cli-jaw 2.17.57 → 2.17.58

package/scripts/notarize-mac-dmg.mjs

@@ -0,0 +1,207 @@
+#!/usr/bin/env node
+/**
+ * Notarize and staple the signed macOS disk image, then re-describe it.
+ *
+ * electron-builder 25.1.8 notarizes and staples the app bundle, and with
+ * `dmg.sign` it signs the disk image, but it never notarizes the disk image.
+ * A user who downloads the DMG therefore opens a container Gatekeeper cannot
+ * vouch for: `spctl --type open` rejects it and the stapler finds no ticket.
+ *
+ * Stapling is the part that needs care. dmg-builder hashes the DMG into its
+ * blockmap immediately after signing it (dmg-builder/out/dmg.js:62-67) and
+ * that hash is what lands in latest-mac.yml. Stapling appends the ticket to
+ * the file, so every description written before it (the DMG entry in
+ * latest-mac.yml and the .blockmap next to the DMG) would describe bytes that
+ * no longer exist. This script rebuilds both from the stapled file with the
+ * same app-builder command electron-builder uses, and only touches the DMG
+ * entry: the ZIP entry and the legacy top-level path/sha512 fields are the
+ * updater payload and must stay byte-for-byte what electron-builder wrote.
+ *
+ * Every step fails closed. A DMG that is unsigned, signed by another team,
+ * rejected by the notary service, or not stapled stops the release here
+ * instead of being uploaded as if it were trusted.
+ */
+import childProcess from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { existsSync, readdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { basename, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { parseDocument } from 'yaml';
+
+const projectRoot = resolve(fileURLToPath(import.meta.url), '..', '..');
+const CREDENTIAL_NAMES = ['APPLE_ID', 'APPLE_APP_SPECIFIC_PASSWORD', 'APPLE_TEAM_ID'];
+
+function defaultRun(cmd, args) {
+  const result = childProcess.spawnSync(cmd, args, { encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 });
+  return {
+    status: result.status,
+    stdout: result.stdout ?? '',
+    stderr: result.stderr ?? '',
+    error: result.error ?? null,
+  };
+}
+
+/** Locate the one DMG electron-builder produced; anything else is ambiguous. */
+export function findDiskImage(distDir) {
+  if (!existsSync(distDir)) throw new Error(`No build output directory at ${distDir}`);
+  const images = readdirSync(distDir).filter(name => name.endsWith('.dmg'));
+  if (images.length !== 1) {
+    throw new Error(`Expected exactly one .dmg in ${distDir}, found ${images.length}${images.length ? `: ${images.join(', ')}` : ''}`);
+  }
+  return join(distDir, images[0]);
+}
+
+function requireCredentials(env) {
+  const missing = CREDENTIAL_NAMES.filter(name => !String(env[name] ?? '').trim());
+  if (missing.length > 0) throw new Error(`Missing notarization credential(s): ${missing.join(', ')}`);
+  return {
+    appleId: String(env['APPLE_ID']).trim(),
+    password: String(env['APPLE_APP_SPECIFIC_PASSWORD']).trim(),
+    teamId: String(env['APPLE_TEAM_ID']).trim(),
+  };
+}
+
+function outputOf(result) {
+  return `${result.stdout ?? ''}${result.stderr ?? ''}${result.error ? result.error.message : ''}`;
+}
+
+/** Keep the app-specific password out of every message this script can print. */
+function redactor(secret) {
+  return text => (secret ? String(text).split(secret).join('[redacted]') : String(text));
+}
+
+function sha512Base64(path) {
+  return createHash('sha512').update(readFileSync(path)).digest('base64');
+}
+
+export function resolveAppBuilder() {
+  const electronRequire = createRequire(join(projectRoot, 'electron', 'package.json'));
+  const { appBuilderPath } = electronRequire('app-builder-bin');
+  if (!appBuilderPath || !existsSync(appBuilderPath)) {
+    throw new Error(`app-builder binary not found at ${String(appBuilderPath)}; run npm ci --prefix electron`);
+  }
+  return appBuilderPath;
+}
+
+/**
+ * Rewrite only the DMG entry of latest-mac.yml. Returns false when the
+ * metadata does not list the DMG at all, which leaves nothing stale to fix.
+ */
+export function updateDiskImageMetadata(metadataPath, dmgName, { sha512, size }) {
+  const doc = parseDocument(readFileSync(metadataPath, 'utf8'));
+  if (doc.errors.length > 0) throw new Error(`Cannot parse YAML at ${metadataPath}: ${doc.errors[0].message}`);
+  if (doc.get('path') === dmgName) {
+    throw new Error(`latest-mac.yml names the DMG as the update payload; expected the ZIP`);
+  }
+  const files = doc.get('files');
+  const items = files?.items ?? [];
+  const matches = items.filter(item => item?.get?.('url') === dmgName);
+  if (matches.length > 1) throw new Error(`latest-mac.yml lists ${dmgName} more than once`);
+  if (matches.length === 0) return false;
+  matches[0].set('sha512', sha512);
+  matches[0].set('size', size);
+  writeFileSync(metadataPath, doc.toString());
+  return true;
+}
+
+export function notarizeMacDiskImage(options = {}) {
+  const run = options.run ?? defaultRun;
+  const env = options.env ?? process.env;
+  const distDir = resolve(options.distDir ?? join(projectRoot, 'electron', 'dist'));
