK,QAAQ,GAAG,SAAS;AACpF,MAAa,gBAAgB,SAAiB,KAAK,YAAY,CAAC,CAAC,QAAQ,cAAc,GAAG,IAAI;;;;;AAM9F,SAAgB,iBAAiB,MAAc,MAAc,OAAgC;CAC3F,MAAM,QAAQ,KAAK,MAAM,IAAI;CAC7B,MAAM,MAAM,MAAM,WAAW,MAAM,mBAAmB,KAAK,CAAC,CAAC;CAC7D,MAAM,SAAS,WAAmB,CAAC,GAAG,SAAS,KAAK,IAAI,GAAG,MAAM,KAAK,MAAM,GAAG,SAAS,SAAS,GAAG,CAAC;CACrG,IAAI,MAAM,GAAG;EACX,MAAM,OAAO,KAAK,QAAQ,QAAQ,EAAE;EACpC,OAAO,GAAG,OAAO,GAAG,KAAK,QAAQ,GAAG,gBAAgB,MAAM,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE;CAC7E;CACA,MAAM,OAAO,MAAM,IAAI,CAAE,QAAQ,oBAAoB,EAAE,CAAC,CAAC,QAAQ,QAAQ,EAAE,CAAC,CAAC,KAAK;CAClF,IAAI,QAAQ,SAAS,QAAQ,SAAS,UAAU,SAAS,KAAK,OAAO;CACrE,IAAI,MAAM,MAAM,OAAO;CAEvB,IAAI,MAAM,MAAM;CAChB,OAAO,MAAM,MAAM,WAAW,MAAM,IAAI,CAAE,KAAK,MAAM,MAAM,MAAM,KAAK,MAAM,IAAK,IAAI;CACrF,MAAM,OAAO,MAAM,MAAM,MAAM,GAAG,GAAG;CACrC,MAAM,aAAa,KAAK,MAAM,MAAM,EAAE,KAAK,KAAK,CAAC,EAAE,UAAU,CAAC,CAAC,WAAW,GAAG,CAAC;CAC9E,MAAM,SAAS,aAAa,WAAW,MAAM,QAAQ,CAAC,CAAE,KAAM;CAC9D,IAAI,CAAC,UAAU,KAAK,KAAK,MAAM,GAAG,OAAO;CACzC,MAAM,OAAiB,CAAC;CACxB,IAAI,WAAW;CACf,KAAK,MAAM,KAAK,MAAM;EACpB,MAAM,MAAM,EAAE,MAAM,QAAQ,CAAC,CAAE,EAAE,CAAE;EACnC,IAAI,EAAE,KAAK,KAAK,QAAQ,OAAO,QAAQ,WAAW,IAAI,OAAO,IAAI,SAAS,MAAM,EAAE,OAAO,SAAS,IAAI,EAAE,WAAW,CAAC,CAAC,KAAK,CAAC;OACtH,IAAI,EAAE,KAAK,KAAK,MAAM,OAAO,QAAQ,OAAO;EACjD,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC;CAC5B;CACA,MAAM,SAAS,MAAM,MAAM;CAC3B,OAAO;EAAC,GAAG,MAAM,MAAM,GAAG,MAAM,CAAC;EAAG,GAAG;EAAQ,GAAG;EAAM,GAAG,MAAM,MAAM,GAAG;CAAC,CAAC,CAAC,KAAK,IAAI;AACxF;AAEA,SAAS,cAAc,MAAc,KAAa,OAAuB;CACvE,MAAM,OAAO,GAAG,IAAI,GAAG;CACvB,MAAM,KAAK,IAAI,OAAO,uBAAuB,SAAS,GAAG,EAAE,WAAW,GAAG;CACzE,IAAI,GAAG,KAAK,IAAI,GAAG,OAAO,KAAK,QAAQ,IAAI,IAAI;CAC/C,MAAM,OAAO,KAAK,QAAQ,QAAQ,EAAE;CACpC,OAAO,GAAG,OAAO,GAAG,KAAK,MAAM,KAAK,KAAK;AAC3C;AAEA,SAAS,YAAY,GAAmB,aAAqC;CAC3E,MAAM,OAAO,WAAW;CACxB,MAAM,aAAa,KAAK,MAAM,aAAa;CAC3C,MAAM,UAAU,KAAK,MAAM,MAAM;CACjC,MAAM,SAAS,aAAa,EAAE,IAAI;CAClC,MAAM,QAAQ;EAAC,QAAQ,KAAK,UAAU,EAAE,GAAG;EAAK;EAAY,+BAA+B,OAAO;CAAG;CACrG,MAAM,SAAS;EACb,UAAU,WAAW;EACrB;EACA,OAAO,EAAE,KAAK;EACd,GAAG,MAAM,KAAK,MAAM,SAAS,GAAG;EAChC,UAAU,QAAQ,KAAK,OAAO,uCAAuC,YAAY;EACjF,uCAAuC,EAAE;CAC3C;CAEA,MAAM,OAAO,iBADG,WAAW,UAAU,IAAI,aAAa,YAAY,MAAM,IAAI,IACrC,EAAE,MAAM,KAAK;CACpD,IAAI,SAAS,MAAM,OAAO;EAAE,IAAI;EAAO,SAAS,GAAG,WAAW;EAAiD;CAAO;CACtH,MAAM,aAAa,WAAW,OAAO,IAAI,aAAa,SAAS,MAAM,IAAI;CACzE,MAAM,SAAS,WAAW,UAAU;CACpC,MAAM,YAAY,WAAW,OAAO;CACpC,iBAAiB,SAAS,cAAc,YAAY,QAAQ,EAAE,GAAG,GAAG,EAAE,YAAY,MAAM,CAAC;CACzF,iBAAiB,YAAY,KAAK,SAAS,IAAI,IAAI,OAAO,GAAG,KAAK,KAAK,EAAE,YAAY,MAAM,CAAC;CAC5F,OAAO;EACL,IAAI;EACJ,SAAS,UAAU,EAAE,KAAK,OAAO,WAAW,kBAAkB,QAAQ,MAAM,OAAO,0CAA0C,EAAE;EAC/H,QAAQ,CAAC,QAAQ,SAAS,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,KAAK,IAAI,KAAK;CAC5D;AACF"}

package/dist/paths-BCBp8vrG.js

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export { s as profilePath } from "./paths-TLp8hiMt.js";

package/dist/paths-TLp8hiMt.js

@@ -0,0 +1,40 @@
+#!/usr/bin/env node
+import { homedir } from "node:os";
+import { join } from "node:path";
+//#region server/listen/paths.ts
+/**
+* Agent-side locations (the machine running `connect` / `listen`, not the daemon). XDG on Linux and
+* macOS alike, so one set of paths works everywhere:
+*   config  $XDG_CONFIG_HOME/agentinbox  (~/.config/agentinbox)       profiles/<name>.json (0600)
+*   state   $XDG_STATE_HOME/agentinbox   (~/.local/state/agentinbox)  listen/<name>/{listen.log,dead.jsonl,status.json}
+*   data    $XDG_DATA_HOME/agentinbox    (~/.local/share/agentinbox)  app/ (stable install the services run)
