bridgerator 1.0.7 → 1.1.0

package/src/pc-check.mjs

@@ -0,0 +1,112 @@
+// LOGIC: see critical-logic/bridge.md ("PC check"). One-command, read-only PC health: disks (space,
+// drive health), event log errors of the last days (grouped), startup programs, devices with driver
+// problems, Windows updates, load and memory. Facts come from pc-check.ps1 (CIM classes, Get-WinEvent
+// by Level/Id, registry) — numbers and ids, any Windows language; this file turns them into findings.
+// A part that could not be read is reported as not checked, never as "fine".
+import { fileURLToPath } from 'node:url';
+import { psJson, json, needAction, int } from './tool-lib.mjs';
+
+const PS = fileURLToPath(new URL('./pc-check.ps1', import.meta.url));
+const ALL = ['disks', 'events', 'startup', 'drivers', 'updates', 'load'];
+const GB = 1024 ** 3;
+// MSFT_PhysicalDisk numbers.
+const HEALTH = { 0: 'healthy', 1: 'warning', 2: 'unhealthy', 5: 'unknown' };
+const MEDIA = { 0: 'unspecified', 3: 'HDD', 4: 'SSD', 5: 'SCM' };
+// Win32_PnPEntity ConfigManagerErrorCode → plain words.
+const DEVICE = {
+  1: 'not configured correctly', 3: 'driver may be damaged or memory is low', 10: 'cannot start', 12: 'not enough free resources',
+  14: 'needs a restart', 18: 'drivers need reinstalling', 19: 'registry data is damaged', 21: 'being removed', 22: 'disabled', 24: 'not present or not working',
+  28: 'no driver installed', 29: 'disabled in firmware', 31: 'not working (driver could not load)', 32: 'driver service disabled', 37: 'driver failed to start',
+  39: 'driver missing or damaged', 43: 'stopped and reported a problem (code 43)', 45: 'not connected', 47: 'prepared for safe removal', 48: 'blocked (known problems)', 52: 'driver signature cannot be verified',
+};
+
+/** Facts → { findings: [{ level: problem|warning|info|not_checked, area, text }], ...facts trimmed }. */
+export function analyze(f, now = Date.now()) {
+  // PowerShell unrolls a list returned from a scriptblock: none → {} and one → the item itself. Normalize both (pc-check.ps1 also returns ,@()).
+  for (const k of ['startup', 'drivers']) { const v = f[k]; if (k in f && !Array.isArray(v) && !v?.error) f = { ...f, [k]: v && Object.keys(v).length ? [v] : [] }; }
+  const out = [];
+  const add = (level, area, text) => out.push({ level, area, text });
+  const nc = (area, v) => { if (v && !Array.isArray(v) && v.error) { add('not_checked', area, `Could not read: ${v.error}`); return true; } return false; };
+  if (f.disks && !nc('disks', f.disks)) {
+    for (const v of f.disks.volumes || []) {
+      if (!v.size) continue;
+      const pct = (v.free / v.size) * 100;
+      const txt = `${v.drive} ${(v.free / GB).toFixed(1)} GB free of ${(v.size / GB).toFixed(0)} GB (${pct.toFixed(0)} %)`;
+      if (v.free < 2 * GB || pct < 5) add('problem', 'disks', `${txt} — almost full`);
+      else if (v.free < 10 * GB || pct < 10) add('warning', 'disks', `${txt} — getting full`);
+      else add('info', 'disks', txt);
+    }
+    if (nc('disks', f.disks.physical)) { /* reported */ } else for (const p of f.disks.physical || []) {
+      const h = HEALTH[p.health] || 'unknown';
+      add(h === 'healthy' ? 'info' : h === 'unknown' ? 'not_checked' : 'problem', 'disks', `Drive "${p.name}" (${MEDIA[p.media] || 'disk'}): health ${h}${h === 'unhealthy' || h === 'warning' ? ' — back up important files and plan a replacement' : ''}`);
+    }
+  }
+  if (f.events && !nc('events', f.events)) {
+    const e = f.events;
+    if (!e.total) add('info', 'events', `No errors in the System and Application logs in the last ${e.days} days`);
+    else {
+      add(e.critical ? 'warning' : 'info', 'events', `${e.total} errors${e.critical ? `, ${e.critical} critical` : ''} in the last ${e.days} days (the most frequent are listed in "events")`);
+      // Event 41 Kernel-Power = the PC was not shut down cleanly (power loss, freeze, forced off).
+      // Counted by pc-check.ps1 over all events (kernelPower); older facts: only the listed groups.
+      const kp = Number.isInteger(e.kernelPower) ? e.kernelPower : (e.groups || []).find((g) => g.id === 41 && /Kernel-Power/i.test(g.source))?.count || 0;
+      if (kp) add('warning', 'events', `The PC turned off unexpectedly ${kp} time(s) (power loss, freeze or holding the power button)`);
+    }
+  }
+  if (f.startup && !nc('startup', f.startup)) {
+    const on = f.startup.filter((s) => s.enabled !== false);
+    add(on.length > 15 ? 'warning' : 'info', 'startup', `${on.length} programs start with Windows${f.startup.length > on.length ? ` (${f.startup.length - on.length} more turned off)` : ''}${on.length > 15 ? ' — many; turning some off speeds up the start' : ''}`);
+  }
+  if (f.drivers && !nc('drivers', f.drivers)) {
+    const off = f.drivers.filter((d) => d.code === 22), bad = f.drivers.filter((d) => d.code !== 22);
+    if (!bad.length) add('info', 'drivers', 'All devices work');
+    for (const d of bad) add('problem', 'drivers', `${d.name || d.id}: ${DEVICE[d.code] || `problem code ${d.code}`}`);
+    // Code 22 = turned off on purpose (Device Manager → Disable): not a problem.
