github-router 0.3.276 → 0.3.285

package/dist/self-invocation-CKMjcA5F.js

@@ -0,0 +1,380 @@
+import { t as PACKAGE_ROOT_FLAG } from "./package-root-B-osctCk.js";
+import { t as PATHS } from "./paths-wLC0InjX.js";
+import consola from "consola";
+import { chmodSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, utimesSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { createHash } from "node:crypto";
+import os from "node:os";
+//#region src/lib/hook-launcher/provision.ts
+/**
+* Publish the self-contained hook launcher (`dist/hooks.mjs`) to a stable,
+* content-addressed path under `<APP_DIR>/hooks/`.
+*
+* Why this exists: `github-router claude` persists Claude Code hook commands
+* into a settings.json that outlives the process that wrote it, built from
+* `process.argv[1]`. Under `bunx` that path is inside `$TMPDIR`, and macOS's
+* per-user temp reaper deletes files there (keeping the directory skeleton) —
+* so `node <tmp>/…/dist/main.js` died on its first bare import with
+* `ERR_MODULE_NOT_FOUND` and EVERY hook in a long-running session failed until
+* the tree happened to be re-extracted. `bunx pkg@latest` also re-extracts in
+* place whenever npm's `latest` advances, so a live session's hooks could
+* silently start executing a different version's code.
+*
+* Deliberate departures from `provisionBrowserAssets()`, which this otherwise
+* mirrors:
+*
+*   - **Content-addressed, immutable names.** The digest IS the filename, so a
+*     new build never overwrites an old launcher and there is nothing to
+*     garbage-collect. Version-keyed names would need GC, and GC across
+*     concurrent proxies is a race: proxy N deleting N+1's launcher (or the
+*     reverse) breaks a live session's hooks. At ~1.5 MB, keeping stale
+*     launchers costs less than the race would.
+*
+*   - **The source is verified before it is published.** Hashing the bytes
+*     read from `dist/hooks.mjs` only identifies those bytes; it does not
+*     prove they are a complete artifact. A concurrent in-place `bunx`
+*     extraction can hand over a truncated file, which content-addressing
+*     would happily preserve forever under its own hash. The build writes a
+*     `dist/hooks.sha256` sidecar and we publish only on a match.
+*
+*   - **Failures are not latched.** A transient `EBUSY` (Windows antivirus, a
+*     concurrent reader) must not disable provisioning for the process
+*     lifetime, so only success is cached.
+*
+* Never throws: the caller degrades to `process.argv[1]` with a visible
+* warning rather than failing the launch.
+*/
+/** Sidecar written by `scripts/stamp-hooks-digest.ts` next to the bundle. */
+const DIGEST_SIDECAR = "hooks.sha256";
+/** Basename of the built launcher bundle. */
+const BUNDLE_NAME = "hooks.mjs";
+/**
+* Publish retries. A rename can lose a race with another proxy publishing the
+* same digest, or hit a Windows sharing violation while an antivirus scanner
+* holds the temp file. Both clear in milliseconds.
+*/
+const PUBLISH_ATTEMPTS = 3;
+let _published;
+let _inFlight;
+/**
+* Resolve the built bundle that sits beside the running code.
+*
+* In a built layout every chunk lives in `dist/`, so a sibling lookup finds
+* `dist/hooks.mjs`. Running from source it resolves to
+* `src/lib/hook-launcher/hooks.mjs`, which does not exist — which is exactly
+* the wanted behaviour: a `bun run dev` session must keep using
+* `process.argv[1]` rather than silently adopting a stale bundle from some
+* earlier build.
+*/
+function bundledLauncherPath() {
+	try {
+		return path.join(path.dirname(fileURLToPath(import.meta.url)), BUNDLE_NAME);
+	} catch {
+		return;
+	}
+}
+function sha256(buf) {
+	return createHash("sha256").update(buf).digest("hex");
+}
+/**
+* Read the build's expected digest. Absent or malformed means "cannot verify",
+* which is treated as a refusal to publish rather than as permission to skip
+* the check — an unverified source is the one thing content-addressing cannot
+* recover from.