+*/
+const xdg = (envVar, fallback) => {
+	const v = process.env[envVar];
+	return v && v.startsWith("/") ? v : join(homedir(), fallback);
+};
+const configDir = () => join(xdg("XDG_CONFIG_HOME", ".config"), "agentinbox");
+const stateDir = () => join(xdg("XDG_STATE_HOME", ".local/state"), "agentinbox");
+const dataDir = () => join(xdg("XDG_DATA_HOME", ".local/share"), "agentinbox");
+const profilesDir = () => join(configDir(), "profiles");
+const profilePath = (name) => join(profilesDir(), `${name}.json`);
+const profileStateDir = (name) => join(stateDir(), "listen", name);
+const logPath = (name) => join(profileStateDir(name), "listen.log");
+const deadPath = (name) => join(profileStateDir(name), "dead.jsonl");
+const statusPath = (name) => join(profileStateDir(name), "status.json");
+/** Default working directory for --exec commands: private (0700), so no planted CLAUDE.md, .mcp.json or hooks apply. */
+const workDir = (name) => join(profileStateDir(name), "work");
+/** The listeners' stable install (shared by all profiles), staged and swapped like the daemon's `<data>/app`. */
+const listenAppDir = () => join(dataDir(), "app");
+const DEFAULT_PROFILE = "default";
+const PROFILE_RE = /^[a-z0-9][a-z0-9_-]{0,39}$/;
+/** Profile names become file names and service names, so they are kept boring. */
+function validProfileName(name) {
+	const n = name.trim().toLowerCase();
+	if (!PROFILE_RE.test(n)) throw new Error(`Invalid profile name "${name}": use 1-40 lowercase letters, digits, "-" or "_", starting with a letter or digit.`);
+	return n;
+}
+//#endregion
+export { listenAppDir as a, profileStateDir as c, statusPath as d, validProfileName as f, deadPath as i, profilesDir as l, configDir as n, logPath as o, workDir as p, dataDir as r, profilePath as s, DEFAULT_PROFILE as t, stateDir as u };
+
+//# sourceMappingURL=paths-TLp8hiMt.js.map

package/dist/paths-TLp8hiMt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths-TLp8hiMt.js","names":[],"sources":["../server/listen/paths.ts"],"sourcesContent":["import { homedir } from \"node:os\";\nimport { join } from \"node:path\";\n\n/**\n * Agent-side locations (the machine running `connect` / `listen`, not the daemon). XDG on Linux and\n * macOS alike, so one set of paths works everywhere:\n *   config  $XDG_CONFIG_HOME/agentinbox  (~/.config/agentinbox)       profiles/<name>.json (0600)\n *   state   $XDG_STATE_HOME/agentinbox   (~/.local/state/agentinbox)  listen/<name>/{listen.log,dead.jsonl,status.json}\n *   data    $XDG_DATA_HOME/agentinbox    (~/.local/share/agentinbox)  app/ (stable install the services run)\n */\n\nconst xdg = (envVar: string, fallback: string) => {\n  const v = process.env[envVar];\n  // The XDG spec says relative paths are invalid and must be ignored.\n  return v && v.startsWith(\"/\") ? v : join(homedir(), fallback);\n};\n\nexport const configDir = () => join(xdg(\"XDG_CONFIG_HOME\", \".config\"), \"agentinbox\");\nexport const stateDir = () => join(xdg(\"XDG_STATE_HOME\", \".local/state\"), \"agentinbox\");\nexport const dataDir = () => join(xdg(\"XDG_DATA_HOME\", \".local/share\"), \"agentinbox\");\n\nexport const profilesDir = () => join(configDir(), \"profiles\");\nexport const profilePath = (name: string) => join(profilesDir(), `${name}.json`);\nexport const profileStateDir = (name: string) => join(stateDir(), \"listen\", name);\nexport const logPath = (name: string) => join(profileStateDir(name), \"listen.log\");\nexport const deadPath = (name: string) => join(profileStateDir(name), \"dead.jsonl\");\nexport const statusPath = (name: string) => join(profileStateDir(name), \"status.json\");\n/** Default working directory for --exec commands: private (0700), so no planted CLAUDE.md, .mcp.json or hooks apply. */\nexport const workDir = (name: string) => join(profileStateDir(name), \"work\");\n/** The listeners' stable install (shared by all profiles), staged and swapped like the daemon's `<data>/app`. */\nexport const listenAppDir = () => join(dataDir(), \"app\");\n\nexport const DEFAULT_PROFILE = \"default\";\nconst PROFILE_RE = /^[a-z0-9][a-z0-9_-]{0,39}$/;\n\n/** Profile names become file names and service names, so they are kept boring. */\nexport function validProfileName(name: string): string {\n  const n = name.trim().toLowerCase();\n  if (!PROFILE_RE.test(n)) {\n    throw new Error(`Invalid profile name \"${name}\": use 1-40 lowercase letters, digits, \"-\" or \"_\", starting with a letter or digit.`);\n  }\n  return n;\n}\n"],"mappings":";;;;;;;;;;;AAWA,MAAM,OAAO,QAAgB,aAAqB;CAChD,MAAM,IAAI,QAAQ,IAAI;CAEtB,OAAO,KAAK,EAAE,WAAW,GAAG,IAAI,IAAI,KAAK,QAAQ,GAAG,QAAQ;AAC9D;AAEA,MAAa,kBAAkB,KAAK,IAAI,mBAAmB,SAAS,GAAG,YAAY;AACnF,MAAa,iBAAiB,KAAK,IAAI,kBAAkB,cAAc,GAAG,YAAY;AACtF,MAAa,gBAAgB,KAAK,IAAI,iBAAiB,cAAc,GAAG,YAAY;AAEpF,MAAa,oBAAoB,KAAK,UAAU,GAAG,UAAU;AAC7D,MAAa,eAAe,SAAiB,KAAK,YAAY,GAAG,GAAG,KAAK,MAAM;AAC/E,MAAa,mBAAmB,SAAiB,KAAK,SAAS,GAAG,UAAU,IAAI;AAChF,MAAa,WAAW,SAAiB,KAAK,gBAAgB,IAAI,GAAG,YAAY;AACjF,MAAa,YAAY,SAAiB,KAAK,gBAAgB,IAAI,GAAG,YAAY;AAClF,MAAa,cAAc,SAAiB,KAAK,gBAAgB,IAAI,GAAG,aAAa;;AAErF,MAAa,WAAW,SAAiB,KAAK,gBAAgB,IAAI,GAAG,MAAM;;AAE3E,MAAa,qBAAqB,KAAK,QAAQ,GAAG,KAAK;AAEvD,MAAa,kBAAkB;AAC/B,MAAM,aAAa;;AAGnB,SAAgB,iBAAiB,MAAsB;CACrD,MAAM,IAAI,KAAK,KAAK,CAAC,CAAC,YAAY;CAClC,IAAI,CAAC,WAAW,KAAK,CAAC,GACpB,MAAM,IAAI,MAAM,yBAAyB,KAAK,oFAAoF;CAEpI,OAAO;AACT"}

package/dist/profile-CgGgJ4Dm.js

@@ -0,0 +1,181 @@
+#!/usr/bin/env node
+import { n as EVENT_TYPES, r as NPM_PACKAGE } from "./types-3eEsBFVj.js";
+import { r as webhookFilterSchema } from "./filter-DGVz6-P1.js";
+import { f as validProfileName, l as profilesDir, s as profilePath, t as DEFAULT_PROFILE } from "./paths-TLp8hiMt.js";
+import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { randomBytes } from "node:crypto";
+import { z } from "zod";
+//#region server/listen/version.ts
+/** How printed instructions invoke the CLI without a global install. */
+const NPX = `npx ${NPM_PACKAGE}`;
+/** package.json sits above dist/ (bundled) or two levels above server/listen/ (source). */
+function readVersion() {
+	for (const rel of ["..", "../.."]) try {
+		const pkg = JSON.parse(readFileSync(join(import.meta.dirname, rel, "package.json"), "utf8"));
+		if (pkg.name === "agentinbox-cli" && pkg.version) return pkg.version;
+	} catch {}
+	return "0.0.0";
+}
+const version = readVersion();
+//#endregion
+//#region server/listen/fsutil.ts
+/** Creates a directory (and parents) readable only by this user. Tightens an existing one. */
+function ensurePrivateDir(dir) {
+	mkdirSync(dir, {
+		recursive: true,
+		mode: 448
+	});
+	if (process.platform !== "win32" && (statSync(dir).mode & 63) !== 0) chmodSync(dir, 448);
+}
+/**
+* Writes a file with mode 0600 atomically (temp file + rename), so a crash never leaves a
+* half-written profile and the secret is never briefly world-readable.