+    if (off.length) add('info', 'drivers', `${off.length} device(s) turned off in Device Manager: ${[...new Set(off.map((d) => d.name || d.id))].slice(0, 5).join(', ')}`);
+  }
+  if (f.updates && !nc('updates', f.updates)) {
+    const u = f.updates;
+    const last = (u.recent || [])[0];
+    if (last) {
+      const age = Math.round((now - Date.parse(last.installed)) / 86400000);
+      add(age > 60 ? 'warning' : 'info', 'updates', `Last update installed ${last.installed} (${last.id})${age > 60 ? ` — ${age} days ago, check Windows Update` : ''}`);
+    } else add('not_checked', 'updates', 'No installed updates listed');
+    if (u.rebootPending) add('warning', 'updates', 'A restart is needed to finish updates');
+    if (Array.isArray(u.pending)) add(u.pending.length ? 'warning' : 'info', 'updates', u.pending.length ? `${u.pending.length} updates waiting to be installed` : 'No updates waiting');
+    else nc('updates', u.pending);
+  }
+  if (f.load && !nc('load', f.load)) {
+    const l = f.load;
+    const used = l.memTotalMb ? Math.round(((l.memTotalMb - l.memFreeMb) / l.memTotalMb) * 100) : null;
+    if (used !== null) add(used > 90 ? 'warning' : 'info', 'load', `Memory ${used} % used (${Math.round(l.memFreeMb / 1024 * 10) / 10} GB free of ${Math.round(l.memTotalMb / 1024)} GB)`);
+    if (Number.isFinite(l.cpuLoad)) add(l.cpuLoad > 85 ? 'warning' : 'info', 'load', `Processor load ${Math.round(l.cpuLoad)} %`);
+    const up = Date.parse(l.bootedAt);
+    if (Number.isFinite(up)) { const d = Math.floor((now - up) / 86400000); add(d > 14 ? 'warning' : 'info', 'load', `Running ${d} day(s) since the last restart${d > 14 ? ' — a restart often helps' : ''}`); }
+  }
+  const order = { problem: 0, warning: 1, not_checked: 2, info: 3 };
+  out.sort((a, b) => order[a.level] - order[b.level]);
+  return out;
+}
+
+export const defs = [{
+  name: 'pc_health',
+  title: 'PC health check',
+  description: 'Read-only health check of this PC. summary: everything at once (disks, event log errors, startup programs, devices with driver problems, Windows updates, memory and load); or one part: disks, events (errors of the last `days`), startup, drivers, updates (pending: true also asks Windows Update for waiting updates — slow), load. Returns findings in plain words plus the details. Changes nothing.',
+  inputSchema: {
+    type: 'object', additionalProperties: false, required: ['action'],
+    properties: {
+      action: { type: 'string', enum: ['summary', ...ALL] },
+      days: { type: 'integer', minimum: 1, maximum: 30, description: 'events: how many days back (default 3)' },
+      pending: { type: 'boolean', description: 'updates: also list updates waiting to be installed (takes up to a few minutes)' },
+    },
+  },
+  annotations: { readOnlyHint: true, destructiveHint: false, openWorldHint: false },
+}];
+
+export async function handle(name, args, ctx) {
+  const action = needAction(args, defs[0].inputSchema.properties.action.enum);
+  const days = int(args, 'days', { min: 1, max: 30, def: 3 });
+  const parts = action === 'summary' ? ALL : [action];
+  const pending = args.pending === true && parts.includes('updates');
+  const facts = await psJson(ctx, { files: [PS], env: { BRX_PARTS: parts.join(','), BRX_DAYS: String(days), BRX_PENDING: pending ? '1' : '' }, timeout: pending ? 300000 : 90000 });
+  return json({ action, findings: analyze(facts), details: facts });
+}

package/src/pc-check.ps1

@@ -0,0 +1,103 @@
+# Bridgerator PC check (read-only). Input: BRX_PARTS (comma list: disks,events,startup,drivers,updates,load),
+# BRX_DAYS (event log days), BRX_PENDING (1 = ask Windows Update for pending updates, slow).
+# Output: ONE JSON line. Every part is caught on its own: a failed part is { error } (NOT CHECKED), not a failed run.
+# Values are read as numbers / ids / registry data, never as localized label text.
