copyrun 0.1.0 → 0.2.0

package/dist/live.js

@@ -118,14 +118,14 @@ function parseManaged(v) {
     if (!SLUG.test(s)) problems.push("org must be an org slug");
     else config.org = s;
   }
-  for (const k of ["forbidPublic", "forbidAnonymous", "forbidUnlisted", "requireShape", "disableNudge", "disableLive", "disableAutopilot", "copyLink"]) bool(k);
+  for (const k of ["forbidPublic", "forbidAnonymous", "forbidUnlisted", "requireShape", "disableNudge", "disableLive", "disableReceipts", "disableAutopilot", "copyLink", "disableAsk", "disableMission", "disableCopy"]) bool(k);
   if (o.autopilotOrg !== void 0) {
     const s = typeof o.autopilotOrg === "string" ? o.autopilotOrg.trim().toLowerCase() : "";
     if (!SLUG.test(s)) problems.push("autopilotOrg must be an org slug");
     else config.autopilotOrg = s;
   }
   if (o.autopilotContent !== void 0) {
-    if (o.autopilotContent !== "full" && o.autopilotContent !== "actions") problems.push('autopilotContent must be "full" or "actions"');
+    if (o.autopilotContent !== "full" && o.autopilotContent !== "actions" && o.autopilotContent !== "commands") problems.push('autopilotContent must be "full", "actions" or "commands"');
     else config.autopilotContent = o.autopilotContent;
   }
   if (o.allowedCloneSources !== void 0) {
@@ -158,6 +158,20 @@ function parseManaged(v) {
     if (o.restrictMode !== "block-all-uploads") problems.push('restrictMode must be "block-all-uploads"');
     else config.restrictMode = o.restrictMode;
   }
+  if (o.askBefore !== void 0) {
+    if (!Array.isArray(o.askBefore) || !o.askBefore.every((t) => typeof t === "string")) problems.push("askBefore must be a list of change areas and path patterns");
+    else config.askBefore = [...new Set(o.askBefore.map((t) => t.trim()).filter((t) => t && t.length <= 200))].slice(0, 50);
+  }
+  if (o.askTimeoutMinutes !== void 0) {
+    const n = o.askTimeoutMinutes;
+    if (typeof n !== "number" || !Number.isFinite(n) || n < 1 || n > 15) problems.push("askTimeoutMinutes must be a number from 1 to 15");
+    else config.askTimeoutMinutes = Math.round(n);
+  }
+  if (o.askOrg !== void 0) {
+    const s = typeof o.askOrg === "string" ? o.askOrg.trim().toLowerCase() : "";
+    if (!SLUG.test(s)) problems.push("askOrg must be an org slug");
+    else config.askOrg = s;
+  }
   if (o.allowCloneYesWith !== void 0) {
     const l = o.allowCloneYesWith;
     if (!Array.isArray(l) || !l.every((x) => GATED_CAPABILITIES.includes(x))) problems.push('allowCloneYesWith must list only "shell", "install", "network" and/or "settings"');
@@ -217,6 +231,7 @@ function loadManaged(deps = {}) {
   }
   if (state.config.allowedCloneSources === "org-playbook" && !state.config.org) state.errors.push('allowedCloneSources "org-playbook" needs org');
   if (state.config.autopilotOrg && state.config.org && state.config.autopilotOrg !== state.config.org) state.errors.push("autopilotOrg must be the same org as org");
+  if (state.config.askOrg && state.config.org && state.config.askOrg !== state.config.org) state.errors.push("askOrg must be the same org as org");
   return state;
 }
 var cached;

package/dist/mission-watch.js

@@ -0,0 +1,541 @@
+#!/usr/bin/env node
+
+// src/mission-watch.ts
+import { execFile as execFile2 } from "child_process";
+import { readFileSync as readFileSync3, readlinkSync, unlinkSync, writeFileSync } from "fs";
+import { hostname } from "os";
+import { basename, join as join4 } from "path";
+import { promisify as promisify2 } from "util";
+
+// src/config.ts
