agentinbox-cli 0.1.0-nightly.3 → 0.1.0-nightly.30

package/README.md

@@ -4,308 +4,24 @@
 [![npm](https://img.shields.io/npm/v/agentinbox-cli)](https://www.npmjs.com/package/agentinbox-cli)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue)](LICENSE)
 
-A self-hosted Gmail broker for AI agents. One small daemon holds your Gmail credentials; every agent gets its own
-scoped API key and reaches mail through **MCP tools** (read, search, draft, send, organize) and **signed webhooks** or an
-MCP event feed for new mail. Guardrails decide what each agent may do per mailbox, every action lands in an audit log,
-and a web console makes setup and management painless. It runs anywhere Node does, against your own Google Cloud
-project, with no cloud service in between.
-
-## Features
-
-- **One place for credentials.** Connect Gmail and Google Workspace accounts once. Refresh tokens are encrypted at rest.
-  Agents only ever see an `aib_…` key.
-- **MCP for every agent.** Streamable HTTP at `/mcp`: `search_threads`, `get_thread`, `reply`, `send_message`,
-  `modify_labels`, `wait_for_events` and more. Each agent sees only the tools its grants allow.
-- **Real-time events.** New mail, replies to threads you sent into, and label changes arrive within seconds through
-  Gmail push via a Pub/Sub *pull* subscription (no public URL needed), or by polling with zero extra setup.
-- **Webhooks.** Filter by account, label, sender, recipient, subject or attachments. Payloads are signed per
-  [Standard Webhooks](https://www.standardwebhooks.com), retried with backoff, logged, and replayable.
-- **Guardrails that don't degrade content.** Per agent and mailbox: capabilities, label scope, send mode (direct,
-  draft-only or human approval), recipient allowlists, reply-only and send caps. Email content is cleaned, not censored.
-- **A console you'll actually enjoy.** Guided Google setup, connect snippets for Claude Code, Codex and Cursor, an
-  approvals inbox, live events, delivery logs and the audit trail. Dark mode included.
-- **A ready-made agent skill.** `SKILL.md` teaches agents to use the tools well and to treat email as data.
-
-<!--
-## Preview
-
-![Overview](docs/screenshots/overview.png)
-
-<table>
-  <tr>
-    <td width="50%"><img src="docs/screenshots/setup.png" alt="Setup wizard"><br>Guided Google Cloud setup.</td>
-    <td width="50%"><img src="docs/screenshots/agents.png" alt="Agents"><br>Agents, grants and connect snippets.</td>
-  </tr>
-  <tr>
-    <td><img src="docs/screenshots/approvals.png" alt="Approvals"><br>Approve or reject sends.</td>
-    <td><img src="docs/screenshots/webhooks.png" alt="Webhooks"><br>Webhooks with delivery log and replay.</td>
-  </tr>
-</table>
--->
-
-## Quick start
-
-Requires Node.js 22.13 or newer.
+A self-hosted Gmail broker for AI agents: one small server holds your Gmail credentials and gives each agent scoped,
+audited access through MCP tools and webhooks.
 
 ```sh
 npx agentinbox-cli
 ```
 
-The npm package is `agentinbox-cli`; the command it provides is `agentinbox`. Use `npx agentinbox-cli …` for one-off
-runs, or `npm i -g agentinbox-cli` and then `agentinbox …`.
-
-agentinbox starts on port 8425 and prints a one-time setup link (and opens it if it can):
-
-```
-  agentinbox v0.1.0 · data in /home/you/.agentinbox
-
-  First run: open this link to claim the instance and finish setup:
-
-  http://localhost:8425/setup?token=…
-```
-
-Open it, choose an admin password, and the setup wizard walks you through the rest in about ten minutes.
-
-## Setting up Google
-
-agentinbox uses **your own** Google Cloud project and OAuth client. Gmail's read scopes are restricted, so a shared
-client isn't an option, and this way your mail never passes through anyone else's app. The wizard shows each step with
-the exact values to paste; in short:
-
-1. **Create a Google Cloud project** and enable the **Gmail API** (and the **Cloud Pub/Sub API** if you want push).
-2. **Configure the OAuth consent screen** (Google Auth Platform → Audience):
-   - **Internal** if every mailbox is in your Google Workspace organization. No review, no expiry, nothing else to do.
-   - **External** for personal `@gmail.com` accounts (or mailboxes outside your org). Then **publish the app to
-     "In production"**. Left in *Testing*, Google expires refresh tokens after **7 days** and your accounts silently
-     disconnect. You don't need Google's verification for your own use: on consent, click *Advanced → Go to
-     (app name)* past the "unverified app" warning.
-3. **Create an OAuth client** of type *Web application*, add the redirect URI the console shows
-   (`<public URL>/oauth/callback`), and paste the client ID, client secret and project ID into the console.
-4. **Connect accounts.** Each one goes through Google's consent screen. If the console is on plain HTTP at a non-localhost
-   address, Google can't redirect back to it; the console then asks you to paste the URL you land on instead.
-5. **Choose how new mail arrives:**
-   - **Pub/Sub (recommended):** one click creates the topic, grants Gmail's push service
-     (`gmail-api-push@system.gserviceaccount.com`) permission to publish, and creates a pull subscription, using a
-     connected account that can manage Pub/Sub in the project. Events arrive in seconds, with no inbound connections.
-     If a Workspace organization policy (domain-restricted sharing) blocks that grant, the console says so; use polling.
-   - **Polling:** no extra setup; checks each mailbox every 30 seconds by default.
-
-Then create an agent and give it a grant on a mailbox.
-
-## Connecting agents
-
-Create an agent in the console (**Agents → New agent**) to get its API key; the key is shown once. The console has
-copy-paste snippets with your URL and key filled in, and a **Test connection** button. By hand:
-
-**Claude Code**
-
-```sh
-claude mcp add --transport http agentinbox http://your-host:8425/mcp --header "Authorization: Bearer aib_…"
-```
-
-**Codex** (`~/.codex/config.toml`)
-
-```toml
-[mcp_servers.agentinbox]
-url = "http://your-host:8425/mcp"
-bearer_token_env_var = "AGENTINBOX_KEY"
-```
-
-**Cursor** (`~/.cursor/mcp.json`) and most other MCP clients
-
-```json
-{
-  "mcpServers": {
-    "agentinbox": {
-      "url": "http://your-host:8425/mcp",
-      "headers": { "Authorization": "Bearer aib_…" }
-    }
-  }
-}
-```
-
-Any MCP client that speaks streamable HTTP works: endpoint `/mcp`, header `Authorization: Bearer <key>`.
-
-### The agent skill
-
-`SKILL.md` teaches an agent the tools, Gmail search syntax, reply etiquette, how sends and denials work, the event loop,
-and that email content is data, never instructions. Install it on the machine where the agent runs (no running
-agentinbox needed there):
-
-```sh
-npx agentinbox-cli skill install --url https://mail.example.com          # ~/.claude/skills/agentinbox/SKILL.md
-npx agentinbox-cli skill install --target codex --url https://mail.example.com
-npx agentinbox-cli skill install --target ./skills --url https://mail.example.com
-npx agentinbox-cli skill print --url https://mail.example.com             # to stdout
-```
-
-Every instance also serves it at `/skill.md` with its public URL filled in.
-
-## Events and webhooks
-
-Event types: `message.received`, `message.sent`, `thread.reply_received` (a reply in a thread the account sent into),
-`label.added`, `label.removed`, `account.auth_failed` and `sync.gap`. Agents only receive events for mailboxes and
-labels their grants let them read.
-
-- **Agents without an HTTP endpoint** (most coding agents) use the MCP tools `wait_for_events` (long poll),
-  `list_events` and `ack_events`. The server keeps each agent's position.
-- **Agents with an endpoint** get webhooks: create one under **Webhooks**, pick event types and filters, and optionally
-  include the cleaned message body. Failed deliveries retry with exponential backoff before they're marked dead, and
-  any delivery can be replayed from the console.
-
-Each webhook request carries `webhook-id`, `webhook-timestamp` and `webhook-signature` headers. Verify them with any
-[Standard Webhooks library](https://github.com/standard-webhooks/standard-webhooks) and the `whsec_…` secret shown when
-you create the webhook:
-
-```js
-import { Webhook } from "standardwebhooks";
+Open the link it prints: the console walks you through the rest (Google Cloud setup, connecting Gmail, your first
+agent). Requires Node.js 22.13 or newer.
 