+$parts = @(($env:BRX_PARTS -split ',') | Where-Object { $_ })
+$days = 3; [int]::TryParse([string]$env:BRX_DAYS, [ref]$days) | Out-Null
+if ($days -lt 1 -or $days -gt 30) { $days = 3 }
+$out = [ordered]@{}
+function Cut([string]$s, [int]$n) { if ($null -eq $s) { return '' }; $s = ($s -replace '\s+', ' ').Trim(); if ($s.Length -gt $n) { return $s.Substring(0, $n) + '...' }; return $s }
+function Part([string]$name, [scriptblock]$body) {
+  if ($parts -notcontains $name) { return }
+  try { $out[$name] = & $body } catch { $out[$name] = @{ error = (Cut $_.Exception.Message 200) } }
+}
+
+Part 'disks' {
+  $vol = @(Get-CimInstance Win32_LogicalDisk -Filter 'DriveType=3' -ErrorAction Stop | ForEach-Object {
+    @{ drive = [string]$_.DeviceID; label = [string]$_.VolumeName; fs = [string]$_.FileSystem; size = [int64]$_.Size; free = [int64]$_.FreeSpace }
+  })
+  $phys = $null
+  try {
+    $phys = @(Get-CimInstance -Namespace 'root/Microsoft/Windows/Storage' -ClassName MSFT_PhysicalDisk -ErrorAction Stop | ForEach-Object {
+      @{ name = [string]$_.FriendlyName; media = [int]$_.MediaType; bus = [int]$_.BusType; health = [int]$_.HealthStatus; status = @($_.OperationalStatus | ForEach-Object { [int]$_ }); size = [int64]$_.Size }
+    })
+  } catch { $phys = @{ error = (Cut $_.Exception.Message 160) } }
+  @{ volumes = $vol; physical = $phys }
+}
+
+Part 'events' {
+  $since = (Get-Date).AddDays(-$days)
+  $ev = @()
+  foreach ($log in 'System', 'Application') {
+    try { $ev += @(Get-WinEvent -FilterHashtable @{ LogName = $log; Level = 1, 2; StartTime = $since } -MaxEvents 3000 -ErrorAction Stop) }
+    catch { if ($_.FullyQualifiedErrorId -notlike 'NoMatchingEventsFound*') { throw } }
+  }
+  $groups = @($ev | Group-Object { "$($_.LogName)|$($_.ProviderName)|$($_.Id)" } | Sort-Object Count -Descending | Select-Object -First 15 | ForEach-Object {
+    $last = $_.Group | Sort-Object TimeCreated -Descending | Select-Object -First 1
+    $msg = ''; try { $msg = $last.Message } catch {}
+    @{ log = [string]$last.LogName; source = [string]$last.ProviderName; id = [int]$last.Id; level = [int]$last.Level; count = [int]$_.Count; last = $last.TimeCreated.ToString('o'); message = (Cut $msg 220) }
+  })
+  # Kernel-Power 41 (turned off unexpectedly) is counted over ALL events, not only the 15 most frequent groups.
+  $kp = @($ev | Where-Object { $_.Id -eq 41 -and [string]$_.ProviderName -eq 'Microsoft-Windows-Kernel-Power' }).Count
+  @{ days = $days; total = $ev.Count; critical = @($ev | Where-Object { $_.Level -eq 1 }).Count; kernelPower = $kp; groups = $groups }
+}
+
+Part 'startup' {
+  $approved = @{}
+  foreach ($k in 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run', 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run', 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\StartupFolder') {
+    try { $p = Get-ItemProperty $k -ErrorAction Stop; foreach ($n in $p.PSObject.Properties) { if ($n.Value -is [byte[]] -and $n.Value.Length -gt 0) { $approved[$n.Name] = ($n.Value[0] % 2 -eq 0) } } } catch {}
+  }
+  ,@(Get-CimInstance Win32_StartupCommand -ErrorAction Stop | ForEach-Object {
+    $name = [string]$_.Name; $en = $true
+    foreach ($key in @($name, [string]$_.Caption, ([string]$_.Command -split '\\')[-1])) { if ($approved.ContainsKey($key)) { $en = $approved[$key]; break } }
+    @{ name = $name; command = (Cut ([string]$_.Command) 200); location = [string]$_.Location; user = [string]$_.User; enabled = $en }
+  })
+}
+
+Part 'drivers' {
+  ,@(Get-CimInstance Win32_PnPEntity -Filter 'ConfigManagerErrorCode<>0' -ErrorAction Stop | Select-Object -First 50 | ForEach-Object {
+    @{ name = [string]$_.Name; class = [string]$_.PNPClass; code = [int]$_.ConfigManagerErrorCode; id = (Cut ([string]$_.PNPDeviceID) 120) }
+  })
+}
+
+# Win32_QuickFixEngineering.InstalledOn is a string in the PC's own date format (15.10.2026, 10/15/2026)
+# or a hex FILETIME on some updates: M/d/yyyy (slashes) is read invariant first, other forms with the
+# current culture first; unreadable = skipped.
