botmux 3.5.2 → 3.6.0

package/dist/utils/allowed-users-apply.js

@@ -0,0 +1,123 @@
+/**
+ * Decide how to apply a startup / refresh resolve of allowedUsers.
+ *
+ * Runtime permission (canTalk/canOperate) only matches app-scoped open_ids
+ * (`ou_…`). Config may store stable `on_…` / emails that must be resolved each
+ * boot. A transient contact API failure used to overwrite the runtime list with
+ * `[]`, which fail-closed locks out even the real owner with almost no signal.
+ *
+ * This module merges the fresh resolve with a last-known-good `raw → ou_` cache,
+ * but ONLY per-entry and ONLY when that entry both (a) transient-failed this
+ * pass and (b) is still present in the current raw config. That guards against
+ * two revival hazards a bare `ou_[]` fallback list would create:
+ *   - config swaps owner `on_old → on_new`, contact API blips → `ou_old` would
+ *     be resurrected from cache even though the operator removed it;
+ *   - an owner is definitively removed from the tenant (errored=false,
+ *     resolved=[]) → they would be revived indefinitely.
+ * The cache is keyed by raw entry, so an entry no longer in config, or one that
+ * resolved definitively-gone, is never reused.
+ */
+/** Config entries that require a contact resolve (email / union / literal ou_). */
+function needsContactResolve(rawEntries) {
+    return rawEntries.some(u => u.includes('@') || u.startsWith('on_') || u.startsWith('ou_'));
+}
+function entryStatusOf(status, entry) {
+    // Absent → definitive: never revive an entry the resolver did not explicitly
+    // flag as transient. Safer to drop than to resurrect a stale grant.
+    return status?.get(entry) ?? 'definitive';
+}
+/**
+ * Pure merge of a fresh resolve result + a last-known-good `raw → ou_` cache.
+ *
+ * Walk raw config in order. For each entry:
+ *   - fresh `ou_` from this resolve → use it (authoritative);
+ *   - else if this entry transient-failed AND has a cached `ou_` → reuse cache
+ *     (marks usedFallback + failed);
+ *   - else (definitive miss / no cache / non-resolvable literal) → drop it.
+ * Never leaves bare `on_` / emails in the runtime list — those cannot match
+ * message senders and would still lock the owner out. Output `map` mirrors the
+ * chosen `resolved` set so downstream `/revoke` + sidecar stay consistent.
+ */
+export function applyAllowedUsersResolve(input) {
+    const rawEntries = input.rawEntries.filter(u => typeof u === 'string' && u.trim().length > 0);
+    const prevMap = input.previousResolvedMap ?? {};
+    const { map: freshMap, errored, entryStatus } = input.resolveResult;
+    if (rawEntries.length === 0) {
+        return { resolved: [], map: new Map(), usedFallback: false, failed: false, notice: null };
+    }
+    const outMap = new Map();
+    const resolved = [];
+    const seen = new Set();
+    let usedFallback = false;
+    let transientMissWithoutCache = false;
+    const recoveredEntries = [];
+    const push = (rawEntry, oid) => {
+        if (!oid.startsWith('ou_'))
+            return;
+        outMap.set(rawEntry, oid);
+        if (!seen.has(oid)) {
+            seen.add(oid);
+            resolved.push(oid);
+        }
+    };
+    for (const entry of rawEntries) {
+        const fresh = freshMap.get(entry);
+        if (fresh && fresh.startsWith('ou_')) {
+            push(entry, fresh);
+            continue;
+        }
+        // No fresh ou_. Only reuse cache if this entry TRANSIENT-failed this pass —
+        // a definitive miss (removed / invalid / swapped out) must not be revived.
+        if (entryStatusOf(entryStatus, entry) === 'transient') {
+            const cached = prevMap[entry];
+            if (typeof cached === 'string' && cached.startsWith('ou_')) {
+                push(entry, cached);
+                usedFallback = true;
+                recoveredEntries.push(entry);
+            }
+            else {
+                transientMissWithoutCache = true;
+            }
+        }
+        // definitive / resolved-without-ou_ / non-resolvable literal → drop entry.
+    }
+    // A resolve is "healthy" only when nothing transient-failed. Definitive
+    // drops (removed owners) are expected and do NOT mark failed — the config
+    // is simply reflecting reality; there is nothing to retry.
+    const anyTransient = rawEntries.some(e => entryStatusOf(entryStatus, e) === 'transient');
+    const failed = !!errored || anyTransient;
+    if (!failed) {
+        // Clean pass. resolved may still be empty here if config holds only
+        // definitively-gone / non-resolvable entries — that is a legitimate empty
+        // allowlist, not a fallback situation. Non-resolvable-only configs (no
+        // contact entries) also land here with no notice.
+        return { resolved, map: outMap, usedFallback: false, failed: false, notice: null };
+    }
+    // Degraded pass (something transient-failed). Build an operator-facing notice.
+    let notice;
+    if (resolved.length > 0 && usedFallback) {
+        notice =
+            `allowedUsers resolve degraded: contact API transiently failed for ` +
+                `${recoveredEntries.length} entr${recoveredEntries.length === 1 ? 'y' : 'ies'} ` +
+                `(${recoveredEntries.join(', ')}); reused last-known ou_ from cache so owner talk keeps working. ` +
+                `Retrying automatically; restart after Feishu contact recovers if needed.`;
+    }
+    else if (resolved.length > 0) {
+        notice =
+            `allowedUsers resolve degraded: some entries transiently failed but ` +
+                `${resolved.length} open_id(s) resolved/recovered. Raw entries: ${rawEntries.join(', ')}. Retrying.`;
+    }
+    else if (transientMissWithoutCache || needsContactResolve(rawEntries)) {
+        notice =
+            `allowedUsers resolve failed: contact API unavailable and no last-known ou_ cache for the ` +
+                `affected entr${recoveredEntries.length === 1 ? 'y' : 'ies'}; runtime allowlist is empty so ` +
+                `everyone (including the real owner) is denied. Raw entries: ${rawEntries.join(', ')}. ` +
+                `Check Feishu contact API / bot scopes; retrying automatically.`;
+    }
+    else {
+        notice =
+            `allowedUsers resolve degraded; runtime allowlist is empty. Raw entries: ${rawEntries.join(', ')}.`;
+    }
+    return { resolved, map: outMap, usedFallback, failed: true, notice };
+}
+//# sourceMappingURL=allowed-users-apply.js.map