+  const dmgPath = options.dmgPath ? resolve(options.dmgPath) : findDiskImage(distDir);
+  const metadataPath = options.metadataPath ?? join(distDir, 'latest-mac.yml');
+  const credentials = requireCredentials(env);
+  const redact = redactor(credentials.password);
+  const expectedTeam = String(options.expectedTeamId ?? env['EXPECTED_APPLE_TEAM_ID'] ?? '').trim() || null;
+  const log = options.log ?? (message => console.log(message));
+
+  if (!existsSync(dmgPath)) throw new Error(`No disk image at ${dmgPath}`);
+  if (expectedTeam && credentials.teamId !== expectedTeam) {
+    throw new Error('APPLE_TEAM_ID does not match the expected release signing team');
+  }
+
+  // 1. The DMG must already carry our Developer ID signature. dmg-builder
+  // skips signing silently when it cannot find an identity.
+  const info = run('/usr/bin/codesign', ['-dv', '--verbose=2', dmgPath]);
+  const infoText = outputOf(info);
+  if (info.error || info.status !== 0) throw new Error(`codesign -dv failed for ${dmgPath}:\n${infoText.trim()}`);
+  if (!/Authority=Developer ID Application:/.test(infoText)) {
+    throw new Error(`${basename(dmgPath)} is not signed with a Developer ID Application certificate`);
+  }
+  const signedTeam = (infoText.match(/TeamIdentifier=(\S+)/) ?? [, '(unknown)'])[1];
+  if (signedTeam !== credentials.teamId) {
+    throw new Error(`${basename(dmgPath)} is signed by team "${signedTeam}", not the notarizing team`);
+  }
+  if (!/^Timestamp=/m.test(infoText)) throw new Error(`${basename(dmgPath)} signature has no secure timestamp`);
+
+  // 2. Submit and wait for the notary verdict.
+  log(`[notarize-mac-dmg] submitting ${basename(dmgPath)}`);
+  const submit = run('/usr/bin/xcrun', [
+    'notarytool', 'submit', dmgPath,
+    '--apple-id', credentials.appleId,
+    '--password', credentials.password,
+    '--team-id', credentials.teamId,
+    '--wait', '--timeout', '45m',
+    '--output-format', 'json',
+  ]);
+  let verdict = null;
+  try { verdict = JSON.parse(submit.stdout); } catch { verdict = null; }
+  if (submit.error || verdict?.status !== 'Accepted') {
+    let detail = redact(outputOf(submit).trim());
+    if (typeof verdict?.id === 'string' && /^[0-9a-f-]{36}$/i.test(verdict.id)) {
+      const notaryLog = run('/usr/bin/xcrun', [
+        'notarytool', 'log', verdict.id,
+        '--apple-id', credentials.appleId,
+        '--password', credentials.password,
+        '--team-id', credentials.teamId,
+      ]);
+      detail += `\n\nnotary log:\n${redact(outputOf(notaryLog).trim())}`;
+    }
+    throw new Error(`notarization of ${basename(dmgPath)} was not accepted (status: ${String(verdict?.status ?? 'unknown')})\n${detail}`);
+  }
+  log(`[notarize-mac-dmg] accepted (submission ${verdict.id})`);
+
+  // 3. Staple so the first open works offline, then prove the ticket is there.
+  const staple = run('/usr/bin/xcrun', ['stapler', 'staple', dmgPath]);
+  if (staple.error || staple.status !== 0) throw new Error(`stapler staple failed:\n${outputOf(staple).trim()}`);
+  const validate = run('/usr/bin/xcrun', ['stapler', 'validate', dmgPath]);
+  if (validate.error || validate.status !== 0) throw new Error(`stapler validate failed:\n${outputOf(validate).trim()}`);
+
+  // 4. Rebuild the blockmap from the stapled bytes, exactly as electron-builder does.
+  const appBuilder = options.appBuilderPath ?? resolveAppBuilder();
+  const blockmapPath = `${dmgPath}.blockmap`;
+  const blockmap = run(appBuilder, ['blockmap', '--input', dmgPath, '--output', blockmapPath]);
+  if (blockmap.error || blockmap.status !== 0) throw new Error(`app-builder blockmap failed:\n${outputOf(blockmap).trim()}`);
+  let described;
+  try { described = JSON.parse(blockmap.stdout); } catch { described = null; }
+  const actualSize = statSync(dmgPath).size;
+  const actualHash = sha512Base64(dmgPath);
+  if (described?.size !== actualSize || described?.sha512 !== actualHash) {
+    throw new Error('app-builder blockmap description does not match the stapled disk image');
+  }
+
+  // 5. Point the DMG entry of latest-mac.yml at the stapled bytes.
+  const metadataUpdated = existsSync(metadataPath)
+    ? updateDiskImageMetadata(metadataPath, basename(dmgPath), { sha512: actualHash, size: actualSize })
+    : false;
+
+  return { dmgPath, blockmapPath, metadataPath, metadataUpdated, submissionId: verdict.id, sha512: actualHash, size: actualSize };
+}
+
+function main() {
+  try {
+    const report = notarizeMacDiskImage({ dmgPath: process.argv[2] });
+    console.log('[notarize-mac-dmg] OK');
+    console.log(`  dmg       ${report.dmgPath}`);
+    console.log(`  stapled   yes`);
+    console.log(`  blockmap  ${report.blockmapPath}`);
+    console.log(`  metadata  ${report.metadataUpdated ? 'DMG entry updated' : 'no DMG entry'}`);
+    console.log(`  sha512    ${report.sha512}`);
+  } catch (error) {
+    console.error(`\n[notarize-mac-dmg] FAIL: ${error instanceof Error ? error.message : String(error)}\n`);
+    process.exit(1);
+  }
+}
+
+if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) main();