-const wh = new Webhook(process.env.AGENTINBOX_WEBHOOK_SECRET);
-const payload = wh.verify(rawBody, request.headers); // throws if the signature or timestamp is bad
-```
-
-A dependency-free Node version is in the [skill](server/skill/SKILL.md#webhooks).
-
-By default webhooks may only target public addresses and loopback; other private addresses (for example a LAN host or
-`n8n.internal`) must be added to the webhook allowlist in **Settings**.
-
-## Security model
-
-agentinbox assumes agents can be manipulated by the mail they read. So it keeps content intact and puts the hard limits
-on actions.
-
-**Content is cleaned, not censored.** Agents get full-fidelity mail converted to tidy Markdown, with links and tables.
-Only what a human reader couldn't see is removed: hidden CSS (`display:none`, zero-size, transparent or
-same-colour text), HTML comments, scripts and styles, zero-width characters, Unicode tag characters and bidi overrides.
-Each body is wrapped in one `<email_content … untrusted>` delimiter and comes with signals: SPF/DKIM/DMARC results, an
-external-sender flag, whether hidden content was removed, and phrases typical of prompt injection. Signals are
-informational; nothing is withheld because of them.
-
-**Actions are strictly controlled.** A new agent can do nothing. Each grant (agent × mailbox) sets:
-
-| Control | |
-|---|---|
-| Capabilities | `read` (search, read, attachments, events), `draft`, `send`, `organize` (labels, archive, read state), `trash` |
-| Label scope | Confine the agent to threads carrying certain labels. Searches are rewritten and fetches by id are checked. |
-| Send mode | `draft_only` (default: a Gmail draft for a human to send), `approval` (queued in the console; approving sends it) or `direct` |
-| Allowed recipients | Exact addresses or `*@domain.com` globs |
-| Reply only | Sending only inside threads the agent can already see |
-| Send caps | Per hour and per day |
-
-**Everything is audited.** Every tool call and every console change is recorded with its outcome, and denials name the
-guardrail that blocked them.
-
-**The console** is protected by an admin password (set through the one-time setup link), HttpOnly session cookies
-that expire after 30 days of inactivity (90 at most), a CSRF header on every change, request size limits, a strict
-Content Security Policy, and a 15-minute lockout after five wrong passwords (or 30 attempts) from one address. When
-failures pile up across many addresses, every sign-in attempt is slowed down instead. It never allows being framed.
-The data directory and database are readable only by their owner.
-
-Recommendations: split agents that read untrusted mail from agents that can send; prefer `draft_only` or `approval`;
-use allowlists for anything that sends directly.
-
-## Running it
-
-### As a service
-
-```sh
-npx agentinbox-cli service install
-```
-
-Installs a background service that starts at boot: systemd on Linux (a user service with lingering enabled, or a system
-service when run as root) and launchd on macOS. The service runs its own copy of agentinbox from the data directory,
-so it never depends on the npx cache; a failed install leaves the running service as it was. Re-run `service install`
-to update; `service status` and `service uninstall` do what you'd expect, and uninstalling keeps your data. Pass the same
-`--port`, `--host` and `--data` options each time. `AGENTINBOX_MASTER_KEY`, `TRUST_PROXY`, `TRUST_PROXY_HOPS` and
-`AGENTINBOX_LOG_LEVEL` are taken from your shell and remembered in `<data>/service.env`, so later installs keep them
-(set one to an empty value to remove it).
-
-Only one agentinbox runs per data directory; a second one refuses to start.
-
-When a newer version is published, the console shows **Update available** with the exact command to run.
-
-### Behind a reverse proxy
-
-agentinbox serves plain HTTP. To expose it beyond your network, put it behind a TLS-terminating proxy (Caddy, nginx,
-Tailscale Funnel) and:
-
-- bind it to localhost: `--host 127.0.0.1`
-- set `TRUST_PROXY=1`, so lockouts apply per client and cookies are marked `Secure`. The client address is taken from
-  the right end of `X-Forwarded-For`; with more than one proxy in front, set `TRUST_PROXY_HOPS` to their number
-- set **Settings → Public URL** to the https address, so MCP snippets, the skill and the OAuth redirect use it
-
-`GET /health` (or `/api/health`) needs no auth and suits uptime monitors: `200` when healthy, `503` when degraded, for
-example when an account needs to be reconnected or ingest is failing. It reports only a status, the version and
-whether setup is complete.
-
-### Options
-
-With a global install (`npm i -g agentinbox-cli`); otherwise prefix `npx agentinbox-cli` instead of `agentinbox`.
-
-```
-agentinbox [start] [--port 8425] [--host 0.0.0.0] [--data ~/.agentinbox] [--no-open] [--dev]
-agentinbox service install|uninstall|status [--port …] [--host …] [--data …]
-agentinbox skill install [--target claude|codex|agents|<dir>] [--url <public url>]
-agentinbox skill print [--url <public url>]
-agentinbox reset-password [--data …]
-```
-
-| Flag | Env | Default | |
-|---|---|---|---|
-| `--port` | `PORT` | `8425` | Port to listen on |
-| `--host` | `HOST` | `0.0.0.0` | Bind address. Use `127.0.0.1` behind a reverse proxy or SSH tunnel |
-| `--data` | `AGENTINBOX_DATA` | `~/.agentinbox` | Data directory |
-| | `AGENTINBOX_MASTER_KEY` | | Base64 32-byte key for encrypting secrets, instead of `<data>/master.key` |
-| | `TRUST_PROXY` | | `1` behind a reverse proxy: client IPs from `X-Forwarded-For`, https from `X-Forwarded-Proto` |
-| | `TRUST_PROXY_HOPS` | `1` | Number of proxies in front of agentinbox (which `X-Forwarded-For` entry, from the right, is the client) |
-| | `AGENTINBOX_LOG_LEVEL` | `info` | `debug`, `info`, `warn` or `error` |
-
-Forgot the admin password? Run `npx agentinbox-cli reset-password` on the server, as the user agentinbox runs as (`sudo` for a
-system service) and with the same `--data`. It signs out all sessions and prints a new setup link; a running instance
-picks it up without a restart.
-
-## Data and backups
-
-Everything lives in the data directory (`~/.agentinbox` by default):
-
-| File | |
-|---|---|
-| `agentinbox.db` | SQLite database: accounts, encrypted tokens, agents, grants, events, deliveries, approvals, audit log |
-| `master.key` | Encrypts refresh tokens, webhook secrets and the OAuth client secret (mode 0600) |
-| `setup-token` | The one-time setup token, until the instance is claimed |
-| `agentinbox.lock` | Marks the running instance (pid and port) |
-| `service.env` | Environment the service was installed with, possibly including `AGENTINBOX_MASTER_KEY` (mode 0600; `service install` only) |
-| `agentinbox.log` | Service output on macOS (launchd); on Linux use `journalctl --user -u agentinbox` (or without `--user` for a system service) |
-| `app/` | The service's own install (`service install` only) |
-
-Back up `agentinbox.db` and `master.key` together: without the key, stored secrets can't be decrypted, and agentinbox
-refuses to start rather than create a new one. Keep the key somewhere safer than the database backup, or supply it via
-`AGENTINBOX_MASTER_KEY`. The database runs in WAL mode, so don't just copy the file while agentinbox is running: stop
-it first (`systemctl --user stop agentinbox`), or take a consistent copy with
-`sqlite3 ~/.agentinbox/agentinbox.db ".backup /path/to/backup.db"`. Mail
-bodies are never stored; agentinbox keeps metadata (ids, headers, labels, snippets) and fetches content from Gmail on
-demand. Events, deliveries and audit entries are pruned after the retention period set in **Settings** (30 days by
-default).
-
-## Development
-
-```sh
-pnpm install
-AGENTINBOX_DATA=/tmp/agentinbox-dev pnpm dev
-```
-
-`pnpm dev` runs the server on `:8425` in watch mode (API, MCP and OAuth only) and the console on Vite at `:5173`, which
-proxies to it. Open the Vite URL; the printed setup link already points there.
+![Overview](docs/screenshots/overview.png)
 
-```sh
-pnpm typecheck && pnpm lint && pnpm test
-pnpm build           # console → dist/web, server → dist/cli.js
-node dist/cli.js     # run the build
-```
+## More
 
-Stack: TypeScript on Node 22+, Hono on `@hono/node-server`, `node:sqlite`, the MCP TypeScript SDK, and thin fetch-based
-Google clients (no `googleapis`, so `npx` stays fast). The console is Vite, React 19, TanStack Router / Query / Table /
-Form and shadcn/ui on Tailwind v4.
+- [Reference](docs/reference.md): features, configuration, running as a service or behind a proxy, security model,
+  webhooks, data and backups, development
+- [Waking local agents with `agentinbox listen`](docs/listen.md)
+- [Screenshots](docs/screenshots/README.md)
 