package/dist/utils/allowed-users-apply.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"allowed-users-apply.js","sourceRoot":"","sources":["../../src/utils/allowed-users-apply.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAiDH,mFAAmF;AACnF,SAAS,mBAAmB,CAAC,UAAoB;IAC/C,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7F,CAAC;AAED,SAAS,aAAa,CACpB,MAAmD,EACnD,KAAa;IAEb,6EAA6E;IAC7E,oEAAoE;IACpE,OAAO,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,wBAAwB,CACtC,KAAoC;IAEpC,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC9F,MAAM,OAAO,GAAG,KAAK,CAAC,mBAAmB,IAAI,EAAE,CAAC;IAChD,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC,aAAa,CAAC;IAEpE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,GAAG,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC5F,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,yBAAyB,GAAG,KAAK,CAAC;IACtC,MAAM,gBAAgB,GAAa,EAAE,CAAC;IAEtC,MAAM,IAAI,GAAG,CAAC,QAAgB,EAAE,GAAW,EAAE,EAAE;QAC7C,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,OAAO;QACnC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC1B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;IACH,CAAC,CAAC;IAEF,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YACrC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YACnB,SAAS;QACX,CAAC;QACD,4EAA4E;QAC5E,2EAA2E;QAC3E,IAAI,aAAa,CAAC,WAAW,EAAE,KAAK,CAAC,KAAK,WAAW,EAAE,CAAC;YACtD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;YAC9B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3D,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;gBACpB,YAAY,GAAG,IAAI,CAAC;gBACpB,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC/B,CAAC;iBAAM,CAAC;gBACN,yBAAyB,GAAG,IAAI,CAAC;YACnC,CAAC;QACH,CAAC;QACD,2EAA2E;IAC7E,CAAC;IAED,wEAAwE;IACxE,0EAA0E;IAC1E,2DAA2D;IAC3D,MAAM,YAAY,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,CAAC,CAAC,KAAK,WAAW,CAAC,CAAC;IACzF,MAAM,MAAM,GAAG,CAAC,CAAC,OAAO,IAAI,YAAY,CAAC;IAEzC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,oEAAoE;QACpE,0EAA0E;QAC1E,uEAAuE;QACvE,kDAAkD;QAClD,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACrF,CAAC;IAED,+EAA+E;IAC/E,IAAI,MAAc,CAAC;IACnB,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,YAAY,EAAE,CAAC;QACxC,MAAM;YACJ,oEAAoE;gBACpE,GAAG,gBAAgB,CAAC,MAAM,QAAQ,gBAAgB,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG;gBAChF,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,mEAAmE;gBAClG,0EAA0E,CAAC;IAC/E,CAAC;SAAM,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM;YACJ,qEAAqE;gBACrE,GAAG,QAAQ,CAAC,MAAM,gDAAgD,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;IACzG,CAAC;SAAM,IAAI,yBAAyB,IAAI,mBAAmB,CAAC,UAAU,CAAC,EAAE,CAAC;QACxE,MAAM;YACJ,2FAA2F;gBAC3F,gBAAgB,gBAAgB,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,kCAAkC;gBAC7F,+DAA+D,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;gBACxF,gEAAgE,CAAC;IACrE,CAAC;SAAM,CAAC;QACN,MAAM;YACJ,2EAA2E,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IACxG,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACvE,CAAC"}

package/dist/utils/allowed-users-cache.d.ts

@@ -0,0 +1,29 @@
+export declare function allowedUsersCachePath(dataDir: string, larkAppId: string): string;
+/** Read the persisted `raw → ou_` cache (ou_ values only). `{}` on any error. */
+export declare function readAllowedUsersResolveCache(dataDir: string, larkAppId: string): Record<string, string>;
+export interface WriteAllowedUsersCacheOpts {
+    /**
+     * Fresh `raw → ou_` pairs to upsert (only ou_ values are kept). Callers pass
+     * the resolve/mutation result map.
+     */
+    map: Map<string, string> | Record<string, string>;
+    /**
+     * Entries to delete from the cache regardless of `map` — e.g. definitively-gone
+     * ids (removed from tenant) or a raw entry just revoked. Pruned so a later
+     * restart during an API blip can't mark them transient and revive a stale owner.
+     */
+    deleteEntries?: Iterable<string>;
+    /**
+     * When provided, the cache is pruned to ONLY these raw keys (plus whatever
+     * `map` upserts). Pass the current raw allowedUsers config so keys no longer
+     * configured (owner swap) never linger. Omit to merge without pruning.
+     */
+    retainKeys?: Iterable<string>;
+}
+/**
+ * Persist the `raw → ou_` cache. Merges `map` over the existing cache, deletes
+ * `deleteEntries`, and — when `retainKeys` is given — drops every key not in
+ * that set. Best-effort; never throws.
+ */
+export declare function writeAllowedUsersResolveCache(dataDir: string, larkAppId: string, opts: WriteAllowedUsersCacheOpts): void;
+//# sourceMappingURL=allowed-users-cache.d.ts.map

package/dist/utils/allowed-users-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"allowed-users-cache.d.ts","sourceRoot":"","sources":["../../src/utils/allowed-users-cache.ts"],"names":[],"mappings":"AAsBA,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAEhF;AAED,iFAAiF;AACjF,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAevG;AAED,MAAM,WAAW,0BAA0B;IACzC;;;OAGG;IACH,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClD;;;;OAIG;IACH,aAAa,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjC;;;;OAIG;IACH,UAAU,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;CAC/B;AAED;;;;GAIG;AACH,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,0BAA0B,GAC/B,IAAI,CA+BN"}