package/scripts/verify-electron-update-metadata.mjs

@@ -73,6 +73,25 @@ export function verifyElectronUpdateMetadata(options = {}) {
     throw new Error('Legacy macOS update metadata fields do not match files[0]');
   }
 
+  // The other entries (the DMG) are not the updater payload, but they are
+  // published next to it and describe bytes users download. The DMG is
+  // stapled after electron-builder hashed it, so a stale description here
+  // means the post-staple metadata repair did not run or did not stick.
+  const otherArtifacts = [];
+  for (const file of metadata.files) {
+    if (file === entry) continue;
+    const artifactPath = join(distDir, file.url);
+    if (!existsSync(artifactPath)) throw new Error(`Missing listed update artifact: ${artifactPath}`);
+    const size = statSync(artifactPath).size;
+    if (file.size !== size) {
+      throw new Error(`${file.url} size mismatch: metadata=${String(file.size)} actual=${size}`);
+    }
+    if (file.sha512 !== sha512(artifactPath)) {
+      throw new Error(`${file.url} SHA-512 does not match update metadata`);
+    }
+    otherArtifacts.push(artifactPath);
+  }
+
   const provider = readYaml(appUpdatePath);
   for (const [key, expected] of Object.entries(EXPECTED_PROVIDER)) {
     if (provider?.[key] !== expected) {
@@ -80,7 +99,7 @@ export function verifyElectronUpdateMetadata(options = {}) {
     }
   }
 
-  return { metadataPath, zipPath, blockmapPath, version, sha512: actualHash };
+  return { metadataPath, zipPath, blockmapPath, version, sha512: actualHash, otherArtifacts };
 }
 
 function main() {
@@ -95,6 +114,7 @@ function main() {
     console.log(`  zip       ${report.zipPath}`);
     console.log(`  blockmap  ${report.blockmapPath}`);
     console.log(`  sha512    ${report.sha512}`);
+    for (const artifact of report.otherArtifacts) console.log(`  listed    ${artifact} (hash matches)`);
   } catch (error) {
     console.error(`\n[verify-electron-update-metadata] FAIL: ${error instanceof Error ? error.message : String(error)}\n`);
     process.exit(1);

package/scripts/verify-mac-signature.mjs

@@ -15,8 +15,8 @@
  * code of the step that produced it.
  */
 import childProcess from 'node:child_process';
-import { existsSync } from 'node:fs';
-import { resolve } from 'node:path';
+import { existsSync, readdirSync } from 'node:fs';
+import { join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 /** Capture stdout and stderr because macOS security tools report on stderr. */
@@ -112,7 +112,90 @@ function normalizeExpectedTeam(value) {
   return normalized || null;
 }
 
