cli-jaw 2.2.8 → 2.2.10

package/scripts/pi-rpc-probe.mts

@@ -0,0 +1,361 @@
+#!/usr/bin/env -S npx tsx
+
+import { spawn, spawnSync, type ChildProcessWithoutNullStreams } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { StringDecoder } from 'node:string_decoder';
+import {
+    DEFAULT_PI_PROFILE,
+    DEFAULT_PI_SETTINGS,
+    ensurePiRuntimeConfig,
+    parsePiRpcRecord,
+    resolvePiCommand,
+    type PiCommand,
+} from '../src/agent/pi-runtime.js';
+import { JAW_HOME } from '../src/core/config.js';
+import {
+    classifySecondPromptOutcome,
+    type PiRpcVerdict,
+    type PiRpcVerdictRecord,
+} from '../src/agent/pi-rpc-verdict.js';
+
+const GET_STATE_ID = 1;
+const FIRST_PROMPT_ID = 2;
+const SECOND_PROMPT_ID = 3;
+const THIRD_PROMPT_ID = 4;
+const ABORT_ID = 5;
+const FIRST_TIMEOUT_MS = 60_000;
+const SECOND_TIMEOUT_MS = 30_000;
+const ABORT_START_TIMEOUT_MS = 30_000;
+const ABORT_TERMINAL_TIMEOUT_MS = 15_000;
+
+type RawRecord = Record<string, unknown>;
+type ObservedRecord = { raw: RawRecord; normalized: PiRpcVerdictRecord };
+type WaitResult = { matched: boolean; closed: boolean; timedOut: boolean };
+type AttemptResult = {
+    verdict: PiRpcVerdict;
+    abortEffective: boolean;
+    firstPromptSucceeded: boolean;
+    selfExited: boolean;
+    secondTimedOut: boolean;
+    recordCount: number;
+};
+
+function normalizeRecord(raw: RawRecord): PiRpcVerdictRecord {
+    const parsed = parsePiRpcRecord(raw);
+    const normalized: PiRpcVerdictRecord = {};
+    if (typeof raw['id'] === 'number') normalized.id = raw['id'];
+    if (typeof raw['type'] === 'string') normalized.type = raw['type'];
+    if (raw['type'] === 'response') {
+        if (typeof raw['command'] === 'string') normalized.command = raw['command'];
+        if (typeof raw['success'] === 'boolean') normalized.success = raw['success'];
+    }
+    const error = raw['error'];
+    if (error && typeof error === 'object') {
+        const message = (error as Record<string, unknown>)['message'];
+        normalized.error = typeof message === 'string' ? { message } : {};
+    }
+    if (parsed.done !== undefined) normalized.done = parsed.done;
+    if (parsed.text !== undefined) normalized.text = parsed.text;
+    if (raw['type'] === 'agent_end') {
+        // user echo 추출 — 모델이 text 파트를 생략하는 비결정성에 강건한 턴 상관 증거
+        const messages = raw['messages'];
+        if (Array.isArray(messages)) {
+            normalized.userEcho = messages
+                .filter((entry) => !!entry && typeof entry === 'object' && (entry as Record<string, unknown>)['role'] === 'user')
+                .map((entry) => extractProbeText((entry as Record<string, unknown>)['content']))
+                .join('');
+        }
+    }
+    return normalized;
+}
+
+function extractProbeText(value: unknown): string {
+    if (typeof value === 'string') return value;
+    if (Array.isArray(value)) return value.map(extractProbeText).join('');
+    if (!value || typeof value !== 'object') return '';
+    const obj = value as Record<string, unknown>;
+    if (obj['type'] === 'thinking') return '';
+    return extractProbeText(obj['text']) || extractProbeText(obj['content']) || '';
+}
+
+function isSuccessfulStateResponse(record: ObservedRecord): boolean {
+    return record.normalized.id === GET_STATE_ID
+        && record.raw['type'] === 'response'
+        && record.raw['command'] === 'get_state'
+        && record.raw['success'] === true;
+}
+
+function isGenerationEvent(record: ObservedRecord): boolean {
+    const type = record.raw['type'];
+    if (type === 'agent_end') return false;
+    if (record.normalized.text) return true;
+    return typeof type === 'string' && type !== 'response';
+}
+
+function isAbortAccepted(record: ObservedRecord): boolean {
+    return record.normalized.id === ABORT_ID
+        && record.raw['type'] === 'response'
+        && record.raw['command'] === 'abort'
+        && record.raw['success'] === true;
+}
+
+function isTerminalRecord(record: ObservedRecord): boolean {
+    if (record.normalized.done) return true;
+    const data = record.raw['data'];
+    if (!data || typeof data !== 'object') return false;
+    const state = data as Record<string, unknown>;
+    if (state['running'] === false || state['isRunning'] === false) return true;
+    return typeof state['state'] === 'string' && !['running', 'active', 'generating'].includes(state['state'].toLowerCase());
+}
+
+class RpcProbeProcess {
+    readonly records: ObservedRecord[] = [];
+    readonly child: ChildProcessWithoutNullStreams;
+    private readonly listeners = new Set<() => void>();
+    private buffer = '';
+    private readonly decoder = new StringDecoder('utf8');
+    private closed = false;
+    private closeCode: number | null = null;
+
+    constructor(command: PiCommand, runtimeDir: string) {
+        const args = [
+            ...command.baseArgs,
+            '--mode', 'rpc',
+            '--no-context-files',
+            '--provider', DEFAULT_PI_PROFILE.id,
+            '--model', DEFAULT_PI_PROFILE.model,
+            '--api-key', DEFAULT_PI_PROFILE.apiKey || 'dummy',
+        ];
+        console.log(`[probe:spawn] ${JSON.stringify([command.command, ...args])}`);
+        this.child = spawn(command.command, args, {
+            cwd: process.cwd(),
+            env: { ...process.env, PI_CODING_AGENT_DIR: runtimeDir },
+            stdio: ['pipe', 'pipe', 'pipe'],
