botmux 3.10.0 → 3.23.1

package/dist/core/maintenance.js

@@ -1,340 +0,0 @@
-/**
- * Maintenance timer: scheduled auto-update / auto-restart. Runs only on the
- * primary daemon (bot-0) — restart is a host-wide operation (it takes down all
- * per-bot daemons), so exactly one process must own it.
- *
- * At the scheduled local time (Asia/Shanghai, once/day) it:
- *  - checks the cross-daemon busy gate (anyDaemonBusy) — a session mid-CLI-turn
- *    anywhere defers the run to the next day (no retry);
- *  - auto-update (npm/pnpm/Bun global): update the package with its owning package
- *    manager, then restart
- *    to apply iff the version actually changed;
- *  - auto-restart: just restart.
- * Before triggering a restart it drops a restart-intent breadcrumb so the fresh
- * daemon knows to DM the owner (vs. staying silent on a crash-restart).
- *
- * runMaintenanceTick is pure over its injected deps (unit tested); the rest is
- * production wiring.
- */
-import { execSync, spawn, spawnSync } from 'node:child_process';
-import { closeSync, existsSync, mkdirSync, openSync, readFileSync, renameSync, writeFileSync, writeSync } from 'node:fs';
-import { homedir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { config } from '../config.js';
-import { logger } from '../utils/logger.js';
-import { readGlobalConfig } from '../global-config.js';
-import { evaluateDue } from './maintenance-schedule.js';
-import { anyDaemonBusy } from './daemon-heartbeat.js';
-import { claimRestartLease, clearRestartLease, hasActiveRestartLease, writeRestartIntent, } from '../services/restart-intent-store.js';
-import { isLocalDevInstall, botmuxVersion, botmuxVersionAt, botmuxCliEntry, botmuxCliEntryAt, } from '../utils/install-info.js';
-import { resolveGlobalInstallPlan, } from '../utils/global-install.js';
-import { withFileLockSync } from '../utils/file-lock.js';
-/**
- * One maintenance tick. The schedule is driven solely by auto-update's time
- * (once/day). At that time: install the latest version (download only), and
- * — only if a newer version was actually installed AND the auto-restart toggle
- * is on — restart to apply it. A busy session anywhere skips the whole run to
- * the next day; auto-restart off ⇒ install only (applied on the next restart).
- * Pure orchestration over injected deps.
- */
-export function runMaintenanceTick(deps) {
-    const cfg = deps.readConfig();
-    if (!cfg?.autoUpdate?.enabled)
-        return; // auto-restart has no schedule of its own
-    const now = deps.now();
-    const state = deps.readState();
-    const log = deps.log ?? (() => { });
-    const upd = evaluateDue(cfg.autoUpdate, state.autoUpdate?.lastDate, now);
-    if ((upd.decision === 'due' || upd.decision === 'missed') && upd.markDate) {
-        state.autoUpdate = { lastDate: upd.markDate };
-        deps.writeState(state);
-    }
-    if (upd.decision !== 'due')
-        return;
-    if (deps.isLocalDev()) {
-        log('auto-update skipped: local-dev install (global package install only)');
-        return;
-    }
-    if (deps.anyBusy()) {
-        log('auto-update skipped: a session is busy — slipping to next day');
-        return;
-    }
-    let before = '';
-    let after = '';
-    let restartFailed = false;
-    try {
-        deps.withUpdateLock(() => {
-            before = deps.currentVersion();
-            deps.runUpdate();
-            after = deps.currentVersion();
-            if (after !== before && cfg.autoRestart?.enabled) {
-                deps.writeIntent({ kind: 'update', oldVersion: before, newVersion: after, at: new Date(now).toISOString() });
-                try {
-                    deps.triggerRestart();
-                }
-                catch (e) {
-                    // Update succeeded but the restart handoff failed (e.g. lease taken
-                    // by a concurrent manual restart, or the detached driver did not
-                    // start). The new version is already on disk — log it clearly so it
-                    // isn't mistaken for a full update failure, and don't rethrow: the
-                    // next tick sees after===before and would otherwise never retry.
-                    restartFailed = true;
-                    log(`auto-update: installed ${after} but restart failed: ${e instanceof Error ? e.message : e}`);
-                }
-            }
-        });
-    }
-    catch (e) {
-        log(`auto-update failed: ${e instanceof Error ? e.message : e}`);
-        return;
-    }
-    if (after === before) {
-        log('auto-update: already on the latest version');
-        return;
-    }
-    // A newer version was installed.