+import { randomUUID } from "crypto";
+import { chmod, mkdir, readFile, rename, writeFile } from "fs/promises";
+import { homedir } from "os";
+import { join as join2 } from "path";
+
+// src/managed.ts
+import { execFileSync } from "child_process";
+import { existsSync, readFileSync } from "fs";
+import { join } from "path";
+var GATED_CAPABILITIES = ["shell", "install", "network", "settings"];
+var SLUG = /^[a-z0-9][a-z0-9-]{0,39}$/;
+var HANDLE = /^[a-z0-9][a-z0-9-]{0,38}$/;
+function parseManaged(v) {
+  const problems = [];
+  const config = {};
+  if (!v || typeof v !== "object" || Array.isArray(v)) return { config, problems: ["not a JSON object"] };
+  const o = v;
+  const bool = (k) => {
+    if (o[k] === void 0) return;
+    if (typeof o[k] !== "boolean") problems.push(`${k} must be true or false`);
+    else config[k] = o[k];
+  };
+  if (o.apiHost !== void 0) {
+    try {
+      const u = new URL(String(o.apiHost));
+      const local = u.hostname === "localhost" || u.hostname === "127.0.0.1";
+      if (u.protocol !== "https:" && !(local && u.protocol === "http:")) problems.push("apiHost must be an https URL");
+      else config.apiHost = u.origin;
+    } catch {
+      problems.push("apiHost must be a URL");
+    }
+  }
+  if (o.org !== void 0) {
+    const s = typeof o.org === "string" ? o.org.trim().toLowerCase() : "";
+    if (!SLUG.test(s)) problems.push("org must be an org slug");
+    else config.org = s;
+  }
+  for (const k of ["forbidPublic", "forbidAnonymous", "forbidUnlisted", "requireShape", "disableNudge", "disableLive", "disableReceipts", "disableAutopilot", "copyLink", "disableAsk", "disableMission", "disableCopy"]) bool(k);
+  if (o.autopilotOrg !== void 0) {
+    const s = typeof o.autopilotOrg === "string" ? o.autopilotOrg.trim().toLowerCase() : "";
+    if (!SLUG.test(s)) problems.push("autopilotOrg must be an org slug");
+    else config.autopilotOrg = s;
+  }
+  if (o.autopilotContent !== void 0) {
+    if (o.autopilotContent !== "full" && o.autopilotContent !== "actions" && o.autopilotContent !== "commands") problems.push('autopilotContent must be "full", "actions" or "commands"');
+    else config.autopilotContent = o.autopilotContent;
+  }
+  if (o.allowedCloneSources !== void 0) {
+    const a = o.allowedCloneSources;
+    if (a === "any" || a === "org-playbook") config.allowedCloneSources = a;
+    else if (Array.isArray(a) && a.every((x) => typeof x === "string" && HANDLE.test(x.trim().replace(/^@/, "").toLowerCase())))
+      config.allowedCloneSources = [...new Set(a.map((x) => x.trim().replace(/^@/, "").toLowerCase()))];
+    else problems.push('allowedCloneSources must be "any", "org-playbook" or a list of handles and org slugs');
+  }
+  if (o.extraRedactTerms !== void 0) {
+    if (!Array.isArray(o.extraRedactTerms) || !o.extraRedactTerms.every((t) => typeof t === "string")) problems.push("extraRedactTerms must be a list of strings");
+    else config.extraRedactTerms = [...new Set(o.extraRedactTerms.map((t) => t.trim()).filter((t) => t.length >= 2 && t.length <= 100))].slice(0, 200);
+  }
+  if (o.profile !== void 0) {
+    if (o.profile !== "finance" && o.profile !== "hipaa") problems.push('profile must be "finance" or "hipaa"');
+    else config.profile = o.profile;
+  }
+  if (o.archive !== void 0) {
+    const a = o.archive;
+    const org = a && typeof a.org === "string" ? a.org.trim().toLowerCase() : "";
+    if (!a || typeof a !== "object" || !SLUG.test(org) || a.required !== void 0 && typeof a.required !== "boolean") problems.push("archive must be { org: <slug>, required: true|false }");