+            ...(process.platform === 'win32' && !command.command.toLowerCase().endsWith('.exe') ? { shell: true } : {}),
+        });
+        this.child.stdout.on('data', (chunk: Buffer) => this.consumeStdout(chunk));
+        this.child.stderr.on('data', (chunk: Buffer) => process.stderr.write(`[probe:stderr] ${chunk.toString()}`));
+        this.child.on('error', (error) => {
+            console.error(`[probe:error] ${error.message}`);
+            this.notify();
+        });
+        this.child.on('close', (code) => {
+            this.buffer += this.decoder.end();
+            if (this.buffer.trim()) this.consumeLine(this.buffer.trim());
+            this.buffer = '';
+            this.closed = true;
+            this.closeCode = code;
+            console.log(`[probe:close] code=${String(code)}`);
+            this.notify();
+        });
+    }
+
+    get didClose(): boolean { return this.closed; }
+    get exitedNormally(): boolean { return this.closed && this.closeCode === 0; }
+
+    send(id: number, type: string, fields: RawRecord = {}): Promise<void> {
+        const line = JSON.stringify({ id, type, ...fields });
+        console.log(`[probe:send] ${line}`);
+        return new Promise((resolve, reject) => {
+            if (!this.child.stdin.writable) {
+                reject(new Error('pi rpc stdin is not writable'));
+                return;
+            }
+            this.child.stdin.write(`${line}\n`, (error) => error ? reject(error) : resolve());
+        });
+    }
+
+    async waitFrom(start: number, predicate: (records: ObservedRecord[]) => boolean, timeoutMs: number): Promise<WaitResult> {
+        if (predicate(this.records.slice(start))) return { matched: true, closed: this.closed, timedOut: false };
+        if (this.closed) return { matched: false, closed: true, timedOut: false };
+        return new Promise((resolve) => {
+            const finish = (result: WaitResult) => {
+                clearTimeout(timer);
+                this.listeners.delete(check);
+                resolve(result);
+            };
+            const check = () => {
+                if (predicate(this.records.slice(start))) finish({ matched: true, closed: this.closed, timedOut: false });
+                else if (this.closed) finish({ matched: false, closed: true, timedOut: false });
+            };
+            const timer = setTimeout(() => finish({ matched: false, closed: this.closed, timedOut: true }), timeoutMs);
+            this.listeners.add(check);
+        });
+    }
+
+    async stop(): Promise<void> {
+        try { this.child.stdin.end(); } catch { /* already closed */ }
+        if (this.closed) return;
+        if (!this.child.killed) this.child.kill('SIGTERM');
+        const stopped = await this.waitFrom(this.records.length, () => false, 2_000);
+        if (!stopped.closed) {
+            this.child.kill('SIGKILL');
+            await this.waitFrom(this.records.length, () => false, 1_000);
+        }
+    }
+
+    private consumeStdout(chunk: Buffer): void {
+        this.buffer += this.decoder.write(chunk);
+        const lines = this.buffer.split('\n');
+        this.buffer = lines.pop() ?? '';
+        for (const line of lines) if (line.trim()) this.consumeLine(line.trim());
+    }
+
+    private consumeLine(line: string): void {
+        process.stdout.write(`${line}\n`);
+        try {
+            const raw = JSON.parse(line) as unknown;
+            if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return;
+            this.records.push({ raw: raw as RawRecord, normalized: normalizeRecord(raw as RawRecord) });
+            this.notify();
+        } catch {
+            console.error(`[probe:parse-error] ${line.slice(0, 200)}`);
+        }
+    }
+
+    private notify(): void {
+        for (const listener of [...this.listeners]) listener();
+    }
+}
+
+async function probeAbort(rpc: RpcProbeProcess): Promise<boolean> {
+    if (rpc.didClose) return false;
+    const thirdStart = rpc.records.length;
+    try {
+        await rpc.send(THIRD_PROMPT_ID, 'prompt', { message: 'Write a very long story, at least 2000 words.' });
+    } catch (error) {
+        console.error(`[probe:abort] third prompt write failed: ${(error as Error).message}`);
+        return false;
+    }
+    const started = await rpc.waitFrom(thirdStart, (records) => records.some(isGenerationEvent), ABORT_START_TIMEOUT_MS);
+    if (!started.matched || rpc.didClose) return false;
+
+    const abortStart = rpc.records.length;
+    try {
+        await rpc.send(ABORT_ID, 'abort');
+    } catch (error) {
+        console.error(`[probe:abort] abort write failed: ${(error as Error).message}`);
+        return false;
+    }
+    const terminal = await rpc.waitFrom(abortStart, (records) => {
+        const accepted = records.some(isAbortAccepted);
+        return accepted && records.some(isTerminalRecord);
+    }, ABORT_TERMINAL_TIMEOUT_MS);
+    return terminal.matched;
+}
+
+async function runAttempt(command: PiCommand, attempt: number): Promise<AttemptResult> {
+    const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), `cli-jaw-pi-rpc-probe-${attempt}-`));
+    const runtimeDir = ensurePiRuntimeConfig(DEFAULT_PI_SETTINGS, DEFAULT_PI_PROFILE.id, '', tempRoot);
+    const rpc = new RpcProbeProcess(command, runtimeDir);
+    let firstPromptSucceeded = false;
+    let selfExited = false;
+    let secondTimedOut = false;
+    let abortEffective = false;