-    if (!cfg.autoRestart?.enabled) {
-        log(`auto-update: installed ${after} (was ${before}); auto-restart off — applies on next restart`);
-    }
-    else if (!restartFailed) {
-        log(`auto-update: ${before} → ${after}, restarting to apply`);
-    }
-}
-// ---- maintenance-state store (dir-injected for tests) ----
-const STATE_FILE = 'maintenance-state.json';
-export function maintenanceStatePathIn(dir) {
-    return join(dir, STATE_FILE);
-}
-export function readMaintenanceStateTo(dir) {
-    const path = maintenanceStatePathIn(dir);
-    if (!existsSync(path))
-        return {};
-    try {
-        const v = JSON.parse(readFileSync(path, 'utf-8'));
-        return v && typeof v === 'object' ? v : {};
-    }
-    catch {
-        return {};
-    }
-}
-export function writeMaintenanceStateTo(dir, s) {
-    if (!existsSync(dir))
-        mkdirSync(dir, { recursive: true });
-    const path = maintenanceStatePathIn(dir);
-    const tmp = `${path}.${process.pid}.tmp`;
-    writeFileSync(tmp, JSON.stringify(s, null, 2) + '\n');
-    renameSync(tmp, path);
-}
-// ---- production wiring ----
-/** How often to evaluate the schedule. Sub-minute so an HH:MM target fires
- *  within the same minute it's reached. */
-export const MAINTENANCE_TICK_MS = 60_000;
-/** Where the auto-restart driver's stdout/stderr is captured, so a failed
- *  restart-to-apply is diagnosable (previously stdio was 'ignore'). */
-export function maintenanceRestartLogPath() {
-    return join(homedir(), '.botmux', 'logs', 'maintenance-restart.log');
-}
-/**
- * Stable cwd (HOME) for spawns that must not inherit a possibly-deleted cwd.
- * A global package update replaces the botmux package dir, so any process whose cwd
- * points there (notably the dashboard, started by pm2 with `cwd: PKG_ROOT`) is
- * left holding a deleted directory. Both the package-manager child and the
- * detached restart driver spawned afterwards would then die at startup reading
- * cwd (`uv_cwd`/ENOENT). Pinning them to HOME sidesteps that entirely.
- */
-export function globalInstallUpdateCwd() {
-    return homedir();
-}
-/** Run the ownership-aware update synchronously. */
-export function installLatestBotmuxSync(plan = resolveGlobalInstallPlan()) {
-    const result = spawnSync(plan.command, plan.args, {
-        cwd: globalInstallUpdateCwd(),
-        env: { ...process.env, ...plan.env },
-        stdio: 'inherit',
-        shell: process.platform === 'win32', // resolve npm.cmd / pnpm.cmd / bun.exe
-    });
-    if (result.error)
-        throw result.error;
-    if (result.status !== 0) {
-        throw new Error(`${plan.manager} install exited with ${result.status ?? result.signal ?? 'unknown status'}`);
-    }
-}
-/**
- * Cross-process lock target that serializes global botmux updates
- * between the scheduled auto-update (this daemon process) and a
- * dashboard-triggered manual update (the separate `botmux-dashboard` process),
- * so the two never write the active global install concurrently. Both sides acquire
- * `withFileLock(Sync)` on this path.
- */
-export function globalInstallUpdateLockTargetIn(dataDir) {
-    // Keep the historical filename so old/new daemon-dashboard processes still
-    // serialize correctly during a rolling upgrade.
-    return join(dataDir, 'npm-global-update');
-}
-export function globalInstallUpdateLockTarget() {
-    return globalInstallUpdateLockTargetIn(config.session.dataDir);
-}
-/**
- * Build the command to launch `botmux restart` for applying an auto-update.
- *
- * The restart driver must NOT remain a descendant of the daemon it's about to
- * tear down: `botmux restart` deletes botmux-0 (the very daemon that spawned
- * this), and when PM2 kills botmux-0 a child in its process tree gets
- * interrupted — so the restart aborts after deleting botmux-0 and never
- * restarts the rest (the 2026-06-11 incident). `setsid` starts it in a brand
- * new session, reparented to init, immune to botmux-0's teardown. Without
- * setsid we fall back to a plain spawn (still detached by the caller).
- */
-export function buildRestartLauncher(node, cliEntry, hasSetsid) {
-    if (hasSetsid)
-        return { cmd: 'setsid', args: [node, cliEntry, 'restart'] };
-    return { cmd: node, args: [cliEntry, 'restart'] };
-}
-export function detachedRestartEnv(inheritedEnv = process.env) {
-    const env = { ...inheritedEnv };
-    // The dashboard/daemon snapshot may outlive a ~/.botmux/.env edit. Let the
-    // fresh CLI reload these settings from the file.