+    else config.archive = { org, required: a.required === true };
+  }
+  if (o.restrictOrgs !== void 0) {
+    const list = typeof o.restrictOrgs === "string" ? o.restrictOrgs.split(",") : o.restrictOrgs;
+    if (!Array.isArray(list) || !list.every((x) => typeof x === "string" && SLUG.test(x.trim().toLowerCase()))) problems.push("restrictOrgs must be a list of org slugs");
+    else config.restrictOrgs = [...new Set(list.map((x) => x.trim().toLowerCase()))];
+  }
+  if (o.restrictMode !== void 0) {
+    if (o.restrictMode !== "block-all-uploads") problems.push('restrictMode must be "block-all-uploads"');
+    else config.restrictMode = o.restrictMode;
+  }
+  if (o.askBefore !== void 0) {
+    if (!Array.isArray(o.askBefore) || !o.askBefore.every((t) => typeof t === "string")) problems.push("askBefore must be a list of change areas and path patterns");
+    else config.askBefore = [...new Set(o.askBefore.map((t) => t.trim()).filter((t) => t && t.length <= 200))].slice(0, 50);
+  }
+  if (o.askTimeoutMinutes !== void 0) {
+    const n = o.askTimeoutMinutes;
+    if (typeof n !== "number" || !Number.isFinite(n) || n < 1 || n > 15) problems.push("askTimeoutMinutes must be a number from 1 to 15");
+    else config.askTimeoutMinutes = Math.round(n);
+  }
+  if (o.askOrg !== void 0) {
+    const s = typeof o.askOrg === "string" ? o.askOrg.trim().toLowerCase() : "";
+    if (!SLUG.test(s)) problems.push("askOrg must be an org slug");
+    else config.askOrg = s;
+  }
+  if (o.allowCloneYesWith !== void 0) {
+    const l = o.allowCloneYesWith;
+    if (!Array.isArray(l) || !l.every((x) => GATED_CAPABILITIES.includes(x))) problems.push('allowCloneYesWith must list only "shell", "install", "network" and/or "settings"');
+    else config.allowCloneYesWith = [...new Set(l)];
+  }
+  return { config, problems };
+}
+function systemManagedPaths(platform = process.platform, env = process.env) {
+  if (platform === "darwin")
+    return [
+      { path: "/Library/Application Support/copyrun/managed.json", kind: "json" },
+      // a configuration profile (Jamf, Kandji, Intune for Mac) lands here; it wins over the file
+      { path: "/Library/Managed Preferences/ai.copyrun.cli.plist", kind: "plist" }
+    ];
+  if (platform === "win32") return [{ path: join(env.ProgramData || env.PROGRAMDATA || "C:\\ProgramData", "copyrun", "managed.json"), kind: "json" }];
+  return [{ path: "/etc/copyrun/managed.json", kind: "json" }];
+}
+function plutil(p) {
+  try {
+    return execFileSync("/usr/bin/plutil", ["-convert", "json", "-o", "-", p], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 5e3 });
+  } catch {
+    return void 0;
+  }
+}
+function loadManaged(deps = {}) {
+  const env = deps.env ?? process.env;
+  const exists = deps.exists ?? existsSync;
+  const read = deps.read ?? ((p) => readFileSync(p, "utf8"));
+  const plist = deps.plistToJson ?? plutil;
+  const system = systemManagedPaths(deps.platform ?? process.platform, env).filter((f) => exists(f.path));
+  const files = system.length ? system : env.COPYRUN_MANAGED_CONFIG ? [{ path: env.COPYRUN_MANAGED_CONFIG, kind: "json" }] : [];
+  const state = { config: {}, sources: [], errors: [] };
+  for (const f of files) {
+    let text;
+    try {
+      text = f.kind === "plist" ? plist(f.path) : read(f.path);
+    } catch (e) {
+      state.errors.push(`${f.path}: can't be read (${e.message})`);
+      continue;
+    }
+    if (text === void 0) {