+    let secondRecords: ObservedRecord[] = [];
+    try {
+        const stateStart = rpc.records.length;
+        await rpc.send(GET_STATE_ID, 'get_state');
+        const state = await rpc.waitFrom(stateStart, (records) => records.some(isSuccessfulStateResponse), 15_000);
+        if (!state.matched) {
+            return { verdict: 'inconclusive', abortEffective, firstPromptSucceeded, selfExited, secondTimedOut: state.timedOut, recordCount: rpc.records.length };
+        }
+
+        const firstStart = rpc.records.length;
+        await rpc.send(FIRST_PROMPT_ID, 'prompt', { message: 'Reply with the single token: FIRST' });
+        const first = await rpc.waitFrom(firstStart, (records) => records.some((record) => record.normalized.done === true), FIRST_TIMEOUT_MS);
+        firstPromptSucceeded = first.matched;
+
+        const secondStart = rpc.records.length;
+        if (firstPromptSucceeded) {
+            try {
+                await rpc.send(SECOND_PROMPT_ID, 'prompt', { message: 'Reply with the single token: SECOND' });
+            } catch (error) {
+                console.error(`[probe:second] write failed: ${(error as Error).message}`);
+                selfExited = rpc.exitedNormally;
+            }
+            if (!selfExited) {
+                const second = await rpc.waitFrom(secondStart, (records) => records.some((record) =>
+                    record.normalized.done === true
+                    || (record.normalized.id === SECOND_PROMPT_ID && record.normalized.error !== undefined)
+                ), SECOND_TIMEOUT_MS);
+                secondTimedOut = second.timedOut;
+                secondRecords = rpc.records.slice(secondStart);
+                if (second.closed && rpc.exitedNormally && !second.matched) selfExited = true;
+                if (!secondTimedOut && !rpc.didClose) abortEffective = await probeAbort(rpc);
+            }
+        }
+
+        const verdict = classifySecondPromptOutcome({
+            records: secondRecords.map((record) => record.normalized),
+            secondPromptId: SECOND_PROMPT_ID,
+            timedOut: secondTimedOut,
+            selfExited,
+            firstPromptSucceeded,
+        });
+        if (process.env['PI_RPC_PROBE_DEBUG']) {
+            console.error(`[probe:debug] classifier input: ${JSON.stringify({
+                firstPromptSucceeded, selfExited, secondTimedOut,
+                doneRecords: secondRecords.filter((r) => r.normalized.done).map((r) => r.normalized),
+                secondRecordCount: secondRecords.length,
+            })}`);
+        }
+        return { verdict, abortEffective, firstPromptSucceeded, selfExited, secondTimedOut, recordCount: rpc.records.length };
+    } catch (error) {
+        console.error(`[probe:attempt-${attempt}] ${(error as Error).stack || String(error)}`);
+        return { verdict: 'inconclusive', abortEffective, firstPromptSucceeded, selfExited, secondTimedOut, recordCount: rpc.records.length };
+    } finally {
+        await rpc.stop();
+        fs.rmSync(tempRoot, { recursive: true, force: true });
+    }
+}
+
+function resolveCommandIdentity(command: PiCommand): string {
+    const result = spawnSync(command.command, [...command.baseArgs, '--version'], {
+        encoding: 'utf8',
+        env: process.env,
+        timeout: 15_000,
+    });
+    const version = `${result.stdout || ''}\n${result.stderr || ''}`.trim() || `exit:${String(result.status)}`;
+    return JSON.stringify({ source: command.source, command: command.command, baseArgs: command.baseArgs, version });
+}
+
+function writeCapability(commandId: string, result: AttemptResult, attempts: AttemptResult[]): void {
+    const targetDir = path.join(JAW_HOME, 'pi');
+    const target = path.join(targetDir, 'rpc-capabilities.json');
+    const temp = `${target}.${process.pid}.tmp`;
+    const evidence = attempts.map((attempt, index) =>
+        `attempt=${index + 1},verdict=${attempt.verdict},first=${attempt.firstPromptSucceeded},selfExited=${attempt.selfExited},secondTimedOut=${attempt.secondTimedOut},abort=${attempt.abortEffective},records=${attempt.recordCount}`
+    ).join('; ');
+    fs.mkdirSync(targetDir, { recursive: true });
+    fs.writeFileSync(temp, `${JSON.stringify({
+        schemaVersion: 1,
+        commandId,
+        probedAt: new Date().toISOString(),
+        profileId: DEFAULT_PI_PROFILE.id,
+        abortEffective: result.abortEffective,
+        evidence,
+    }, null, 2)}\n`, 'utf8');
+    fs.renameSync(temp, target);
+    console.log(`[probe:capabilities] ${target}`);
+}
+
+async function main(): Promise<void> {
+    const command = resolvePiCommand();
+    const commandId = resolveCommandIdentity(command);
+    const attempts: AttemptResult[] = [];
+    attempts.push(await runAttempt(command, 1));
+    if (attempts[0]?.verdict === 'inconclusive') attempts.push(await runAttempt(command, 2));
+    const result = attempts.at(-1);
+    if (!result) throw new Error('pi rpc probe produced no result');
+    writeCapability(commandId, result, attempts);
+    console.log(`[probe:verdict] ${result.verdict} abortEffective=${result.abortEffective}`);
+    process.exitCode = result.verdict === 'supported' ? 0 : result.verdict === 'proven-unsupported' ? 1 : 2;
+}
+
+void main().catch((error: unknown) => {
+    console.error(`[probe:fatal] ${(error as Error).stack || String(error)}`);
+    process.exitCode = 2;
+});