 ## License
 

package/dist/admin-8MQLrhsj.js

@@ -0,0 +1,200 @@
+#!/usr/bin/env node
+import { S as ApiError, a as pidAlive, b as Dispatcher, c as writeDead, d as forwardSecret, f as resolveListen, g as checkTransport, h as TransportError, l as DEFAULT_LISTEN_TYPES, m as forwardEvent, o as readDead, s as readStatus, w as getSelf, x as describeGrants, y as runCommand } from "./listen-cDUHSBkN.js";
+import { i as safeText, r as formatDuration } from "./ui-B8Sd4Y7Y.js";
+import { d as NPX, i as saveProfile, n as loadProfile, s as ensurePrivateDir } from "./profile-uRinkfdm.js";
+import { c as profilePath, i as deadPath, o as logPath, p as validProfileName } from "./paths-DckASYtc.js";
+import { d as unitName, n as isServiceInstalled, r as launchdLabel } from "./service-DXiBV61B.js";
+import pc from "picocolors";
+//#region server/listen/admin.ts
+const out = (s = "") => process.stdout.write(`${s}\n`);
+const flagFor = (profile) => profile === "default" ? "" : ` --profile ${profile}`;
+const ago = (iso) => iso ? `${formatDuration(Date.now() - Date.parse(iso))} ago` : "never";
+/** Prints the forward-mode signing secret (generating and saving it on first use). */
+function printSecret(profileName, opts) {
+	const name = validProfileName(profileName);
+	const profile = loadProfile(name);
+	let { secret, created } = forwardSecret(profile);
+	if (opts.rotate) {
+		secret = forwardSecret({
+			...profile,
+			forward: void 0,
+			forwardSecret: void 0
+		}).secret;
+		created = true;
+	}
+	if (created) {
+		if (profile.forward) profile.forward = {
+			...profile.forward,
+			secret
+		};
+		else profile.forwardSecret = secret;
+		saveProfile(name, profile);
+		process.stderr.write(pc.gray(`${opts.rotate ? "Rotated" : "Generated"} the forward signing secret for profile "${name}"${opts.rotate ? "; restart the listener" : ""}.\n`));
+	}
+	out(secret);
+}
+async function printStatus(profileName) {
+	const name = validProfileName(profileName);
+	const profile = loadProfile(name);
+	const st = readStatus(name);
+	const alive = st ? pidAlive(st.pid) && !st.stoppedAt : false;
+	const dead = readDead(name);
+	out(`${pc.bold("Profile")}   ${name}  ${pc.gray(profilePath(name))}`);
+	out(`${pc.bold("Agent")}     ${safeText(profile.agentName)} ${pc.gray(`(${profile.agentId})`)}`);
+	out(`${pc.bold("Daemon")}    ${profile.url}`);
+	out(`${pc.bold("Consumer")}  ${st?.consumer ?? profile.consumer}`);
+	const exec = st && st.exec !== void 0 ? st.exec : profile.exec;
+	const forward = st && st.forward !== void 0 ? st.forward : profile.forward?.url;
+	const targets = [exec ? `exec ${safeText(exec, 120)}` : null, forward ? `forward ${forward}` : null].filter(Boolean);
+	out(`${pc.bold("Runs")}      ${targets.length ? targets.join(" · ") : pc.gray("nothing saved (pass --exec/--forward with --save)")}`);
+	out(`${pc.bold("Events")}    ${profile.types?.length ? profile.types.join(", ") : `${DEFAULT_LISTEN_TYPES.join(", ")} ${pc.gray("(default types; add --types all --save for every event)")}`}`);
+	let svc = "not installed";
+	if (process.platform === "linux" || process.platform === "darwin") {
+		if (isServiceInstalled(name)) svc = `installed (${process.platform === "linux" ? unitName(name) : launchdLabel(name)}; details: ${NPX} listen service status${flagFor(name)})`;
+	}
+	out(`${pc.bold("Service")}   ${svc}`);
+	try {
+		await checkTransport(profile.url, { insecure: profile.insecure });
+		const self = await getSelf(profile.url, profile.apiKey, 5e3);
+		out(`${pc.bold("Key")}       ${pc.green("valid")}`);
+		const lines = describeGrants(self.grants);
+		out(`${pc.bold("Access")}    ${self.grants.length ? lines[0] : pc.yellow(lines[0])}`);
+		for (const l of lines.slice(1)) out(`          ${l}`);
+	} catch (err) {
+		const revoked = err instanceof ApiError && (err.status === 401 || err.status === 403);
+		const why = err instanceof ApiError && err.status === 0 ? err.cause : err instanceof Error ? err.message.split("\n")[0] : String(err);
+		if (err instanceof TransportError) out(`${pc.bold("Key")}       ${pc.red(`not checked: ${why}`)}`);
+		else out(`${pc.bold("Key")}       ${revoked ? pc.red(`rejected: ${err.message}`) : pc.yellow(`not checked (${why})`)}`);
+	}
+	if (!st) out(`${pc.bold("Listener")}  ${pc.gray("has not run yet")}`);
+	else {
+		const state = !alive ? pc.gray(`not running${st.stoppedAt ? ` (stopped ${ago(st.stoppedAt)}${st.exitReason ? `: ${safeText(st.exitReason, 160)}` : ""})` : " (exited unexpectedly)"}`) : st.connected ? pc.green(`running (pid ${st.pid}), connected ${ago(st.connectedSince)}`) : pc.yellow(`running (pid ${st.pid}), disconnected${st.lastDisconnect ? ` ${ago(st.lastDisconnect.at)}: ${safeText(st.lastDisconnect.reason, 160)}` : ""}`);
+		out(`${pc.bold("Listener")}  ${state}`);
+		out(`${pc.bold("Cursor")}    acked #${st.ackedSeq} · received #${st.receivedSeq}${alive && st.running ? ` · ${st.running} in progress` : ""} · last event ${ago(st.lastEventAt)}`);
+		if (st.recent.length) {
+			out(pc.bold("Recent"));
+			for (const r of st.recent.slice(0, 8)) {
+				const icon = r.outcome === "succeeded" ? pc.green("✓") : r.outcome === "dead" ? pc.red("✖") : r.outcome === "retrying" ? pc.yellow("↻") : pc.gray("·");
+				out(`  ${icon} #${r.seq} ${r.type} ${pc.gray(`${ago(r.at)}${r.attempts > 1 ? `, ${r.attempts} attempts` : ""}${r.error && r.outcome !== "succeeded" ? `, ${safeText(r.error, 100)}` : ""}`)}`);
+			}
+		}
+	}
+	out(`${pc.bold("Dead")}      ${dead.length ? pc.red(`${dead.length} event${dead.length > 1 ? "s" : ""}`) + pc.gray(` (inspect: ${NPX} listen dead${flagFor(name)})`) : "0"}`);
+	out(`${pc.bold("Log")}       ${logPath(name)}`);
+}
+function printDead(profileName, opts) {
+	const name = validProfileName(profileName);
+	const entries = readDead(name);
+	if (opts.json) {
+		for (const e of entries) out(JSON.stringify(e));
+		return;
+	}
+	if (!entries.length) {
+		out(`No dead events for profile "${name}".`);
+		return;
+	}
+	for (const e of entries) {
+		const m = e.payload.data.message;
+		out(`${pc.red("✖")} #${e.seq} ${e.type} ${pc.gray(e.id)}  ${pc.gray(`died ${ago(e.deadAt)} after ${e.attempts} attempts`)}`);
+		if (m) out(`    from ${safeText(m.from?.email ?? "?", 80)}  "${safeText(m.subject, 80)}"`);
+		out(pc.gray(`    ${safeText(e.error, 300)}`));
+	}
+	out();
+	out(pc.gray(`${entries.length} dead event${entries.length > 1 ? "s" : ""} in ${deadPath(name)}.`));
+	out(pc.gray(`Replay with: ${NPX} listen dead --replay${flagFor(name)}   (one: --id <evt_…>; drop all: --clear)`));
+	out(pc.gray(`Replay uses the profile's saved --exec/--forward; if you ran them as flags only, pass them again, e.g. --replay --exec '<command>'.`));
+}
+function clearDead(profileName, id) {
+	const name = validProfileName(profileName);
+	const entries = readDead(name);
+	const keep = id ? entries.filter((e) => e.id !== id) : [];
+	writeDead(name, keep);
+	out(`Removed ${entries.length - keep.length} dead event${entries.length - keep.length === 1 ? "" : "s"}.`);
+}
+/**
+* Runs dead events again through the profile's targets (or the ones passed as flags). Successes are
+* removed from dead.jsonl; failures stay. Returns how many still failed.
+*/
+async function replayDead(flags, opts = {}) {
+	const name = validProfileName(flags.profile ?? "default");
+	const profile = loadProfile(name);
+	const { config } = resolveListen(name, profile, {
+		...flags,
+		save: false
+	});
+	const chosen = readDead(name).filter((e) => !flags.id || e.id === flags.id);
+	if (!chosen.length) {
+		out(flags.id ? `No dead event with id ${flags.id}.` : `No dead events for profile "${name}".`);
+		return 0;
+	}
+	const available = [];
+	if (config.exec) available.push("exec");
+	if (config.forward) available.push("forward");
+	if (!available.length) throw new Error(`Nothing to replay to: pass --exec '<command>' and/or --forward <url> (or save them in the profile with \`${NPX} listen --save …\`).`);
+	if (config.exec && process.platform === "win32") throw new Error("--exec isn't supported on Windows; replay with --forward instead.");
+	const timeoutMs = config.timeoutSeconds * 1e3;
+	if (config.cwdIsDefault) ensurePrivateDir(config.cwd);
+	const failed = /* @__PURE__ */ new Map();
+	const bySeq = new Map(chosen.map((e) => [e.seq, e]));
+	const dispatcher = new Dispatcher({
+		targets: available,
+		concurrency: config.concurrency,
+		maxAttempts: config.maxAttempts,
+		retryDelayMs: opts.retryDelayMs,
+		run: async (job, signal) => {
+			const errors = [];
+			if (job.remaining.has("exec") && config.exec) {
+				const r = await runCommand(config.exec, job.payload, {
+					timeoutMs,
+					signal,
+					cwd: config.cwd
+				});
+				if (r.ok) job.remaining.delete("exec");
+				else errors.push(`command: ${r.error}`);
+			}
+			if (job.remaining.has("forward") && config.forward) {
+				const r = await forwardEvent(config.forward.url, config.forward.secret, job.payload, {
+					timeoutMs: Math.min(timeoutMs, 3e4),
+					signal
+				});
+				if (r.ok) job.remaining.delete("forward");
+				else errors.push(`forward: ${r.error}`);
+			}
+			return errors;
+		},
+		onAdvance: () => {},
+		onDead: (job) => {
+			const e = bySeq.get(job.seq);
+			failed.set(e.id, {
+				...e,
+				deadAt: (/* @__PURE__ */ new Date()).toISOString(),
+				attempts: e.attempts + job.attempts,
+				error: job.lastError ?? "failed"
+			});
+			out(`${pc.red("✖")} #${job.seq} still failing: ${safeText(job.lastError ?? "failed", 200)}`);
+		},
+		onFinished: (job) => {
+			if (job.outcome === "succeeded") out(`${pc.green("✓")} #${job.seq} ${job.payload.type} replayed`);
+		}
+	});
+	out(`Replaying ${chosen.length} dead event${chosen.length > 1 ? "s" : ""} (up to ${config.maxAttempts} attempts each)…`);
+	for (const e of [...chosen].sort((a, b) => a.seq - b.seq)) {
+		const targets = e.targets?.length ? e.targets.filter((t) => available.includes(t)) : available;
+		if (!targets.length) {
+			out(`${pc.yellow("!")} #${e.seq} needs ${e.targets.join(" and ")}, which isn't configured now; pass --${e.targets[0]} to replay it.`);
+			failed.set(e.id, e);
+			continue;
+		}
+		dispatcher.push(e.payload, { targets });
+	}
+	await dispatcher.idle();
+	const replayed = new Set(chosen.map((e) => e.id));
+	const current = readDead(name);
+	writeDead(name, [...current.filter((e) => !replayed.has(e.id)), ...failed.values()]);
+	out(`${chosen.length - failed.size} replayed, ${failed.size} still dead.`);
+	return failed.size;
+}
+//#endregion
+export { clearDead, printDead, printSecret, printStatus, replayDead };
+
+//# sourceMappingURL=admin-8MQLrhsj.js.map

