commandmate 0.27.1 → 0.29.0

package/dist/cli/utils/vapid-keygen.js

@@ -0,0 +1,111 @@
+"use strict";
+/**
+ * VAPID key-pair generation for `commandmate init` (Issue #2123).
+ *
+ * ## Why the CLI generates keys at all
+ *
+ * Web Push sends nothing without `CM_VAPID_PUBLIC_KEY` / `CM_VAPID_PRIVATE_KEY`,
+ * and before this Issue CommandMate offered no way to produce them: `init` never
+ * mentioned VAPID, `env-setup`'s defaults did not carry them, and `scripts/` had
+ * no helper. The documented workaround was to know that the bundled `web-push`
+ * package exposes `generateVAPIDKeys()` and to type a `node -e` one-liner — which
+ * is not a setup step, it is a piece of folklore. `init` now writes a pair, so a
+ * fresh install has push available and the reader never sees a raw `node -e`.
+ *
+ * ## Why the import is lazy
+ *
+ * `web-push` is a runtime dependency (it is what `push-sender` sends with), but
+ * it is a heavy one — it pulls in `https-proxy-agent`, `jws` and their trees. This
+ * module is reached from `src/cli/commands/init.ts`, which `program.ts` imports at
+ * module scope, so a top-level `import` here would load that graph on EVERY CLI
+ * invocation, `commandmate --version` included. The dynamic import keeps the cost
+ * on the one command that needs it.
+ *
+ * ## Why a failure here is not a failure of `init`
+ *
+ * Push is optional. If `web-push` cannot be loaded (a partial install, a bundler
+ * that dropped an optional dependency), `init` must still produce a working `.env`
+ * — so this returns a result object rather than throwing, and the caller reports
+ * the miss and carries on. Same fail-open direction as every other diagnostic
+ * added by #2113 / #2123.
+ *
+ * @module cli/utils/vapid-keygen
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isBase64UrlOfLength = isBase64UrlOfLength;
+exports.isVapidKeyPair = isVapidKeyPair;
+exports.generateVapidKeyPair = generateVapidKeyPair;
+/**
+ * A base64url string of exactly `bytes` decoded bytes.
+ *
+ * VAPID keys are a P-256 point: 65 bytes uncompressed for the public key, 32 for
+ * the private scalar. Checking the shape here means a `web-push` that ever
+ * returned something else is caught at generation rather than at the first push.
+ */
+function isBase64UrlOfLength(value, bytes) {
+    if (typeof value !== 'string' || value.length === 0)
+        return false;
+    if (!/^[A-Za-z0-9_-]+$/.test(value))
+        return false;
+    return Buffer.from(value, 'base64url').length === bytes;
+}
+/** True when both halves look like a usable VAPID application-server key pair. */
+function isVapidKeyPair(value) {
+    if (typeof value !== 'object' || value === null)
+        return false;
+    const pair = value;
+    return isBase64UrlOfLength(pair.publicKey, 65) && isBase64UrlOfLength(pair.privateKey, 32);
+}
+/**
+ * Generate a VAPID application-server key pair using the bundled `web-push`.
+ *
+ * @param load - Loader override, injected by tests so the unit suite does not
+ *   depend on `web-push` being resolvable.
+ * @returns The pair, or the reason none could be produced. Never throws.
+ */
+async function generateVapidKeyPair(load = () => Promise.resolve().then(() => __importStar(require('web-push'))).then((mod) => (mod.default ?? mod))) {
+    try {
+        const webpush = await load();
+        const keys = webpush.generateVAPIDKeys();
+        if (!isVapidKeyPair(keys)) {
+            return { ok: false, error: 'web-push returned a key pair of an unexpected shape' };
+        }
+        return { ok: true, keys };
+    }
+    catch (error) {
+        return { ok: false, error: error instanceof Error ? error.message : String(error) };
+    }
+}