package/scripts/release-gates.mjs

@@ -394,6 +394,89 @@ const GATES = {
             return { ok: true, detail: 'live any/debt/allow counts within frozen baseline' };
         },
     },
+    'redaction-sinks': {
+        description: 'channel replies, sends and loggers route through a credential masker',
+        check() {
+            const r = run('node', ['scripts/check-redaction-sinks.mjs'], { timeout: 60_000 });
+            if (r.status !== 0) {
+                return { ok: false, detail: `unmasked channel sink:\n${(r.stdout || r.stderr || '').slice(-1500)}` };
+            }
+            return { ok: true, detail: 'no unmasked sink in telegram/discord/slack/telegram-hub' };
+        },
+    },
+    'electron-version': {
+        description: 'electron/package.json version matches the root package.json',
+        check() {
+            const r = run('node', ['scripts/sync-electron-version.cjs', '--check'], { timeout: 60_000 });
+            if (r.status !== 0) {
+                return { ok: false, detail: (r.stdout || r.stderr || '').trim().slice(-500) };
+            }
+            return { ok: true, detail: 'desktop artifacts will carry the release version' };
+        },
+    },
+    'gate-docs': {
+        description: 'structure/INDEX.md documents exactly the gates that exist, and each is npm-addressable',
+        check() {
+            // structure/INDEX.md hardcodes the gate count and enumerates every
+            // name. Adding the 16th gate made that row wrong, and nothing
+            // noticed: check-docs.mts counts only routes and endpoints, and
+            // check-doc-drift.sh never looks at gates. Fixing the row by hand
+            // cleared one instance; this closes the class.
+            //
+            // This gate lives inside release-gates.mjs rather than in its own
+            // script because the module calls main() unconditionally at the
+            // bottom, so importing GATES from outside would run every gate.
+            const names = Object.keys(GATES);
+            const doc = readFile('structure/INDEX.md');
+            const row = doc.split('\n').find((line) =>
+                line.includes('named gates') && line.includes('runs all'));
+            if (!row) {
+                return { ok: false, detail: 'the release-gates row is gone from structure/INDEX.md' };
+            }
+
+            const problems = [];
+
+            const claimed = row.match(/runs all (\d+) named gates/);
+            if (!claimed) {
+                problems.push('the row no longer states a gate count');
+            } else if (Number(claimed[1]) !== names.length) {
+                problems.push(`count says ${claimed[1]}, GATES has ${names.length}`);
+            }
+
+            // Read ONLY the parenthesised list, not the whole row. The row also
+            // carries `scripts/release-gates.mjs`, `package.json`, `gate:all`
+            // and `gate:<name>` in prose; scanning the row and filtering those
+            // out by shape both accuses innocent prose and lets a phantom like
+            // `gate:retired-name` through, because a filter keyed on the token
+            // shape cannot tell a stale gate from an ordinary mention.
+            const list = row.match(/named gates \(([^)]*)\)/);
+            if (!list) {
+                problems.push('the parenthesised gate list is gone from the row');
+            } else {
+                const documented = [...list[1].matchAll(/`([^`]+)`/g)].map((m) => m[1]);
+                const missing = names.filter((name) => !documented.includes(name));
+                const stale = documented.filter((name) => !names.includes(name));
+                if (missing.length > 0) problems.push(`undocumented: ${missing.join(', ')}`);
+                if (stale.length > 0) problems.push(`documented but gone: ${stale.join(', ')}`);
+            }
+
+            // The same row promises `gate:<name>` addressability. A gate added
+            // without its npm script makes that sentence false while gate:all
+            // stays green -- the hand-maintained invariant this gate exists to
+            // stop being hand-maintained.
+            const pkg = JSON.parse(readFile('package.json'));
+            const unaddressable = names.filter((name) =>
+                pkg.scripts?.[`gate:${name}`] !== `node scripts/release-gates.mjs ${name}`);
+            if (unaddressable.length > 0) {
+                problems.push(`no npm script: ${unaddressable.map((n) => `gate:${n}`).join(', ')}`);
+            }
+
+            if (problems.length > 0) {
+                return { ok: false, detail: `${problems.join('\n')}\nFix structure/INDEX.md / package.json` };
+            }
+            return { ok: true, detail: `${names.length} gates documented and addressable` };
+        },
+    },
 };
 
 function printResult(name, result) {

package/scripts/release-preview.sh

@@ -148,6 +148,13 @@ npm version "$PREVIEW_VERSION" --no-git-tag-version
 VERSION=$(node -p "require('./package.json').version")
 echo "📌 package.json version: $VERSION"
 
+# Same reason as release.sh: the committed Electron version names the desktop
+# artifacts. This also has to run BEFORE gate:all below -- the electron-version
+# gate compares the two manifests, and the bump above has just moved the root
+# one, so skipping this would fail the preview release outright.
+echo "🖥️  Syncing Electron version to $VERSION..."
+node scripts/sync-electron-version.cjs
+
 echo "🔎 Type checking..."
 pnpm exec tsc --noEmit
 
@@ -169,7 +176,7 @@ npm pack --dry-run >/dev/null
 
 # ─── Commit + Push ────────────────────────────────────
 echo "📝 Creating local commit..."
-git add package.json package-lock.json
+git add package.json package-lock.json electron/package.json electron/package-lock.json
 git commit -m "[agent] chore: preview v$VERSION" --allow-empty
 
 echo "⬆️  Pushing preview branch..."

package/scripts/release.sh

@@ -129,6 +129,12 @@ fi
 VERSION=$(node -p "require('./package.json').version")
 echo "📌 New version: $VERSION"
 
+# Desktop artifacts are named from the version COMMITTED in
+# electron/package.json, and desktop-release.yml builds from a tag checkout --
+# so this has to happen here, before the release commit, not at build time.
+echo "🖥️  Syncing Electron version to $VERSION..."
+node scripts/sync-electron-version.cjs
+
 # ─── Collect changelog ─────────────────────────────────
 if [ -n "$PREV_TAG" ]; then
   CHANGELOG=$(git log "$PREV_TAG"..HEAD --pretty=format:"- %s" --no-merges | head -50)
@@ -155,10 +161,15 @@ fi
 