package/dist/admin-8MQLrhsj.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-8MQLrhsj.js","names":[],"sources":["../server/listen/admin.ts"],"sourcesContent":["import pc from \"picocolors\";\nimport { ApiError, getSelf } from \"./api.ts\";\nimport { describeGrants } from \"./grants.ts\";\nimport { Dispatcher, type Job, type Target } from \"./dispatcher.ts\";\nimport { runCommand } from \"./exec.ts\";\nimport { ensurePrivateDir } from \"./fsutil.ts\";\nimport { forwardEvent } from \"./forward.ts\";\nimport { type ListenFlags, resolveListen } from \"./options.ts\";\nimport { DEFAULT_PROFILE, deadPath, logPath, profilePath, validProfileName } from \"./paths.ts\";\nimport { loadProfile, saveProfile } from \"./profile.ts\";\nimport { DEFAULT_LISTEN_TYPES, forwardSecret } from \"./options.ts\";\nimport { isServiceInstalled, launchdLabel, unitName } from \"./service.ts\";\nimport { type DeadEntry, pidAlive, readDead, readStatus, writeDead } from \"./state.ts\";\nimport { checkTransport, TransportError } from \"./transport.ts\";\nimport { formatDuration, safeText } from \"./ui.ts\";\nimport { NPX } from \"./version.ts\";\n\nconst out = (s = \"\") => process.stdout.write(`${s}\\n`);\nconst flagFor = (profile: string) => (profile === DEFAULT_PROFILE ? \"\" : ` --profile ${profile}`);\nconst ago = (iso: string | null | undefined) => (iso ? `${formatDuration(Date.now() - Date.parse(iso))} ago` : \"never\");\n\n// ───────────── listen secret ─────────────\n\n/** Prints the forward-mode signing secret (generating and saving it on first use). */\nexport function printSecret(profileName: string, opts: { rotate?: boolean }): void {\n  const name = validProfileName(profileName);\n  const profile = loadProfile(name);\n  let { secret, created } = forwardSecret(profile);\n  if (opts.rotate) {\n    secret = forwardSecret({ ...profile, forward: undefined, forwardSecret: undefined }).secret;\n    created = true;\n  }\n  if (created) {\n    if (profile.forward) profile.forward = { ...profile.forward, secret };\n    else profile.forwardSecret = secret;\n    saveProfile(name, profile);\n    process.stderr.write(pc.gray(`${opts.rotate ? \"Rotated\" : \"Generated\"} the forward signing secret for profile \"${name}\"${opts.rotate ? \"; restart the listener\" : \"\"}.\\n`));\n  }\n  // The secret alone on stdout, so `export AGENTINBOX_WEBHOOK_SECRET=$(agentinbox listen secret)` works.\n  out(secret);\n}\n\n// ───────────── listen status ─────────────\n\nexport async function printStatus(profileName: string): Promise<void> {\n  const name = validProfileName(profileName);\n  const profile = loadProfile(name);\n  const st = readStatus(name);\n  const alive = st ? pidAlive(st.pid) && !st.stoppedAt : false;\n  const dead = readDead(name);\n\n  out(`${pc.bold(\"Profile\")}   ${name}  ${pc.gray(profilePath(name))}`);\n  out(`${pc.bold(\"Agent\")}     ${safeText(profile.agentName)} ${pc.gray(`(${profile.agentId})`)}`);\n  out(`${pc.bold(\"Daemon\")}    ${profile.url}`);\n  out(`${pc.bold(\"Consumer\")}  ${st?.consumer ?? profile.consumer}`);\n  // What the last run used (flags included), else what the profile has saved.\n  const exec = st && st.exec !== undefined ? st.exec : profile.exec;\n  const forward = st && st.forward !== undefined ? st.forward : profile.forward?.url;\n  const targets = [exec ? `exec ${safeText(exec, 120)}` : null, forward ? `forward ${forward}` : null].filter(Boolean);\n  out(`${pc.bold(\"Runs\")}      ${targets.length ? targets.join(\" · \") : pc.gray(\"nothing saved (pass --exec/--forward with --save)\")}`);\n  out(\n    `${pc.bold(\"Events\")}    ${\n      profile.types?.length\n        ? profile.types.join(\", \")\n        : `${DEFAULT_LISTEN_TYPES.join(\", \")} ${pc.gray(\"(default types; add --types all --save for every event)\")}`\n    }`,\n  );\n\n  let svc = \"not installed\";\n  if (process.platform === \"linux\" || process.platform === \"darwin\") {\n    if (isServiceInstalled(name)) svc = `installed (${process.platform === \"linux\" ? unitName(name) : launchdLabel(name)}; details: ${NPX} listen service status${flagFor(name)})`;\n  }\n  out(`${pc.bold(\"Service\")}   ${svc}`);\n\n  try {\n    // Never send the key over a connection `listen` itself would refuse.\n    await checkTransport(profile.url, { insecure: profile.insecure });\n    const self = await getSelf(profile.url, profile.apiKey, 5000);\n    out(`${pc.bold(\"Key\")}       ${pc.green(\"valid\")}`);\n    // The access the console actually granted, in plain words (what the agent should report to its human).\n    const lines = describeGrants(self.grants);\n    out(`${pc.bold(\"Access\")}    ${self.grants.length ? lines[0] : pc.yellow(lines[0]!)}`);\n    for (const l of lines.slice(1)) out(`          ${l}`);\n  } catch (err) {\n    const revoked = err instanceof ApiError && (err.status === 401 || err.status === 403);\n    const why = err instanceof ApiError && err.status === 0 ? (err.cause as string) : err instanceof Error ? err.message.split(\"\\n\")[0] : String(err);\n    if (err instanceof TransportError) out(`${pc.bold(\"Key\")}       ${pc.red(`not checked: ${why}`)}`);\n    else out(`${pc.bold(\"Key\")}       ${revoked ? pc.red(`rejected: ${(err as Error).message}`) : pc.yellow(`not checked (${why})`)}`);\n  }\n\n  if (!st) {\n    out(`${pc.bold(\"Listener\")}  ${pc.gray(\"has not run yet\")}`);\n  } else {\n    const state = !alive\n      ? pc.gray(`not running${st.stoppedAt ? ` (stopped ${ago(st.stoppedAt)}${st.exitReason ? `: ${safeText(st.exitReason, 160)}` : \"\"})` : \" (exited unexpectedly)\"}`)\n      : st.connected\n        ? pc.green(`running (pid ${st.pid}), connected ${ago(st.connectedSince)}`)\n        : pc.yellow(`running (pid ${st.pid}), disconnected${st.lastDisconnect ? ` ${ago(st.lastDisconnect.at)}: ${safeText(st.lastDisconnect.reason, 160)}` : \"\"}`);\n    out(`${pc.bold(\"Listener\")}  ${state}`);\n    out(`${pc.bold(\"Cursor\")}    acked #${st.ackedSeq} · received #${st.receivedSeq}${alive && st.running ? ` · ${st.running} in progress` : \"\"} · last event ${ago(st.lastEventAt)}`);\n    if (st.recent.length) {\n      out(pc.bold(\"Recent\"));\n      for (const r of st.recent.slice(0, 8)) {\n        const icon = r.outcome === \"succeeded\" ? pc.green(\"✓\") : r.outcome === \"dead\" ? pc.red(\"✖\") : r.outcome === \"retrying\" ? pc.yellow(\"↻\") : pc.gray(\"·\");\n        out(`  ${icon} #${r.seq} ${r.type} ${pc.gray(`${ago(r.at)}${r.attempts > 1 ? `, ${r.attempts} attempts` : \"\"}${r.error && r.outcome !