package/dist/config/auth-config.d.ts

@@ -20,7 +20,7 @@ export declare function isValidTokenHash(hash: string | undefined): hash is stri
  * Paths excluded from authentication check.
  * S002: Must use === for matching (no startsWith - bypass attack prevention)
  */
-export declare const AUTH_EXCLUDED_PATHS: readonly ["/login", "/api/auth/login", "/api/auth/logout", "/api/auth/status", "/manifest.webmanifest", "/sw.js", "/offline"];
+export declare const AUTH_EXCLUDED_PATHS: readonly ["/login", "/api/auth/login", "/api/auth/logout", "/api/auth/status", "/api/remote/pair", "/manifest.webmanifest", "/sw.js", "/offline"];
 /** Default token expiration duration (24 hours) */
 export declare const DEFAULT_EXPIRE_DURATION_MS: number;
 /**

package/dist/config/auth-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-config.d.ts","sourceRoot":"","sources":["../../src/config/auth-config.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,2CAA2C;AAC3C,eAAO,MAAM,gBAAgB,EAAG,eAAwB,CAAC;AAKzD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,IAAI,MAAM,CAEzE;AAED;;;GAGG;AACH,eAAO,MAAM,mBAAmB,+HAWtB,CAAC;AAeX,mDAAmD;AACnD,eAAO,MAAM,0BAA0B,QAAmB,CAAC;AAQ3D;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAgC/C;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,IAAI,MAAM,GAAG,IAAI,CAgB/C"}
+{"version":3,"file":"auth-config.d.ts","sourceRoot":"","sources":["../../src/config/auth-config.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,2CAA2C;AAC3C,eAAO,MAAM,gBAAgB,EAAG,eAAwB,CAAC;AAKzD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,IAAI,MAAM,CAEzE;AAED;;;GAGG;AACH,eAAO,MAAM,mBAAmB,mJAgBtB,CAAC;AAeX,mDAAmD;AACnD,eAAO,MAAM,0BAA0B,QAAmB,CAAC;AAQ3D;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAgC/C;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,IAAI,MAAM,GAAG,IAAI,CAgB/C"}

package/dist/config/auth-config.js

@@ -35,6 +35,11 @@ exports.AUTH_EXCLUDED_PATHS = [
     '/api/auth/login',
     '/api/auth/logout',
     '/api/auth/status',
+    // Issue #1937 (R5): one-shot pairing-code exchange for `commandmate remote`.
+    // The pairing SCREEN is '/login' above, driven by a '#code=' fragment, so
+    // this is the only entry the remote feature adds. Handler:
+    // src/app/api/remote/pair/route.ts (it authenticates the code itself).
+    '/api/remote/pair',
     // Issue #1124 (PWA): non-sensitive resources that must stay reachable before
     // auth so the app is installable and the offline fallback can be precached.
     // All carry no user data (app metadata / public SW code / static fallback).

package/dist/lib/cli-tools/types.d.ts

@@ -1,7 +1,7 @@
 /**
  * Type definitions and interfaces for CLI tools
  */
-import type { CaptureSpec, ComposerSpec, GracefulExitSpec } from '../../types/cli-tool-contracts';
+import type { CaptureSpec, ComposerSpec, GracefulExitSpec, NavigationKeySpec } from '../../types/cli-tool-contracts';
 /**
  * CLI Tool IDs constant array
  * T2.1: Single source of truth for CLI tool IDs
@@ -220,6 +220,16 @@ export interface ICLITool {
      * (Issue #1933, §10.12).
      */
     captureSpec(): CaptureSpec;
+    /**
+     * Declare the keys this tool's terminal UI may send (Issue #2046).
+     *
+     * `POST /api/worktrees/[id]/special-keys` validates against the answer for
+     * the tool it was given, instead of against one global list shared by every
+     * tool. See {@link NavigationKeySpec} for why a shared list stopped working
+     * once opencode's `ctrl+x`-leader chords arrived, and for the #2032 invariant
+     * every declaration has to keep.
+     */
+    navigationKeys(): NavigationKeySpec;
 }
 /**
  * CLI tool display names for UI rendering