 # ─── Commit + Tag + Push ──────────────────────────────
 echo "🏷️  Creating git tag v$VERSION..."
-git add package.json package-lock.json
+git add package.json package-lock.json electron/package.json electron/package-lock.json
 git commit -m "[agent] chore: release v$VERSION" --allow-empty
 git tag "v$VERSION"
-git push origin main
+# HEAD:main, not main. `git push origin main` pushes the LOCAL main branch,
+# which is not necessarily the tree just built, committed and tagged: releases
+# are cut from whatever branch is checked out, and a local main left behind at
+# an older release would be published instead. Caught before a real release
+# with local main at v2.2.7 while the release commit sat on dev.
+git push origin HEAD:main
 git push origin "v$VERSION"
 
 # ─── GitHub Release with changelog ─────────────────────

package/scripts/sync-electron-version.cjs

@@ -0,0 +1,93 @@
+#!/usr/bin/env node
+/**
+ * Keep electron/package.json's version equal to the root package.json's.
+ *
+ * Without this the two drifted freely: the root reached 2.2.7 while the
+ * Electron shell sat at 0.1.0 since its first commit, so every desktop release
+ * produced identically-named artifacts (cli-jaw-0.1.0-arm64.dmg) and the file
+ * you downloaded told you nothing about which release it came from.
+ *
+ * Why the version has to be COMMITTED rather than injected at build time:
+ * electron-builder's default artifact name is `${productName}-${version}-...`
+ * resolved from the packaged app's own package.json, and
+ * .github/workflows/desktop-release.yml builds from a release-tag checkout. A
+ * build-time flag would work on a developer machine and silently do nothing in
+ * the workflow that actually publishes the assets.
+ *
+ * One implementation serves both the writer and the gate on purpose. A gate
+ * that computed the expected value separately could pass while the release
+ * wrote something else.
+ */
+const { readFileSync } = require('node:fs');
+const { join } = require('node:path');
+const { spawnSync } = require('node:child_process');
+
+const repoRoot = join(__dirname, '..');
+const electronDir = join(repoRoot, 'electron');
+
+/** Version field of the package.json in `dir`. */
+function readVersion(dir) {
+    const file = join(dir, 'package.json');
+    let raw;
+    try {
+        raw = readFileSync(file, 'utf8');
+    } catch (error) {
+        throw new Error(`cannot read ${file}: ${error.message}`);
+    }
+    try {
+        return JSON.parse(raw).version;
+    } catch (error) {
+        throw new Error(`${file} is not valid JSON: ${error.message}`);
+    }
+}
+
+function main() {
+    let rootVersion;
+    let electronVersion;
+    try {
+        rootVersion = readVersion(repoRoot);
+        electronVersion = readVersion(electronDir);
+    } catch (error) {
+        // Fails closed either way -- an unreadable manifest already exited
+        // non-zero via the uncaught throw. What this adds is a first line the
+        // reader can act on instead of a Node stack trace.
+        console.error(`ERROR: ${error.message}`);
+        return 1;
+    }
+    const check = process.argv.includes('--check');
+
+    if (electronVersion === rootVersion) {
+        console.log(`[electron-version] OK ${rootVersion}`);
+        return 0;
+    }
+
+    if (check) {
+        // Name both values. "versions differ" leaves the reader guessing which
+        // side is authoritative.
+        console.error(
+            `ERROR: electron/package.json version ${electronVersion} != root package.json ${rootVersion}`);
+        console.error('Run: npm run sync:electron-version');
+        return 1;
+    }
+
+    // Delegate to npm instead of editing JSON by hand: `npm version` updates
+    // package.json and the root entries of package-lock.json together. Writing
+    // both files directly means reimplementing the lockfile's shape, and
+    // getting it subtly wrong surfaces later as unexplained churn in someone
+    // else's dependency diff.
+    const result = spawnSync(
+        'npm',
+        ['version', rootVersion, '--no-git-tag-version', '--allow-same-version'],
+        { cwd: electronDir, encoding: 'utf8', timeout: 60_000 },
+    );
+    if (result.status !== 0) {
+        const detail = (result.stderr || result.stdout || '').trim();
+        console.error(`ERROR: npm version failed in electron/: ${detail}`);
+        return 1;
+    }
+
+    console.log(`[electron-version] synced ${electronVersion} -> ${rootVersion}`);
+    return 0;
+}
+
+process.exit(main());