+function To-Date($v) {
+  $s = ([string]$v).Trim()
+  if (-not $s) { return $null }
+  if ($s -match '^[0-9A-Fa-f]{16}$') { try { return [DateTime]::FromFileTimeUtc([Convert]::ToInt64($s, 16)) } catch { return $null } }
+  $d = [datetime]::MinValue
+  $order = @([Globalization.CultureInfo]::CurrentCulture, [Globalization.CultureInfo]::InvariantCulture)
+  if ($s.Contains('/')) { [array]::Reverse($order) }
+  foreach ($c in $order) {
+    if ([datetime]::TryParse($s, $c, [Globalization.DateTimeStyles]::None, [ref]$d)) { return $d }
+  }
+  return $null
+}
+Part 'updates' {
+  $hot = @(Get-CimInstance Win32_QuickFixEngineering -ErrorAction Stop | ForEach-Object { $d = To-Date $_.InstalledOn; if ($d) { @{ id = [string]$_.HotFixID; on = $d } } } | Sort-Object { $_.on } -Descending | Select-Object -First 5 | ForEach-Object {
+    @{ id = $_.id; installed = $_.on.ToString('yyyy-MM-dd', [Globalization.CultureInfo]::InvariantCulture) }
+  })
+  $reboot = (Test-Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired') -or (Test-Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\RebootPending')
+  $pending = $null
+  if ($env:BRX_PENDING -eq '1') {
+    try {
+      $s = (New-Object -ComObject Microsoft.Update.Session).CreateUpdateSearcher()
+      $r = $s.Search('IsInstalled=0 and IsHidden=0 and Type=''Software''')
+      $pending = @($r.Updates | Select-Object -First 30 | ForEach-Object { @{ title = (Cut ([string]$_.Title) 160); kb = (@($_.KBArticleIDs) -join ','); mb = [math]::Round($_.MaxDownloadSize / 1MB) } })
+    } catch { $pending = @{ error = (Cut $_.Exception.Message 160) } }
+  }
+  @{ recent = $hot; rebootPending = [bool]$reboot; pending = $pending }
+}
+
+Part 'load' {
+  $os = Get-CimInstance Win32_OperatingSystem -ErrorAction Stop
+  $cpu = @(Get-CimInstance Win32_Processor -ErrorAction Stop)
+  $load = ($cpu | Measure-Object -Property LoadPercentage -Average).Average
+  $top = @(Get-Process -ErrorAction SilentlyContinue | Sort-Object WorkingSet64 -Descending | Select-Object -First 6 | ForEach-Object { @{ name = [string]$_.ProcessName; mb = [math]::Round($_.WorkingSet64 / 1MB); cpuSec = [math]::Round([double]$_.CPU) } })
+  $topCpu = @(Get-Process -ErrorAction SilentlyContinue | Where-Object { $_.CPU } | Sort-Object CPU -Descending | Select-Object -First 6 | ForEach-Object { @{ name = [string]$_.ProcessName; mb = [math]::Round($_.WorkingSet64 / 1MB); cpuSec = [math]::Round([double]$_.CPU) } })
+  @{ os = [string]$os.Caption; build = [string]$os.BuildNumber; bootedAt = $os.LastBootUpTime.ToString('o'); memTotalMb = [math]::Round($os.TotalVisibleMemorySize / 1KB); memFreeMb = [math]::Round($os.FreePhysicalMemory / 1KB); cpuLoad = $load; cpu = [string]$cpu[0].Name; cores = [int](($cpu | Measure-Object -Property NumberOfLogicalProcessors -Sum).Sum); topMemory = $top; topCpu = $topCpu }
+}
+
+$out | ConvertTo-Json -Compress -Depth 6

package/src/pc-text.mjs

@@ -0,0 +1,94 @@
+// The questions on the PC (toast / fallback window) in the PC's language (config.json `language`,
+// en | ru — the same choice as the window). The bridge writes every question in English; this file
+// turns the fixed texts (headers, buttons, fixed sentences, the "auto-deny in 2 min" line) into
+// Russian just before they are shown. Commands, paths and names stay as they are.
+// LOGIC: critical-logic/bridge.md ("Questions on the PC: language").
+
+const RU = {
+  // headers (confirm.mjs HEAD, bridge.mjs, automations.mjs)
+  'ChatGPT wants to delete files': 'ChatGPT хочет удалить файлы',
+  'ChatGPT wants to run a system command': 'ChatGPT хочет выполнить системную команду',
+  'ChatGPT wants to change a file': 'ChatGPT хочет изменить файл',
+  'ChatGPT wants to move or rename': 'ChatGPT хочет переместить или переименовать',
+  'ChatGPT wants to run a command': 'ChatGPT хочет выполнить команду',
+  'ChatGPT wants to install or update a program': 'ChatGPT хочет установить или обновить программу',
+  'ChatGPT wants to schedule a script': 'ChatGPT хочет поставить сценарий на расписание',
+  'ChatGPT wants to change a scheduled script': 'ChatGPT хочет изменить сценарий на расписании',
+  'ChatGPT wants to do something your rules ask about': 'ChatGPT хочет сделать то, о чём просят спрашивать ваши правила',
+  'ChatGPT asks to stop confirming actions on this PC. Allow?': 'ChatGPT просит больше не спрашивать подтверждений на этом ПК. Разрешить?',
+  'Bridgerator settings file changed': 'Файл настроек Bridgerator изменён',
+  'ChatGPT suggests Bridgerator settings': 'ChatGPT предлагает настройки Bridgerator',
+  'ChatGPT wants to change Bridgerator settings': 'ChatGPT хочет изменить настройки Bridgerator',
+  'ChatGPT scheduled a script on this PC': 'ChatGPT поставил сценарий на расписание на этом ПК',
+  'Test notification': 'Пробное уведомление',
+  // fixed sentences
+  'After that, deletions and system commands run without asking you. Turn it back on any time: bridgerator.cmd confirm on': 'После этого удаление и системные команды выполняются без вопроса. Включить снова можно в любой момент: bridgerator.cmd confirm on',
+  'Too many changes for a notification — review them in the Bridgerator window.': 'Слишком много изменений для уведомления — посмотрите их в окне Bridgerator.',
+  'Every task in the Bridgerator queue will be removed.': 'Все задачи в очереди Bridgerator будут удалены.',
+  'Bridgerator paused itself. Continue? No answer = it stays paused.': 'Bridgerator поставил себя на паузу. Продолжить? Нет ответа = пауза остаётся.',
+  'This is how Bridgerator asks before risky actions. Nothing will run.': 'Так Bridgerator спрашивает перед рискованными действиями. Ничего не будет выполнено.',
+  // buttons
+  Allow: 'Разрешить', 'Allow 10 min': 'Разрешить на 10 мин', 'Allow always': 'Разрешать всегда', Deny: 'Запретить',
+  Apply: 'Применить', Keep: 'Оставить', Cancel: 'Отмена', Clear: 'Очистить', Continue: 'Продолжить', 'Keep paused': 'Оставить паузу',
+  Delete: 'Удалить', Show: 'Показать', 'Turn off': 'Выключить', 'Allow all': 'Разрешить всё', 'Review…': 'Просмотреть…',
+};
+// "auto-deny in 2 min": the word for what happens without an answer.