package/dist/lib/cli-tools/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/lib/cli-tools/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EACV,WAAW,EACX,YAAY,EACZ,gBAAgB,EACjB,MAAM,gCAAgC,CAAC;AAExC;;;;GAIG;AACH,eAAO,MAAM,YAAY,4FAA6F,CAAC;AAEvH;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC;AAuBtD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,WAAW,GAAG,OAAO,CAEnE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,WAAW,EACtB,sBAAsB,EAAE,OAAO,GAC9B,OAAO,CAET;AAMD;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAEtC;;GAEG;AACH,eAAO,MAAM,sBAAsB,KAAK,CAAC;AAEzC;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,QAAqB,CAAC;AAEtD,yCAAyC;AACzC,eAAO,MAAM,sBAAsB,KAAK,CAAC;AAEzC;;;;;;;;;;GAUG;AACH,MAAM,WAAW,aAAa;IAC5B,sEAAsE;IACtE,EAAE,EAAE,MAAM,CAAC;IACX,sCAAsC;IACtC,OAAO,EAAE,WAAW,CAAC;IACrB,6EAA6E;IAC7E,KAAK,EAAE,MAAM,CAAC;IACd,gDAAgD;IAChD,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,EAAE,IAAI,MAAM,CAK1D;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAEjE;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAE/F;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAE5E;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,MAAM,CAGpF;AAED;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAC;IAEzB,iBAAiB;IACjB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,mBAAmB;IACnB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB;;;OAGG;IACH,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAEhC;;;;;OAKG;IACH,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAErE;;;;;OAKG;IACH,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE3F;;;;;OAKG;IACH,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAErF;;;;OAIG;IACH,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEpE;;;;;OAKG;IACH,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAEhE;;;;OAIG;IACH,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAElE;;;;;;;;OAQG;IACH,gBAAgB,IAAI,YAAY,CAAC;IAEjC;;;;;OAKG;IACH,oBAAoB,IAAI,gBAAgB,CAAC;IAEzC;;;OAGG;IACH,WAAW,IAAI,WAAW,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAQ9D,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,WAAW,CAEjE;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,WAAW,GAAG,MAAM,CAE7D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,QAAQ,SAAc,GAAG,MAAM,CAI5F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE;IAAE,OAAO,EAAE,WAAW,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAM3F;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,aAAa,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,WAAW,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,EAC9E,gBAAgB,EAAE,MAAM,EACxB,eAAe,EAAE,WAAW,GAC3B,MAAM,CAGR;AAED;;;;;;;;;GASG;AACH,wBAAgB,gCAAgC,CAAC,cAAc,EAAE,WAAW,EAAE,GAAG,aAAa,EAAE,CAO/F;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,6BAA6B,MAAM,CAAC;AAEjD;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,UAAU,CAAC;AAErD;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAO7E;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oBAAoB,QAAmC,CAAC;AAErE;;;;GAIG;AACH,MAAM,WAAW,oBAAqB,SAAQ,QAAQ;IACpD,6CAA6C;IAC7C,aAAa,IAAI,IAAI,CAAC;IACtB;;;;;;OAMG;IACH,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClH;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,QAAQ,GAAG,IAAI,IAAI,oBAAoB,CAIlF;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,eAAe;IACf,EAAE,EAAE,WAAW,CAAC;IAChB,UAAU;IACV,IAAI,EAAE,MAAM,CAAC;IACb,YAAY;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB;IAChB,SAAS,EAAE,OAAO,CAAC;CACpB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