package/dist/utils/allowed-users-cache.js

@@ -0,0 +1,82 @@
+/**
+ * Persistent last-known-good `raw entry → ou_` cache for allowedUsers.
+ *
+ * This is DELIBERATELY NOT the dashboard descriptor: that descriptor is
+ * (a) overwritten unconditionally early in daemon boot with the still-unresolved
+ * raw config (so its `resolvedAllowedUsers` is `[]` for an on_/email-only owner),
+ * and (b) deleted on every clean shutdown. Reading it as a fallback source is
+ * dead-on-arrival for the transient-failure-on-restart scenario this cache
+ * exists to survive. This sidecar lives in the persistent data dir, is written
+ * whenever a healthy/partial resolve or a hot config/grant mutation produces a
+ * fresh `raw → ou_` mapping, and is never deleted on shutdown.
+ *
+ * Keyed by raw config entry so recovery is per-entry: an entry removed from
+ * config (owner swap / revoke) or definitively gone is never revived. Both the
+ * daemon startup/retry path and the runtime set/revoke paths write through here
+ * so the cache never diverges from the live allowlist.
+ */
+import { readFileSync, existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { atomicWriteFileSync } from './atomic-write.js';
+import { logger } from './logger.js';
+export function allowedUsersCachePath(dataDir, larkAppId) {
+    return join(dataDir, `allowed-users-cache-${larkAppId}.json`);
+}
+/** Read the persisted `raw → ou_` cache (ou_ values only). `{}` on any error. */
+export function readAllowedUsersResolveCache(dataDir, larkAppId) {
+    try {
+        const fp = allowedUsersCachePath(dataDir, larkAppId);
+        if (!existsSync(fp))
+            return {};
+        const raw = JSON.parse(readFileSync(fp, 'utf8'));
+        const m = raw?.map;
+        if (!m || typeof m !== 'object' || Array.isArray(m))
+            return {};
+        const out = {};
+        for (const [k, v] of Object.entries(m)) {
+            if (typeof k === 'string' && typeof v === 'string' && v.startsWith('ou_'))
+                out[k] = v;
+        }
+        return out;
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * Persist the `raw → ou_` cache. Merges `map` over the existing cache, deletes
+ * `deleteEntries`, and — when `retainKeys` is given — drops every key not in
+ * that set. Best-effort; never throws.
+ */
+export function writeAllowedUsersResolveCache(dataDir, larkAppId, opts) {
+    try {
+        let merged = readAllowedUsersResolveCache(dataDir, larkAppId);
+        if (opts.retainKeys) {
+            const keep = new Set();
+            for (const k of opts.retainKeys)
+                if (typeof k === 'string')
+                    keep.add(k);
+            const pruned = {};
+            for (const [k, v] of Object.entries(merged))
+                if (keep.has(k))
+                    pruned[k] = v;
+            merged = pruned;
+        }
+        for (const e of opts.deleteEntries ?? []) {
+            if (typeof e === 'string')
+                delete merged[e];
+        }
+        const entries = opts.map instanceof Map
+            ? opts.map.entries()
+            : Object.entries(opts.map);
+        for (const [k, v] of entries) {
+            if (typeof k === 'string' && typeof v === 'string' && v.startsWith('ou_'))
+                merged[k] = v;
+        }
+        atomicWriteFileSync(allowedUsersCachePath(dataDir, larkAppId), JSON.stringify({ map: merged, updatedAt: Date.now() }), { mode: 0o600 });
+    }
+    catch (err) {
+        logger.debug(`[${larkAppId}] failed to persist allowedUsers cache: ${err?.message ?? err}`);
+    }
+}
+//# sourceMappingURL=allowed-users-cache.js.map

package/dist/utils/allowed-users-cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"allowed-users-cache.js","sourceRoot":"","sources":["../../src/utils/allowed-users-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,MAAM,UAAU,qBAAqB,CAAC,OAAe,EAAE,SAAiB;IACtE,OAAO,IAAI,CAAC,OAAO,EAAE,uBAAuB,SAAS,OAAO,CAAC,CAAC;AAChE,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,4BAA4B,CAAC,OAAe,EAAE,SAAiB;IAC7E,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,qBAAqB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACrD,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAAE,OAAO,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAsB,CAAC;QACtE,MAAM,CAAC,GAAG,GAAG,EAAE,GAAG,CAAC;QACnB,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAAE,OAAO,EAAE,CAAC;QAC/D,MAAM,GAAG,GAA2B,EAAE,CAAC;QACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAA4B,CAAC,EAAE,CAAC;YAClE,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC;gBAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACxF,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAsBD;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAC3C,OAAe,EACf,SAAiB,EACjB,IAAgC;IAEhC,IAAI,CAAC;QACH,IAAI,MAAM,GAAG,4BAA4B,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAE9D,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;YAC/B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,UAAU;gBAAE,IAAI,OAAO,CAAC,KAAK,QAAQ;oBAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACxE,MAAM,MAAM,GAA2B,EAAE,CAAC;YAC1C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;gBAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;oBAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAC5E,MAAM,GAAG,MAAM,CAAC;QAClB,CAAC;QAED,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,aAAa,IAAI,EAAE,EAAE,CAAC;YACzC,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;QAC9C,CAAC;QAED,MAAM,OAAO,GAA+B,IAAI,CAAC,GAAG,YAAY,GAAG;YACjE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE;YACpB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC;gBAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC3F,CAAC;QAED,mBAAmB,CACjB,qBAAqB,CAAC,OAAO,EAAE,SAAS,CAAC,EACzC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,EACtD,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;IACJ,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,MAAM,CAAC,KAAK,CAAC,IAAI,SAAS,2CAA2C,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,CAAC,CAAC;IAC9F,CAAC;AACH,CAAC"}

package/dist/utils/child-env.d.ts

@@ -77,7 +77,8 @@ export declare const BOTMUX_INJECTED_ENV_KEYS: readonly ["__OWNER_OPEN_ID", "BOT
 /** Proxy env vars that must reach the CLI child process so it can dial the
  *  upstream API on hosts without direct internet access. Forwarded explicitly
  *  by buildBotmuxEnvAssignments (tmux/tmux-pipe/zellij backends) and
- *  prepareSandbox (bwrap); the pty backend inherits them via the full child env.
+ *  prepareDirectSandbox (bwrap --setenv); the pty backend inherits them via the
+ *  full child env.
  *  Deliberately NOT in BOTMUX_INJECTED_ENV_KEYS: that list drives tmuxEnv()
  *  stripping and scrubTmuxServerGlobalEnv() cleanup — adding proxy keys there
  *  would delete the user's own tmux server proxy config. */

package/dist/utils/child-env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"child-env.d.ts","sourceRoot":"","sources":["../../src/utils/child-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,uBAAuB,4GAiB1B,CAAC;AAEX;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,yBAAyB,8CAA+C,CAAC;AAEtF;;;iBAGiB;AACjB,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,IAAI,CAEnE;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,wBAAwB,qpBA+C3B,CAAC;AAEX;;;;;;4DAM4D;AAC5D,eAAO,MAAM,cAAc,uHAGjB,CAAC;AAsBX;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED;;;;;GAKG;AACH,wBAAgB,qCAAqC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAE1E;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAIzE"}
+{"version":3,"file":"child-env.d.ts","sourceRoot":"","sources":["../../src/utils/child-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,uBAAuB,4GAiB1B,CAAC;AAEX;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,yBAAyB,8CAA+C,CAAC;AAEtF;;;iBAGiB;AACjB,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,IAAI,CAEnE;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,wBAAwB,qpBA+C3B,CAAC;AAEX;;;;;;;4DAO4D;AAC5D,eAAO,MAAM,cAAc,uHAGjB,CAAC;AAsBX;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED;;;;;GAKG;AACH,wBAAgB,qCAAqC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAE1E;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAIzE"}