+const AUTO_RU = { 'auto-deny': 'авто-запрет', 'auto-cancel': 'авто-отмена', 'auto-keep': 'авто-сохранение', closes: 'закроется' };
+// What a changed confirm.ini would turn off (confirm.mjs weakerBy / LABEL).
+const OFF_RU = {
+  confirmations: 'подтверждения', 'your own patterns': 'ваши шаблоны',
+  'confirmations for deletions': 'подтверждения удаления', 'confirmations for system commands': 'подтверждения системных команд',
+  'confirmations for file changes': 'подтверждения изменения файлов', 'confirmations for moves and renames': 'подтверждения перемещений',
+  'confirmations for commands': 'подтверждения команд', 'confirmations for installing programs': 'подтверждения установки программ',
+  'confirmations for scheduled scripts': 'подтверждения сценариев на расписании',
+};
+const PLAN_VERB_RU = { move: 'переместить', write: 'записать', edit: 'изменить', create: 'создать', run: 'выполнить', do: 'выполнить' };
+/** Russian plural: forms = [1 файл, 2 файла, 5 файлов] → the form for n. */
+export function ruPlural(n, [one, few, many]) {
+  const a = Math.abs(Math.trunc(n)) % 100, b = a % 10;
+  return a >= 11 && a <= 14 ? many : b === 1 ? one : b >= 2 && b <= 4 ? few : many;
+}
+// Plan card nouns (batch.mjs): after the verb ("переместить 1 файл", "выполнить 2 команды") and in the
+// mixed list ("214 перемещений, 1 команда"). English singular/plural both map to one entry.
+const PLAN_OBJ_RU = { file: ['файл', 'файла', 'файлов'], folder: ['папку', 'папки', 'папок'], command: ['команду', 'команды', 'команд'], action: ['действие', 'действия', 'действий'] };
+const PLAN_LIST_RU = { move: ['перемещение', 'перемещения', 'перемещений'], write: ['запись', 'записи', 'записей'], edit: ['правка', 'правки', 'правок'], 'new folder': ['новая папка', 'новые папки', 'новых папок'], command: ['команда', 'команды', 'команд'] };
+const planCount = (n, word, forms) => { const f = forms[word.replace(/s$/, '')]; return f ? `${n} ${ruPlural(Number(n), f)}` : null; };
+
+/** One English text → Russian (unknown text stays English). */
+export function ruText(t) {
+  if (typeof t !== 'string' || !t) return t;
+  if (Object.hasOwn(RU, t)) return RU[t];
+  let m;
+  if ((m = /^Turn off (.+)\?$/.exec(t))) return `Выключить: ${m[1].split(', ').map((x) => OFF_RU[x] || x).join(', ')}?`;
+  if ((m = /^Apply: (.+)\?$/s.exec(t))) return `Применить: ${m[1]}?`;
+  if ((m = /^ChatGPT wants to clear (\d+) tasks?$/.exec(t))) return `ChatGPT хочет удалить задачи из очереди: ${m[1]}`;
+  if ((m = /^ChatGPT deleted or moved (\d+) files in a minute$/.exec(t))) return `ChatGPT удалил или переместил файлов за минуту: ${m[1]}`;
+  if ((m = /^ChatGPT wants to delete (\d+) items? for good$/.exec(t))) return `ChatGPT хочет удалить безвозвратно: ${m[1]}`;
+  if ((m = /^No Recycle Bin on that drive: (.*)$/s.exec(t))) return `На этом диске нет Корзины: ${m[1]}`;
+  // Plan card (batch.mjs headline): "ChatGPT wants to move 214 files" / "… to do 220 actions (214 moves, 6 commands)".
+  if ((m = /^ChatGPT wants to (move|write|edit|create|run|do) (\d+) ([a-z ]+?)( \((.+)\))?$/.exec(t))) {
+    const head = planCount(m[2], m[3], PLAN_OBJ_RU);
+    const list = m[5] ? m[5].split(', ').map((x) => { const p = /^(\d+) ([a-z ]+)$/.exec(x); return p && planCount(p[1], p[2], PLAN_LIST_RU); }) : [];
+    if (head && !list.includes(null)) return `ChatGPT хочет ${PLAN_VERB_RU[m[1]]} ${head}${list.length ? ` (${list.join(', ')})` : ''}`;
+  }
+  return t;
+}
+
+/** The attribution line under a question: "PC-NAME · auto-deny in 2 min". */
+export function attrLine(host, auto, secs, lang) {
+  const ru = lang === 'ru';
+  const when = secs >= 120 && secs % 60 === 0 ? `${secs / 60} ${ru ? 'мин' : 'min'}` : `${secs} ${ru ? 'с' : 's'}`;
+  return `${host} · ${ru ? AUTO_RU[auto] || auto : auto} ${ru ? 'через' : 'in'} ${when}`;
+}
+
+/** A question as it is shown on a PC with language `lang` (head, text, button labels, auto word). */
+export function localizeAsk(q, lang) {
+  if (lang !== 'ru') return q;
+  return {
+    ...q,
+    head: ruText(q.head),
+    text: ruText(q.text),
+    buttons: (q.buttons || []).map(([k, label, kind]) => [k, ruText(label), kind]),
+    auto: q.auto ? AUTO_RU[q.auto] || q.auto : q.auto,
+  };
+}

package/src/pdf-font.mjs

@@ -0,0 +1,245 @@
+// LOGIC: see critical-logic/bridge.md ("Extra tools" → create_document). A tiny TrueType reader for
+// PDF output with the fonts every Windows PC has (Segoe UI / Arial / Tahoma): metrics for layout, a
+// subset with only the glyphs used (glyph ids kept, other outlines dropped → a small file), and an
+// object with the fields pdf-lib's custom-font embedder reads (it normally takes @pdf-lib/fontkit,
+// which is not installed — this replaces it for plain left-to-right text, no shaping / kerning).