/lib/cli-tools/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EACV,WAAW,EACX,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,EAClB,MAAM,gCAAgC,CAAC;AAExC;;;;GAIG;AACH,eAAO,MAAM,YAAY,4FAA6F,CAAC;AAEvH;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC;AAuBtD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,WAAW,GAAG,OAAO,CAEnE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,WAAW,EACtB,sBAAsB,EAAE,OAAO,GAC9B,OAAO,CAET;AAMD;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAEtC;;GAEG;AACH,eAAO,MAAM,sBAAsB,KAAK,CAAC;AAEzC;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,QAAqB,CAAC;AAEtD,yCAAyC;AACzC,eAAO,MAAM,sBAAsB,KAAK,CAAC;AAEzC;;;;;;;;;;GAUG;AACH,MAAM,WAAW,aAAa;IAC5B,sEAAsE;IACtE,EAAE,EAAE,MAAM,CAAC;IACX,sCAAsC;IACtC,OAAO,EAAE,WAAW,CAAC;IACrB,6EAA6E;IAC7E,KAAK,EAAE,MAAM,CAAC;IACd,gDAAgD;IAChD,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,EAAE,IAAI,MAAM,CAK1D;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAEjE;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAE/F;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAE5E;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,MAAM,CAGpF;AAED;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAC;IAEzB,iBAAiB;IACjB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,mBAAmB;IACnB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB;;;OAGG;IACH,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAEhC;;;;;OAKG;IACH,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAErE;;;;;OAKG;IACH,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE3F;;;;;OAKG;IACH,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAErF;;;;OAIG;IACH,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEpE;;;;;OAKG;IACH,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAEhE;;;;OAIG;IACH,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAElE;;;;;;;;OAQG;IACH,gBAAgB,IAAI,YAAY,CAAC;IAEjC;;;;;OAKG;IACH,oBAAoB,IAAI,gBAAgB,CAAC;IAEzC;;;OAGG;IACH,WAAW,IAAI,WAAW,CAAC;IAE3B;;;;;;;;OAQG;IACH,cAAc,IAAI,iBAAiB,CAAC;CACrC;AAED;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAQ9D,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,WAAW,CAEjE;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,WAAW,GAAG,MAAM,CAE7D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,QAAQ,SAAc,GAAG,MAAM,CAI5F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE;IAAE,OAAO,EAAE,WAAW,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAM3F;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,aAAa,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,WAAW,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,EAC9E,gBAAgB,EAAE,MAAM,EACxB,eAAe,EAAE,WAAW,GAC3B,MAAM,CAGR;AAED;;;;;;;;;GASG;AACH,wBAAgB,gCAAgC,CAAC,cAAc,EAAE,WAAW,EAAE,GAAG,aAAa,EAAE,CAO/F;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,6BAA6B,MAAM,CAAC;AAEjD;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,UAAU,CAAC;AAErD;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAO7E;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oBAAoB,QAAmC,CAAC;AAErE;;;;GAIG;AACH,MAAM,WAAW,oBAAqB,SAAQ,QAAQ;IACpD,6CAA6C;IAC7C,aAAa,IAAI,IAAI,CAAC;IACtB;;;;;;OAMG;IACH,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClH;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,QAAQ,GAAG,IAAI,IAAI,oBAAoB,CAIlF;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,eAAe;IACf,EAAE,EAAE,WAAW,CAAC;IAChB,UAAU;IACV,IAAI,EAAE,MAAM,CAAC;IACb,YAAY;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB;IAChB,SAAS,EAAE,OAAO,CAAC;CACpB"}