+      if (f.kind === "plist" && files.some((x) => x.kind === "json")) continue;
+      state.errors.push(`${f.path}: can't be read (plutil unavailable)`);
+      continue;
+    }
+    let json;
+    try {
+      json = JSON.parse(text);
+    } catch {
+      state.errors.push(`${f.path}: not valid JSON`);
+      continue;
+    }
+    const { config, problems } = parseManaged(json);
+    if (problems.length) state.errors.push(`${f.path}: ${problems.join("; ")}`);
+    state.config = { ...state.config, ...config };
+    state.sources.push(f.path);
+  }
+  if (state.config.allowedCloneSources === "org-playbook" && !state.config.org) state.errors.push('allowedCloneSources "org-playbook" needs org');
+  if (state.config.autopilotOrg && state.config.org && state.config.autopilotOrg !== state.config.org) state.errors.push("autopilotOrg must be the same org as org");
+  if (state.config.askOrg && state.config.org && state.config.askOrg !== state.config.org) state.errors.push("askOrg must be the same org as org");
+  return state;
+}
+var cached;
+function managed() {
+  return cached ??= loadManaged();
+}
+
+// src/config.ts
+var VERSION = "0.2.0";
+var DIR = process.env.COPYRUN_HOME ?? join2(homedir(), ".copyrun");
+function isLoopbackHost(hostname2) {
+  const h = hostname2.toLowerCase();
+  return h === "localhost" || h.endsWith(".localhost") || h === "127.0.0.1" || /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(h) || h === "[::1]" || h === "::1";
+}
+function apiProblem(url) {
+  let u;
+  try {
+    u = new URL(url);
+  } catch {
+    return `"${url}" isn't a URL (--api / COPYRUN_API).`;
+  }
+  if (u.protocol === "https:" || u.protocol === "http:" && isLoopbackHost(u.hostname)) return void 0;
+  return `copyrun won't talk to ${u.origin}: the server must be https (plain http only for localhost). Your device token and runs would travel unencrypted.`;
+}
+function apiBase(flag) {
+  const pinned = managed().config.apiHost;
+  if (pinned) return pinned;
+  const base = (flag ?? process.env.COPYRUN_API ?? "https://copyrun.ai").replace(/\/$/, "");
+  const problem = apiProblem(base);
+  if (problem) throw new Error(problem);
+  return base;
+}
+
+// src/live-logic.ts
+import { createHash } from "crypto";
+function gateHeaders(env) {
+  const h = {};
+  const prelaunch = env.COPYRUN_PRELAUNCH_KEY?.trim();
+  if (prelaunch) h["x-copyrun-prelaunch"] = prelaunch;
+  const beta = env.COPYRUN_BETA?.trim();
+  if (beta && beta.includes(":")) h["x-copyrun-beta"] = beta;
+  return h;
+}
+
+// src/local-project.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2, statSync } from "fs";
+import { dirname, isAbsolute, join as join3, resolve } from "path";
+var gitRootOf = (cwd) => {
+  try {
+    return existsSync2(cwd) ? gitRoot(cwd)?.root : void 0;
+  } catch {
+    return void 0;
+  }
+};
+function gitRoot(cwd) {
+  let dir = resolve(cwd);
+  for (let i = 0; i < 40; i++) {
+    const g = join3(dir, ".git");
+    try {
+      const st = statSync(g);
+      if (st.isDirectory()) return { root: dir, gitDir: g };
+      if (st.isFile()) {
+        const m = readFileSync2(g, "utf8").match(/^gitdir:\s*(.+)$/m);
+        if (m) {
+          const wt = isAbsolute(m[1].trim()) ? m[1].trim() : resolve(dir, m[1].trim());
+          let common = wt;
+          try {
+            const c = readFileSync2(join3(wt, "commondir"), "utf8").trim();
+            common = isAbsolute(c) ? c : resolve(wt, c);
+          } catch {
+          }
+          return { root: dir, gitDir: common };
+        }
+      }