package/dist/utils/child-env.js

@@ -144,7 +144,8 @@ export const BOTMUX_INJECTED_ENV_KEYS = [
 /** Proxy env vars that must reach the CLI child process so it can dial the
  *  upstream API on hosts without direct internet access. Forwarded explicitly
  *  by buildBotmuxEnvAssignments (tmux/tmux-pipe/zellij backends) and
- *  prepareSandbox (bwrap); the pty backend inherits them via the full child env.
+ *  prepareDirectSandbox (bwrap --setenv); the pty backend inherits them via the
+ *  full child env.
  *  Deliberately NOT in BOTMUX_INJECTED_ENV_KEYS: that list drives tmuxEnv()
  *  stripping and scrubTmuxServerGlobalEnv() cleanup — adding proxy keys there
  *  would delete the user's own tmux server proxy config. */

package/dist/utils/child-env.js.map

@@ -1 +1 @@
-{"version":3,"file":"child-env.js","sourceRoot":"","sources":["../../src/utils/child-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,aAAa;IACb,iBAAiB;IACjB,cAAc;IACd,UAAU;IACV,YAAY;IACZ,4EAA4E;IAC5E,8EAA8E;IAC9E,+EAA+E;IAC/E,+EAA+E;IAC/E,4EAA4E;IAC5E,2EAA2E;IAC3E,gFAAgF;IAChF,6EAA6E;IAC7E,mEAAmE;IACnE,MAAM;IACN,WAAW;CACH,CAAC;AAEX;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,mBAAmB,EAAE,YAAY,CAAU,CAAC;AAEtF;;;iBAGiB;AACjB,MAAM,UAAU,sBAAsB,CAAC,GAAsB;IAC3D,KAAK,MAAM,GAAG,IAAI,yBAAyB;QAAE,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,iBAAiB;IACjB,QAAQ;IACR,kBAAkB;IAClB,YAAY;IACZ,wEAAwE;IACxE,mEAAmE;IACnE,mBAAmB;IACnB,gBAAgB;IAChB,0EAA0E;IAC1E,wEAAwE;IACxE,wCAAwC;IACxC,2BAA2B;IAC3B,6BAA6B;IAC7B,qEAAqE;IACrE,kBAAkB;IAClB,oBAAoB;IACpB,wBAAwB;IACxB,sEAAsE;IACtE,2EAA2E;IAC3E,sBAAsB;IACtB,gBAAgB;IAChB,yBAAyB;IACzB,0EAA0E;IAC1E,sDAAsD;IACtD,oBAAoB;IACpB,4EAA4E;IAC5E,+BAA+B;IAC/B,4EAA4E;IAC5E,uEAAuE;IACvE,yEAAyE;IACzE,6EAA6E;IAC7E,wBAAwB;IACxB,2EAA2E;IAC3E,mCAAmC;IACnC,sCAAsC;IACtC,sBAAsB;IACtB,qEAAqE;IACrE,aAAa;IACb,2BAA2B;IAC3B,6BAA6B;IAC7B,gDAAgD;IAChD,mBAAmB;IACnB,YAAY;IACZ,wDAAwD;IACxD,oCAAoC;IACpC,mBAAmB;CACX,CAAC;AAEX;;;;;;4DAM4D;AAC5D,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa;IACxD,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW;CACxC,CAAC;AAEX,MAAM,sBAAsB,GAAwB,IAAI,GAAG,CAAC;IAC1D,GAAG,wBAAwB;IAC3B,GAAG,uBAAuB;IAC1B,uEAAuE;IACvE,uEAAuE;IACvE,yEAAyE;IACzE,wEAAwE;IACxE,yEAAyE;IACzE,4EAA4E;IAC5E,6BAA6B;IAC7B,GAAG,cAAc;CAClB,CAAC,CAAC;AAEH,MAAM,6BAA6B,GAAwB,IAAI,GAAG,CAAC;IACjE,GAAG,wBAAwB;IAC3B,aAAa;IACb,iBAAiB;IACjB,YAAY;CACb,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,GAAW;IACnD,OAAO,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,sBAAsB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACrE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qCAAqC,CAAC,GAAW;IAC/D,OAAO,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,6BAA6B,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,cAAc,CAAC,IAAuB;IACpD,MAAM,GAAG,GAAsB,EAAE,GAAG,IAAI,EAAE,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,uBAAuB;QAAE,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3D,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"child-env.js","sourceRoot":"","sources":["../../src/utils/child-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,aAAa;IACb,iBAAiB;IACjB,cAAc;IACd,UAAU;IACV,YAAY;IACZ,4EAA4E;IAC5E,8EAA8E;IAC9E,+EAA+E;IAC/E,+EAA+E;IAC/E,4EAA4E;IAC5E,2EAA2E;IAC3E,gFAAgF;IAChF,6EAA6E;IAC7E,mEAAmE;IACnE,MAAM;IACN,WAAW;CACH,CAAC;AAEX;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,mBAAmB,EAAE,YAAY,CAAU,CAAC;AAEtF;;;iBAGiB;AACjB,MAAM,UAAU,sBAAsB,CAAC,GAAsB;IAC3D,KAAK,MAAM,GAAG,IAAI,yBAAyB;QAAE,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,iBAAiB;IACjB,QAAQ;IACR,kBAAkB;IAClB,YAAY;IACZ,wEAAwE;IACxE,mEAAmE;IACnE,mBAAmB;IACnB,gBAAgB;IAChB,0EAA0E;IAC1E,wEAAwE;IACxE,wCAAwC;IACxC,2BAA2B;IAC3B,6BAA6B;IAC7B,qEAAqE;IACrE,kBAAkB;IAClB,oBAAoB;IACpB,wBAAwB;IACxB,sEAAsE;IACtE,2EAA2E;IAC3E,sBAAsB;IACtB,gBAAgB;IAChB,yBAAyB;IACzB,0EAA0E;IAC1E,sDAAsD;IACtD,oBAAoB;IACpB,4EAA4E;IAC5E,+BAA+B;IAC/B,4EAA4E;IAC5E,uEAAuE;IACvE,yEAAyE;IACzE,6EAA6E;IAC7E,wBAAwB;IACxB,2EAA2E;IAC3E,mCAAmC;IACnC,sCAAsC;IACtC,sBAAsB;IACtB,qEAAqE;IACrE,aAAa;IACb,2BAA2B;IAC3B,6BAA6B;IAC7B,gDAAgD;IAChD,mBAAmB;IACnB,YAAY;IACZ,wDAAwD;IACxD,oCAAoC;IACpC,mBAAmB;CACX,CAAC;AAEX;;;;;;;4DAO4D;AAC5D,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa;IACxD,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW;CACxC,CAAC;AAEX,MAAM,sBAAsB,GAAwB,IAAI,GAAG,CAAC;IAC1D,GAAG,wBAAwB;IAC3B,GAAG,uBAAuB;IAC1B,uEAAuE;IACvE,uEAAuE;IACvE,yEAAyE;IACzE,wEAAwE;IACxE,yEAAyE;IACzE,4EAA4E;IAC5E,6BAA6B;IAC7B,GAAG,cAAc;CAClB,CAAC,CAAC;AAEH,MAAM,6BAA6B,GAAwB,IAAI,GAAG,CAAC;IACjE,GAAG,wBAAwB;IAC3B,aAAa;IACb,iBAAiB;IACjB,YAAY;CACb,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,GAAW;IACnD,OAAO,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,sBAAsB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACrE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qCAAqC,CAAC,GAAW;IAC/D,OAAO,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,6BAA6B,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,cAAc,CAAC,IAAuB;IACpD,MAAM,GAAG,GAAsB,EAAE,GAAG,IAAI,EAAE,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,uBAAuB;QAAE,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3D,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/utils/cli-usage-limit.d.ts