package/dist/lib/detection/tools/verified-against.d.ts

@@ -42,10 +42,21 @@ export declare const COPILOT_VERIFIED_AGAINST: {
     readonly capturedAt: "2026-08-21";
     readonly paneGeometry: "200x1000";
 };
-/** opencode these rules were read off (#1883 / #1893 / #1896 fixtures). */
+/**
+ * opencode these rules were read off (#1883 / #1893 / #1896 fixtures; re-measured
+ * against 1.18.22 by the canary in #2050).
+ *
+ * Bumped from 1.18.21 because the frames were RE-CAPTURED, not because the
+ * version number moved: `npm run canary -- --tool opencode` drove 1.18.22 into
+ * all five states branches A0-E read (idle composer / `esc interrupt` /
+ * `Allow once   Allow always   Reject` / `/models` picker / `▣ … · <duration>`)
+ * at the production 80x200 geometry and every rule answered as it did on
+ * 1.18.21. The frames are `tests/fixtures/canary/opencode-*.ts` and the run is
+ * written up in `docs/design/opencode-server-live-verification.md` §18.
+ */
 export declare const OPENCODE_VERIFIED_AGAINST: {
-    readonly version: "1.18.21";
-    readonly capturedAt: "2026-08-21";
+    readonly version: "1.18.22";
+    readonly capturedAt: "2026-08-26";
     readonly paneGeometry: "80x200";
 };
 /** agy these rules were read off (#988 / #995). */

package/dist/lib/detection/tools/verified-against.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verified-against.d.ts","sourceRoot":"","sources":["../../../../src/lib/detection/tools/verified-against.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,iEAAiE;AACjE,eAAO,MAAM,uBAAuB;;;;CAI1B,CAAC;AAEX,4EAA4E;AAC5E,eAAO,MAAM,sBAAsB;;;;CAIzB,CAAC;AAEX,sEAAsE;AACtE,eAAO,MAAM,wBAAwB;;;;CAI3B,CAAC;AAEX,2EAA2E;AAC3E,eAAO,MAAM,yBAAyB;;;;CAI5B,CAAC;AAEX,mDAAmD;AACnD,eAAO,MAAM,4BAA4B;;;;CAI/B,CAAC;AAEX;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B;;;;CAI9B,CAAC;AAEX,iFAAiF;AACjF,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAQpF,CAAC"}
+{"version":3,"file":"verified-against.d.ts","sourceRoot":"","sources":["../../../../src/lib/detection/tools/verified-against.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,iEAAiE;AACjE,eAAO,MAAM,uBAAuB;;;;CAI1B,CAAC;AAEX,4EAA4E;AAC5E,eAAO,MAAM,sBAAsB;;;;CAIzB,CAAC;AAEX,sEAAsE;AACtE,eAAO,MAAM,wBAAwB;;;;CAI3B,CAAC;AAEX;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,yBAAyB;;;;CAI5B,CAAC;AAEX,mDAAmD;AACnD,eAAO,MAAM,4BAA4B;;;;CAI/B,CAAC;AAEX;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B;;;;CAI9B,CAAC;AAEX,iFAAiF;AACjF,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAQpF,CAAC"}

package/dist/lib/detection/tools/verified-against.js

@@ -45,10 +45,21 @@ exports.COPILOT_VERIFIED_AGAINST = {
     capturedAt: '2026-08-21',
     paneGeometry: '200x1000',
 };
-/** opencode these rules were read off (#1883 / #1893 / #1896 fixtures). */
+/**
+ * opencode these rules were read off (#1883 / #1893 / #1896 fixtures; re-measured
+ * against 1.18.22 by the canary in #2050).
+ *
+ * Bumped from 1.18.21 because the frames were RE-CAPTURED, not because the
+ * version number moved: `npm run canary -- --tool opencode` drove 1.18.22 into
+ * all five states branches A0-E read (idle composer / `esc interrupt` /
+ * `Allow once   Allow always   Reject` / `/models` picker / `▣ … · <duration>`)
+ * at the production 80x200 geometry and every rule answered as it did on
+ * 1.18.21. The frames are `tests/fixtures/canary/opencode-*.ts` and the run is
+ * written up in `docs/design/opencode-server-live-verification.md` §18.
+ */
 exports.OPENCODE_VERIFIED_AGAINST = {
-    version: '1.18.21',
-    capturedAt: '2026-08-21',
+    version: '1.18.22',
+    capturedAt: '2026-08-26',
     paneGeometry: '80x200',
 };
 /** agy these rules were read off (#988 / #995). */