+    } catch {
+    }
+    const up = dirname(dir);
+    if (up === dir) return void 0;
+    dir = up;
+  }
+  return void 0;
+}
+
+// src/mission-logic.ts
+import { createHash as createHash2 } from "crypto";
+var BEAT_TIMEOUT_MS = 1500;
+var TOKENS_MAX_BYTES = 64 * 1024 * 1024;
+var WATCHED = {
+  gemini: { agent: "gemini" },
+  opencode: { agent: "opencode" },
+  openclaw: { agent: "openclaw" },
+  copilot: { agent: "copilot" },
+  aider: { agent: "aider" },
+  goose: { agent: "goose" },
+  amp: { agent: "amp" },
+  crush: { agent: "agent", label: "Crush" },
+  qwen: { agent: "agent", label: "Qwen Code" },
+  kimi: { agent: "agent", label: "Kimi CLI" },
+  droid: { agent: "agent", label: "Factory Droid" },
+  "kiro-cli": { agent: "agent", label: "Kiro CLI" }
+};
+var WATCH_SETTLE_MS = 1e4;
+var WATCH_TICK_MS = 5e3;
+var WATCH_ALIVE_MS = 2e4;
+var BUSY_CPU = 1;
+var RUNTIMES = /^(node|nodejs|bun|deno|python[\d.]*|pypy[\d.]*|ruby)$/;
+var basenameOf = (p) => p.replace(/^["']|["']$/g, "").split(/[\\/]/).pop() ?? "";
+var GENERIC_SCRIPT = /^(index|main|cli|bin|app|start|run|entry|dist)$/i;
+var PACKAGE_NAMES = {
+  "@google/gemini-cli": "gemini",
+  "opencode-ai": "opencode",
+  openclaw: "openclaw",
+  "@github/copilot": "copilot",
+  "@sourcegraph/amp": "amp",
+  "@qwen-code/qwen-code": "qwen"
+};
+function programName(command) {
+  const parts = command.trim().match(/"[^"]*"|'[^']*'|\S+/g) ?? [];
+  let name = basenameOf(parts[0] ?? "");
+  if (RUNTIMES.test(name.replace(/\.exe$/i, ""))) {
+    const script = parts.slice(1).find((a) => !a.startsWith("-"));
+    if (script) {
+      name = basenameOf(script);
+      if (GENERIC_SCRIPT.test(name.replace(/\.(m?js|cjs|ts)$/i, ""))) {
+        const m = /node_modules[\\/]((?:@[^\\/"']+[\\/])?[^\\/"']+)/i.exec(script);
+        const pkg = m?.[1]?.replace(/\\/g, "/").toLowerCase();
+        if (pkg && PACKAGE_NAMES[pkg]) name = PACKAGE_NAMES[pkg];
+      }
+    }
+  }
+  return name.replace(/\.(m?js|cjs|ts|py|exe)$/i, "").toLowerCase();
+}
+var WINDOWS_PS_ARGS = ["-NoProfile", "-NonInteractive", "-Command", "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine,KernelModeTime,UserModeTime | ConvertTo-Json -Compress"];
+function parseWindowsProcs(json) {
+  let rows;
+  try {
+    rows = JSON.parse(json);
+  } catch {
+    return [];
+  }
+  const list = Array.isArray(rows) ? rows : rows && typeof rows === "object" ? [rows] : [];
+  const out = [];
+  for (const r of list) {
+    const pid = Number(r.ProcessId);
+    if (!Number.isInteger(pid) || pid <= 0) continue;
+    const line = typeof r.CommandLine === "string" && r.CommandLine.trim() ? r.CommandLine : typeof r.Name === "string" ? r.Name : "";
+    const t = (Number(r.KernelModeTime) || 0) + (Number(r.UserModeTime) || 0);
+    out.push({ pid, ppid: Number(r.ParentProcessId) || 0, cpu: 0, cpuTime: t / 1e7, name: programName(line) });
+  }
+  return out;
+}
+function cpuFromTimes(procs, prev, now) {
+  const next = /* @__PURE__ */ new Map();
+  const out = [];
+  for (const p of procs) {
+    const was = prev.get(p.pid);
+    const dt = was ? (now - was.at) / 1e3 : 0;
+    const cpu = was && dt > 0 && p.cpuTime >= was.cpuTime ? Math.min(100 * (p.cpuTime - was.cpuTime) / dt, 100 * 64) : 0;
+    next.set(p.pid, { cpuTime: p.cpuTime, at: now });
+    out.push({ pid: p.pid, ppid: p.ppid, cpu, name: p.name });
+  }
+  prev.clear();
+  for (const [k, v] of next) prev.set(k, v);
+  return out;
+}
+function parsePs(out) {
+  const procs = [];
+  for (const line of out.split("\n")) {