+/**
+ * The disk image users download is a separate trust decision from the app
+ * inside it. Gatekeeper assesses a quarantined DMG with the `open` operation
+ * and the primary-signature context; an unsigned image reports "no usable
+ * signature" and a signed but unnotarized one reports "Unnotarized Developer
+ * ID". Only a notarized, stapled Developer ID image passes offline.
+ */
+export function verifyMacDiskImage(options = {}) {
+  const dmgPath = resolve(options.dmgPath ?? findDiskImage(options.distDir ?? 'electron/dist'));
+  const expectedTeamId = normalizeExpectedTeam(options.expectedTeamId ?? process.env['VERIFY_EXPECTED_TEAM_ID']);
+
+  if (!existsSync(dmgPath)) {
+    throw new Error(`No disk image at ${dmgPath}. Did the build step run?`);
+  }
+
+  const problems = [];
+  const info = probe('/usr/bin/codesign', ['-dv', '--verbose=4', dmgPath]);
+  if (!info.ok) {
+    problems.push(`codesign -dv failed:\n${info.text.trim()}`);
+  } else {
+    if (!/Authority=Developer ID Application:/.test(info.text)) {
+      problems.push('disk image is not signed with a Developer ID Application certificate');
+    }
+    if (!/^Timestamp=/m.test(info.text)) {
+      problems.push('disk image signature has no secure timestamp');
+    }
+  }
+
+  const teamId = (info.text.match(/TeamIdentifier=(\S+)/) ?? [, '(unknown)'])[1];
+  if (expectedTeamId && teamId !== expectedTeamId) {
+    problems.push(`disk image team "${teamId}" does not match expected team "${expectedTeamId}"`);
+  }
+
+  const strict = probe('/usr/bin/codesign', ['--verify', '--strict', '--verbose=2', dmgPath]);
+  if (!strict.ok) {
+    problems.push(`codesign --verify failed:\n${strict.text.trim()}`);
+  }
+
+  const assess = probe('/usr/sbin/spctl', [
+    '--assess', '--type', 'open', '--context', 'context:primary-signature', '--verbose=4', dmgPath,
+  ]);
+  if (!assess.ok || !/source=Notarized Developer ID/.test(assess.text)) {
+    problems.push(`spctl did not accept the disk image as notarized:\n${assess.text.trim()}`);
+  }
+
+  const staple = probe('/usr/bin/xcrun', ['stapler', 'validate', dmgPath]);
+  if (!staple.ok) {
+    problems.push(`disk image has no stapled notarization ticket:\n${staple.text.trim()}`);
+  }
+
+  if (problems.length > 0) {
+    throw new Error(`${dmgPath}\n\n  - ${problems.join('\n  - ')}`);
+  }
+
+  const authority = (info.text.match(/Authority=(.+)/) ?? [, '(unknown)'])[1].trim();
+  return { dmgPath, authority, teamId };
+}
+
+function findDiskImage(distDir) {
+  const dir = resolve(distDir);
+  if (!existsSync(dir)) throw new Error(`No build output directory at ${dir}`);
+  const images = readdirSync(dir).filter(name => name.endsWith('.dmg'));
+  if (images.length !== 1) {
+    throw new Error(`Expected exactly one .dmg in ${dir}, found ${images.length}`);
+  }
+  return join(dir, images[0]);
+}
+
 function main() {
+  if (process.argv[2] === '--dmg') {
+    try {
+      const report = verifyMacDiskImage({ dmgPath: process.argv[3] });
+      console.log('[verify-mac-signature] disk image OK');
+      console.log(`  dmg       ${report.dmgPath}`);
+      console.log(`  authority ${report.authority}`);
+      console.log(`  team      ${report.teamId}`);
+      console.log('  notarized yes');
+      console.log('  stapled   yes');
+    } catch (error) {
+      console.error(`\n[verify-mac-signature] FAIL: ${error instanceof Error ? error.message : String(error)}\n`);
+      process.exit(1);
+    }
+    return;
+  }
   try {
     const report = verifyMacSignature({ appPath: process.argv[2] });
     console.log('[verify-mac-signature] OK');