package/public/dist/assets/ChannelsDiscord-Bt1_rtNC.js

@@ -1 +0,0 @@
-import{r as e}from"./rolldown-runtime-XQCOJYun.js";import{n as t,t as n}from"./jsx-runtime-gFMgZ0TQ.js";import{a as r,i,n as a,r as o,t as s}from"./page-shell-LF7vVVfG.js";import{a as c,n as l,o as u,s as d}from"./fields-zkeByFQW.js";import{t as f}from"./path-utils-LsJeDCKF.js";import{a as p,n as m,r as h,t as g}from"./TransportStatusChips-Bld0yXi7.js";var _=e(t(),1),v=n(),y=[`channel`,`discord.enabled`,`discord.token`,`discord.guildId`,`discord.channelIds`,`discord.forwardAll`,`discord.allowBots`,`discord.mentionOnly`];function b(e){return e?/^\d{5,32}$/.test(e.trim()):!1}function x({port:e,client:t,dirty:n,registerSave:x}){let{state:S,refresh:C,setData:w}=r(t,`/api/settings`),[T,E]=(0,_.useState)(!1),[D,O]=(0,_.useState)(``),[k,A]=(0,_.useState)(``),[j,M]=(0,_.useState)([]),[N,P]=(0,_.useState)(!0),[F,I]=(0,_.useState)(!1),[L,R]=(0,_.useState)(!1);(0,_.useEffect)(()=>{if(S.kind!==`ready`)return;let e=S.data.discord||{};E(!!e.enabled),O(``),A(e.guildId??``),M(Array.isArray(e.channelIds)?[...e.channelIds]:[]),P(e.forwardAll!==!1),I(!!e.allowBots),R(!!e.mentionOnly)},[S]),(0,_.useEffect)(()=>()=>{for(let e of y)n.remove(e)},[n]);let z=(0,_.useCallback)((e,t)=>n.set(e,t),[n]),B=(0,_.useMemo)(()=>S.kind===`ready`&&S.data.discord||{},[S]),V=S.kind===`ready`?S.data.channel:void 0,H=(0,_.useCallback)(async()=>{let e=n.saveBundle();if(Object.keys(e).length===0)return;let r=f(e),i=await t.put(`/api/settings`,r),a=i&&typeof i==`object`&&`data`in i?i.data:i;n.clear(),w(a);let o=a.discord||{};E(!!o.enabled),O(``),A(o.guildId??``),M(Array.isArray(o.channelIds)?[...o.channelIds]:[]),P(o.forwardAll!==!1),I(!!o.allowBots),R(!!o.mentionOnly),await C()},[t,n,C,w]);if((0,_.useEffect)(()=>{if(x)return x(H),()=>x(null)},[x,H]),S.kind===`loading`)return(0,v.jsx)(a,{});if(S.kind===`offline`)return(0,v.jsx)(o,{port:e});if(S.kind===`error`)return(0,v.jsx)(s,{message:S.message});let U=B.token?B.token.slice(-4):``,W=B.token?`••••••••${U}`:`(empty)`,G=k&&!b(k)?`Guild ID must be a numeric snowflake.`:null,K=j.filter(e=>!b(e)),q=K.length>0?`Snowflake IDs only — invalid: ${K.join(`, `)}`:null;return(0,v.jsxs)(`form`,{className:`settings-page-form`,onSubmit:e=>{e.preventDefault(),H()},children:[(0,v.jsxs)(i,{title:`Channels`,hint:`Choose which channel receives inbound chat. Outbound send can still work on the other channel when configured.`,children:[(0,v.jsx)(p,{original:V,dirty:n,idPrefix:`dc-channel`}),(0,v.jsx)(g,{client:t,channel:`discord`})]}),(0,v.jsxs)(i,{title:`Discord`,hint:`Bot token, guild + channels, forwarding rules.`,children:[(0,v.jsx)(c,{id:`dc-enabled`,label:`Discord enabled`,value:T,onChange:e=>{E(e),z(`discord.enabled`,{value:e,original:!!B.enabled,valid:!0})}}),(0,v.jsx)(u,{id:`dc-token`,label:`Bot token`,value:D,placeholder:W,onChange:e=>{if(O(e),e.length===0){n.remove(`discord.token`);return}z(`discord.token`,{value:e,original:B.token??``,valid:!0})}}),(0,v.jsx)(d,{id:`dc-guildId`,label:`Guild ID`,value:k,placeholder:`123456789012345678`,error:G,onChange:e=>{A(e);let t=e.length===0||b(e);z(`discord.guildId`,{value:e,original:B.guildId??``,valid:t})}}),(0,v.jsx)(l,{id:`dc-channelIds`,label:`Channel IDs`,value:j,placeholder:`987654321098765432`,error:q,onChange:e=>{M(e);let t=e.every(b);z(`discord.channelIds`,{value:e,original:B.channelIds??[],valid:t})}}),(0,v.jsx)(c,{id:`dc-forwardAll`,label:`Forward all`,value:N,onChange:e=>{P(e),z(`discord.forwardAll`,{value:e,original:B.forwardAll!==!1,valid:!0})}}),(0,v.jsx)(c,{id:`dc-allowBots`,label:`Allow other bots`,value:F,onChange:e=>{I(e),z(`discord.allowBots`,{value:e,original:!!B.allowBots,valid:!0})}}),(0,v.jsx)(c,{id:`dc-mentionOnly`,label:`Mention only`,value:L,onChange:e=>{R(e),z(`discord.mentionOnly`,{value:e,original:!!B.mentionOnly,valid:!0})}})]}),(0,v.jsx)(i,{title:`Health`,hint:`Probes /api/health for Discord readiness. Degraded mode means the bot is missing the MESSAGE_CONTENT intent (slash commands only).`,children:(0,v.jsx)(m,{client:t,label:`Discord`,endpoint:`/api/health`,method:`GET`,interpret:h})})]})}export{x as default,b as isValidSnowflake};