-    //
-    // This list MUST mirror DAEMON_ENV_KEYS in src/cli/daemon-lifecycle-env.ts:
-    // every key baked into the PM2 env block there has to be stripped here, or a
-    // detached restart (dashboard update/restart, maintenance auto-update) keeps
-    // the stale baked value instead of reloading from the file. Keep them in sync.
-    for (const key of [
-        'WEB_EXTERNAL_HOST',
-        'BOTMUX_DASHBOARD_EXTERNAL_HOST',
-        'BOTMUX_DASHBOARD_HOST',
-        'BOTMUX_DASHBOARD_PORT',
-        'BOTMUX_DAEMON_IPC_BASE_PORT',
-        'BOTMUX_DASHBOARD_PUBLIC_READONLY',
-        'BOTMUX_PUBLIC_URL',
-    ])
-        delete env[key];
-    return env;
-}
-function setsidAvailable() {
-    try {
-        execSync('command -v setsid', { stdio: 'ignore' });
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-/**
- * Spawn a detached `botmux restart`, immune to this process's own teardown
- * (setsid → a new session reparented to init, so PM2 killing the current
- * process doesn't interrupt the restart driver). Output is appended to the
- * maintenance-restart log so a failed restart stays diagnosable. Shared by the
- * maintenance timer (auto-update) and the dashboard's manual update/restart.
- *
- * @param reason short tag written to the log (e.g. 'auto-update', 'dashboard').
- */
-export function spawnDetachedRestart(reason, activePackageRoot, restartLeaseId) {
-    const logFile = maintenanceRestartLogPath();
-    let fd;
-    try {
-        mkdirSync(dirname(logFile), { recursive: true });
-        fd = openSync(logFile, 'a');
-        writeSync(fd, `\n[${new Date().toISOString()}] ${reason}: launching restart\n`);
-    }
-    catch {
-        fd = undefined; // fall back to discarding output rather than failing the restart
-    }
-    const cliEntry = activePackageRoot ? botmuxCliEntryAt(activePackageRoot) : botmuxCliEntry();
-    const { cmd, args } = buildRestartLauncher(process.execPath, cliEntry, setsidAvailable());
-    const child = spawn(cmd, args, {
-        detached: true,
-        stdio: fd !== undefined ? ['ignore', fd, fd] : 'ignore',
-        env: {
-            ...detachedRestartEnv(),
-            ...(restartLeaseId ? {
-                BOTMUX_RESTART_LEASE_ID: restartLeaseId,
-                BOTMUX_RESTART_LEASE_DIR: config.session.dataDir,
-            } : {}),
-        },
-        // Run from HOME, not the caller's cwd: the dashboard (cwd: PKG_ROOT) triggers
-        // this right after a global update replaced that dir, so inheriting it
-        // would start the restart driver in a deleted directory. See globalInstallUpdateCwd.
-        cwd: globalInstallUpdateCwd(),
-    });
-    // A detached child's 'error' (e.g. spawn ENOENT) would otherwise throw
-    // unhandled and crash this process — log it instead.
-    child.on('error', (e) => logger.error(`[maintenance] restart launch failed: ${e instanceof Error ? e.message : e}`));
-    child.unref();
-    if (fd !== undefined) {
-        try {
-            closeSync(fd);
-        }
-        catch { /* the detached child holds its own dup */ }
-    }
-    return child;
-}
-function productionDeps() {
-    // Kept after a successful resolve so post-pnpm-update version/restart lookups
-    // use the stable global node_modules/botmux symlink, not the removed
-    // .pnpm/botmux@old runtime realpath.
-    let installPlan;
-    return {
-        now: () => Date.now(),
-        readConfig: () => readGlobalConfig().maintenance,
-        readState: () => readMaintenanceStateTo(config.session.dataDir),
-        writeState: (s) => writeMaintenanceStateTo(config.session.dataDir, s),
-        anyBusy: () => anyDaemonBusy(),
-        isLocalDev: () => isLocalDevInstall(),
-        withUpdateLock: (fn) => withFileLockSync(globalInstallUpdateLockTarget(), () => {
-            if (hasActiveRestartLease())
-                throw new Error('restart already pending');
-            fn();
-        }, { maxWaitMs: 500 }),
-        currentVersion: () => installPlan
-            ? botmuxVersionAt(installPlan.activePackageRoot)
-            : botmuxVersion(),
-        runUpdate: () => {
-            installPlan ??= resolveGlobalInstallPlan();
-            installLatestBotmuxSync(installPlan);
-        },
-        writeIntent: (intent) => writeRestartIntent(intent),
-        triggerRestart: () => {
-            const leaseId = claimRestartLease();
-            if (!leaseId)
-                throw new Error('restart already pending');
-            try {
-                const child = spawnDetachedRestart('auto-update', installPlan?.activePackageRoot, leaseId);
-                if (!child.pid)
-                    throw new Error('restart driver did not start');
-            }
-            catch (error) {
-                clearRestartLease(leaseId);
-                throw error;
-            }
-        },
-        log: (msg) => logger.info(`[maintenance] ${msg}`),
-    };
-}
-let timer;
-/** Start the maintenance loop. Call only on the primary daemon (bot-0). */
-export function startMaintenance() {
-    if (timer)
-        return;
-    const deps = productionDeps();
-    const tick = () => {
-        try {
-            runMaintenanceTick(deps);
-        }
-        catch (e) {
-            logger.warn(`[maintenance] tick failed: ${e instanceof Error ? e.message : e}`);
-        }
-    };
-    // First evaluation shortly after startup, then on a steady cadence.