package/dist/lib/push/vapid.d.ts

@@ -0,0 +1,178 @@
+/**
+ * VAPID configuration for Web Push, and the one startup check that reports on it
+ * (Issue #1125; the check and the subject rules are Issues #2123 / #2124).
+ *
+ * Keys are supplied via environment variables and read lazily so tests can vary
+ * them and so an unconfigured deployment simply disables push (never crashes).
+ * The private key and subject are secrets — never log the returned config.
+ *
+ * ## Why the default subject is an https: URL (Issue #2124)
+ *
+ * The VAPID `sub` claim is the sender's contact, and **Apple validates it**. The
+ * original default, `mailto:commandmate@localhost`, names a domain that cannot
+ * exist, so APNs answered 403 and iOS/iPadOS received nothing while Android kept
+ * working — FCM is permissive about `sub`, so testing on Android alone cannot
+ * see it. Measured by the orchestrator during the Epic #2002 device UAT
+ * (2026-08-27, develop e8d09989), fanning ONE waiting notification to two
+ * devices:
+ *
+ *   Android 10 / Chrome 151 -> FCM   default subject: delivered
+ *   iPad / iPadOS 18.7      -> APNs  default subject: 403, push-send-failed
+ *                                    https://github.com/Kewton/CommandMate: delivered
+ *
+ * This file's author did NOT reproduce that on hardware; the APNs/FCM behaviour
+ * above is quoted from that UAT and is not re-measured here. What IS pinned by
+ * the unit suite is the pure part: which subjects this module accepts and which
+ * it flags, and that the default is one of the accepted ones.
+ *
+ * RFC 8292 §2.1 allows both `mailto:` and `https:` for `sub`, so a project URL
+ * is a conforming default that needs no per-install mailbox.
+ *
+ * ## Why an invalid subject is reported and NOT replaced
+ *
+ * {@link inspectVapidConfig} flags a bad `CM_VAPID_SUBJECT`; {@link getVapidConfig}
+ * still returns it verbatim. Silently substituting the default would make the
+ * warning describe a value the server does not actually send, and would make
+ * `commandmate status` disagree with the wire. The operator set it; they are told
+ * it will be rejected, and startup is never blocked (fail-open, exactly as
+ * `lib/server/localhost-self-check` is).
+ *
+ * ## No `@/` imports here, ever
+ *
+ * `src/cli/commands/status.ts` imports this module so the CLI and the server run
+ * the SAME check, and `tsconfig.cli.json` resets `paths` to `{}` — an alias
+ * import here would break `npm run build:cli`. Same constraint as
+ * `lib/server/localhost-self-check.ts` and `lib/detection/version-probes.ts`.
+ * This module must also stay dependency-free for that reason.
+ *
+ * @module lib/push/vapid
+ */
+export interface VapidConfig {
+    publicKey: string;
+    privateKey: string;
+    subject: string;
+}
+/**
+ * Default `sub` claim when `CM_VAPID_SUBJECT` is unset.
+ *
+ * A real, resolvable https: URL — see the module header for the APNs measurement
+ * that made `mailto:commandmate@localhost` the wrong answer (Issue #2124).
+ */
+export declare const VAPID_DEFAULT_SUBJECT = "https://github.com/Kewton/CommandMate";
+/** The three environment variables that configure Web Push. */
+export declare const VAPID_ENV_KEYS: {
+    readonly publicKey: "CM_VAPID_PUBLIC_KEY";
+    readonly privateKey: "CM_VAPID_PRIVATE_KEY";
+    readonly subject: "CM_VAPID_SUBJECT";
+};
+/** What is wrong with a `CM_VAPID_SUBJECT`, or `null` when nothing is. */
+export type VapidSubjectIssue = 
+/** Neither `mailto:` nor `https:` — RFC 8292 §2.1 allows only those two. */
+'unsupported-scheme'
+/** Parsed as a supported scheme but carries no host at all. */
+ | 'missing-host'
+/** A host no push service can resolve: `localhost`, a bare name, a reserved TLD, a loopback literal. */
+ | 'non-routable-host';
+/**
+ * The host a subject names, lowercased, or `null` when it names none.
+ *
+ * `mailto:` takes everything after the LAST `@` (a local part may legally contain
+ * one when quoted) up to the first `?` (RFC 6068 header separator). `https:` is
+ * parsed by `URL`, whose `hostname` already strips the brackets off an IPv6
+ * literal.
+ */
+export declare function extractVapidSubjectHost(subject: string): string | null;
+/**
+ * Decide whether a `sub` claim is one a push service can be expected to accept.
+ *
+ * Deliberately conservative: it rejects only hosts that provably cannot resolve.
+ * A reachable-but-wrong contact (`mailto:nobody@example.com`) is the operator's