+*/
+function writePrivateFile(linkOrPath, content, opts = {}) {
+	const path = resolveLink(linkOrPath);
+	if (opts.privateDir !== false) ensurePrivateDir(dirname(path));
+	else mkdirSync(dirname(path), { recursive: true });
+	const tmp = `${path}.${randomBytes(4).toString("hex")}.tmp`;
+	try {
+		writeFileSync(tmp, content, {
+			mode: 384,
+			flag: "wx"
+		});
+		chmodSync(tmp, 384);
+		renameSync(tmp, path);
+	} catch (err) {
+		rmSync(tmp, { force: true });
+		throw err;
+	}
+}
+function resolveLink(path) {
+	try {
+		return lstatSync(path).isSymbolicLink() ? realpathSync(path) : path;
+	} catch {
+		return path;
+	}
+}
+/** Copies `path` next to itself as `<path>.agentinbox-backup-<timestamp>` (0600). Returns the copy, or null if there was nothing to back up. */
+function backupFile(path) {
+	if (!existsSync(path)) return null;
+	const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+	const content = readFileSync(path);
+	for (let n = 0;; n++) {
+		const backup = `${path}.agentinbox-backup-${stamp}${n ? `-${n}` : ""}`;
+		try {
+			writeFileSync(backup, content, {
+				mode: 384,
+				flag: "wx"
+			});
+			return backup;
+		} catch (err) {
+			if (err.code !== "EEXIST" || n > 20) throw err;
+		}
+	}
+}
+/** Tightens an existing file to 0600 (files created by appendFileSync keep their first mode). */
+function tighten(path) {
+	if (process.platform !== "win32" && existsSync(path) && (statSync(path).mode & 63) !== 0) chmodSync(path, 384);
+}
+/**
+* A directory commands may run in: must exist, be owned by this user and not be writable by group or
+* others (otherwise someone else could plant agent instructions, MCP configs or hooks there).
+*/
+function assertTrustedDir(dir) {
+	let st;
+	try {
+		st = statSync(dir);
+	} catch {
+		throw new Error(`--cwd ${dir} does not exist.`);
+	}
+	if (!st.isDirectory()) throw new Error(`--cwd ${dir} is not a directory.`);
+	const uid = process.getuid?.();
+	if (uid !== void 0 && st.uid !== uid) throw new Error(`Refusing --cwd ${dir}: it belongs to another user, who could plant instructions or hooks for the agent there.`);
+	if (process.platform !== "win32" && (st.mode & 18) !== 0) throw new Error(`Refusing --cwd ${dir}: it is writable by group or others (mode ${(st.mode & 511).toString(8)}). Use a directory only you can write to.`);
+	for (let p = dirname(dir); p !== dirname(p); p = dirname(p)) try {
+		const ps = statSync(p);
+		if (process.platform !== "win32" && (ps.mode & 18) !== 0 && (ps.mode & 512) === 0) {
+			process.stderr.write(`warning: --cwd ${dir}: its parent ${p} is writable by group or others, so they could replace it.\n`);
+			break;
+		}
+	} catch {
+		break;
+	}
+	return dir;
+}
+/** True when group or others can read/write the file. */
+const isTooOpen = (path) => process.platform !== "win32" && (statSync(path).mode & 63) !== 0;
+//#endregion
+//#region server/listen/profile.ts
+const profileSchema = z.object({
+	url: z.string().refine((u) => URL.canParse(u), "url must be a full URL"),
+	apiKey: z.string().min(8),
+	agentId: z.string().min(1),
+	agentName: z.string(),
+	consumer: z.string().min(1).max(100),
+	insecure: z.boolean().optional(),
+	types: z.array(z.enum(EVENT_TYPES)).optional(),
+	filter: webhookFilterSchema.optional(),
+	includeBody: z.boolean().optional(),
+	exec: z.string().min(1).optional(),
+	forward: z.object({
+		url: z.string(),
+		secret: z.string().startsWith("whsec_")
+	}).optional(),
+	concurrency: z.number().int().min(1).max(32).optional(),
+	timeoutSeconds: z.number().int().min(1).max(86400).optional(),
+	maxAttempts: z.number().int().min(1).max(100).optional(),
+	tool: z.enum([
+		"claude-code",
+		"codex",
+		"cursor",
+		"hermes",
+		"other"
+	]).optional(),
+	mcpUrl: z.string().optional(),
+	skillUrl: z.string().optional(),
+	forwardSecret: z.string().startsWith("whsec_").optional(),
+	cwd: z.string().startsWith("/").optional(),
+	createdAt: z.string().optional()
+}).loose();
+const profileExists = (name) => existsSync(profilePath(validProfileName(name)));
+function listProfiles() {