@@ -10,6 +10,32 @@ export interface CliUsageLimitNotDetected {
     limited: false;
 }
 export type CliUsageLimitDetection = CliUsageLimitState | CliUsageLimitNotDetected;
-export declare function detectCliUsageLimit(text: string, now?: Date): CliUsageLimitDetection;
+export declare const HARD_RATE_LIMIT_COOLDOWN_MS: number;
+export interface DetectUsageLimitOptions {
+    /**
+     * Suppress the screen-scan `rate` verdict entirely. Set for CLIs that have an
+     * authoritative structured rate-limit signal (Claude family via transcript
+     * `error:"rate_limit"`): there, scraping the screen for "429" / "rate limit"
+     * only produces false positives (the model's own output, or a dev editing
+     * rate-limit code, puts those phrases on screen). `usage` quota detection is
+     * unaffected — it has no structured equivalent yet.
+     */
+    suppressRateKind?: boolean;
+}
+export declare function detectCliUsageLimit(text: string, now?: Date, opts?: DetectUsageLimitOptions): CliUsageLimitDetection;
 export declare function usageLimitStateKey(state: CliUsageLimitState): string;
+/**
+ * Build a rate-limit state from a STRUCTURED signal (e.g. Claude Code's
+ * transcript `error: "rate_limit"` record) instead of screen text.
+ *
+ * The caller has already decided this IS a rate limit via a machine field, so
+ * unlike detectCliUsageLimit() there is no pattern gate here — we only need to
+ * fix the retry time. Claude's rate-limit records usually carry a human clock
+ * in their text ("You've hit your session limit · resets 10:40pm"); when
+ * `text` yields a parseable time we honor it (accurate retry_ready flip),
+ * otherwise we reuse the same wall-clock-bucketed fallback the screen-text
+ * hard-429 path uses so the usageLimitStateKey stays stable across repeated
+ * ticks within a bucket (no persist/timer churn on the daemon side).
+ */
+export declare function structuredRateLimitState(text?: string, now?: Date): CliUsageLimitState;
 //# sourceMappingURL=cli-usage-limit.d.ts.map

package/dist/utils/cli-usage-limit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-usage-limit.d.ts","sourceRoot":"","sources":["../../src/utils/cli-usage-limit.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG,MAAM,CAAC;AAEjD,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,IAAI,CAAC;IACd,IAAI,EAAE,iBAAiB,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,KAAK,CAAC;CAChB;AAED,MAAM,MAAM,sBAAsB,GAAG,kBAAkB,GAAG,wBAAwB,CAAC;AAuDnF,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAa,GAAG,sBAAsB,CAwB1F;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,kBAAkB,GAAG,MAAM,CAEpE"}
+{"version":3,"file":"cli-usage-limit.d.ts","sourceRoot":"","sources":["../../src/utils/cli-usage-limit.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG,MAAM,CAAC;AAEjD,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,IAAI,CAAC;IACd,IAAI,EAAE,iBAAiB,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,KAAK,CAAC;CAChB;AAED,MAAM,MAAM,sBAAsB,GAAG,kBAAkB,GAAG,wBAAwB,CAAC;AAoCnF,eAAO,MAAM,2BAA2B,QAAgB,CAAC;AA0DzD,MAAM,WAAW,uBAAuB;IACtC;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,GAAG,OAAa,EAChB,IAAI,GAAE,uBAA4B,GACjC,sBAAsB,CAsCxB;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,kBAAkB,GAAG,MAAM,CAEpE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,SAAK,EAAE,GAAG,OAAa,GAAG,kBAAkB,CAUxF"}