-    setTimeout(tick, 10_000).unref?.();
-    timer = setInterval(tick, MAINTENANCE_TICK_MS);
-    timer.unref?.();
-    logger.info('[maintenance] timer started (primary daemon)');
-}
-export function stopMaintenance() {
-    if (timer) {
-        clearInterval(timer);
-        timer = undefined;
-    }
-}
-//# sourceMappingURL=maintenance.js.map

package/dist/core/maintenance.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"maintenance.js","sourceRoot":"","sources":["../../src/core/maintenance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACzH,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAA0B,MAAM,qBAAqB,CAAC;AAC/E,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,qBAAqB,EACrB,kBAAkB,GAEnB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,eAAe,EACf,cAAc,EACd,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,wBAAwB,GAEzB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AA0BzD;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAqB;IACtD,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO;QAAE,OAAO,CAAC,0CAA0C;IAEjF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;IAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAEnC,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;IACzE,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC1E,KAAK,CAAC,UAAU,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC9C,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK;QAAE,OAAO;IAEnC,IAAI,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;QACtB,GAAG,CAAC,sEAAsE,CAAC,CAAC;QAC5E,OAAO;IACT,CAAC;IACD,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QACnB,GAAG,CAAC,+DAA+D,CAAC,CAAC;QACrE,OAAO;IACT,CAAC;IAED,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE;YACvB,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;YAC/B,IAAI,CAAC,SAAS,EAAE,CAAC;YACjB,KAAK,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;YAC9B,IAAI,KAAK,KAAK,MAAM,IAAI,GAAG,CAAC,WAAW,EAAE,OAAO,EAAE,CAAC;gBACjD,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;gBAC7G,IAAI,CAAC;oBACH,IAAI,CAAC,cAAc,EAAE,CAAC;gBACxB,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,oEAAoE;oBACpE,iEAAiE;oBACjE,oEAAoE;oBACpE,mEAAmE;oBACnE,iEAAiE;oBACjE,aAAa,GAAG,IAAI,CAAC;oBACrB,GAAG,CAAC,0BAA0B,KAAK,wBAAwB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACnG,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,GAAG,CAAC,uBAAuB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACjE,OAAO;IACT,CAAC;IACD,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,GAAG,CAAC,4CAA4C,CAAC,CAAC;QAClD,OAAO;IACT,CAAC;IAED,iCAAiC;IACjC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,EAAE,CAAC;QAC9B,GAAG,CAAC,0BAA0B,KAAK,SAAS,MAAM,+CAA+C,CAAC,CAAC;IACrG,CAAC;SAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC1B,GAAG,CAAC,gBAAgB,MAAM,MAAM,KAAK,uBAAuB,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED,6DAA6D;AAE7D,MAAM,UAAU,GAAG,wBAAwB,CAAC;AAE5C,MAAM,UAAU,sBAAsB,CAAC,GAAW;IAChD,OAAO,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,GAAW;IAChD,MAAM,IAAI,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QAClD,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAqB,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,GAAW,EAAE,CAAmB;IACtE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IACzC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACtD,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACxB,CAAC;AAED,8BAA8B;AAE9B;2CAC2C;AAC3C,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAE1C;uEACuE;AACvE,MAAM,UAAU,yBAAyB;IACvC,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,yBAAyB,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB;IACpC,OAAO,OAAO,EAAE,CAAC;AACnB,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,uBAAuB,CAAC,OAA0B,wBAAwB,EAAE;IAC1F,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE;QAChD,GAAG,EAAE,sBAAsB,EAAE;QAC7B,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE;QACpC,KAAK,EAAE,SAAS;QAChB,KAAK,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,uCAAuC;KAC7E,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,KAAK;QAAE,MAAM,MAAM,CAAC,KAAK,CAAC;IACrC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,wBAAwB,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,IAAI,gBAAgB,EAAE,CAAC,CAAC;IAC/G,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,+BAA+B,CAAC,OAAe;IAC7D,2EAA2E;IAC3E,gDAAgD;IAChD,OAAO,IAAI,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,6BAA6B;IAC3C,OAAO,+BAA+B,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAY,EACZ,QAAgB,EAChB,SAAkB;IAElB,IAAI,SAAS;QAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;IAC3E,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,eAAkC,OAAO,CAAC,GAAG;IAC9E,MAAM,GAAG,GAAG,EAAE,GAAG,YAAY,EAAE,CAAC;IAChC,2EAA2E;IAC3E,iDAAiD;IACjD,EAAE;IACF,4EAA4E;IAC5E,6EAA6E;IAC7E,6EAA6E;IAC7E,+EAA+E;IAC/E,KAAK,MAAM,GAAG,IAAI;QAChB,mBAAmB;QACnB,gCAAgC;QAChC,uBAAuB;QACvB,uBAAuB;QACvB,6BAA6B;QAC7B,kCAAkC;QAClC,mBAAmB;KACpB;QAAE,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;IACnB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,eAAe;IACtB,IAAI,CAAC;QACH,QAAQ,CAAC,mBAAmB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAc,EACd,iBAA0B,EAC1B,cAAuB;IAEvB,MAAM,OAAO,GAAG,yBAAyB,EAAE,CAAC;IAC5C,IAAI,EAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC5B,SAAS,CAAC,EAAE,EAAE,MAAM,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,MAAM,uBAAuB,CAAC,CAAC;IAClF,CAAC;IAAC,MAAM,CAAC;QACP,EAAE,GAAG,SAAS,CAAC,CAAC,iEAAiE;IACnF,CAAC;IACD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,CAAC,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;IAC5F,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,oBAAoB,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC;IAC1F,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE;QAC7B,QAAQ,EAAE,IAAI;QACd,KAAK,EAAE,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ;QACvD,GAAG,EAAE;YACH,GAAG,kBAAkB,EAAE;YACvB,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;gBACnB,uBAAuB,EAAE,cAAc;gBACvC,wBAAwB,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO;aACjD,CAAC,CAAC,CAAC,EAAE,CAAC;SACR;QACD,8EAA8E;QAC9E,uEAAuE;QACvE,qFAAqF;QACrF,GAAG,EAAE,sBAAsB,EAAE;KAC9B,CAAC,CAAC;IACH,uEAAuE;IACvE,qDAAqD;IACrD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,wCAAwC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACrH,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;QACrB,IAAI,CAAC;YAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,0CAA0C,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc;IACrB,8EAA8E;IAC9E,qEAAqE;IACrE,qCAAqC;IACrC,IAAI,WAA0C,CAAC;IAC/C,OAAO;QACL,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;QACrB,UAAU,EAAE,GAAG,EAAE,CAAC,gBAAgB,EAAE,CAAC,WAAW;QAChD,SAAS,EAAE,GAAG,EAAE,CAAC,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;QAC/D,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QACrE,OAAO,EAAE,GAAG,EAAE,CAAC,aAAa,EAAE;QAC9B,UAAU,EAAE,GAAG,EAAE,CAAC,iBAAiB,EAAE;QACrC,cAAc,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,gBAAgB,CAAC,6BAA6B,EAAE,EAAE,GAAG,EAAE;YAC7E,IAAI,qBAAqB,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;YACxE,EAAE,EAAE,CAAC;QACP,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;QACtB,cAAc,EAAE,GAAG,EAAE,CAAC,WAAW;YAC/B,CAAC,CAAC,eAAe,CAAC,WAAW,CAAC,iBAAiB,CAAC;YAChD,CAAC,CAAC,aAAa,EAAE;QACnB,SAAS,EAAE,GAAG,EAAE;YACd,WAAW,KAAK,wBAAwB,EAAE,CAAC;YAC3C,uBAAuB,CAAC,WAAW,CAAC,CAAC;QACvC,CAAC;QACD,WAAW,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,kBAAkB,CAAC,MAAM,CAAC;QACnD,cAAc,EAAE,GAAG,EAAE;YACnB,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAC;YACpC,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;YACzD,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,oBAAoB,CAAC,aAAa,EAAE,WAAW,EAAE,iBAAiB,EAAE,OAAO,CAAC,CAAC;gBAC3F,IAAI,CAAC,KAAK,CAAC,GAAG;oBAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;YAClE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,iBAAiB,CAAC,OAAO,CAAC,CAAC;gBAC3B,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QACD,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,GAAG,EAAE,CAAC;KAClD,CAAC;AACJ,CAAC;AAED,IAAI,KAAiC,CAAC;AAEtC,2EAA2E;AAC3E,MAAM,UAAU,gBAAgB;IAC9B,IAAI,KAAK;QAAE,OAAO;IAClB,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,GAAG,EAAE;QAChB,IAAI,CAAC;YAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YAC3C,MAAM,CAAC,IAAI,CAAC,8BAA8B,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC,CAAC;IACF,oEAAoE;IACpE,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;IACnC,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;IAC/C,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAChB,MAAM,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,IAAI,KAAK,EAAE,CAAC;QAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAAC,KAAK,GAAG,SAAS,CAAC;IAAC,CAAC;AACzD,CAAC"}

package/dist/core/managed-origin-capability.d.ts

@@ -1,37 +0,0 @@
-export declare const RELAY_ORIGIN_CAPABILITY_BASENAME = ".botmux-origin-capability.json";
-export interface ManagedOriginCapabilityClaim {
-    sessionId: string;
-    capability: string;
-    turnId?: string;
-    dispatchAttempt?: number;
-}
-/**
- * Per-session path used by macOS read-isolated CLIs to read only their own
- * rotating daemon-IPC capability. Hashing keeps an untrusted session id out of
- * the path while still letting the worker and CLI derive the same filename.