+    const m = /^\s*(\d+)\s+(\d+)\s+([\d.,]+)\s+(.+)$/.exec(line);
+    if (!m) continue;
+    procs.push({ pid: Number(m[1]), ppid: Number(m[2]), cpu: Number(m[3].replace(",", ".")) || 0, name: programName(m[4]) });
+  }
+  return procs;
+}
+function agentProcs(procs, selfPid) {
+  const byPid = new Map(procs.map((p) => [p.pid, p]));
+  const kids = /* @__PURE__ */ new Map();
+  for (const p of procs) kids.set(p.ppid, [...kids.get(p.ppid) ?? [], p]);
+  const treeCpu = (p, depth = 0) => p.cpu + (depth > 8 ? 0 : (kids.get(p.pid) ?? []).reduce((a, k) => a + treeCpu(k, depth + 1), 0));
+  const out = [];
+  for (const p of procs) {
+    const w = WATCHED[p.name];
+    if (!w || p.pid === selfPid) continue;
+    let up = byPid.get(p.ppid);
+    let nested = false;
+    for (let i = 0; up && i < 32; i++, up = byPid.get(up.ppid)) {
+      if (up.name === p.name) {
+        nested = true;
+        break;
+      }
+    }
+    if (!nested) out.push({ ...p, ...w, cpuTree: treeCpu(p) });
+  }
+  return out;
+}
+var watchKey = (host, pid, name) => createHash2("sha256").update(`copyrun-mission-watch:${host}:${pid}:${name}`).digest("hex").slice(0, 32);
+function parseLsofCwd(out) {
+  const m = /* @__PURE__ */ new Map();
+  let pid = 0;
+  for (const line of out.split("\n")) {
+    if (line.startsWith("p")) pid = Number(line.slice(1));
+    else if (line.startsWith("n") && pid) m.set(pid, line.slice(1));
+  }
+  return m;
+}
+
+// src/procs.ts
+import { execFile } from "child_process";
+import { promisify } from "util";
+var run = promisify(execFile);
+var times = /* @__PURE__ */ new Map();
+async function listProcs() {
+  if (process.platform === "win32") {
+    const { stdout: stdout2 } = await run("powershell", WINDOWS_PS_ARGS, { timeout: 15e3, maxBuffer: 64 << 20, windowsHide: true });
+    return cpuFromTimes(parseWindowsProcs(stdout2), times, Date.now());
+  }
+  const { stdout } = await run("ps", ["-axww", "-o", "pid=,ppid=,pcpu=,command="], { timeout: 4e3, maxBuffer: 16 << 20 });
+  return parsePs(stdout);
+}
+async function watchedAgents() {
+  return agentProcs(await listProcs(), process.pid);
+}
+var alive = (pid) => {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+};
+function endProcess(pid) {
+  if (process.platform === "win32") {
+    run("taskkill", ["/PID", String(pid), "/T"], { windowsHide: true }).catch(() => void 0);
+    setTimeout(() => run("taskkill", ["/PID", String(pid), "/T", "/F"], { windowsHide: true }).catch(() => void 0), 4e3).unref();
+    return;
+  }
+  try {
+    process.kill(pid, "SIGINT");
+  } catch {
+  }
+  setTimeout(() => {
+    if (alive(pid))
+      try {
+        process.kill(pid, "SIGTERM");
+      } catch {
+      }
+  }, 4e3).unref();
+}
+
+// src/mission-watch.ts
+var run2 = promisify2(execFile2);
+var PID_FILE = join4(DIR, "mission-watch.pid");
+var tracked = /* @__PURE__ */ new Map();
+function readJson(path) {
+  try {
+    return JSON.parse(readFileSync3(path, "utf8"));
+  } catch {
+    return void 0;
+  }
+}
+function alive2(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function claimPidFile() {
+  const other = Number(String(readJson(PID_FILE) ?? ""));
+  if (other && other !== process.pid && alive2(other)) return false;
+  try {
+    writeFileSync(PID_FILE, String(process.pid), { mode: 384 });
+  } catch {
+  }
+  return true;
+}
+async function folders(pids) {
+  if (!pids.length || process.platform === "win32") return /* @__PURE__ */ new Map();
+  if (process.platform === "linux") {
+    const m = /* @__PURE__ */ new Map();