package/public/dist/assets/agent-meta-CkRJlOmN.js

@@ -1 +0,0 @@
-import{r as e,t}from"./cli-engine-NdU0lzs_.js";var n=[`gpt-5.5`,`gpt-5.4`,`gpt-5.4-mini`,`gpt-5.3-codex-spark`,`gpt-5.6-sol`,`gpt-5.6-terra`,`gpt-5.6-luna`],r=[`pi`,`claude`,`agy`,`codex`,`cursor`,`kiro-code`,`gemini`],i={agy:{label:`Antigravity`,models:[`Gemini 3.7 Flash (Medium)`,`Gemini 3.6 Flash (Medium)`],efforts:[],modelNote:`AGY model override is version-dependent. Observed AGY 1.1.13 supports --model; cli-jaw probes the installed binary and emits this field only when supported. Leave empty to use native AGY selection.`,effortNote:`AGY has no separate effort flag.`},pi:{label:`Pi`,defaultProvider:`progrok`,providers:[`progrok`],models:[`grok-composer-2.5-fast`,`grok-4.6`,`grok-4.5`,`grok-4.3`],efforts:[`low`,`medium`,`high`,`xhigh`,`max`],effortNote:`Pi runs through --mode rpc. grok-composer-2.5-fast is the verified default; bare grok-composer-2.5 currently has no team access.`},claude:{label:`Claude`,models:[`opus`,`sonnet`,`sonnet[1m]`,`haiku`,`claude-fable-5-1`,`claude-fable-5`,`claude-fable-5[1m]`,`claude-sonnet-5`,`claude-sonnet-5[1m]`,`claude-opus-5`,`claude-opus-5[1m]`,`claude-opus-4-8`,`claude-opus-4-8[1m]`,`claude-opus-4-7`,`claude-opus-4-7[1m]`,`claude-opus-4-6`,`claude-opus-4-6[1m]`,`claude-sonnet-4-6`,`claude-sonnet-4-6[1m]`,`claude-haiku-4-5`],efforts:[`low`,`medium`,`high`,`xhigh`,`max`]},codex:{label:`Codex`,models:n,efforts:[`low`,`medium`,`high`,`xhigh`]},"codex-app":{label:`Codex App`,models:n,efforts:[`low`,`medium`,`high`,`xhigh`]},cursor:{label:`Cursor`,models:`auto,composer-2.5,gpt-5.5,gpt-5.6-sol,gpt-5.6-terra,gpt-5.6-luna,gpt-5.4,gpt-5.4-mini,gpt-5.4-nano,gpt-5.3-codex,gpt-5.2,gpt-5.2-codex,gpt-5.1-codex-max,gpt-5.1-codex-mini,gpt-5.1,claude-sonnet-5,claude-fable-5,claude-fable-5-thinking,claude-opus-5,claude-opus-4-8,claude-opus-4-8-thinking,claude-opus-4-7,claude-opus-4-7-thinking,claude-4.6-opus,claude-4.6-sonnet,claude-4.5-opus-high,claude-4.5-sonnet,claude-4-sonnet,gemini-3.1-pro,gemini-3-flash,gemini-3-pro,gemini-3.5-flash,grok-4.6,grok-4.5,gpt-5-mini,glm-5.2,glm-5.3,gpt-5.5-extra,kimi-k2.7-code,kimi-k3,gemini-3.6-flash,gemini-3.7-flash`.split(`,`),efforts:[`none`,`none-fast`,`low`,`low-fast`,`medium`,`medium-fast`,`high`,`high-fast`,`xhigh`,`xhigh-fast`,`max`,`max-fast`],effortNote:`Cursor effort resolves to model IDs; no separate --effort flag`},"kiro-code":{label:`Kiro`,models:[`auto`,`gpt-5.6-sol`,`gpt-5.6-terra`,`gpt-5.6-luna`,`claude-fable-5`,`claude-sonnet-5`,`claude-opus-5`,`claude-opus-4.8`,`claude-opus-4.7`,`claude-opus-4.6`,`claude-sonnet-4.6`,`claude-opus-4.5`,`claude-sonnet-4.5`,`claude-sonnet-4`,`claude-haiku-4.5`,`deepseek-3.2`,`minimax-m2.5`,`minimax-m2.1`,`glm-5`,`qwen3-coder-next`],efforts:[`low`,`medium`,`high`,`xhigh`],effortNote:`Kiro CLI forwards --effort; cli-jaw maps xhigh to Kiro max on the wire`},gemini:{label:`Gemini`,models:[`gemini-3-pro-preview`,`gemini-2.5-pro`,`gemini-3-flash-preview`],efforts:[]},grok:{label:`Grok`,models:[`grok-build`,`grok-composer-2.5-fast`],efforts:[],effortNote:`unsupported by grok-build/composer; do not pass --effort`},opencode:{label:`OpenCode`,models:[`opencode-go/kimi-k2.7-code`,`opencode-go/glm-5.2`,`opencode-go/glm-5.1`,`opencode-go/kimi-k2.6`,`opencode-go/mimo-v2.5-pro`,`opencode-go/mimo-v2.5`,`opencode-go/minimax-m2.7`,`opencode-go/qwen3.7-plus`,`opencode-go/qwen3.6-plus`,`opencode-go/deepseek-v4-pro`,`opencode-go/deepseek-v4-flash`],efforts:[`minimal`,`low`,`high`,`max`]},copilot:{label:`Copilot`,models:[`gpt-5.6-sol`,`gpt-5.6-terra`,`gpt-5.6-luna`,`gpt-5.5`,`claude-fable-5`,`claude-opus-4.8`,`claude-opus-4.7`,`claude-sonnet-4.6`,`gpt-5.4`],efforts:[`low`,`medium`,`high`]}};function a(e){return Array.isArray(e)?e.filter(e=>typeof e==`string`):[]}function o(e){if(!e||typeof e!=`object`||Array.isArray(e))return;let t={};for(let[n,r]of Object.entries(e))t[n]=a(r);return t}function s(e){if(!e||typeof e!=`object`||Array.isArray(e))return;let t={};for(let[n,r]of Object.entries(e))typeof r==`string`&&(t[n]=r);return t}function c(e){if(!e||typeof e!=`object`||Array.isArray(e))return;let t={};for(let[n,r]of Object.entries(e)){let e=o(r);e&&(t[n]=e)}return t}function l(e){if(!e||typeof e!=`object`||Array.isArray(e))return;let t={};for(let[n,r]of Object.entries(e)){let e=s(r);e&&(t[n]=e)}return t}function u(e){if(!e||typeof e!=`object`||Array.isArray(e))return{};let n={};for(let[r,i]of Object.entries(e)){if(t(r)||!i||typeof i!=`object`||Array.isArray(i))continue;let e=i,u=o(e.modelsByProvider),d=o(e.effortsByProvider),f=o(e.effortsByModel),p=s(e.defaultEffortByModel),m=c(e.effortsByModelByProvider),h=l(e.defaultEffortByModelByProvider);n[r]={label:typeof e.label==`string`?e.label:r,models:a(e.models),efforts:a(e.efforts),...typeof e.defaultProvider==`string`?{defaultProvider:e.defaultProvider}:{},...e.providers?{providers:a(e.providers)}:{},...u?{modelsByProvider:u}:{},...d?{effortsByProvider:d}:{},...f?{effortsByModel:f}:{},...p?{defaultEffortByModel:p}:{},...m?{effortsByModelByProvider:m}:{},...h?{defaultEffortByModelByProvider:h}:{},...typeof e.modelSource==`string`?{modelSource:e.modelSource}:{},...typeof e.effortNote==`string`?{effortNote:e.effortNote}:{},...typeof e.modelNote==`string`?{modelNote:e.modelNote}:{}}}return n}function d(e,t,n,r){let i=(t||``).trim();if(r){let t=e.effortsByModelByProvider?.[r]?.[i];if(t)return t}return e.effortsByModel?.[i]||(n??e.efforts)}function f(e,t,n,r,i){let a=d(e,t,r,i);if(n&&a.includes(n))return n;let o=(t||``).trim(),s=(i?e.defaultEffortByModelByProvider?.[i]?.[o]:void 0)??e.defaultEffortByModel?.[o]??``;return a.includes(s)?s:``}function p(n,r){return t(n)?{label:e(n),models:[],efforts:[]}:r?.[n]||i[n]||{label:n,models:[],efforts:[]}}function m(e){return e.filter(e=>!t(e))}function h(e){let t=m(e),n=r.filter(e=>t.includes(e)),i=t.filter(e=>!r.includes(e));return[...n,...i]}function g(e,t={},n={}){return n[e]?.model||t[e]?.model||``}function _(e,t={},n={}){return n[e]?.effort||t[e]?.effort||``}function v(e,t=``){let n=new Set;t&&n.add(t);for(let t of e)n.add(t);return Array.from(n).map(e=>({value:e,label:e}))}export{p as a,h as c,m as d,d as i,_ as l,r as n,u as o,f as r,v as s,i as t,g as u};