- * The parent is denied wholesale by the Seatbelt profile; only this exact file
- * is carved back in for the owning session.
- */
-export declare function managedOriginCapabilityPath(dataDir: string, sessionId: string): string;
-/**
- * Atomically replace a capability file without following an attacker-planted
- * destination symlink. The generic atomic writer intentionally follows
- * symlinks for user-managed dotfiles; authority files need the opposite
- * contract so an isolated child cannot redirect the worker's next rotation.
- */
-export declare function replaceManagedOriginCapabilityFile(filePath: string, body: string): void;
-/**
- * Read the current origin claim from the per-session sandbox relay (Linux) or
- * the exact Seatbelt carve-out (macOS). A file is only transport: the daemon
- * still compares the token with its live worker registry, so stale files and
- * forged tuple fields never confer authority.
- */
-export declare function readManagedOriginCapability(dataDir: string, sessionId: string | undefined, relayDir?: string): ManagedOriginCapabilityClaim | null;
-/**
- * Verify that the child-visible capability transport contains the exact token
- * currently authorized by the worker. Existence alone is insufficient: a
- * writable relay can contain a stale token, malformed JSON, or even a directory
- * at the reserved path after a prior sandbox generation.
- */
-export declare function hasMatchingManagedOriginCapability(dataDir: string, sessionId: string | undefined, expectedCapability: string | undefined, relayDir?: string): boolean;
-//# sourceMappingURL=managed-origin-capability.d.ts.map

package/dist/core/managed-origin-capability.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"managed-origin-capability.d.ts","sourceRoot":"","sources":["../../src/core/managed-origin-capability.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,gCAAgC,mCAAmC,CAAC;AAEjF,MAAM,WAAW,4BAA4B;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAGtF;AAED;;;;;GAKG;AACH,wBAAgB,kCAAkC,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAiBvF;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,QAAQ,CAAC,EAAE,MAAM,GAChB,4BAA4B,GAAG,IAAI,CAwCrC;AAED;;;;;GAKG;AACH,wBAAgB,kCAAkC,CAChD,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,kBAAkB,EAAE,MAAM,GAAG,SAAS,EACtC,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAIT"}

package/dist/core/managed-origin-capability.js

@@ -1,100 +0,0 @@
-import { createHash, randomBytes } from 'node:crypto';
-import { lstatSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync, } from 'node:fs';
-import { dirname, join } from 'node:path';
-export const RELAY_ORIGIN_CAPABILITY_BASENAME = '.botmux-origin-capability.json';
-/**
- * Per-session path used by macOS read-isolated CLIs to read only their own
- * rotating daemon-IPC capability. Hashing keeps an untrusted session id out of
- * the path while still letting the worker and CLI derive the same filename.
- * The parent is denied wholesale by the Seatbelt profile; only this exact file
- * is carved back in for the owning session.
- */
-export function managedOriginCapabilityPath(dataDir, sessionId) {
-    const digest = createHash('sha256').update(sessionId).digest('hex');
-    return join(dataDir, 'read-isolation', `origin-${digest}.json`);
-}
-/**
- * Atomically replace a capability file without following an attacker-planted
- * destination symlink. The generic atomic writer intentionally follows
- * symlinks for user-managed dotfiles; authority files need the opposite
- * contract so an isolated child cannot redirect the worker's next rotation.