+import fs from 'node:fs';
+import path from 'node:path';
+
+export class FontError extends Error { constructor(m) { super(m); this.code = 'FONT'; } }
+
+const tag = (b, o) => String.fromCharCode(b[o], b[o + 1], b[o + 2], b[o + 3]);
+
+/** Parses a .ttf (glyf outlines; CFF / collections are refused). */
+export function parseTtf(bytes) {
+  const b = Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+  if (b.length < 12) throw new FontError('not a font file');
+  const ver = b.readUInt32BE(0);
+  if (ver !== 0x00010000 && tag(b, 0) !== 'true') throw new FontError('only TrueType (.ttf) fonts are supported');
+  const n = b.readUInt16BE(4), tables = {};
+  for (let i = 0; i < n; i++) {
+    const o = 12 + i * 16;
+    const off = b.readUInt32BE(o + 8), len = b.readUInt32BE(o + 12);
+    if (off + len > b.length) throw new FontError('broken font file');
+    tables[tag(b, o)] = b.subarray(off, off + len);
+  }
+  for (const t of ['head', 'hhea', 'maxp', 'hmtx', 'loca', 'glyf', 'cmap']) if (!tables[t]) throw new FontError(`font has no ${t} table`);
+  const head = tables.head, hhea = tables.hhea;
+  const unitsPerEm = head.readUInt16BE(18);
+  const bbox = { minX: head.readInt16BE(36), minY: head.readInt16BE(38), maxX: head.readInt16BE(40), maxY: head.readInt16BE(42) };
+  const macStyle = head.readUInt16BE(44);
+  const locFmt = head.readInt16BE(50);
+  const numGlyphs = tables.maxp.readUInt16BE(4);
+  const nHM = hhea.readUInt16BE(34);
+  const hmtx = tables.hmtx;
+  const advance = (g) => hmtx.readUInt16BE(4 * Math.min(g, nHM - 1));
+  const cmap = readCmap(tables.cmap);
+  const post = tables.post;
+  const os2 = tables['OS/2'];
+  const os2v = os2 ? os2.readUInt16BE(0) : 0;
+  const loca = (g) => (locFmt ? tables.loca.readUInt32BE(4 * g) : tables.loca.readUInt16BE(2 * g) * 2);
+  return {
+    tables, unitsPerEm, bbox, numGlyphs, cmap, advance, loca,
+    ascent: hhea.readInt16BE(4), descent: hhea.readInt16BE(6),
+    italicAngle: post ? post.readInt32BE(4) / 65536 : 0,
+    isFixedPitch: post ? post.readUInt32BE(12) !== 0 : false,
+    familyClass: os2 && os2.length > 32 ? os2.readInt16BE(30) : 0,
+    xHeight: os2 && os2v >= 2 && os2.length > 90 ? os2.readInt16BE(86) : 0,
+    capHeight: os2 && os2v >= 2 && os2.length > 90 ? os2.readInt16BE(88) : 0,
+    italic: (macStyle & 2) !== 0, bold: (macStyle & 1) !== 0,
+    postscriptName: psName(tables.name),
+  };
+}
+
+function readCmap(t) {
+  const n = t.readUInt16BE(2);
+  const subs = [];
+  for (let i = 0; i < n; i++) {
+    const o = 4 + i * 8;
+    subs.push({ pid: t.readUInt16BE(o), eid: t.readUInt16BE(o + 2), off: t.readUInt32BE(o + 4) });
+  }
+  const pick = (pid, eid, fmt) => subs.find((s) => s.pid === pid && s.eid === eid && s.off + 2 <= t.length && t.readUInt16BE(s.off) === fmt);
+  const s12 = pick(3, 10, 12) || pick(0, 4, 12) || pick(0, 6, 12);
+  const map = new Map();
+  if (s12) {
+    const o = s12.off, groups = t.readUInt32BE(o + 12);
+    for (let i = 0; i < groups && o + 16 + i * 12 + 12 <= t.length; i++) {
+      const g = o + 16 + i * 12;
+      const start = t.readUInt32BE(g), end = Math.min(t.readUInt32BE(g + 4), start + 0x10000), gid = t.readUInt32BE(g + 8);
+      for (let c = start; c <= end; c++) if (gid + c - start) map.set(c, gid + c - start);
+    }
+    return map;
+  }
+  const s4 = pick(3, 1, 4) || pick(0, 3, 4) || pick(0, 4, 4) || pick(0, 1, 4);