package/public/dist/assets/ChannelsTelegram-BLV0m1oq.js

@@ -1 +0,0 @@
-import{r as e}from"./rolldown-runtime-XQCOJYun.js";import{n as t,t as n}from"./jsx-runtime-gFMgZ0TQ.js";import{a as r,i,n as a,r as o,t as s}from"./page-shell-LF7vVVfG.js";import{a as c,n as l,o as u}from"./fields-zkeByFQW.js";import{t as d}from"./path-utils-LsJeDCKF.js";import{a as f,i as p,n as m,t as h}from"./TransportStatusChips-Bld0yXi7.js";var g=e(t(),1),_=n(),v=[`channel`,`telegram.enabled`,`telegram.token`,`telegram.allowedChatIds`,`telegram.forwardAll`,`telegram.mentionOnly`];function y(e){return e?/^-?\d+$/.test(e.trim()):!1}function b(e){let t=[],n=[];for(let r of e)y(r)?t.push(r.trim()):n.push(r);return{valid:t,invalid:n}}function x(e){return e?e.filter(e=>Number.isFinite(e)).map(e=>String(e)):[]}function S(e){let t=[];for(let n of e){if(!y(n))continue;let e=Number(n);Number.isFinite(e)&&t.push(e)}return t}function C({port:e,client:t,dirty:n,registerSave:C}){let{state:w,refresh:T,setData:E}=r(t,`/api/settings`),[D,O]=(0,g.useState)(!1),[k,A]=(0,g.useState)(``),[j,M]=(0,g.useState)([]),[N,P]=(0,g.useState)(!0),[F,I]=(0,g.useState)(!0);(0,g.useEffect)(()=>{if(w.kind!==`ready`)return;let e=w.data.telegram||{};O(!!e.enabled),A(``),M(x(e.allowedChatIds)),P(e.forwardAll!==!1),I(e.mentionOnly!==!1)},[w]),(0,g.useEffect)(()=>()=>{for(let e of v)n.remove(e)},[n]);let L=(0,g.useCallback)((e,t)=>n.set(e,t),[n]),R=(0,g.useMemo)(()=>w.kind===`ready`&&w.data.telegram||{},[w]),z=w.kind===`ready`?w.data.channel:void 0,B=(0,g.useCallback)(async()=>{let e=n.saveBundle();if(Object.keys(e).length===0)return;let r=d(e),i=await t.put(`/api/settings`,r),a=i&&typeof i==`object`&&`data`in i?i.data:i;n.clear(),E(a);let o=a.telegram||{};O(!!o.enabled),A(``),M(x(o.allowedChatIds)),P(o.forwardAll!==!1),I(o.mentionOnly!==!1),await T()},[t,n,T,E]);if((0,g.useEffect)(()=>{if(C)return C(B),()=>C(null)},[C,B]),w.kind===`loading`)return(0,_.jsx)(a,{});if(w.kind===`offline`)return(0,_.jsx)(o,{port:e});if(w.kind===`error`)return(0,_.jsx)(s,{message:w.message});let V=R.token?R.token.slice(-4):``,H=R.token?`••••••••${V}`:`(empty)`,{invalid:U}=b(j),W=U.length>0?`Numeric chat IDs only — invalid: ${U.join(`, `)}`:null;return(0,_.jsxs)(`form`,{className:`settings-page-form`,onSubmit:e=>{e.preventDefault(),B()},children:[(0,_.jsxs)(i,{title:`Channels`,hint:`Choose which channel receives inbound chat. Outbound send can still work on the other channel when configured.`,children:[(0,_.jsx)(f,{original:z,dirty:n,idPrefix:`tg-channel`}),(0,_.jsx)(h,{client:t,channel:`telegram`})]}),(0,_.jsxs)(i,{title:`Telegram`,hint:`Bot token, allow-list, and forwarding rules.`,children:[(0,_.jsx)(c,{id:`tg-enabled`,label:`Telegram enabled`,value:D,onChange:e=>{O(e),L(`telegram.enabled`,{value:e,original:!!R.enabled,valid:!0})}}),(0,_.jsx)(u,{id:`tg-token`,label:`Bot token`,value:k,placeholder:H,onChange:e=>{if(A(e),e.length===0){n.remove(`telegram.token`);return}L(`telegram.token`,{value:e,original:R.token??``,valid:!0})}}),(0,_.jsx)(l,{id:`tg-allowedChatIds`,label:`Allowed chat IDs`,value:j,placeholder:`123456789`,error:W,onChange:e=>{M(e);let t=e.every(y);L(`telegram.allowedChatIds`,{value:S(e),original:R.allowedChatIds??[],valid:t})}}),(0,_.jsx)(c,{id:`tg-forwardAll`,label:`Forward all responses`,value:N,onChange:e=>{P(e),L(`telegram.forwardAll`,{value:e,original:R.forwardAll!==!1,valid:!0})}}),(0,_.jsx)(c,{id:`tg-mentionOnly`,label:`Mention only`,value:F,onChange:e=>{I(e),L(`telegram.mentionOnly`,{value:e,original:R.mentionOnly!==!1,valid:!0})}})]}),(0,_.jsx)(i,{title:`Health`,hint:`Probe the bot to confirm token + connectivity. 404 means the instance hasn't shipped the probe endpoint yet.`,children:(0,_.jsx)(m,{client:t,label:`Telegram`,endpoint:`/api/telegram/probe`,method:`POST`,interpret:p})})]})}export{x as chatIdsToChips,S as chipsToChatIds,C as default,y as isValidChatId,b as partitionChatIds};