- */
-export function replaceManagedOriginCapabilityFile(filePath, body) {
-    const parent = dirname(filePath);
-    mkdirSync(parent, { recursive: true, mode: 0o700 });
-    const parentStat = lstatSync(parent);
-    if (!parentStat.isDirectory() || parentStat.isSymbolicLink()) {
-        throw new Error(`managed origin capability parent is not a real directory: ${parent}`);
-    }
-    const temp = `${filePath}.${process.pid}.${randomBytes(4).toString('hex')}.tmp`;
-    try {
-        writeFileSync(temp, body, { encoding: 'utf8', mode: 0o600, flag: 'wx' });
-        // rename replaces the destination directory entry itself; unlike opening
-        // filePath, it does not dereference an existing destination symlink.
-        renameSync(temp, filePath);
-    }
-    catch (error) {
-        try {
-            unlinkSync(temp);
-        }
-        catch { /* temp may not have been created */ }
-        throw error;
-    }
-}
-/**
- * Read the current origin claim from the per-session sandbox relay (Linux) or
- * the exact Seatbelt carve-out (macOS). A file is only transport: the daemon
- * still compares the token with its live worker registry, so stale files and
- * forged tuple fields never confer authority.
- */
-export function readManagedOriginCapability(dataDir, sessionId, relayDir) {
-    if (!sessionId)
-        return null;
-    const relay = !!relayDir;
-    const path = relay
-        ? join(relayDir, RELAY_ORIGIN_CAPABILITY_BASENAME)
-        : managedOriginCapabilityPath(dataDir, sessionId);
-    try {
-        const parsed = JSON.parse(readFileSync(path, 'utf8'));
-        if (!relay && parsed.sessionId !== sessionId)
-            return null;
-        const capability = typeof parsed.capability === 'string'
-            ? parsed.capability
-            : parsed.token;
-        if (typeof capability !== 'string' || !/^[a-f0-9]{32,128}$/i.test(capability)) {
-            return null;
-        }
-        const turnId = typeof parsed.turnId === 'string'
-            && parsed.turnId.length > 0
-            && parsed.turnId.length <= 256
-            ? parsed.turnId
-            : undefined;
-        const dispatchAttempt = typeof parsed.dispatchAttempt === 'number'
-            && Number.isSafeInteger(parsed.dispatchAttempt)
-            && parsed.dispatchAttempt > 0
-            ? parsed.dispatchAttempt
-            : undefined;
-        return {
-            sessionId,
-            capability,
-            ...(turnId ? { turnId } : {}),
-            ...(dispatchAttempt !== undefined ? { dispatchAttempt } : {}),
-        };
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Verify that the child-visible capability transport contains the exact token
- * currently authorized by the worker. Existence alone is insufficient: a
- * writable relay can contain a stale token, malformed JSON, or even a directory
- * at the reserved path after a prior sandbox generation.
- */
-export function hasMatchingManagedOriginCapability(dataDir, sessionId, expectedCapability, relayDir) {
-    if (!expectedCapability)
-        return false;
-    return readManagedOriginCapability(dataDir, sessionId, relayDir)?.capability
-        === expectedCapability;
-}
-//# sourceMappingURL=managed-origin-capability.js.map

package/dist/core/managed-origin-capability.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"managed-origin-capability.js","sourceRoot":"","sources":["../../src/core/managed-origin-capability.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EACL,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,GAC1E,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,MAAM,CAAC,MAAM,gCAAgC,GAAG,gCAAgC,CAAC;AASjF;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CAAC,OAAe,EAAE,SAAiB;IAC5E,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpE,OAAO,IAAI,CAAC,OAAO,EAAE,gBAAgB,EAAE,UAAU,MAAM,OAAO,CAAC,CAAC;AAClE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kCAAkC,CAAC,QAAgB,EAAE,IAAY;IAC/E,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,IAAI,UAAU,CAAC,cAAc,EAAE,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,6DAA6D,MAAM,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,QAAQ,IAAI,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;IAChF,IAAI,CAAC;QACH,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACzE,yEAAyE;QACzE,qEAAqE;QACrE,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC;YAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,oCAAoC,CAAC,CAAC;QACxE,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CACzC,OAAe,EACf,SAA6B,EAC7B,QAAiB;IAEjB,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,KAAK,GAAG,CAAC,CAAC,QAAQ,CAAC;IACzB,MAAM,IAAI,GAAG,KAAK;QAChB,CAAC,CAAC,IAAI,CAAC,QAAS,EAAE,gCAAgC,CAAC;QACnD,CAAC,CAAC,2BAA2B,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACpD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAMnD,CAAC;QACF,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QAC1D,MAAM,UAAU,GAAG,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ;YACtD,CAAC,CAAC,MAAM,CAAC,UAAU;YACnB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QACjB,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9E,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;eAC3C,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;eACxB,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,GAAG;YAC9B,CAAC,CAAC,MAAM,CAAC,MAAM;YACf,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,eAAe,GAAG,OAAO,MAAM,CAAC,eAAe,KAAK,QAAQ;eAC7D,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,eAAe,CAAC;eAC5C,MAAM,CAAC,eAAe,GAAG,CAAC;YAC7B,CAAC,CAAC,MAAM,CAAC,eAAe;YACxB,CAAC,CAAC,SAAS,CAAC;QACd,OAAO;YACL,SAAS;YACT,UAAU;YACV,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7B,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9D,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kCAAkC,CAChD,OAAe,EACf,SAA6B,EAC7B,kBAAsC,EACtC,QAAiB;IAEjB,IAAI,CAAC,kBAAkB;QAAE,OAAO,KAAK,CAAC;IACtC,OAAO,2BAA2B,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,UAAU;YACtE,kBAAkB,CAAC;AAC3B,CAAC"}

package/dist/core/passthrough-commands.d.ts

@@ -1,56 +0,0 @@
-/**
- * Passthrough / daemon command sets — extracted into a leaf module so both the
- * command router ({@link ../core/command-handler.js}) and the `/botconfig` config
- * store ({@link ../services/bot-config-store.js}) can share the normalization
- * without a circular import (command-handler already imports the config store).