package/public/dist/assets/bgtask-badge-DNOEtlYA.js

@@ -1 +0,0 @@
-import{r as e,t}from"./bgtask-badge-GHPSB8YA.js";export{t as applyBgtaskUpdate,e as refreshBgtaskBadge};

package/public/dist/assets/constants-DmRtjRj3.js

@@ -1 +0,0 @@
-import{n as e}from"./api-CUtiCd2-.js";import{t}from"./cli-engine-NdU0lzs_.js";var n={agy:{label:`Antigravity`,efforts:[],effortNote:`AGY has no separate effort flag`,models:[`Gemini 3.7 Flash (Medium)`,`Gemini 3.6 Flash (Medium)`]},claude:{label:`Claude`,efforts:[`low`,`medium`,`high`,`xhigh`,`max`],models:[`opus`,`sonnet`,`sonnet[1m]`,`haiku`,`claude-fable-5-1`,`claude-fable-5`,`claude-fable-5[1m]`,`claude-sonnet-5`,`claude-sonnet-5[1m]`,`claude-opus-5`,`claude-opus-5[1m]`,`claude-opus-4-8`,`claude-opus-4-8[1m]`,`claude-opus-4-7`,`claude-opus-4-7[1m]`,`claude-opus-4-6`,`claude-opus-4-6[1m]`,`claude-sonnet-4-6`,`claude-sonnet-4-6[1m]`,`claude-haiku-4-5`]},codex:{label:`Codex`,efforts:[`low`,`medium`,`high`,`xhigh`],models:[`gpt-5.5`,`gpt-5.4`,`gpt-5.4-mini`,`gpt-5.3-codex-spark`,`gpt-5.6-sol`,`gpt-5.6-terra`,`gpt-5.6-luna`]},"codex-app":{label:`Codex App`,efforts:[`low`,`medium`,`high`,`xhigh`],models:[`gpt-5.5`,`gpt-5.4`,`gpt-5.4-mini`,`gpt-5.3-codex-spark`,`gpt-5.6-sol`,`gpt-5.6-terra`,`gpt-5.6-luna`]},cursor:{label:`Cursor`,efforts:[`none`,`none-fast`,`low`,`low-fast`,`medium`,`medium-fast`,`high`,`high-fast`,`xhigh`,`xhigh-fast`,`max`,`max-fast`],effortNote:`Cursor effort resolves to model IDs; cli-jaw never passes --effort`,models:`auto,composer-2.5,gpt-5.5,gpt-5.6-sol,gpt-5.6-terra,gpt-5.6-luna,gpt-5.4,gpt-5.4-mini,gpt-5.4-nano,gpt-5.3-codex,gpt-5.2,gpt-5.2-codex,gpt-5.1-codex-max,gpt-5.1-codex-mini,gpt-5.1,claude-sonnet-5,claude-fable-5,claude-fable-5-thinking,claude-opus-5,claude-opus-4-8,claude-opus-4-8-thinking,claude-opus-4-7,claude-opus-4-7-thinking,claude-4.6-opus,claude-4.6-sonnet,claude-4.5-opus-high,claude-4.5-sonnet,claude-4-sonnet,gemini-3.1-pro,gemini-3-flash,gemini-3-pro,gemini-3.5-flash,grok-4.6,grok-4.5,gpt-5-mini,glm-5.2,glm-5.3,gpt-5.5-extra,kimi-k2.7-code,kimi-k3,gemini-3.6-flash,gemini-3.7-flash`.split(`,`)},"kiro-code":{label:`Kiro`,efforts:[`low`,`medium`,`high`,`xhigh`],effortNote:`Kiro CLI forwards --effort; cli-jaw maps xhigh to Kiro max on the wire`,models:[`auto`,`gpt-5.6-sol`,`gpt-5.6-terra`,`gpt-5.6-luna`,`claude-fable-5`,`claude-sonnet-5`,`claude-opus-5`,`claude-opus-4.8`,`claude-opus-4.7`,`claude-opus-4.6`,`claude-sonnet-4.6`,`claude-opus-4.5`,`claude-sonnet-4.5`,`claude-sonnet-4`,`claude-haiku-4.5`,`deepseek-3.2`,`minimax-m2.5`,`minimax-m2.1`,`glm-5`,`qwen3-coder-next`]},gemini:{label:`Gemini`,efforts:[],models:[`gemini-3.0-pro-preview`,`gemini-3.1-pro-preview`,`gemini-2.5-pro`,`gemini-3-flash-preview`,`gemini-2.5-flash`]},grok:{label:`Grok`,efforts:[],effortNote:`unsupported by grok-build/composer; do not pass --effort`,models:[`grok-build`,`grok-composer-2.5-fast`]},opencode:{label:`OpenCode`,efforts:[`minimal`,`low`,`high`,`max`],models:[`opencode-go/kimi-k2.7-code`,`opencode-go/kimi-k3`,`opencode-go/kimi-k2.6`,`opencode-go/kimi-k2.5`,`opencode-go/glm-5.3`,`opencode-go/glm-5.2`,`opencode-go/glm-5.1`,`opencode-go/glm-5`,`opencode-go/grok-4.6`,`opencode-go/grok-4.5`,`opencode-go/minimax-m3`,`opencode-go/minimax-m2.7`,`opencode-go/minimax-m2.5`,`opencode-go/qwen3.7-max`,`opencode-go/qwen3.7-plus`,`opencode-go/qwen3.6-plus`,`opencode-go/qwen3.5-plus`,`opencode-go/mimo-v2.5-pro`,`opencode-go/mimo-v2.5`,`opencode-go/mimo-v2-pro`,`opencode-go/mimo-v2-omni`,`opencode-go/deepseek-v4-pro`,`opencode-go/deepseek-v4-flash`,`opencode-go/hy3`]},copilot:{label:`Copilot`,efforts:[`low`,`medium`,`high`],effortNote:`-> ~/.copilot/config.json`,models:[`gpt-5.6-sol`,`gpt-5.6-terra`,`gpt-5.6-luna`,`gpt-5.5`,`claude-fable-5`,`claude-opus-4.8`,`claude-sonnet-4.6`,`claude-haiku-4.5`,`gpt-5.4`,`gpt-5.3-codex`,`gpt-5.2-codex`,`gpt-5.1-codex`,`gpt-4.1`,`gpt-5-mini`,`gemini-3-pro-preview`]}};function r(e){let t={};for(let[n,r]of Object.entries(e))t[n]=Array.isArray(r?.models)?