+    for (const p of pids) {
+      try {
+        m.set(p, readlinkSync(`/proc/${p}/cwd`));
+      } catch {
+      }
+    }
+    return m;
+  }
+  try {
+    const { stdout } = await run2("lsof", ["-a", "-d", "cwd", "-Fn", "-p", pids.join(",")], { timeout: 4e3, maxBuffer: 1 << 20 });
+    return parseLsofCwd(stdout);
+  } catch (e) {
+    const out = e.stdout;
+    return out ? parseLsofCwd(out) : /* @__PURE__ */ new Map();
+  }
+}
+function credentials() {
+  if (managed().config.disableMission) return void 0;
+  const cfg = readJson(join4(DIR, "config.json")) ?? {};
+  if (cfg.mission !== true) return void 0;
+  const api = apiBase();
+  const token = cfg.device && cfg.device.api === api && typeof cfg.device.token === "string" ? cfg.device.token : void 0;
+  return token ? { api, token } : void 0;
+}
+async function send(c, beat) {
+  try {
+    const res = await fetch(`${c.api}/api/v1/me/mission/beat`, {
+      method: "POST",
+      headers: { ...gateHeaders(process.env), authorization: `Bearer ${c.token}`, "content-type": "application/json", "user-agent": `copyrun-cli/${VERSION} mission-watch` },
+      body: JSON.stringify(beat),
+      signal: AbortSignal.timeout(BEAT_TIMEOUT_MS * 3)
+    });
+    if (!res.ok) return {};
+    const body = await res.json().catch(() => ({}));
+    return { stop: body.stop === true };
+  } catch {
+    return {};
+  }
+}
+async function tick(host) {
+  const c = credentials();
+  if (!c) return;
+  const found = await watchedAgents();
+  const now = Date.now();
+  const seen = new Set(found.map((p) => p.pid));
+  const fresh = found.filter((p) => !tracked.has(p.pid));
+  const where = await folders(fresh.map((p) => p.pid));
+  for (const p of fresh) {
+    const cwd = where.get(p.pid);
+    const project = cwd ? basename(gitRootOf(cwd) ?? cwd) : void 0;
+    tracked.set(p.pid, { key: watchKey(host, p.pid, p.name), agent: p.agent, ...p.label ? { label: p.label } : {}, ...project && project !== "/" ? { project } : {}, firstSeen: now, started: false, lastBeat: 0 });
+  }
+  const base = (t) => ({ session: t.key, agent: t.agent, via: "watch", ...t.label ? { label: t.label } : {}, ...t.project ? { project: t.project } : {} });
+  for (const p of found) {
+    const t = tracked.get(p.pid);
+    if (t.stopping) continue;
+    if (now - t.firstSeen < WATCH_SETTLE_MS) continue;
+    const idle = p.cpuTree < BUSY_CPU;
+    if (!t.started) {
+      t.started = true;
+      t.lastBeat = now;
+      t.idle = idle;
+      await send(c, { ...base(t), event: "start" });
+      continue;
+    }
+    if (now - t.lastBeat < WATCH_ALIVE_MS && idle === t.idle) continue;
+    t.lastBeat = now;
+    t.idle = idle;
+    const r = await send(c, { ...base(t), event: "alive", ...idle ? { idle: true } : {} });
+    if (r.stop) {
+      t.stopping = now;
+      endProcess(p.pid);
+    }
+  }
+  for (const [pid, t] of tracked) {
+    if (seen.has(pid)) continue;
+    tracked.delete(pid);
+    if (t.started) await send(c, { ...base(t), event: "end" });
+  }
+}
+async function main() {
+  if (!claimPidFile()) return;
+  const host = hostname();
+  const cleanup = () => {
+    try {
+      if (String(readJson(PID_FILE)) === String(process.pid)) unlinkSync(PID_FILE);
+    } catch {
+    }
+    process.exit(0);
+  };
+  process.on("SIGINT", cleanup);
+  process.on("SIGTERM", cleanup);
+  for (; ; ) {
+    await tick(host).catch(() => {
+    });
+    await new Promise((r) => setTimeout(r, WATCH_TICK_MS));
+  }
+}
+main().catch(() => process.exit(0));