- */
-/**
- * Slash commands handled by the daemon itself (open a conversation / act on the
- * chat) rather than relayed to the CLI. Used both for routing and to reject
- * `customPassthroughCommands` entries that would shadow a daemon command.
- */
-export declare const DAEMON_COMMANDS: Set<string>;
-/**
- * Slash commands that are forwarded verbatim to the underlying CLI (e.g.
- * Claude Code's `/compact`, `/model`, `/usage`). The daemon does NOT handle
- * these — it just relays them to the worker via a raw_input IPC message,
- * bypassing the normal prompt-wrapping and bracketed-paste path so the CLI's
- * own slash-command parser sees them.
- */
-export declare const PASSTHROUGH_COMMANDS: Set<string>;
-/**
- * Shape of a slash-command token: leading `/`, an alphanumeric first char, then
- * `[a-z0-9:_-]`. Shared by passthrough normalization AND the grant-restriction
- * gate ({@link ../daemon.js}'s `grantRestrictedSlashCommandText`) so a custom
- * passthrough command can't slip past the restriction check via a shape one
- * recognizes but the other doesn't (e.g. `/foo:bar`, `/1cmd` — colon / leading
- * digit). Keep the two in lockstep: anything passthrough accepts must also be
- * recognized as a command by the restriction gate.
- */
-export declare const SLASH_COMMAND_SHAPE: RegExp;
-/**
- * Normalize a single custom passthrough command: lowercase, must match the
- * slash-command shape, and must not shadow a daemon command (passthrough is
- * checked BEFORE DAEMON_COMMANDS in the router). Returns null for anything that
- * doesn't qualify. Does NOT prepend the leading `/` — callers that accept bare
- * user input should add it first (see {@link parseCustomPassthroughInput}).
- */
-export declare function normalizePassthroughCommand(cmd: unknown): string | null;
-/**
- * Parse free-text dashboard / `/botconfig` input (comma, space or newline
- * separated) into a normalized, deduped custom passthrough command list. The
- * leading `/` is optional per token (so users can type `goal export` or
- * `/goal, /export`); illegal and daemon-shadowing tokens are dropped. Mirrors
- * the normalization {@link ../bot-registry.js}'s parseBotConfigsFromText applies
- * when loading bots.json, so a round-trip through the card is stable.
- */
-export declare function parseCustomPassthroughInput(raw: string): string[];
-/**
- * Parse free-text input for `canTalkDaemonCommands` — the inverse filter of
- * {@link parseCustomPassthroughInput}: after the same normalization (lowercase,
- * auto `/`), keep ONLY entries that ARE daemon commands. The default stringList
- * parser (parseCustomPassthroughInput) rejects every daemon command, so wiring
- * it to this field would silently drop all valid input.
- */
-export declare function parseCanTalkDaemonCommandsInput(raw: string): string[];
-//# sourceMappingURL=passthrough-commands.d.ts.map

package/dist/core/passthrough-commands.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"passthrough-commands.d.ts","sourceRoot":"","sources":["../../src/core/passthrough-commands.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;;GAIG;AACH,eAAO,MAAM,eAAe,aAAqY,CAAC;AAEla;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,aAgC/B,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,QAA6B,CAAC;AAE9D;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAMvE;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAUjE;AAED;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CASrE"}