+ * business, and a check that guessed at it would warn on healthy installs.
+ *
+ * @param subject - Raw `CM_VAPID_SUBJECT`, or the default.
+ * @returns The problem, or `null` when the subject is usable.
+ */
+export declare function classifyVapidSubject(subject: string): VapidSubjectIssue | null;
+/** How a deployment's Web Push configuration reads right now. */
+export type VapidStatus = 
+/** Neither key is set: push is off, and nothing was half-configured. */
+'unconfigured'
+/** Exactly one of the two keys is set — almost always a typo or a half-finished edit. */
+ | 'partial'
+/** Both keys present, but `CM_VAPID_SUBJECT` will be rejected by at least APNs. */
+ | 'invalid-subject'
+/** Both keys present and the subject is usable. Nothing to report. */
+ | 'ok';
+/** The single verdict {@link inspectVapidConfig} produces (Issues #2123 / #2124). */
+export interface VapidInspection {
+    status: VapidStatus;
+    /** True when both keys are present, i.e. when push can send at all. */
+    configured: boolean;
+    /** The `sub` claim that will actually be sent. */
+    subject: string;
+    /** Whether {@link subject} came from the environment or from the built-in default. */
+    subjectSource: 'env' | 'default';
+    /** What is wrong with {@link subject}, or `null`. */
+    subjectIssue: VapidSubjectIssue | null;
+    /** Names of the VAPID variables that are set — never their values. */
+    presentKeys: readonly string[];
+    /** Names of the key variables that are missing. */
+    missingKeys: readonly string[];
+}
+/** The slice of the environment this module reads. */
+export type VapidEnv = Readonly<Record<string, string | undefined>>;
+/**
+ * Read the three variables and say, in one verdict, everything both Issues need
+ * reported: whether push is on at all (#2123) and whether the subject will be
+ * accepted (#2124).
+ *
+ * ONE check, two facts — deliberately not two checks. The startup log, the
+ * `commandmate status` output and the unit suite all consume this one function,
+ * so the two surfaces cannot drift apart.
+ *
+ * Pure: no I/O, no logging, never throws.
+ *
+ * @param env - Environment to read (default: `process.env`). `commandmate status`
+ *   passes the env the *daemon* runs with, which is not this process's own.
+ */
+export declare function inspectVapidConfig(env?: VapidEnv): VapidInspection;
+/**
+ * The startup / `status` report, as lines — shared by both surfaces so they can
+ * never drift apart, exactly as `formatLocalhostConflictWarning` is (#2113).
+ *
+ * **Returns an empty array when the configuration is healthy.** That silence is
+ * the negative control both Issues ask for: a correctly configured server prints
+ * nothing about push, so the presence of a line is itself the signal.
+ *
+ * Never includes a key or a private value. `subject` is printed because it is the
+ * value the operator has to fix, and it is a contact address rather than a
+ * credential — the module header's "never log the config" rule is about the keys.
+ */
+export declare function formatVapidReportLines(inspection: VapidInspection): string[];
+/** Options for {@link runVapidSelfCheck}. */
+export interface RunVapidSelfCheckOptions {
+    /** Environment to inspect (default: `process.env`). */
+    env?: VapidEnv;
+    /** Where the report goes (default: `console.warn`). */
+    warn?: (message: string) => void;
+}
+/**
+ * Run the startup self-check and print its verdict, or nothing when healthy.
+ *
+ * Fail-open by construction, the same contract `runLocalhostSelfCheck` carries:
+ * it never throws, it never blocks `listen`, and a healthy install is silent.
+ *
+ * @returns The inspection, or `null` when the check itself could not be carried
+ *   out (which is reported as nothing at all).
+ */
+export declare function runVapidSelfCheck(options?: RunVapidSelfCheckOptions): VapidInspection | null;
+/**
+ * Returns the VAPID config, or null when push is not configured (both public
+ * and private keys must be present). Read from env on every call.
+ */
+export declare function getVapidConfig(): VapidConfig | null;
+/** True when both VAPID keys are configured. */
+export declare function isPushConfigured(): boolean;
+/** The public (application server) key clients need to subscribe, or null. */
+export declare function getVapidPublicKey(): string | null;
+//# sourceMappingURL=vapid.d.ts.map