[...r.models]:[];return t}function i(e){let n={};for(let[r,i]of Object.entries(e||{})){if(t(r)||!i||typeof i!=`object`)continue;let e=i,a={label:e.label||r,efforts:Array.isArray(e.efforts)?[...e.efforts]:[],models:Array.isArray(e.models)?[...e.models]:[]};typeof e.effortNote==`string`&&e.effortNote.trim()&&(a.effortNote=e.effortNote),typeof e.modelNote==`string`&&e.modelNote.trim()&&(a.modelNote=e.modelNote),typeof e.defaultProvider==`string`&&(a.defaultProvider=e.defaultProvider),Array.isArray(e.providers)&&(a.providers=[...e.providers]),e.modelsByProvider&&typeof e.modelsByProvider==`object`&&(a.modelsByProvider=Object.fromEntries(Object.entries(e.modelsByProvider).filter(e=>Array.isArray(e[1])).map(([e,t])=>[e,[...t]]))),e.effortsByProvider&&typeof e.effortsByProvider==`object`&&(a.effortsByProvider=Object.fromEntries(Object.entries(e.effortsByProvider).filter(e=>Array.isArray(e[1])).map(([e,t])=>[e,[...t]]))),e.effortsByModel&&typeof e.effortsByModel==`object`&&(a.effortsByModel=Object.fromEntries(Object.entries(e.effortsByModel).filter(e=>Array.isArray(e[1])).map(([e,t])=>[e,t.filter(e=>typeof e==`string`)]))),e.defaultEffortByModel&&typeof e.defaultEffortByModel==`object`&&(a.defaultEffortByModel=Object.fromEntries(Object.entries(e.defaultEffortByModel).filter(e=>typeof e[1]==`string`))),typeof e.modelSource==`string`&&(a.modelSource=e.modelSource),e.effortsByModelByProvider&&typeof e.effortsByModelByProvider==`object`&&(a.effortsByModelByProvider=Object.fromEntries(Object.entries(e.effortsByModelByProvider).filter(e=>!!e[1]&&typeof e[1]==`object`&&!Array.isArray(e[1])).map(([e,t])=>[e,Object.fromEntries(Object.entries(t).filter(e=>Array.isArray(e[1])).map(([e,t])=>[e,t.filter(e=>typeof e==`string`)]))]))),e.defaultEffortByModelByProvider&&typeof e.defaultEffortByModelByProvider==`object`&&(a.defaultEffortByModelByProvider=Object.fromEntries(Object.entries(e.defaultEffortByModelByProvider).filter(e=>!!e[1]&&typeof e[1]==`object`&&!Array.isArray(e[1])).map(([e,t])=>[e,Object.fromEntries(Object.entries(t).filter(e=>typeof e[1]==`string`))]))),n[r]=a}return n}var a=i(n),o=Object.keys(a),s=r(a);function c(e){let t=i(e);return Object.keys(t).length?(a=t,o=Object.keys(t),s=r(t),!0):!1}async function l(){try{let t=await e(`/api/cli-registry`);if(!t||!c(t))throw Error(`invalid registry`)}catch(e){console.warn(`[cli-registry] fallback:`,e.message),c(n)}return a}function u(){return o}function d(e){return a[e]||null}var f=[`pi`,`claude`,`agy`,`codex`,`cursor`,`kiro-code`,`gemini`],p=[{value:`frontend`,labelKey:`role.label.frontend`,label:`Frontend`,prompt:`Frontend employee — UI/UX, CSS, components`,skill:`jaw-dev-frontend`},{value:`backend`,labelKey:`role.label.backend`,label:`Backend`,prompt:`Backend employee — API, DB, server logic`,skill:`jaw-dev-backend`},{value:`data`,labelKey:`role.label.data`,label:`Data`,prompt:`Data employee — data pipeline, analysis, ML`,skill:`jaw-dev-data`},{value:`docs`,labelKey:`role.label.docs`,label:`Docs`,prompt:`Docs employee — documentation, README, API docs`,skill:`documentation`},{value:`security`,labelKey:`role.label.security`,label:`Security`,prompt:`Security reviewer — auth, secrets, injection, destructive-command, sandbox, and data exposure risks`,skill:`jaw-dev-security`},{value:`testing`,labelKey:`role.label.testing`,label:`Testing`,prompt:`Testing reviewer — unit, integration, regression, smoke, and edge-case coverage`,skill:`jaw-dev-testing`},{value:`custom`,labelKey:`role.label.custom`,label:`Custom...`,prompt:``,skill:null}];export{d as a,u as i,f as n,l as o,p as r,s as t};