+	if (!existsSync(profilesDir())) return [];
+	return readdirSync(profilesDir()).filter((f) => f.endsWith(".json")).map((f) => f.slice(0, -5)).sort();
+}
+function loadProfile(name = DEFAULT_PROFILE) {
+	const n = validProfileName(name);
+	const path = profilePath(n);
+	if (!existsSync(path)) {
+		const others = listProfiles();
+		const hint = others.length ? ` Known profiles: ${others.join(", ")} (pick one with --profile).` : ` Run \`${NPX} connect <daemon-url>\` first.`;
+		throw new Error(`No agentinbox profile "${n}" (${path}).${hint}`);
+	}
+	if (isTooOpen(path)) {
+		chmodSync(path, 384);
+		process.stderr.write(`warning: ${path} was readable by other users; it is 0600 again. If anyone else could have read it, rotate the agent's key in the console and run \`${NPX} connect … --force\`.\n`);
+	}
+	let raw;
+	try {
+		raw = JSON.parse(readFileSync(path, "utf8"));
+	} catch (err) {
+		throw new Error(`Profile ${path} is not valid JSON (${err.message}). Fix it or run \`${NPX} connect\` again.`);
+	}
+	const parsed = profileSchema.safeParse(raw);
+	if (!parsed.success) {
+		const issue = parsed.error.issues[0];
+		throw new Error(`Profile ${path} is invalid: ${issue?.path.join(".") || "file"}: ${issue?.message}`);
+	}
+	return parsed.data;
+}
+function saveProfile(name, profile) {
+	const path = profilePath(validProfileName(name));
+	const clean = Object.fromEntries(Object.entries(profile).filter(([, v]) => v !== void 0));
+	writePrivateFile(path, JSON.stringify(clean, null, 2) + "\n");
+	return path;
+}
+//#endregion
+export { assertTrustedDir as a, isTooOpen as c, NPX as d, version as f, saveProfile as i, tighten as l, loadProfile as n, backupFile as o, profileExists as r, ensurePrivateDir as s, listProfiles as t, writePrivateFile as u };
+
+//# sourceMappingURL=profile-CgGgJ4Dm.js.map

package/dist/profile-CgGgJ4Dm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile-CgGgJ4Dm.js","names":[],"sources":["../server/listen/version.ts","../server/listen/fsutil.ts","../server/listen/profile.ts"],"sourcesContent":["import { readFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\n\nimport { NPM_PACKAGE } from \"../../shared/types.ts\";\n\n/** How printed instructions invoke the CLI without a global install. */\nexport const NPX = `npx ${NPM_PACKAGE}`;\n\n/** package.json sits above dist/ (bundled) or two levels above server/listen/ (source). */\nfunction readVersion(): string {\n  for (const rel of [\"..\", \"../..\"]) {\n    try {\n      const pkg = JSON.parse(readFileSync(join(import.meta.dirname, rel, \"package.json\"), \"utf8\")) as { name?: string; version?: string };\n      if (pkg.name === NPM_PACKAGE && pkg.version) return pkg.version;\n    } catch {\n      // Try the next candidate.\n    }\n  }\n  return \"0.0.0\";\n}\n\nexport const version = readVersion();\n","import { randomBytes } from \"node:crypto\";\nimport { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from \"node:fs\";\nimport { dirname } from \"node:path\";\n\n/** Creates a directory (and parents) readable only by this user. Tightens an existing one. */\nexport function ensurePrivateDir(dir: string): void {\n  mkdirSync(dir, { recursive: true, mode: 0o700 });\n  if (process.platform !== \"win32\" && (statSync(dir).mode & 0o077) !== 0) chmodSync(dir, 0o700);\n}\n\n/**\n * Writes a file with mode 0600 atomically (temp file + rename), so a crash never leaves a\n * half-written profile and the secret is never briefly world-readable.\n */\nexport function writePrivateFile(linkOrPath: string, content: string, opts: { privateDir?: boolean } = {}): void {\n  // A symlinked config (dotfiles repos) is updated at its real location instead of being replaced by a plain file.\n  const path = resolveLink(linkOrPath);\n  if (opts.privateDir !== false) ensurePrivateDir(dirname(path));\n  else mkdirSync(dirname(path), { recursive: true });\n  const tmp = `${path}.