== \"succeeded\" ? `, ${safeText(r.error, 100)}` : \"\"}`)}`);\n      }\n    }\n  }\n  out(`${pc.bold(\"Dead\")}      ${dead.length ? pc.red(`${dead.length} event${dead.length > 1 ? \"s\" : \"\"}`) + pc.gray(` (inspect: ${NPX} listen dead${flagFor(name)})`) : \"0\"}`);\n  out(`${pc.bold(\"Log\")}       ${logPath(name)}`);\n}\n\n// ───────────── listen dead ─────────────\n\nexport function printDead(profileName: string, opts: { json?: boolean }): void {\n  const name = validProfileName(profileName);\n  const entries = readDead(name);\n  if (opts.json) {\n    for (const e of entries) out(JSON.stringify(e));\n    return;\n  }\n  if (!entries.length) {\n    out(`No dead events for profile \"${name}\".`);\n    return;\n  }\n  for (const e of entries) {\n    const m = e.payload.data.message;\n    out(`${pc.red(\"✖\")} #${e.seq} ${e.type} ${pc.gray(e.id)}  ${pc.gray(`died ${ago(e.deadAt)} after ${e.attempts} attempts`)}`);\n    if (m) out(`    from ${safeText(m.from?.email ?? \"?\", 80)}  \"${safeText(m.subject, 80)}\"`);\n    out(pc.gray(`    ${safeText(e.error, 300)}`));\n  }\n  out();\n  out(pc.gray(`${entries.length} dead event${entries.length > 1 ? \"s\" : \"\"} in ${deadPath(name)}.`));\n  out(pc.gray(`Replay with: ${NPX} listen dead --replay${flagFor(name)}   (one: --id <evt_…>; drop all: --clear)`));\n  out(pc.gray(`Replay uses the profile's saved --exec/--forward; if you ran them as flags only, pass them again, e.g. --replay --exec '<command>'.`));\n}\n\nexport function clearDead(profileName: string, id?: string): void {\n  const name = validProfileName(profileName);\n  const entries = readDead(name);\n  const keep = id ? entries.filter((e) => e.id !== id) : [];\n  writeDead(name, keep);\n  out(`Removed ${entries.length - keep.length} dead event${entries.length - keep.length === 1 ? \"\" : \"s\"}.`);\n}\n\n/**\n * Runs dead events again through the profile's targets (or the ones passed as flags). Successes are\n * removed from dead.jsonl; failures stay. Returns how many still failed.\n */\nexport async function replayDead(flags: ListenFlags & { id?: string }, opts: { retryDelayMs?: (n: number) => number } = {}): Promise<number> {\n  const name = validProfileName(flags.profile ?? DEFAULT_PROFILE);\n  const profile = loadProfile(name);\n  const { config } = resolveListen(name, profile, { ...flags, save: false });\n  const all = readDead(name);\n  const chosen = all.filter((e) => !flags.id || e.id === flags.id);\n  if (!chosen.length) {\n    out(flags.id ? `No dead event with id ${flags.id}.` : `No dead events for profile \"${name}\".`);\n    return 0;\n  }\n  const available: Target[] = [];\n  if (config.exec) available.push(\"exec\");\n  if (config.forward) available.push(\"forward\");\n  if (!available.length) throw new Error(`Nothing to replay to: pass --exec '<command>' and/or --forward <url> (or save them in the profile with \\`${NPX} listen --save …\\`).`);\n  if (config.exec && process.platform === \"win32\") throw new Error(\"--exec isn't supported on Windows; replay with --forward instead.\");\n\n  const timeoutMs = config.timeoutSeconds * 1000;\n  if (config.cwdIsDefault) ensurePrivateDir(config.cwd);\n  const failed = new Map<string, DeadEntry>();\n  const bySeq = new Map(chosen.map((e) => [e.seq, e]));\n  const dispatcher = new Dispatcher({\n    targets: available,\n    concurrency: config.concurrency,\n    maxAttempts: config.maxAttempts,\n    retryDelayMs: opts.retryDelayMs,\n    run: async (job: Job, signal) => {\n      const errors: string[] = [];\n      if (job.remaining.has(\"exec\") && config.exec) {\n        const r = await runCommand(config.exec, job.payload, { timeoutMs, signal, cwd: config.cwd });\n        if (r.ok) job.remaining.delete(\"exec\");\n        else errors.push(`command: ${r.error}`);\n      }\n      if (job.remaining.has(\"forward\") && config.forward) {\n        const r = await forwardEvent(config.forward.url, config.forward.secret, job.payload, { timeoutMs: Math.min(timeoutMs, 30_000), signal });\n        if (r.ok) job.remaining.delete(\"forward\");\n        else errors.push(`forward: ${r.error}`);\n      }\n      return errors;\n    },\n    onAdvance: () => {},\n    onDead: (job) => {\n      const e = bySeq.get(job.seq)!;\n      failed.set(e.id, { ...e, deadAt: new Date().toISOString(), attempts: e.attempts + job.attempts, error: job.lastError ?? \"failed\" });\n      out(`${pc.red(\"✖\")} #${job.seq} still failing: ${safeText(job.lastError ?? \"failed\", 200)}`);\n    },\n    onFinished: (job) => {\n      if (job.outcome === \"succeeded\") out(`${pc.green(\"✓\")} #${job.seq} ${job.payload.type} replayed`);\n    },\n  });\n  out(`Replaying ${chosen.length} dead event${chosen.length > 1 ? \"s\" : \"\"} (up to ${config.maxAttempts} attempts each)…`);\n  // Only the targets that never succeeded (a forward that went through isn't POSTed again).\n  for (const e of [...chosen].sort((a, b) => a.seq - b.seq)) {\n    const targets = e.targets?.length ? e.targets.filter((t) => available.includes(t)) : available;\n    if (!targets.length) {\n      out(`${pc.yellow(\"!\")} #${e.seq} needs ${e.targets.join(\" and \")}, which isn't configured now; pass --${e.targets[0]} to replay it.`);\n      failed.set(e.id, e);\n      continue;\n    }\n    dispatcher.push(e.payload, { targets });\n  }\n  await dispatcher.idle();\n\n  const replayed = new Set(chosen.map((e) => e.id));\n  // Re-read so entries added by a running listener meanwhile are kept.\n  const current = readDead(name);\n  writeDead(name, [...current.filter((e) => !replayed.has(e.id)), ...failed.values()]);\n  out(`${chosen.length - failed.size} replayed, ${failed.size} still dead.