package/public/dist/assets/iframe-renderer-CKg5BMGK.js

@@ -1 +0,0 @@
-import{a as e}from"./iframe-renderer-BTTOQPS-.js";export{e as refreshFileWidget};

package/public/dist/assets/memory-4jRy1vVN.js

@@ -1 +0,0 @@
-import{a as e}from"./memory-BtrzxI2f.js";export{e as refreshMemorySidebar};

package/public/dist/assets/message-history-S9ZHb1mg.js

@@ -1 +0,0 @@
-import{o as e,s as t}from"./message-history-BPlxn_fF.js";export{e as historyReloadInFlight,t as loadMessages};

package/public/dist/assets/settings-CO1kvTfO.js

@@ -1 +0,0 @@
-import{c as e,n as t}from"./settings-core-C9d6LGNB.js";import"./settings-CoalzYdp.js";export{t as loadSettings,e as updateSettings};

package/public/dist/assets/settings-core-P9taYIOs.js

@@ -1 +0,0 @@
-import{a as e}from"./settings-core-C9d6LGNB.js";export{e as refreshHeaderFromSettingsChange};

package/public/dist/assets/skills-BesnYjWa.js

@@ -1 +0,0 @@
-import{n as e}from"./skills-D0ZTAdcQ.js";export{e as loadSkills};

package/public/dist/assets/slash-commands-Bjurf5lq.js

@@ -1 +0,0 @@
-import{a as e}from"./slash-commands-CRaPab4c.js";export{e as loadCommands};

package/public/dist/assets/ui-B49acfZi.js

@@ -1 +0,0 @@
-import{p as e}from"./iframe-renderer-BTTOQPS-.js";import{I as t,s as n}from"./message-history-BPlxn_fF.js";import{r}from"./ui-BYUrgEqP.js";export{r as cleanupToolActivity,n as loadMessages,e as reconcileChatBottomAfterRestore,t as updateQueueBadge};