${randomBytes(4).toString(\"hex\")}.tmp`;\n  try {\n    writeFileSync(tmp, content, { mode: 0o600, flag: \"wx\" });\n    chmodSync(tmp, 0o600);\n    renameSync(tmp, path);\n  } catch (err) {\n    rmSync(tmp, { force: true });\n    throw err;\n  }\n}\n\nfunction resolveLink(path: string): string {\n  try {\n    return lstatSync(path).isSymbolicLink() ? realpathSync(path) : path;\n  } catch {\n    return path;\n  }\n}\n\n/** Copies `path` next to itself as `<path>.agentinbox-backup-<timestamp>` (0600). Returns the copy, or null if there was nothing to back up. */\nexport function backupFile(path: string): string | null {\n  if (!existsSync(path)) return null;\n  const stamp = new Date().toISOString().replace(/[:.]/g, \"-\");\n  const content = readFileSync(path);\n  // Created 0600 and exclusively (never through an existing file or symlink), then filled.\n  for (let n = 0; ; n++) {\n    const backup = `${path}.agentinbox-backup-${stamp}${n ? `-${n}` : \"\"}`;\n    try {\n      writeFileSync(backup, content, { mode: 0o600, flag: \"wx\" });\n      return backup;\n    } catch (err) {\n      if ((err as NodeJS.ErrnoException).code !== \"EEXIST\" || n > 20) throw err;\n    }\n  }\n}\n\n/** Tightens an existing file to 0600 (files created by appendFileSync keep their first mode). */\nexport function tighten(path: string): void {\n  if (process.platform !== \"win32\" && existsSync(path) && (statSync(path).mode & 0o077) !== 0) chmodSync(path, 0o600);\n}\n\n/**\n * A directory commands may run in: must exist, be owned by this user and not be writable by group or\n * others (otherwise someone else could plant agent instructions, MCP configs or hooks there).\n */\nexport function assertTrustedDir(dir: string): string {\n  let st;\n  try {\n    st = statSync(dir);\n  } catch {\n    throw new Error(`--cwd ${dir} does not exist.`);\n  }\n  if (!st.isDirectory()) throw new Error(`--cwd ${dir} is not a directory.`);\n  const uid = process.getuid?.();\n  if (uid !== undefined && st.uid !== uid) throw new Error(`Refusing --cwd ${dir}: it belongs to another user, who could plant instructions or hooks for the agent there.`);\n  if (process.platform !== \"win32\" && (st.mode & 0o022) !== 0) {\n    throw new Error(`Refusing --cwd ${dir}: it is writable by group or others (mode ${(st.mode & 0o777).toString(8)}). Use a directory only you can write to.`);\n  }\n  // A parent others can write to (without the sticky bit) lets them swap this directory out.\n  for (let p = dirname(dir); p !== dirname(p); p = dirname(p)) {\n    try {\n      const ps = statSync(p);\n      if (process.platform !== \"win32\" && (ps.mode & 0o022) !== 0 && (ps.mode & 0o1000) === 0) {\n        process.stderr.write(`warning: --cwd ${dir}: its parent ${p} is writable by group or others, so they could replace it.\\n`);\n        break;\n      }\n    } catch {\n      break;\n    }\n  }\n  return dir;\n}\n\n/** True when group or others can read/write the file. */\nexport const isTooOpen = (path: string) => process.platform !== \"win32\" && (statSync(path).mode & 0o077) !== 0;\n","import { chmodSync, existsSync, readdirSync, readFileSync, rmSync } from \"node:fs\";\nimport { z } from \"zod\";\nimport type { AgentTool, ListenerConfig } from \"../../shared/agent-api.ts\";\nimport { EVENT_TYPES } from \"../../shared/types.ts\";\nimport { webhookFilterSchema } from \"../webhooks/filter.ts\";\nimport { isTooOpen, writePrivateFile } from \"./fsutil.ts\";\nimport { DEFAULT_PROFILE, profilePath, profilesDir, validProfileName } from \"./paths.ts\";\nimport { NPX } from \"./version.ts\";\n\n/**\n * A profile file: the shared ListenerConfig plus a few agent-side extras. Holds the agent's API key,\n * so it is always 0600 inside a 0700 directory, and nothing ever prints it.