`);\n  return failed.size;\n}\n"],"mappings":";;;;;;;;AAiBA,MAAM,OAAO,IAAI,OAAO,QAAQ,OAAO,MAAM,GAAG,EAAE,GAAG;AACrD,MAAM,WAAW,YAAqB,YAAA,YAA8B,KAAK,cAAc;AACvF,MAAM,OAAO,QAAoC,MAAM,GAAG,eAAe,KAAK,IAAI,IAAI,KAAK,MAAM,GAAG,CAAC,EAAE,QAAQ;;AAK/G,SAAgB,YAAY,aAAqB,MAAkC;CACjF,MAAM,OAAO,iBAAiB,WAAW;CACzC,MAAM,UAAU,YAAY,IAAI;CAChC,IAAI,EAAE,QAAQ,YAAY,cAAc,OAAO;CAC/C,IAAI,KAAK,QAAQ;EACf,SAAS,cAAc;GAAE,GAAG;GAAS,SAAS,KAAA;GAAW,eAAe,KAAA;EAAU,CAAC,CAAC,CAAC;EACrF,UAAU;CACZ;CACA,IAAI,SAAS;EACX,IAAI,QAAQ,SAAS,QAAQ,UAAU;GAAE,GAAG,QAAQ;GAAS;EAAO;OAC/D,QAAQ,gBAAgB;EAC7B,YAAY,MAAM,OAAO;EACzB,QAAQ,OAAO,MAAM,GAAG,KAAK,GAAG,KAAK,SAAS,YAAY,YAAY,2CAA2C,KAAK,GAAG,KAAK,SAAS,2BAA2B,GAAG,IAAI,CAAC;CAC5K;CAEA,IAAI,MAAM;AACZ;AAIA,eAAsB,YAAY,aAAoC;CACpE,MAAM,OAAO,iBAAiB,WAAW;CACzC,MAAM,UAAU,YAAY,IAAI;CAChC,MAAM,KAAK,WAAW,IAAI;CAC1B,MAAM,QAAQ,KAAK,SAAS,GAAG,GAAG,KAAK,CAAC,GAAG,YAAY;CACvD,MAAM,OAAO,SAAS,IAAI;CAE1B,IAAI,GAAG,GAAG,KAAK,SAAS,EAAE,KAAK,KAAK,IAAI,GAAG,KAAK,YAAY,IAAI,CAAC,GAAG;CACpE,IAAI,GAAG,GAAG,KAAK,OAAO,EAAE,OAAO,SAAS,QAAQ,SAAS,EAAE,GAAG,GAAG,KAAK,IAAI,QAAQ,QAAQ,EAAE,GAAG;CAC/F,IAAI,GAAG,GAAG,KAAK,QAAQ,EAAE,MAAM,QAAQ,KAAK;CAC5C,IAAI,GAAG,GAAG,KAAK,UAAU,EAAE,IAAI,IAAI,YAAY,QAAQ,UAAU;CAEjE,MAAM,OAAO,MAAM,GAAG,SAAS,KAAA,IAAY,GAAG,OAAO,QAAQ;CAC7D,MAAM,UAAU,MAAM,GAAG,YAAY,KAAA,IAAY,GAAG,UAAU,QAAQ,SAAS;CAC/E,MAAM,UAAU,CAAC,OAAO,QAAQ,SAAS,MAAM,GAAG,MAAM,MAAM,UAAU,WAAW,YAAY,IAAI,CAAC,CAAC,OAAO,OAAO;CACnH,IAAI,GAAG,GAAG,KAAK,MAAM,EAAE,QAAQ,QAAQ,SAAS,QAAQ,KAAK,KAAK,IAAI,GAAG,KAAK,mDAAmD,GAAG;CACpI,IACE,GAAG,GAAG,KAAK,QAAQ,EAAE,MACnB,QAAQ,OAAO,SACX,QAAQ,MAAM,KAAK,IAAI,IACvB,GAAG,qBAAqB,KAAK,IAAI,EAAE,GAAG,GAAG,KAAK,yDAAyD,KAE/G;CAEA,IAAI,MAAM;CACV,IAAI,QAAQ,aAAa,WAAW,QAAQ,aAAa,UACnD;MAAA,mBAAmB,IAAI,GAAG,MAAM,cAAc,QAAQ,aAAa,UAAU,SAAS,IAAI,IAAI,aAAa,IAAI,EAAE,aAAa,IAAI,wBAAwB,QAAQ,IAAI,EAAE;CAAA;CAE9K,IAAI,GAAG,GAAG,KAAK,SAAS,EAAE,KAAK,KAAK;CAEpC,IAAI;EAEF,MAAM,eAAe,QAAQ,KAAK,EAAE,UAAU,QAAQ,SAAS,CAAC;EAChE,MAAM,OAAO,MAAM,QAAQ,QAAQ,KAAK,QAAQ,QAAQ,GAAI;EAC5D,IAAI,GAAG,GAAG,KAAK,KAAK,EAAE,SAAS,GAAG,MAAM,OAAO,GAAG;EAElD,MAAM,QAAQ,eAAe,KAAK,MAAM;EACxC,IAAI,GAAG,GAAG,KAAK,QAAQ,EAAE,MAAM,KAAK,OAAO,SAAS,MAAM,KAAK,GAAG,OAAO,MAAM,EAAG,GAAG;EACrF,KAAK,MAAM,KAAK,MAAM,MAAM,CAAC,GAAG,IAAI,aAAa,GAAG;CACtD,SAAS,KAAK;EACZ,MAAM,UAAU,eAAe,aAAa,IAAI,WAAW,OAAO,IAAI,WAAW;EACjF,MAAM,MAAM,eAAe,YAAY,IAAI,WAAW,IAAK,IAAI,QAAmB,eAAe,QAAQ,IAAI,QAAQ,MAAM,IAAI,CAAC,CAAC,KAAK,OAAO,GAAG;EAChJ,IAAI,eAAe,gBAAgB,IAAI,GAAG,GAAG,KAAK,KAAK,EAAE,SAAS,GAAG,IAAI,gBAAgB,KAAK,GAAG;OAC5F,IAAI,GAAG,GAAG,KAAK,KAAK,EAAE,SAAS,UAAU,GAAG,IAAI,aAAc,IAAc,SAAS,IAAI,GAAG,OAAO,gBAAgB,IAAI,EAAE,GAAG;CACnI;CAEA,IAAI,CAAC,IACH,IAAI,GAAG,GAAG,KAAK,UAAU,EAAE,IAAI,GAAG,KAAK,iBAAiB,GAAG;MACtD;EACL,MAAM,QAAQ,CAAC,QACX,GAAG,KAAK,cAAc,GAAG,YAAY,aAAa,IAAI,GAAG,SAAS,IAAI,GAAG,aAAa,KAAK,SAAS,GAAG,YAAY,GAAG,MAAM,GAAG,KAAK,0BAA0B,IAC9J,GAAG,YACD,GAAG,MAAM,gBAAgB,GAAG,IAAI,eAAe,IAAI,GAAG,cAAc,GAAG,IACvE,GAAG,OAAO,gBAAgB,GAAG,IAAI,iBAAiB,GAAG,iBAAiB,IAAI,IAAI,GAAG,eAAe,EAAE,EAAE,IAAI,SAAS,GAAG,eAAe,QAAQ,GAAG,MAAM,IAAI;EAC9J,IAAI,GAAG,GAAG,KAAK,UAAU,EAAE,IAAI,OAAO;EACtC,IAAI,GAAG,GAAG,KAAK,QAAQ,EAAE,aAAa,GAAG,SAAS,eAAe,GAAG,cAAc,SAAS,GAAG,UAAU,MAAM,GAAG,QAAQ,gBAAgB,GAAG,gBAAgB,IAAI,GAAG,WAAW,GAAG;EACjL,IAAI,GAAG,OAAO,QAAQ;GACpB,IAAI,GAAG,KAAK,QAAQ,CAAC;GACrB,KAAK,MAAM,KAAK,GAAG,OAAO,MAAM,GAAG,CAAC,GAAG;IACrC,MAAM,OAAO,EAAE,YAAY,cAAc,GAAG,MAAM,GAAG,IAAI,EAAE,YAAY,SAAS,GAAG,IAAI,GAAG,IAAI,EAAE,YAAY,aAAa,GAAG,OAAO,GAAG,IAAI,GAAG,KAAK,GAAG;IACrJ,IAAI,KAAK,KAAK,IAAI,EAAE,IAAI,GAAG,EAAE,KAAK,GAAG,GAAG,KAAK,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,WAAW,IAAI,KAAK,EAAE,SAAS,aAAa,KAAK,EAAE,SAAS,EAAE,YAAY,cAAc,KAAK,SAAS,EAAE,OAAO,GAAG,MAAM,IAAI,GAAG;GAC/L;EACF;CACF;CACA,IAAI,GAAG,GAAG,KAAK,MAAM,EAAE,QAAQ,KAAK,SAAS,GAAG,IAAI,GAAG,KAAK,OAAO,QAAQ,KAAK,SAAS,IAAI,MAAM,IAAI,IAAI,GAAG,KAAK,cAAc,IAAI,cAAc,QAAQ,IAAI,EAAE,EAAE,IAAI,KAAK;CAC5K,IAAI,GAAG,GAAG,KAAK,KAAK,EAAE,SAAS,QAAQ,IAAI,GAAG;AAChD;AAIA,SAAgB,UAAU,aAAqB,MAAgC;CAC7E,MAAM,OAAO,iBAAiB,WAAW;CACzC,MAAM,UAAU,SAAS,IAAI;CAC7B,IAAI,KAAK,MAAM;EACb,KAAK,MAAM,KAAK,SAAS,IAAI,KAAK,UAAU,CAAC,CAAC;EAC9C;CACF;CACA,IAAI,CAAC,QAAQ,QAAQ;EACnB,IAAI,+BAA+B,KAAK,GAAG;EAC3C;CACF;CACA,KAAK,MAAM,KAAK,SAAS;EACvB,MAAM,IAAI,EAAE,QAAQ,KAAK;EACzB,IAAI,GAAG,GAAG,IAAI,GAAG,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,KAAK,GAAG,GAAG,KAAK,EAAE,EAAE,EAAE,IAAI,GAAG,KAAK,QAAQ,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,UAAU,GAAG;EAC3H,IAAI,GAAG,IAAI,YAAY,SAAS,EAAE,MAAM,SAAS,KAAK,EAAE,EAAE,KAAK,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE;EACzF,IAAI,GAAG,KAAK,OAAO,SAAS,EAAE,OAAO,GAAG,GAAG,CAAC;CAC9C;CACA,IAAI;CACJ,IAAI,GAAG,KAAK,GAAG,QAAQ,OAAO,aAAa,QAAQ,SAAS,IAAI,MAAM,GAAG,MAAM,SAAS,IAAI,EAAE,EAAE,CAAC;CACjG,IAAI,GAAG,KAAK,gBAAgB,IAAI,uBAAuB,QAAQ,IAAI,EAAE,0CAA0C,CAAC;CAChH,IAAI,GAAG,KAAK,qIAAqI,CAAC;AACpJ;AAEA,SAAgB,UAAU,aAAqB,IAAmB;CAChE,MAAM,OAAO,iBAAiB,WAAW;CACzC,MAAM,UAAU,SAAS,IAAI;CAC7B,MAAM,OAAO,KAAK,QAAQ,QAAQ,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;CACxD,UAAU,MAAM,IAAI;CACpB,IAAI,WAAW,QAAQ,SAAS,KAAK,OAAO,aAAa,QAAQ,SAAS,KAAK,WAAW,IAAI,KAAK,IAAI,EAAE;AAC3G;;;;;AAMA,eAAsB,WAAW,OAAsC,OAAiD,CAAC,GAAoB;CAC3I,MAAM,OAAO,iBAAiB,MAAM,WAAA,SAA0B;CAC9D,MAAM,UAAU,YAAY,IAAI;CAChC,MAAM,EAAE,WAAW,cAAc,MAAM,SAAS;EAAE,GAAG;EAAO,MAAM;CAAM,CAAC;CAEzE,MAAM,SADM,SAAS,IACJ,CAAC,CAAC,QAAQ,MAAM,CAAC,MAAM,MAAM,EAAE,OAAO,MAAM,EAAE;CAC/D,IAAI,CAAC,OAAO,QAAQ;EAClB,IAAI,MAAM,KAAK,yBAAyB,MAAM,GAAG,KAAK,+BAA+B,KAAK,GAAG;EAC7F,OAAO;CACT;CACA,MAAM,YAAsB,CAAC;CAC7B,IAAI,OAAO,MAAM,UAAU,KAAK,MAAM;CACtC,IAAI,OAAO,SAAS,UAAU,KAAK,SAAS;CAC5C,IAAI,CAAC,UAAU,QAAQ,MAAM,IAAI,MAAM,4GAA4G,IAAI,qBAAqB;CAC5K,IAAI,OAAO,QAAQ,QAAQ,aAAa,SAAS,MAAM,IAAI,MAAM,mEAAmE;CAEpI,MAAM,YAAY,OAAO,iBAAiB;CAC1C,IAAI,OAAO,cAAc,iBAAiB,OAAO,GAAG;CACpD,MAAM,yBAAS,IAAI,IAAuB;CAC1C,MAAM,QAAQ,IAAI,IAAI,OAAO,KAAK,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;CACnD,MAAM,aAAa,IAAI,WAAW;EAChC,SAAS;EACT,aAAa,OAAO;EACpB,aAAa,OAAO;EACpB,cAAc,KAAK;EACnB,KAAK,OAAO,KAAU,WAAW;GAC/B,MAAM,SAAmB,CAAC;GAC1B,IAAI,IAAI,UAAU,IAAI,MAAM,KAAK,OAAO,MAAM;IAC5C,MAAM,IAAI,MAAM,WAAW,OAAO,MAAM,IAAI,SAAS;KAAE;KAAW;KAAQ,KAAK,OAAO;IAAI,CAAC;IAC3F,IAAI,EAAE,IAAI,IAAI,UAAU,OAAO,MAAM;SAChC,OAAO,KAAK,YAAY,EAAE,OAAO;GACxC;GACA,IAAI,IAAI,UAAU,IAAI,SAAS,KAAK,OAAO,SAAS;IAClD,MAAM,IAAI,MAAM,aAAa,OAAO,QAAQ,KAAK,OAAO,QAAQ,QAAQ,IAAI,SAAS;KAAE,WAAW,KAAK,IAAI,WAAW,GAAM;KAAG;IAAO,CAAC;IACvI,IAAI,EAAE,IAAI,IAAI,UAAU,OAAO,SAAS;SACnC,OAAO,KAAK,YAAY,EAAE,OAAO;GACxC;GACA,OAAO;EACT;EACA,iBAAiB,CAAC;EAClB,SAAS,QAAQ;GACf,MAAM,IAAI,MAAM,IAAI,IAAI,GAAG;GAC3B,OAAO,IAAI,EAAE,IAAI;IAAE,GAAG;IAAG,yBAAQ,IAAI,KAAK,EAAA,CAAE,YAAY;IAAG,UAAU,EAAE,WAAW,IAAI;IAAU,OAAO,IAAI,aAAa;GAAS,CAAC;GAClI,IAAI,GAAG,GAAG,IAAI,GAAG,EAAE,IAAI,IAAI,IAAI,kBAAkB,SAAS,IAAI,aAAa,UAAU,GAAG,GAAG;EAC7F;EACA,aAAa,QAAQ;GACnB,IAAI,IAAI,YAAY,aAAa,IAAI,GAAG,GAAG,MAAM,GAAG,EAAE,IAAI,IAAI,IAAI,GAAG,IAAI,QAAQ,KAAK,UAAU;EAClG;CACF,CAAC;CACD,IAAI,aAAa,OAAO,OAAO,aAAa,OAAO,SAAS,IAAI,MAAM,GAAG,UAAU,OAAO,YAAY,iBAAiB;CAEvH,KAAK,MAAM,KAAK,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,GAAG,MAAM,EAAE,MAAM,EAAE,GAAG,GAAG;EACzD,MAAM,UAAU,EAAE,SAAS,SAAS,EAAE,QAAQ,QAAQ,MAAM,UAAU,SAAS,CAAC,CAAC,IAAI;EACrF,IAAI,CAAC,QAAQ,QAAQ;GACnB,IAAI,GAAG,GAAG,OAAO,GAAG,EAAE,IAAI,EAAE,IAAI,SAAS,EAAE,QAAQ,KAAK,OAAO,EAAE,uCAAuC,EAAE,QAAQ,GAAG,eAAe;GACpI,OAAO,IAAI,EAAE,IAAI,CAAC;GAClB;EACF;EACA,WAAW,KAAK,EAAE,SAAS,EAAE,QAAQ,CAAC;CACxC;CACA,MAAM,WAAW,KAAK;CAEtB,MAAM,WAAW,IAAI,IAAI,OAAO,KAAK,MAAM,EAAE,EAAE,CAAC;CAEhD,MAAM,UAAU,SAAS,IAAI;CAC7B,UAAU,MAAM,CAAC,GAAG,QAAQ,QAAQ,MAAM,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC,GAAG,GAAG,OAAO,OAAO,CAAC,CAAC;CACnF,IAAI,GAAG,OAAO,SAAS,OAAO,KAAK,aAAa,OAAO,KAAK,aAAa;CACzE,OAAO,OAAO;AAChB"}