+  if (!s4) throw new FontError('font has no Unicode character map');
+  const o = s4.off, segX2 = t.readUInt16BE(o + 6), segs = segX2 / 2;
+  const ends = o + 14, starts = ends + segX2 + 2, deltas = starts + segX2, ranges = deltas + segX2;
+  for (let i = 0; i < segs; i++) {
+    const end = t.readUInt16BE(ends + 2 * i), start = t.readUInt16BE(starts + 2 * i);
+    const delta = t.readInt16BE(deltas + 2 * i), ro = t.readUInt16BE(ranges + 2 * i);
+    for (let c = start; c <= end && c !== 0xffff; c++) {
+      let g;
+      if (!ro) g = (c + delta) & 0xffff;
+      else {
+        const at = ranges + 2 * i + ro + 2 * (c - start);
+        if (at + 2 > t.length) continue;
+        g = t.readUInt16BE(at);
+        if (g) g = (g + delta) & 0xffff;
+      }
+      if (g) map.set(c, g);
+    }
+  }
+  return map;
+}
+
+function psName(t) {
+  if (!t) return 'Font';
+  const count = t.readUInt16BE(2), strOff = t.readUInt16BE(4);
+  for (let i = 0; i < count; i++) {
+    const o = 6 + i * 12;
+    const pid = t.readUInt16BE(o), nameId = t.readUInt16BE(o + 6), len = t.readUInt16BE(o + 8), off = t.readUInt16BE(o + 10);
+    if (nameId !== 6) continue;
+    const raw = t.subarray(strOff + off, strOff + off + len);
+    let s = '';
+    if (pid === 3 || pid === 0) for (let k = 0; k + 1 < raw.length; k += 2) s += String.fromCharCode(raw.readUInt16BE(k));
+    else s = raw.toString('latin1');
+    s = s.replace(/[^A-Za-z0-9-]/g, '');
+    if (s) return s.slice(0, 60);
+  }
+  return 'Font';
+}
+
+const pad4 = (buf) => (buf.length % 4 ? Buffer.concat([buf, Buffer.alloc(4 - (buf.length % 4))]) : buf);
+function checksum(buf) {
+  const p = pad4(buf);
+  let s = 0;
+  for (let i = 0; i < p.length; i += 4) s = (s + p.readUInt32BE(i)) >>> 0;
+  return s;
+}
+
+/**
+ * A new .ttf with the same glyph ids but only the outlines of `codePoints` (plus composite parts
+ * and .notdef), a cmap of only those characters, post format 3 (no glyph names).
+ */
+export function subsetTtf(font, codePoints) {
+  const { tables, numGlyphs, loca } = font;
+  const glyf = tables.glyf;
+  const keep = new Set([0]);
+  const map = [];
+  for (const c of codePoints) { const g = font.cmap.get(c); if (g) { map.push([c, g]); keep.add(g); } }
+  // Composite glyphs reference other glyphs: keep those too.
+  const stack = [...keep];
+  while (stack.length) {
+    const g = stack.pop();
+    const s = loca(g), e = loca(g + 1);
+    if (e - s < 10 || glyf.readInt16BE(s) >= 0) continue;
+    let o = s + 10;
+    for (let guard = 0; guard < 64 && o + 4 <= e; guard++) {
+      const flags = glyf.readUInt16BE(o), comp = glyf.readUInt16BE(o + 2);
+      if (comp < numGlyphs && !keep.has(comp)) { keep.add(comp); stack.push(comp); }
+      o += 4 + (flags & 1 ? 4 : 2) + (flags & 8 ? 2 : flags & 0x40 ? 4 : flags & 0x80 ? 8 : 0);
+      if (!(flags & 0x20)) break;
+    }
+  }
+  const parts = [], newLoca = Buffer.alloc(4 * (numGlyphs + 1));
+  let at = 0;
+  for (let g = 0; g < numGlyphs; g++) {
+    newLoca.writeUInt32BE(at, 4 * g);
+    if (!keep.has(g)) continue;
+    const s = loca(g), e = loca(g + 1);
+    if (e > s) { const d = pad4(Buffer.from(glyf.subarray(s, e))); parts.push(d); at += d.length; }
+  }
+  newLoca.writeUInt32BE(at, 4 * numGlyphs);
+  // cmap: one format-12 subtable (3,10) with the used characters, as consecutive groups.