\n */\nexport interface Profile extends ListenerConfig {\n  tool?: AgentTool;\n  mcpUrl?: string;\n  skillUrl?: string;\n  /** Forward-mode signing secret while no forward URL is saved (see forwardSecret()). */\n  forwardSecret?: string;\n  /** Working directory for --exec commands (default: a private dir in the state dir). */\n  cwd?: string;\n  createdAt?: string;\n}\n\nconst TOOLS = [\"claude-code\", \"codex\", \"cursor\", \"hermes\", \"other\"] as const;\n\nconst profileSchema = z\n  .object({\n    url: z.string().refine((u) => URL.canParse(u), \"url must be a full URL\"),\n    apiKey: z.string().min(8),\n    agentId: z.string().min(1),\n    agentName: z.string(),\n    consumer: z.string().min(1).max(100),\n    insecure: z.boolean().optional(),\n    types: z.array(z.enum(EVENT_TYPES)).optional(),\n    filter: webhookFilterSchema.optional(),\n    includeBody: z.boolean().optional(),\n    exec: z.string().min(1).optional(),\n    forward: z.object({ url: z.string(), secret: z.string().startsWith(\"whsec_\") }).optional(),\n    concurrency: z.number().int().min(1).max(32).optional(),\n    timeoutSeconds: z.number().int().min(1).max(86_400).optional(),\n    maxAttempts: z.number().int().min(1).max(100).optional(),\n    tool: z.enum(TOOLS).optional(),\n    mcpUrl: z.string().optional(),\n    skillUrl: z.string().optional(),\n    forwardSecret: z.string().startsWith(\"whsec_\").optional(),\n    cwd: z.string().startsWith(\"/\").optional(),\n    createdAt: z.string().optional(),\n  })\n  .loose();\n\nexport const profileExists = (name: string) => existsSync(profilePath(validProfileName(name)));\n\nexport function listProfiles(): string[] {\n  if (!existsSync(profilesDir())) return [];\n  return readdirSync(profilesDir())\n    .filter((f) => f.endsWith(\".json\"))\n    .map((f) => f.slice(0, -5))\n    .sort();\n}\n\nexport function loadProfile(name: string = DEFAULT_PROFILE): Profile {\n  const n = validProfileName(name);\n  const path = profilePath(n);\n  if (!existsSync(path)) {\n    const others = listProfiles();\n    const hint = others.length ? ` Known profiles: ${others.join(\", \")} (pick one with --profile).` : ` Run \\`${NPX} connect <daemon-url>\\` first.`;\n    throw new Error(`No agentinbox profile \"${n}\" (${path}).${hint}`);\n  }\n  // Someone loosened the permissions: tighten them, and say the key may have been read meanwhile.\n  if (isTooOpen(path)) {\n    chmodSync(path, 0o600);\n    process.stderr.write(\n      `warning: ${path} was readable by other users; it is 0600 again. If anyone else could have read it, rotate the agent's key in the console and run \\`${NPX} connect … --force\\`.\\n`,\n    );\n  }\n  let raw: unknown;\n  try {\n    raw = JSON.parse(readFileSync(path, \"utf8\"));\n  } catch (err) {\n    throw new Error(`Profile ${path} is not valid JSON (${(err as Error).message}). Fix it or run \\`${NPX} connect\\` again.`);\n  }\n  const parsed = profileSchema.safeParse(raw);\n  if (!parsed.success) {\n    const issue = parsed.error.issues[0];\n    throw new Error(`Profile ${path} is invalid: ${issue?.path.join(\".\") || \"file\"}: ${issue?.message}`);\n  }\n  return parsed.data as Profile;\n}\n\nexport function saveProfile(name: string, profile: Profile): string {\n  const path = profilePath(validProfileName(name));\n  const clean = Object.fromEntries(Object.entries(profile).filter(([, v]) => v !== undefined));\n  writePrivateFile(path, JSON.stringify(clean, null, 2) + \"\\n\");\n  return path;\n}\n\nexport function deleteProfile(name: string): void {\n  rmSync(profilePath(validProfileName(name)), { force: true });\n}\n"],"mappings":";;;;;;;;;;AAMA,MAAa,MAAM,OAAO;;AAG1B,SAAS,cAAsB;CAC7B,KAAK,MAAM,OAAO,CAAC,MAAM,OAAO,GAC9B,IAAI;EACF,MAAM,MAAM,KAAK,MAAM,aAAa,KAAK,YAAY,SAAS,KAAK,cAAc,GAAG,MAAM,CAAC;EAC3F,IAAI,IAAI,SAAA,oBAAwB,IAAI,SAAS,OAAO,IAAI;CAC1D,QAAQ,CAER;CAEF,OAAO;AACT;AAEA,MAAa,UAAU,YAAY;;;;AChBnC,SAAgB,iBAAiB,KAAmB;CAClD,UAAU,KAAK;EAAE,WAAW;EAAM,MAAM;CAAM,CAAC;CAC/C,IAAI,QAAQ,aAAa,YAAY,SAAS,GAAG,CAAC,CAAC,OAAO,QAAW,GAAG,UAAU,KAAK,GAAK;AAC9F;;;;;AAMA,SAAgB,iBAAiB,YAAoB,SAAiB,OAAiC,CAAC,GAAS;CAE/G,MAAM,OAAO,YAAY,UAAU;CACnC,IAAI,KAAK,eAAe,OAAO,iBAAiB,QAAQ,IAAI,CAAC;MACxD,UAAU,QAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;CACjD,MAAM,MAAM,GAAG,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,SAAS,KAAK,EAAE;CACtD,IAAI;EACF,cAAc,KAAK,SAAS;GAAE,MAAM;GAAO,MAAM;EAAK,CAAC;EACvD,UAAU,KAAK,GAAK;EACpB,WAAW,KAAK,IAAI;CACtB,SAAS,KAAK;EACZ,OAAO,KAAK,EAAE,OAAO,KAAK,CAAC;EAC3B,MAAM;CACR;AACF;AAEA,SAAS,YAAY,MAAsB;CACzC,IAAI;EACF,OAAO,UAAU,IAAI,CAAC,