package/dist/audit-BVpTUgLt.js

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export { t as AuditLog } from "./audit-J2PdyQ1T.js";

package/dist/{audit-CNYWHcik.js → audit-J2PdyQ1T.js}

@@ -1,6 +1,15 @@
 #!/usr/bin/env node
-import { i as now, r as json } from "./db-B2pnfQW5.js";
+import { i as now, r as json } from "./db-CTUkHFMr.js";
 //#region server/audit.ts
+/**
+* SQL condition for an MCP tool call in audit_log: an agent actor and an action without a "." (tool
+* names are like "send_message"; "pairing.key_delivered" and console actions have a dot). The same
+* rule as isMcpToolAction in shared/types.ts (used by the console). `t` is the table alias, if any.
+*/
+function mcpToolCallSql(t) {
+	const c = t ? `${t}.` : "";
+	return `${c}actor_type = 'agent' AND instr(${c}action, '.') = 0`;
+}
 const SELECT = `SELECT a.*, CASE a.actor_type WHEN 'agent' THEN ag.name WHEN 'admin' THEN 'admin' ELSE NULL END AS actor_name
   FROM audit_log a LEFT JOIN agents ag ON a.actor_type = 'agent' AND ag.id = a.actor_id`;
 const toEntry = (r) => ({
@@ -60,6 +69,6 @@ var AuditLog = class {
 	}
 };
 //#endregion
-export { AuditLog as t };
+export { mcpToolCallSql as n, AuditLog as t };
 