package/dist/lib/push/vapid.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vapid.d.ts","sourceRoot":"","sources":["../../../src/lib/push/vapid.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAEH,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,0CAA0C,CAAC;AAE7E,+DAA+D;AAC/D,eAAO,MAAM,cAAc;;;;CAIjB,CAAC;AAuBX,0EAA0E;AAC1E,MAAM,MAAM,iBAAiB;AAC3B,4EAA4E;AAC1E,oBAAoB;AACtB,+DAA+D;GAC7D,cAAc;AAChB,wGAAwG;GACtG,mBAAmB,CAAC;AAQxB;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAiBtE;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAe9E;AAED,iEAAiE;AACjE,MAAM,MAAM,WAAW;AACrB,wEAAwE;AACtE,cAAc;AAChB,yFAAyF;GACvF,SAAS;AACX,mFAAmF;GACjF,iBAAiB;AACnB,sEAAsE;GACpE,IAAI,CAAC;AAET,qFAAqF;AACrF,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,WAAW,CAAC;IACpB,uEAAuE;IACvE,UAAU,EAAE,OAAO,CAAC;IACpB,kDAAkD;IAClD,OAAO,EAAE,MAAM,CAAC;IAChB,sFAAsF;IACtF,aAAa,EAAE,KAAK,GAAG,SAAS,CAAC;IACjC,qDAAqD;IACrD,YAAY,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACvC,sEAAsE;IACtE,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,mDAAmD;IACnD,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;CAChC;AAED,sDAAsD;AACtD,MAAM,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;AAEpE;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,GAAE,QAAsB,GAAG,eAAe,CAiC/E;AAcD;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,eAAe,GAAG,MAAM,EAAE,CAiC5E;AAED,6CAA6C;AAC7C,MAAM,WAAW,wBAAwB;IACvC,uDAAuD;IACvD,GAAG,CAAC,EAAE,QAAQ,CAAC;IACf,uDAAuD;IACvD,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAClC;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,GAAE,wBAA6B,GAAG,eAAe,GAAG,IAAI,CAahG;AAED;;;GAGG;AACH,wBAAgB,cAAc,IAAI,WAAW,GAAG,IAAI,CAQnD;AAED,gDAAgD;AAChD,wBAAgB,gBAAgB,IAAI,OAAO,CAE1C;AAED,8EAA8E;AAC9E,wBAAgB,iBAAiB,IAAI,MAAM,GAAG,IAAI,CAEjD"}