CAAC,eAAe,IAAI,aAAa,IAAI,IAAI;CACjE,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,SAAgB,WAAW,MAA6B;CACtD,IAAI,CAAC,WAAW,IAAI,GAAG,OAAO;CAC9B,MAAM,yBAAQ,IAAI,KAAK,EAAA,CAAE,YAAY,CAAC,CAAC,QAAQ,SAAS,GAAG;CAC3D,MAAM,UAAU,aAAa,IAAI;CAEjC,KAAK,IAAI,IAAI,IAAK,KAAK;EACrB,MAAM,SAAS,GAAG,KAAK,qBAAqB,QAAQ,IAAI,IAAI,MAAM;EAClE,IAAI;GACF,cAAc,QAAQ,SAAS;IAAE,MAAM;IAAO,MAAM;GAAK,CAAC;GAC1D,OAAO;EACT,SAAS,KAAK;GACZ,IAAK,IAA8B,SAAS,YAAY,IAAI,IAAI,MAAM;EACxE;CACF;AACF;;AAGA,SAAgB,QAAQ,MAAoB;CAC1C,IAAI,QAAQ,aAAa,WAAW,WAAW,IAAI,MAAM,SAAS,IAAI,CAAC,CAAC,OAAO,QAAW,GAAG,UAAU,MAAM,GAAK;AACpH;;;;;AAMA,SAAgB,iBAAiB,KAAqB;CACpD,IAAI;CACJ,IAAI;EACF,KAAK,SAAS,GAAG;CACnB,QAAQ;EACN,MAAM,IAAI,MAAM,SAAS,IAAI,iBAAiB;CAChD;CACA,IAAI,CAAC,GAAG,YAAY,GAAG,MAAM,IAAI,MAAM,SAAS,IAAI,qBAAqB;CACzE,MAAM,MAAM,QAAQ,SAAS;CAC7B,IAAI,QAAQ,KAAA,KAAa,GAAG,QAAQ,KAAK,MAAM,IAAI,MAAM,kBAAkB,IAAI,yFAAyF;CACxK,IAAI,QAAQ,aAAa,YAAY,GAAG,OAAO,QAAW,GACxD,MAAM,IAAI,MAAM,kBAAkB,IAAI,6CAA6C,GAAG,OAAO,IAAA,CAAO,SAAS,CAAC,EAAE,0CAA0C;CAG5J,KAAK,IAAI,IAAI,QAAQ,GAAG,GAAG,MAAM,QAAQ,CAAC,GAAG,IAAI,QAAQ,CAAC,GACxD,IAAI;EACF,MAAM,KAAK,SAAS,CAAC;EACrB,IAAI,QAAQ,aAAa,YAAY,GAAG,OAAO,QAAW,MAAM,GAAG,OAAO,SAAY,GAAG;GACvF,QAAQ,OAAO,MAAM,kBAAkB,IAAI,eAAe,EAAE,6DAA6D;GACzH;EACF;CACF,QAAQ;EACN;CACF;CAEF,OAAO;AACT;;AAGA,MAAa,aAAa,SAAiB,QAAQ,aAAa,YAAY,SAAS,IAAI,CAAC,CAAC,OAAO,QAAW;;;ACnE7G,MAAM,gBAAgB,EACnB,OAAO;CACN,KAAK,EAAE,OAAO,CAAC,CAAC,QAAQ,MAAM,IAAI,SAAS,CAAC,GAAG,wBAAwB;CACvE,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACxB,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACzB,WAAW,EAAE,OAAO;CACpB,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;CACnC,UAAU,EAAE,QAAQ,CAAC,CAAC,SAAS;CAC/B,OAAO,EAAE,MAAM,EAAE,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS;CAC7C,QAAQ,oBAAoB,SAAS;CACrC,aAAa,EAAE,QAAQ,CAAC,CAAC,SAAS;CAClC,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;CACjC,SAAS,EAAE,OAAO;EAAE,KAAK,EAAE,OAAO;EAAG,QAAQ,EAAE,OAAO,CAAC,CAAC,WAAW,QAAQ;CAAE,CAAC,CAAC,CAAC,SAAS;CACzF,aAAa,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,SAAS;CACtD,gBAAgB,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAM,CAAC,CAAC,SAAS;CAC7D,aAAa,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,SAAS;CACvD,MAAM,EAAE,KAAK;EAlBF;EAAe;EAAS;EAAU;EAAU;CAkBtC,CAAC,CAAC,CAAC,SAAS;CAC7B,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;CAC5B,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,eAAe,EAAE,OAAO,CAAC,CAAC,WAAW,QAAQ,CAAC,CAAC,SAAS;CACxD,KAAK,EAAE,OAAO,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,SAAS;CACzC,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;AACjC,CAAC,CAAC,CACD,MAAM;AAET,MAAa,iBAAiB,SAAiB,WAAW,YAAY,iBAAiB,IAAI,CAAC,CAAC;AAE7F,SAAgB,eAAyB;CACvC,IAAI,CAAC,WAAW,YAAY,CAAC,GAAG,OAAO,CAAC;CACxC,OAAO,YAAY,YAAY,CAAC,CAAC,CAC9B,QAAQ,MAAM,EAAE,SAAS,OAAO,CAAC,CAAC,CAClC,KAAK,MAAM,EAAE,MAAM,GAAG,EAAE,CAAC,CAAC,CAC1B,KAAK;AACV;AAEA,SAAgB,YAAY,OAAe,iBAA0B;CACnE,MAAM,IAAI,iBAAiB,IAAI;CAC/B,MAAM,OAAO,YAAY,CAAC;CAC1B,IAAI,CAAC,WAAW,IAAI,GAAG;EACrB,MAAM,SAAS,aAAa;EAC5B,MAAM,OAAO,OAAO,SAAS,oBAAoB,OAAO,KAAK,IAAI,EAAE,+BAA+B,UAAU,IAAI;EAChH,MAAM,IAAI,MAAM,0BAA0B,EAAE,KAAK,KAAK,IAAI,MAAM;CAClE;CAEA,IAAI,UAAU,IAAI,GAAG;EACnB,UAAU,MAAM,GAAK;EACrB,QAAQ,OAAO,MACb,YAAY,KAAK,qIAAqI,IAAI,wBAC5J;CACF;CACA,IAAI;CACJ,IAAI;EACF,MAAM,KAAK,MAAM,aAAa,MAAM,MAAM,CAAC;CAC7C,SAAS,KAAK;EACZ,MAAM,IAAI,MAAM,WAAW,KAAK,sBAAuB,IAAc,QAAQ,qBAAqB,IAAI,kBAAkB;CAC1H;CACA,MAAM,SAAS,cAAc,UAAU,GAAG;CAC1C,IAAI,CAAC,OAAO,SAAS;EACnB,MAAM,QAAQ,OAAO,MAAM,OAAO;EAClC,MAAM,IAAI,MAAM,WAAW,KAAK,eAAe,OAAO,KAAK,KAAK,GAAG,KAAK,OAAO,IAAI,OAAO,SAAS;CACrG;CACA,OAAO,OAAO;AAChB;AAEA,SAAgB,YAAY,MAAc,SAA0B;CAClE,MAAM,OAAO,YAAY,iBAAiB,IAAI,CAAC;CAC/C,MAAM,QAAQ,OAAO,YAAY,OAAO,QAAQ,OAAO,CAAC,CAAC,QAAQ,GAAG,OAAO,MAAM,KAAA,CAAS,CAAC;CAC3F,iBAAiB,MAAM,KAAK,UAAU,OAAO,MAAM,CAAC,IAAI,IAAI;CAC5D,OAAO;AACT"}

package/dist/profile-RbN2FRz7.js

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export { n as loadProfile } from "./profile-CgGgJ4Dm.js";

package/dist/recipes-7d_Xws4M.js

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export { i as recipe } from "./recipes-UalOc_LB.js";