package/public/dist/assets/TransportStatusChips-Bld0yXi7.js

@@ -1 +0,0 @@
-import{r as e}from"./rolldown-runtime-XQCOJYun.js";import{n as t,t as n}from"./jsx-runtime-gFMgZ0TQ.js";import{t as r}from"./settings-client-CjbBShxm.js";var i=e(t(),1),a=n(),o=[{value:`telegram`,label:`Telegram`},{value:`discord`,label:`Discord`}];function s({original:e,dirty:t,idPrefix:n=`channel`}){let[r,s]=(0,i.useState)(e??`telegram`),c=(0,i.useCallback)(n=>{s(n),t.set(`channel`,{value:n,original:e??`telegram`,valid:!0})},[t,e]);return(0,a.jsxs)(`fieldset`,{className:`settings-field settings-field-active-channel`,"aria-label":`Active inbound channel`,children:[(0,a.jsx)(`legend`,{className:`settings-field-label`,children:`Active inbound channel (chat replies)`}),(0,a.jsx)(`div`,{className:`settings-active-channel-options`,role:`radiogroup`,children:o.map(e=>{let t=`${n}-${e.value}`,i=r===e.value;return(0,a.jsxs)(`label`,{htmlFor:t,className:`settings-radio`,children:[(0,a.jsx)(`input`,{id:t,type:`radio`,name:n,value:e.value,checked:i,onChange:()=>c(e.value)}),(0,a.jsx)(`span`,{children:e.label})]},e.value)})})]})}function c({client:e,label:t,endpoint:n,method:o=`GET`,interpret:s,auto:c=!1}){let[d,f]=(0,i.useState)({kind:`idle`}),p=(0,i.useRef)(null),m=(0,i.useRef)(!0),h=(0,i.useCallback)(async()=>{p.current?.abort();let t=new AbortController;p.current=t,f({kind:`checking`});try{let r=o===`POST`?await e.post(n,{},{signal:t.signal}):await e.get(n,{signal:t.signal});if(!m.current||t.signal.aborted)return;f(s(r))}catch(e){if(!m.current||t.signal.aborted)return;if(e instanceof r&&e.status===404){f({kind:`unknown`,reason:`Probe endpoint not implemented on this instance.`});return}f({kind:`error`,reason:e instanceof Error?e.message:String(e)})}},[e,n,s,o]);return(0,i.useEffect)(()=>(m.current=!0,c&&h(),()=>{m.current=!1,p.current?.abort()}),[c,h]),(0,a.jsxs)(`div`,{className:`settings-health-badge`,role:`status`,"aria-live":`polite`,children:[(0,a.jsx)(`button`,{type:`button`,className:`settings-action settings-action-discard`,onClick:()=>void h(),disabled:d.kind===`checking`,children:d.kind===`checking`?`Checking…`:`Check ${t}`}),(0,a.jsx)(`span`,{className:`settings-health-pill is-${d.kind}`,children:l(d)}),u(d)?(0,a.jsx)(`span`,{className:`settings-health-detail`,children:u(d)}):null]})}function l(e){switch(e.kind){case`idle`:return`Not checked`;case`checking`:return`Checking`;case`ok`:return`Healthy`;case`degraded`:return`Degraded`;case`unknown`:return`Unknown`;case`error`:return`Error`}}function u(e){return e.kind===`ok`&&e.detail||e.kind===`degraded`?e.detail:e.kind===`unknown`||e.kind===`error`?e.reason:null}function d(e){if(!e||typeof e!=`object`)return{kind:`unknown`,reason:`Empty probe response.`};let t=e;if(t.ok===!0){let e=typeof t.username==`string`?t.username:void 0;return e?{kind:`ok`,detail:`@${e}`}:{kind:`ok`}}return{kind:`error`,reason:typeof t.error==`string`?t.error:`Probe failed.`}}function f(e){if(!e||typeof e!=`object`)return{kind:`unknown`,reason:`Empty health response.`};let t=e,n=t.discord&&typeof t.discord==`object`?t.discord:null;return n?n.ready===!0&&n.degraded!==!0?{kind:`ok`}:n.degraded===!0?{kind:`degraded`,detail:typeof n.degradedReason==`string`?n.degradedReason:`MESSAGE_CONTENT intent missing — slash commands only.`}:n.ready===!1?{kind:`error`,reason:typeof n.error==`string`?n.error:`Bot not connected.`}:{kind:`unknown`,reason:`Discord status indeterminate.`}:{kind:`unknown`,reason:`No discord block in /api/health.`}}function p(e){if(!e||typeof e!=`object`)return!1;let t=e;return typeof t.configured==`boolean`&&typeof t.activeInbound==`boolean`&&typeof t.sendCapable==`boolean`}function m(e){if(!e||typeof e!=`object`)return null;let t=e.channels;if(!t||typeof t!=`object`)return null;let n=t;return n.activeInbound!==`telegram`&&n.activeInbound!==`discord`||!p(n.telegram)||!p(n.discord)?null:{activeInbound:n.activeInbound,telegram:n.telegram,discord:n.discord}}function h(e){let t=[];return t.push(e.configured?`Configured`:`Not configured`),e.sendCapable&&t.push(`Send-capable`),e.activeInbound&&t.push(`Active inbound`),t}function g({client:e,channel:t}){let[n,r]=(0,i.useState)(null),[o,s]=(0,i.useState)(null),c=(0,i.useRef)(!0),l=(0,i.useCallback)(async()=>{try{let t=await e.get(`/api/health`);if(!c.current)return;let n=m(t);r(n),s(n?null:`Channel health unavailable on this instance.`)}catch(e){if(!c.current)return;r(null),s(e instanceof Error?e.message:String(e))}},[e]);(0,i.useEffect)(()=>(c.current=!0,l(),()=>{c.current=!1}),[l]);let u=n?.[t]??null,d=!!(u?.configured&&u.sendCapable&&!u.activeInbound);return(0,a.jsxs)(`div`,{className:`settings-transport-status`,role:`status`,"aria-live":`polite`,children:[o?(0,a.jsx)(`p`,{className:`settings-field-hint`,children:o}):null,u?(0,a.jsxs)(a.Fragment,{children:[(0,a.jsx)(`div`,{className:`settings-transport-chips`,children:h(u).map(e=>(0,a.jsx)(`span`,{className:`settings-health-pill is-ok`,children:e},e))}),d?(0,a.jsx)(`p`,{className:`settings-field-hint`,children:`This transport is not receiving inbound messages, but send-only delivery remains available.`}):null]}):null,(0,a.jsx)(`button`,{type:`button`,className:`settings-action settings-action-discard`,onClick:()=>void l(),children:`Refresh transport status`})]})}export{s as a,d as i,c as n,f as r,g as t};