package/dist/utils/cli-usage-limit.js

@@ -7,7 +7,29 @@ const USAGE_LIMIT_PATTERNS = [
 const RATE_LIMIT_PATTERNS = [
     /\brate limits?.*(?:reached|exceeded)\b/i,
     /\brate limited\b/i,
+    // HTTP-style hard rate limits from CLI/provider retries (Codex/OpenAI path).
+    // Anchor 429 to rate-limit context. A bare /\b429\b/ (or a bare "too many
+    // requests") false-positives on ordinary TUI content — port numbers, log
+    // line numbers, and especially agent command output (e.g. code/docs that
+    // literally print "Too Many Requests"). This detector runs on every screen
+    // frame, so keep it tight: only 429 that sits next to a status word or the
+    // full "429 Too Many Requests" phrase, plus the explicit retry-exhaustion line.
+    /status:\s*429\b/i,
+    /\b429\s+too many requests\b/i,
+    /\bexceeded retry limit\b/i,
 ];
+// Hard rate-limit signatures that often omit a wall-clock retry time.
+// Only these get the fixed-cooldown fallback so generic "try again later"
+// usage copy stays non-blocking (existing product decision). Same tightened
+// contexts as above — never a bare 429 / bare "too many requests".
+const HARD_RATE_LIMIT_WITHOUT_TIME_PATTERNS = [
+    /status:\s*429\b/i,
+    /\b429\s+too many requests\b/i,
+    /\bexceeded retry limit\b/i,
+];
+// Quantized cooldown for hard 429-style errors without a parseable clock time.
+// Bucketed so repeated screen ticks produce a stable usageLimitStateKey.
+export const HARD_RATE_LIMIT_COOLDOWN_MS = 5 * 60 * 1000;
 const RETRY_TIME_PATTERNS = [
     /\btry\s+again\s+at\s+(\d{1,2})(?::(\d{2}))?\s*([ap]\.?m\.?)\b/i,
     /\bresets?(?:\s+at)?\s+(\d{1,2})(?::(\d{2}))?\s*([ap]\.?m\.?)\b/i,
@@ -46,31 +68,81 @@ function parseMeridiemTime(text, now) {
     }
     return null;
 }
-export function detectCliUsageLimit(text, now = new Date()) {
-    // Hot path: runs on every screen tick for every active session. The retry
-    // patterns all require the literal "again" or "reset", so gate the heavier
-    // regex work behind one cheap scan to skip it for the >99% no-limit case.
-    if (!/again|reset/i.test(text))
+/** Stable fixed cooldown pinned to wall-clock buckets for hard 429 fallbacks. */
+function hardRateLimitFallbackTime(now) {
+    const nowMs = now.getTime();
+    const bucketStart = Math.floor(nowMs / HARD_RATE_LIMIT_COOLDOWN_MS) * HARD_RATE_LIMIT_COOLDOWN_MS;
+    // End of the *next* full bucket so the wait is always in (5min, 10min].
+    // Within one bucket every screen tick returns the same retryAtMs/key.
+    const retryAtMs = bucketStart + 2 * HARD_RATE_LIMIT_COOLDOWN_MS;
+    return {
+        retryAtMs,
+        // Label reflects the real (5min, 10min] window, not an optimistic "~5 min":
+        // the card's countdown text must not undersell how long the wait can be.
+        retryLabel: '5-10 min',
+    };
+}
+export function detectCliUsageLimit(text, now = new Date(), opts = {}) {
+    // Hot path: runs on every screen tick for every active session. Gate heavier
+    // regex work behind one cheap scan for the >99% no-limit case.
+    // Include 429 / retry-limit tokens — "retry" does not contain "again".
+    if (!/again|reset|429|too many requests|rate limit|retry limit/i.test(text)) {
         return { limited: false };
+    }
     const time = parseMeridiemTime(text, now);
-    if (!time)
+    const isRate = !opts.suppressRateKind && hasPattern(text, RATE_LIMIT_PATTERNS);
+    const isUsage = !isRate && hasPattern(text, USAGE_LIMIT_PATTERNS);
+    if (!isRate && !isUsage)
         return { limited: false };
-    const kind = hasPattern(text, RATE_LIMIT_PATTERNS)
-        ? 'rate'
-        : hasPattern(text, USAGE_LIMIT_PATTERNS)
-            ? 'usage'
-            : null;
-    if (!kind)
-        return { limited: false };
-    return {
-        limited: true,
-        kind,
-        retryAtMs: time.retryAtMs,
-        retryLabel: time.retryLabel,
-        retryReady: now.getTime() >= time.retryAtMs,
-    };
+    if (time) {
+        return {
+            limited: true,
+            kind: isRate ? 'rate' : 'usage',
+            retryAtMs: time.retryAtMs,
+            retryLabel: time.retryLabel,
+            retryReady: now.getTime() >= time.retryAtMs,
+        };
+    }
+    // Usage limits without a concrete clock time stay non-blocking (existing tests).
+    // Hard HTTP 429 / exceeded-retry-limit paths get a stable cooldown fallback so
+    // the session can still surface as limited → Dashboard「需要你」.
+    if (isRate && hasPattern(text, HARD_RATE_LIMIT_WITHOUT_TIME_PATTERNS)) {
+        const fallback = hardRateLimitFallbackTime(now);
+        return {
+            limited: true,
+            kind: 'rate',
+            retryAtMs: fallback.retryAtMs,
+            retryLabel: fallback.retryLabel,
+            retryReady: now.getTime() >= fallback.retryAtMs,
+        };
+    }
+    return { limited: false };
 }
 export function usageLimitStateKey(state) {
     return `${state.kind}:${state.retryAtMs}:${state.retryLabel}`;
 }
+/**
+ * Build a rate-limit state from a STRUCTURED signal (e.g. Claude Code's
+ * transcript `error: "rate_limit"` record) instead of screen text.
+ *
+ * The caller has already decided this IS a rate limit via a machine field, so
+ * unlike detectCliUsageLimit() there is no pattern gate here — we only need to
+ * fix the retry time. Claude's rate-limit records usually carry a human clock
+ * in their text ("You've hit your session limit · resets 10:40pm"); when
+ * `text` yields a parseable time we honor it (accurate retry_ready flip),
+ * otherwise we reuse the same wall-clock-bucketed fallback the screen-text
+ * hard-429 path uses so the usageLimitStateKey stays stable across repeated
+ * ticks within a bucket (no persist/timer churn on the daemon side).
+ */
+export function structuredRateLimitState(text = '', now = new Date()) {
+    const parsed = parseMeridiemTime(text, now);
+    const { retryAtMs, retryLabel } = parsed ?? hardRateLimitFallbackTime(now);
+    return {
+        limited: true,
+        kind: 'rate',
+        retryAtMs,
+        retryLabel,
+        retryReady: now.getTime() >= retryAtMs,
+    };
+}
 //# sourceMappingURL=cli-usage-limit.js.map