-//# sourceMappingURL=audit-CNYWHcik.js.map
+//# sourceMappingURL=audit-J2PdyQ1T.js.map

package/dist/audit-J2PdyQ1T.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-J2PdyQ1T.js","names":[],"sources":["../server/audit.ts"],"sourcesContent":["import type { ActorType, AuditEntry, AuditOutcome, Page } from \"../shared/types.ts\";\nimport type { Bus } from \"./bus.ts\";\nimport { type Db, json, now } from \"./db/index.ts\";\n\nexport interface AuditInput {\n  actorType: ActorType;\n  actorId?: string | null;\n  /** MCP tool name or console action, e.g. \"send_message\", \"agent.create\", \"account.connect\". */\n  action: string;\n  accountId?: string | null;\n  target?: string | null;\n  outcome: AuditOutcome;\n  /** Required for denials: the guardrail that blocked it (\"allow_to\", \"label_scope\", \"rate_limit\", …). */\n  reason?: string | null;\n  durationMs?: number | null;\n  /** Small, non-sensitive context. Never message bodies, keys or tokens. */\n  detail?: Record<string, unknown> | null;\n}\n\n/**\n * SQL condition for an MCP tool call in audit_log: an agent actor and an action without a \".\" (tool\n * names are like \"send_message\"; \"pairing.key_delivered\" and console actions have a dot). The same\n * rule as isMcpToolAction in shared/types.ts (used by the console). `t` is the table alias, if any.\n */\nexport function mcpToolCallSql(t?: string): string {\n  const c = t ? `${t}.` : \"\";\n  return `${c}actor_type = 'agent' AND instr(${c}action, '.') = 0`;\n}\n\nexport interface AuditQuery {\n  agentId?: string;\n  accountId?: string;\n  outcome?: AuditOutcome;\n  action?: string;\n  /** Opaque cursor from a previous page. */\n  cursor?: string | null;\n  limit?: number;\n}\n\ninterface AuditRow {\n  id: number;\n  ts: string;\n  actor_type: ActorType;\n  actor_id: string | null;\n  actor_name: string | null;\n  action: string;\n  account_id: string | null;\n  target: string | null;\n  outcome: AuditOutcome;\n  reason: string | null;\n  duration_ms: number | null;\n  detail: string | null;\n}\n\nconst SELECT = `SELECT a.*, CASE a.actor_type WHEN 'agent' THEN ag.name WHEN 'admin' THEN 'admin' ELSE NULL END AS actor_name\n  FROM audit_log a LEFT JOIN agents ag ON a.actor_type = 'agent' AND ag.id = a.actor_id`;\n\nconst toEntry = (r: AuditRow): AuditEntry => ({\n  id: r.id,\n  ts: r.ts,\n  actorType: r.actor_type,\n  actorId: r.actor_id,\n  actorName: r.actor_name,\n  action: r.action,\n  accountId: r.account_id,\n  target: r.target,\n  outcome: r.outcome,\n  reason: r.reason,\n  durationMs: r.duration_ms,\n  detail: json.parse<Record<string, unknown> | null>(r.detail, null),\n});\n\n/** Append-only audit log. Every agent tool call and every admin mutation is recorded. */\nexport class AuditLog {\n  constructor(\n    private readonly db: Db,\n    private readonly bus: Bus,\n  ) {}\n\n  record(input: AuditInput): AuditEntry {\n    const { lastInsertRowid } = this.db.run(\n      `INSERT INTO audit_log (ts, actor_type, actor_id, action, account_id, target, outcome, reason, duration_ms, detail)\n       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,\n      now(),\n      input.actorType,\n      input.actorId ?? null,\n      input.action,\n      input.accountId ?? null,\n      input.target ?? null,\n      input.outcome,\n      input.reason ?? null,\n      input.durationMs ?? null,\n      input.detail ? json.str(input.detail) : null,\n    );\n    const entry = toEntry(this.db.get<AuditRow>(`${SELECT} WHERE a.id = ?`, lastInsertRowid)!);\n    this.bus.emit(\"audit\", entry);\n    return entry;\n  }\n\n  /** Newest first. */\n  list(q: AuditQuery = {}): Page<AuditEntry> {\n    const where: string[] = [];\n    const params: (string | number)[] = [];\n    const add = (clause: string, value: string | number) => {\n      where.push(clause);\n      params.push(value);\n    };\n    if (q.agentId) add(\"a.actor_id = ?\", q.agentId);\n    if (q.accountId) add(\"a.account_id = ?\", q.accountId);\n    if (q.outcome) add(\"a.outcome = ?\", q.outcome);\n    if (q.action) add(\"a.action = ?\", q.action);\n    const before = Number(q.cursor);\n    if (q.cursor && Number.isInteger(before)) add(\"a.id < ?\", before);\n    const limit = Math.min(Math.max(q.limit ?? 50, 1), 200);\n    const rows = this.db.all<AuditRow>(\n      `${SELECT} ${where.length ? \"WHERE \" + where.join(\" AND \") : \"\"} ORDER BY a.id DESC LIMIT ?`,\n      ...params,\n      limit + 1,\n    );\n    const items = rows.slice(0, limit).map(toEntry);\n    return { items, nextCursor: rows.length > limit ? String(items.at(-1)!.id) : null };\n  }\n\n  /** Deletes entries older than `beforeIso`. Returns the number removed. */\n  prune(beforeIso: string): number {\n    return this.db.run(\"DELETE FROM audit_log WHERE ts < ?\", beforeIso).changes;\n  }\n}\n"],"mappings":";;;;;;;;AAwBA,SAAgB,eAAe,GAAoB;CACjD,MAAM,IAAI,IAAI,GAAG,EAAE,KAAK;CACxB,OAAO,GAAG,EAAE,iCAAiC,EAAE;AACjD;AA2BA,MAAM,SAAS;;AAGf,MAAM,WAAW,OAA6B;CAC5C,IAAI,EAAE;CACN,IAAI,EAAE;CACN,WAAW,EAAE;CACb,SAAS,EAAE;CACX,WAAW,EAAE;CACb,QAAQ,EAAE;CACV,WAAW,EAAE;CACb,QAAQ,EAAE;CACV,SAAS,EAAE;CACX,QAAQ,EAAE;CACV,YAAY,EAAE;CACd,QAAQ,KAAK,MAAsC,EAAE,QAAQ,IAAI;AACnE;;AAGA,IAAa,WAAb,MAAsB;CAED;CACA;CAFnB,YACE,IACA,KACA;EAFiB,KAAA,KAAA;EACA,KAAA,MAAA;CAChB;CAEH,OAAO,OAA+B;EACpC,MAAM,EAAE,oBAAoB,KAAK,GAAG,IAClC;+CAEA,IAAI,GACJ,MAAM,WACN,MAAM,WAAW,MACjB,MAAM,QACN,MAAM,aAAa,MACnB,MAAM,UAAU,MAChB,MAAM,SACN,MAAM,UAAU,MAChB,MAAM,cAAc,MACpB,MAAM,SAAS,KAAK,IAAI,MAAM,MAAM,IAAI,IAC1C;EACA,MAAM,QAAQ,QAAQ,KAAK,GAAG,IAAc,GAAG,OAAO,kBAAkB,eAAe,CAAE;EACzF,KAAK,IAAI,KAAK,SAAS,KAAK;EAC5B,OAAO;CACT;;CAGA,KAAK,IAAgB,CAAC,GAAqB;EACzC,MAAM,QAAkB,CAAC;EACzB,MAAM,SAA8B,CAAC;EACrC,MAAM,OAAO,QAAgB,UAA2B;GACtD,MAAM,KAAK,MAAM;GACjB,OAAO,KAAK,KAAK;EACnB;EACA,IAAI,EAAE,SAAS,IAAI,kBAAkB,EAAE,OAAO;EAC9C,IAAI,EAAE,WAAW,IAAI,oBAAoB,EAAE,SAAS;EACpD,IAAI,EAAE,SAAS,IAAI,iBAAiB,EAAE,OAAO;EAC7C,IAAI,EAAE,QAAQ,IAAI,gBAAgB,EAAE,MAAM;EAC1C,MAAM,SAAS,OAAO,EAAE,MAAM;EAC9B,IAAI,EAAE,UAAU,OAAO,UAAU,MAAM,GAAG,IAAI,YAAY,MAAM;EAChE,MAAM,QAAQ,KAAK,IAAI,KAAK,IAAI,EAAE,SAAS,IAAI,CAAC,GAAG,GAAG;EACtD,MAAM,OAAO,KAAK,GAAG,IACnB,GAAG,OAAO,GAAG,MAAM,SAAS,WAAW,MAAM,KAAK,OAAO,IAAI,GAAG,8BAChE,GAAG,QACH,QAAQ,CACV;EACA,MAAM,QAAQ,KAAK,MAAM,GAAG,KAAK,CAAC,CAAC,IAAI,OAAO;EAC9C,OAAO;GAAE;GAAO,YAAY,KAAK,SAAS,QAAQ,OAAO,MAAM,GAAG,EAAE,CAAC,CAAE,EAAE,IAAI;EAAK;CACpF;;CAGA,MAAM,WAA2B;EAC/B,OAAO,KAAK,GAAG,IAAI,sCAAsC,SAAS,CAAC,CAAC;CACtE;AACF"}