+  map.sort((a, b) => a[0] - b[0]);
+  const groups = [];
+  for (const [c, g] of map) {
+    const last = groups[groups.length - 1];
+    if (last && c === last[1] + 1 && g === last[2] + (c - last[0])) last[1] = c; else groups.push([c, c, g]);
+  }
+  const cmap = Buffer.alloc(12 + 16 + groups.length * 12);
+  cmap.writeUInt16BE(0, 0); cmap.writeUInt16BE(1, 2);
+  cmap.writeUInt16BE(3, 4); cmap.writeUInt16BE(10, 6); cmap.writeUInt32BE(12, 8);
+  cmap.writeUInt16BE(12, 12); cmap.writeUInt32BE(16 + groups.length * 12, 16); cmap.writeUInt32BE(groups.length, 24);
+  groups.forEach(([s, e, g], i) => { cmap.writeUInt32BE(s, 28 + i * 12); cmap.writeUInt32BE(e, 32 + i * 12); cmap.writeUInt32BE(g, 36 + i * 12); });
+  const head = Buffer.from(tables.head);
+  head.writeUInt32BE(0, 8);           // checkSumAdjustment, set below
+  head.writeInt16BE(1, 50);           // long loca
+  const post = Buffer.alloc(32);
+  if (tables.post) tables.post.copy(post, 0, 0, Math.min(32, tables.post.length));
+  post.writeUInt32BE(0x00030000, 0);
+  const out = { head, hhea: tables.hhea, maxp: tables.maxp, hmtx: tables.hmtx, loca: newLoca, glyf: Buffer.concat(parts), cmap, post };
+  for (const t of ['OS/2', 'name', 'cvt ', 'fpgm', 'prep']) if (tables[t]) out[t] = tables[t];
+  const tags = Object.keys(out).sort();
+  const n = tags.length;
+  let sr = 1, es = 0;
+  while (sr * 2 <= n) { sr *= 2; es++; }
+  const dir = Buffer.alloc(12 + 16 * n);
+  dir.writeUInt32BE(0x00010000, 0); dir.writeUInt16BE(n, 4); dir.writeUInt16BE(sr * 16, 6); dir.writeUInt16BE(es, 8); dir.writeUInt16BE(n * 16 - sr * 16, 10);
+  let off = dir.length;
+  const bodies = [];
+  tags.forEach((t, i) => {
+    const data = out[t];
+    const o = 12 + 16 * i;
+    dir.write(t, o, 4, 'latin1'); dir.writeUInt32BE(checksum(data), o + 4); dir.writeUInt32BE(off, o + 8); dir.writeUInt32BE(data.length, o + 12);
+    const padded = pad4(Buffer.from(data));
+    bodies.push(padded); off += padded.length;
+  });
+  const file = Buffer.concat([dir, ...bodies]);
+  const headAt = dir.readUInt32BE(12 + 16 * tags.indexOf('head') + 8);
+  file.writeUInt32BE((0xb1b0afba - checksum(file)) >>> 0, headAt + 8);
+  return new Uint8Array(file.buffer, file.byteOffset, file.length);
+}
+
+/**
+ * What pdf-lib's CustomFontEmbedder / deriveFontFlags read from a fontkit font. characterSet = every
+ * character of the (subset) cmap, so the widths and ToUnicode cover exactly the used characters.
+ */
+export function fontkitFont(bytes) {
+  const f = parseTtf(bytes);
+  const glyphs = new Map();
+  const glyph = (id, cp) => {
+    let g = glyphs.get(id);
+    if (!g) { g = { id, advanceWidth: f.advance(id), codePoints: cp === undefined ? [] : [cp] }; glyphs.set(id, g); }
+    return g;
+  };
+  const characterSet = [...f.cmap.keys()].sort((a, b) => a - b);
+  for (const c of characterSet) glyph(f.cmap.get(c), c);
+  const forCp = (c) => (f.cmap.has(c) ? glyph(f.cmap.get(c), c) : glyph(0));
+  return {
+    characterSet, unitsPerEm: f.unitsPerEm, postscriptName: f.postscriptName, bbox: f.bbox,
+    ascent: f.ascent, descent: f.descent, capHeight: f.capHeight, xHeight: f.xHeight, italicAngle: f.italicAngle, cff: false,
+    post: { isFixedPitch: f.isFixedPitch }, head: { macStyle: { italic: f.italic, bold: f.bold } }, 'OS/2': { sFamilyClass: f.familyClass },
+    glyphForCodePoint: forCp,
+    layout: (text) => ({ glyphs: Array.from(String(text), (ch) => forCp(ch.codePointAt(0))), positions: [] }),
+  };
+}
+/** pdfDoc.registerFontkit(MINI_FONTKIT). */
+export const MINI_FONTKIT = { create: (bytes) => fontkitFont(bytes) };
+
+// System fonts, best first; each family: regular, bold, italic, bold italic (missing ones fall back).
+const FAMILIES = [
+  ['segoeui.ttf', 'segoeuib.ttf', 'segoeuii.ttf', 'segoeuiz.ttf'],
+  ['arial.ttf', 'arialbd.ttf', 'ariali.ttf', 'arialbi.ttf'],
+  ['tahoma.ttf', 'tahomabd.ttf'],
+  ['verdana.ttf', 'verdanab.ttf', 'verdanai.ttf', 'verdanaz.ttf'],
+];
+const MONO = ['consola.ttf', 'cour.ttf', 'lucon.ttf'];
+export const fontDir = (env = process.env) => path.join(env.WINDIR || env.SystemRoot || 'C:\\Windows', 'Fonts');
+
+/** → { r, b, i, bi, m } parsed fonts (keys missing → fall back to r / b), or throws FontError. */
+export function loadSystemFonts(dir = fontDir()) {
+  const load = (name) => {
+    try { const bytes = fs.readFileSync(path.join(dir, name)); const f = parseTtf(bytes); return f.cmap.has(0x410) ? f : null; } catch { return null; }
+  };
+  for (const [r, b, i, bi] of FAMILIES) {
+    const reg = load(r);
+    if (!reg) continue;
+    const out = { r: reg, b: (b && load(b)) || reg };
+    out.i = (i && load(i)) || reg;
+    out.bi = (bi && load(bi)) || out.b;
+    out.m = MONO.map(load).find(Boolean) || reg;
+    return out;
+  }
+  throw new FontError(`no usable system font (Segoe UI, Arial, Tahoma or Verdana) in ${dir}`);
+}