package/dist/utils/cli-usage-limit.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli-usage-limit.js","sourceRoot":"","sources":["../../src/utils/cli-usage-limit.ts"],"names":[],"mappings":"AAgBA,MAAM,oBAAoB,GAAG;IAC3B,uCAAuC;IACvC,oDAAoD;IACpD,2CAA2C;IAC3C,gEAAgE;CACjE,CAAC;AAEF,MAAM,mBAAmB,GAAG;IAC1B,yCAAyC;IACzC,mBAAmB;CACpB,CAAC;AAEF,MAAM,mBAAmB,GAAG;IAC1B,gEAAgE;IAChE,iEAAiE;CAClE,CAAC;AAEF,SAAS,UAAU,CAAC,IAAY,EAAE,QAAkB;IAClD,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,GAAS;IAChD,KAAK,MAAM,OAAO,IAAI,mBAAmB,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK;YAAE,SAAS;QAErB,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,IAAI,OAAO,GAAG,EAAE;YAAE,OAAO,IAAI,CAAC;QAC3E,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,EAAE;YAAE,OAAO,IAAI,CAAC;QAExE,IAAI,IAAI,GAAG,OAAO,GAAG,EAAE,CAAC;QACxB,IAAI,QAAQ,KAAK,IAAI;YAAE,IAAI,IAAI,EAAE,CAAC;QAElC,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9B,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QACrC,yEAAyE;QACzE,2EAA2E;QAC3E,yEAAyE;QACzE,2EAA2E;QAC3E,IAAI,OAAO,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,IAAI,IAAI,GAAG,EAAE,EAAE,CAAC;YACnD,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;QACzC,CAAC;QAED,OAAO;YACL,SAAS,EAAE,OAAO,CAAC,OAAO,EAAE;YAC5B,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,6CAA6C,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE;SACvF,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE;IAChE,0EAA0E;IAC1E,2EAA2E;IAC3E,0EAA0E;IAC1E,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAE1D,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAErC,MAAM,IAAI,GAA6B,UAAU,CAAC,IAAI,EAAE,mBAAmB,CAAC;QAC1E,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,oBAAoB,CAAC;YACtC,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,IAAI,CAAC;IAEX,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAErC,OAAO;QACL,OAAO,EAAE,IAAI;QACb,IAAI;QACJ,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,UAAU,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,SAAS;KAC5C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAyB;IAC1D,OAAO,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;AAChE,CAAC"}
+{"version":3,"file":"cli-usage-limit.js","sourceRoot":"","sources":["../../src/utils/cli-usage-limit.ts"],"names":[],"mappings":"AAgBA,MAAM,oBAAoB,GAAG;IAC3B,uCAAuC;IACvC,oDAAoD;IACpD,2CAA2C;IAC3C,gEAAgE;CACjE,CAAC;AAEF,MAAM,mBAAmB,GAAG;IAC1B,yCAAyC;IACzC,mBAAmB;IACnB,6EAA6E;IAC7E,0EAA0E;IAC1E,yEAAyE;IACzE,yEAAyE;IACzE,2EAA2E;IAC3E,2EAA2E;IAC3E,gFAAgF;IAChF,kBAAkB;IAClB,8BAA8B;IAC9B,2BAA2B;CAC5B,CAAC;AAEF,sEAAsE;AACtE,0EAA0E;AAC1E,4EAA4E;AAC5E,mEAAmE;AACnE,MAAM,qCAAqC,GAAG;IAC5C,kBAAkB;IAClB,8BAA8B;IAC9B,2BAA2B;CAC5B,CAAC;AAEF,+EAA+E;AAC/E,yEAAyE;AACzE,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzD,MAAM,mBAAmB,GAAG;IAC1B,gEAAgE;IAChE,iEAAiE;CAClE,CAAC;AAEF,SAAS,UAAU,CAAC,IAAY,EAAE,QAAkB;IAClD,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,GAAS;IAChD,KAAK,MAAM,OAAO,IAAI,mBAAmB,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK;YAAE,SAAS;QAErB,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,IAAI,OAAO,GAAG,EAAE;YAAE,OAAO,IAAI,CAAC;QAC3E,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,EAAE;YAAE,OAAO,IAAI,CAAC;QAExE,IAAI,IAAI,GAAG,OAAO,GAAG,EAAE,CAAC;QACxB,IAAI,QAAQ,KAAK,IAAI;YAAE,IAAI,IAAI,EAAE,CAAC;QAElC,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9B,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QACrC,yEAAyE;QACzE,2EAA2E;QAC3E,yEAAyE;QACzE,2EAA2E;QAC3E,IAAI,OAAO,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,IAAI,IAAI,GAAG,EAAE,EAAE,CAAC;YACnD,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;QACzC,CAAC;QAED,OAAO;YACL,SAAS,EAAE,OAAO,CAAC,OAAO,EAAE;YAC5B,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,6CAA6C,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE;SACvF,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,iFAAiF;AACjF,SAAS,yBAAyB,CAAC,GAAS;IAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;IAC5B,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,2BAA2B,CAAC,GAAG,2BAA2B,CAAC;IAClG,wEAAwE;IACxE,sEAAsE;IACtE,MAAM,SAAS,GAAG,WAAW,GAAG,CAAC,GAAG,2BAA2B,CAAC;IAChE,OAAO;QACL,SAAS;QACT,4EAA4E;QAC5E,yEAAyE;QACzE,UAAU,EAAE,UAAU;KACvB,CAAC;AACJ,CAAC;AAcD,MAAM,UAAU,mBAAmB,CACjC,IAAY,EACZ,GAAG,GAAG,IAAI,IAAI,EAAE,EAChB,OAAgC,EAAE;IAElC,6EAA6E;IAC7E,+DAA+D;IAC/D,uEAAuE;IACvE,IAAI,CAAC,2DAA2D,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5E,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,gBAAgB,IAAI,UAAU,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;IAC/E,MAAM,OAAO,GAAG,CAAC,MAAM,IAAI,UAAU,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;IAClE,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAEnD,IAAI,IAAI,EAAE,CAAC;QACT,OAAO;YACL,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;YAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,UAAU,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,SAAS;SAC5C,CAAC;IACJ,CAAC;IAED,iFAAiF;IACjF,+EAA+E;IAC/E,6DAA6D;IAC7D,IAAI,MAAM,IAAI,UAAU,CAAC,IAAI,EAAE,qCAAqC,CAAC,EAAE,CAAC;QACtE,MAAM,QAAQ,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAC;QAChD,OAAO;YACL,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,MAAM;YACZ,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,UAAU,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,QAAQ,CAAC,SAAS;SAChD,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAyB;IAC1D,OAAO,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;AAChE,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAI,GAAG,EAAE,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE;IAClE,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC5C,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,yBAAyB,CAAC,GAAG,CAAC,CAAC;IAC3E,OAAO;QACL,OAAO,EAAE,IAAI;QACb,IAAI,EAAE,MAAM;QACZ,SAAS;QACT,UAAU;QACV,UAAU,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,SAAS;KACvC,CAAC;AACJ,CAAC"}

package/dist/utils/input-gate.d.ts

@@ -27,6 +27,8 @@ export declare function shouldWriteNow(state: {
     supportsTypeAhead: boolean;
     /** True until the CLI has reached its first ready state (boot / re-attach window). */
     awaitingFirstPrompt: boolean;
+    /** A stale Codex App runner must not receive normal or type-ahead input. */
+    holdForRunnerReload?: boolean;
 }): boolean;
 /**
  * Claude runs every matching SessionStart hook in parallel and waits for all of

package/dist/utils/input-gate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"input-gate.d.ts","sourceRoot":"","sources":["../../src/utils/input-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE;IACpC,sCAAsC;IACtC,aAAa,EAAE,OAAO,CAAC;IACvB,0DAA0D;IAC1D,UAAU,EAAE,OAAO,CAAC;IACpB,oEAAoE;IACpE,iBAAiB,EAAE,OAAO,CAAC;IAC3B,sFAAsF;IACtF,mBAAmB,EAAE,OAAO,CAAC;CAC9B,GAAG,OAAO,CAIV;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,2CAA2C,CAAC,KAAK,EAAE;IACjE,cAAc,EAAE,OAAO,CAAC;IACxB,eAAe,EAAE,OAAO,CAAC;IACzB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,aAAa,EAAE,OAAO,CAAC;IACvB,cAAc,EAAE,OAAO,CAAC;CACzB,GAAG,OAAO,CAMV;AAED,wBAAgB,+BAA+B,CAAC,KAAK,EAAE;IACrD,sEAAsE;IACtE,iCAAiC,EAAE,OAAO,CAAC;IAC3C,8EAA8E;IAC9E,eAAe,EAAE,OAAO,CAAC;IACzB,8EAA8E;IAC9E,SAAS,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,aAAa,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAIV;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,sBAAsB,EAAE,OAAO,CAAC;IAChC,+BAA+B,EAAE,OAAO,CAAC;IACzC,0BAA0B,EAAE,OAAO,CAAC;CACrC,GAAG,OAAO,CAEV;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CAAC,iBAAiB,EAAE,OAAO,GAAG,OAAO,GAAG,YAAY,CAE1F"}
+{"version":3,"file":"input-gate.d.ts","sourceRoot":"","sources":["../../src/utils/input-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE;IACpC,sCAAsC;IACtC,aAAa,EAAE,OAAO,CAAC;IACvB,0DAA0D;IAC1D,UAAU,EAAE,OAAO,CAAC;IACpB,oEAAoE;IACpE,iBAAiB,EAAE,OAAO,CAAC;IAC3B,sFAAsF;IACtF,mBAAmB,EAAE,OAAO,CAAC;IAC7B,4EAA4E;IAC5E,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B,GAAG,OAAO,CAKV;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,2CAA2C,CAAC,KAAK,EAAE;IACjE,cAAc,EAAE,OAAO,CAAC;IACxB,eAAe,EAAE,OAAO,CAAC;IACzB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,aAAa,EAAE,OAAO,CAAC;IACvB,cAAc,EAAE,OAAO,CAAC;CACzB,GAAG,OAAO,CAMV;AAED,wBAAgB,+BAA+B,CAAC,KAAK,EAAE;IACrD,sEAAsE;IACtE,iCAAiC,EAAE,OAAO,CAAC;IAC3C,8EAA8E;IAC9E,eAAe,EAAE,OAAO,CAAC;IACzB,8EAA8E;IAC9E,SAAS,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,aAAa,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAIV;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,sBAAsB,EAAE,OAAO,CAAC;IAChC,+BAA+B,EAAE,OAAO,CAAC;IACzC,0BAA0B,EAAE,OAAO,CAAC;CACrC,GAAG,OAAO,CAEV;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CAAC,iBAAiB,EAAE,OAAO,GAAG,OAAO,GAAG,YAAY,CAE1F"}

package/dist/utils/input-gate.js

@@ -19,6 +19,8 @@
  * QUEUE even type-ahead messages and let `markPromptReady()`'s flush deliver them.
  */
 export function shouldWriteNow(state) {
+    if (state.holdForRunnerReload)
+        return false;
     if (state.isPromptReady || state.isFlushing)
         return true;
     // Type-ahead is only safe after the TUI has booted at least once.

package/dist/utils/input-gate.js.map

@@ -1 +1 @@
-{"version":3,"file":"input-gate.js","sourceRoot":"","sources":["../../src/utils/input-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,cAAc,CAAC,KAS9B;IACC,IAAI,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IACzD,kEAAkE;IAClE,OAAO,KAAK,CAAC,iBAAiB,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC;AAC/D,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,2CAA2C,CAAC,KAM3D;IACC,OAAO,KAAK,CAAC,cAAc;WACtB,KAAK,CAAC,eAAe;WACrB,KAAK,CAAC,mBAAmB;WACzB,CAAC,KAAK,CAAC,aAAa;WACpB,CAAC,KAAK,CAAC,cAAc,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,KAS/C;IACC,IAAI,CAAC,KAAK,CAAC,iCAAiC;QAAE,OAAO,IAAI,CAAC;IAC1D,IAAI,CAAC,KAAK,CAAC,eAAe;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,aAAa,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAIrC;IACC,OAAO,KAAK,CAAC,sBAAsB,IAAI,KAAK,CAAC,+BAA+B,IAAI,KAAK,CAAC,0BAA0B,CAAC;AACnH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,uBAAuB,CAAC,iBAA0B;IAChE,OAAO,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC;AACpD,CAAC"}
+{"version":3,"file":"input-gate.js","sourceRoot":"","sources":["../../src/utils/input-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,cAAc,CAAC,KAW9B;IACC,IAAI,KAAK,CAAC,mBAAmB;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IACzD,kEAAkE;IAClE,OAAO,KAAK,CAAC,iBAAiB,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC;AAC/D,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,2CAA2C,CAAC,KAM3D;IACC,OAAO,KAAK,CAAC,cAAc;WACtB,KAAK,CAAC,eAAe;WACrB,KAAK,CAAC,mBAAmB;WACzB,CAAC,KAAK,CAAC,aAAa;WACpB,CAAC,KAAK,CAAC,cAAc,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,KAS/C;IACC,IAAI,CAAC,KAAK,CAAC,iCAAiC;QAAE,OAAO,IAAI,CAAC;IAC1D,IAAI,CAAC,KAAK,CAAC,eAAe;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,aAAa,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAIrC;IACC,OAAO,KAAK,CAAC,sBAAsB,IAAI,KAAK,CAAC,+BAA+B,IAAI,KAAK,CAAC,0BAA0B,CAAC;AACnH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,uBAAuB,CAAC,iBAA0B;IAChE,OAAO,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC;AACpD,CAAC"}

package/dist/utils/runtime-build-id.d.ts

@@ -0,0 +1,21 @@
+export interface RuntimeBuildEntry {
+    path: string;
+    content: string | Buffer;
+}
+export type RuntimeBuildIdentity = {
+    status: 'known';
+    id: string;
+    source: 'artifact' | 'source';
+} | {
+    status: 'unknown';
+    reason: 'artifact_invalid' | 'source_unavailable' | 'read_failed';
+};
+export declare function computeRuntimeBuildId(entries: readonly RuntimeBuildEntry[]): string;
+export declare function isRuntimeBuildId(value: unknown): value is string;
+export declare function collectCompiledRuntimeEntries(sourceRoot: string, distRoot: string): RuntimeBuildEntry[];
+export declare function resolveRuntimeBuildIdentity(options: {
+    artifactPath: string;
+    sourceRoot?: string;
+}): RuntimeBuildIdentity;
+export declare function runtimeBuildIdentity(): RuntimeBuildIdentity;
+//# sourceMappingURL=runtime-build-id.d.ts.map

package/dist/utils/runtime-build-id.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-build-id.d.ts","sourceRoot":"","sources":["../../src/utils/runtime-build-id.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;CAC1B;AAED,MAAM,MAAM,oBAAoB,GAC5B;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,UAAU,GAAG,QAAQ,CAAA;CAAE,GAC9D;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,kBAAkB,GAAG,oBAAoB,GAAG,aAAa,CAAA;CAAE,CAAC;AAK7F,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,SAAS,iBAAiB,EAAE,GAAG,MAAM,CAUnF;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAEhE;AAwBD,wBAAgB,6BAA6B,CAC3C,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,GACf,iBAAiB,EAAE,CAKrB;AAED,wBAAgB,2BAA2B,CAAC,OAAO,EAAE;IACnD,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,oBAAoB,CAsBvB;AAED,wBAAgB,oBAAoB,IAAI,oBAAoB,CAQ3D"}