+*/
+function expectedDigest(bundlePath) {
+	try {
+		const raw = readFileSync(path.join(path.dirname(bundlePath), DIGEST_SIDECAR), "utf8").trim();
+		return /^[0-9a-f]{64}$/.test(raw) ? raw : void 0;
+	} catch {
+		return;
+	}
+}
+/** True when `target` already holds exactly the bytes its name claims. */
+function targetIsValid(target, digest) {
+	try {
+		return sha256(readFileSync(target)) === digest;
+	} catch {
+		return false;
+	}
+}
+/**
+* Write `bytes` to `target` via a unique same-directory temp file plus a
+* rename, so a crash mid-write can never leave a partial file under the name
+* a hook command points at.
+*
+* The target is never deleted first: on Windows that would open a window where
+* a concurrently-launching session finds no launcher at all. A rename onto an
+* existing path can fail there, so a losing racer validates what the winner
+* wrote and accepts it.
+*/
+function publish(target, bytes, digest) {
+	if (targetIsValid(target, digest)) return true;
+	for (let attempt = 0; attempt < PUBLISH_ATTEMPTS; attempt++) {
+		const tmp = `${target}.${process.pid}-${attempt}.tmp`;
+		try {
+			writeFileSync(tmp, bytes, { mode: 384 });
+			renameSync(tmp, target);
+			return true;
+		} catch {
+			try {
+				rmSync(tmp, { force: true });
+			} catch {}
+		}
+	}
+	return targetIsValid(target, digest);
+}
+/** A stranded publish temp is dead well inside this. */
+const TMP_MAX_AGE_MS = 864e5;
+/**
+* Launchers older than this are reaped. Generous on purpose — see the residual
+* risk in `sweepStaleLaunchers`.
+*/
+const LAUNCHER_MAX_AGE_MS = 2592e6;
+/**
+* Reap stranded publish temps and long-unused launchers.
+*
+* Without this the directory grows by ~1.5 MB per shipped version forever, and
+* this project ships a patch release per PR with self-update on by default.
+*
+* The immutable content-addressed naming exists to avoid a GC race, so the
+* sweep is built to not reintroduce one: it never touches the digest THIS
+* launch resolved, and every launch refreshes its own launcher's mtime, so a
+* file survives for as long as some proxy keeps launching against it. Residual
+* risk, stated plainly: a single proxy running continuously for more than 30
+* days without relaunching could have its launcher reaped by a newer proxy.
+* That is bounded and far rarer than the unbounded growth it prevents, but it
+* is not zero — a PID-liveness marker would close it if it ever bites.
+*/
+function sweepStaleLaunchers(dir, keep) {
+	const now = Date.now();
+	let entries;
+	try {
+		entries = readdirSync(dir);
+	} catch {
+		return;
+	}
+	for (const name of entries) {
+		if (name === path.basename(keep)) continue;
+		const isTmp = name.endsWith(".tmp");
+		const isLauncher = /^hooks-[0-9a-f]{64}\.mjs$/.test(name);
+		if (!isTmp && !isLauncher) continue;
+		const target = path.join(dir, name);
+		try {
+			if (now - statSync(target).mtimeMs > (isTmp ? TMP_MAX_AGE_MS : LAUNCHER_MAX_AGE_MS)) rmSync(target, { force: true });
+		} catch {}
+	}
+}
+/**
+* Materialize the launcher and return its stable absolute path, or undefined
+* when it could not be published (running from source, bundle missing or
+* unverifiable, filesystem refusing the write).
+*
+* Single-flight so the startup call and any lazy caller collapse to one run.
+*/
+function provisionHookLauncher() {
+	if (_published) return Promise.resolve(_published);
+	if (_inFlight) return _inFlight;
+	_inFlight = Promise.resolve().then(() => provisionImpl()).then((result) => {
+		if (result) _published = result;
+		return result;
+	}).finally(() => {
+		_inFlight = void 0;
+	});
+	return _inFlight;
+}
+function provisionImpl() {
+	const bundlePath = bundledLauncherPath();
+	if (!bundlePath) return void 0;
+	return publishLauncherFrom(bundlePath);
+}
+/**
+* Verify and publish one specific bundle. Split out from the source resolution
+* above so the publication semantics are testable: running from source,
+* `bundledLauncherPath()` deliberately points at a file that does not exist,
+* which is the right behaviour but leaves nothing to exercise.
+*
+* @internal — production callers go through `provisionHookLauncher()`.
+*/
+function publishLauncherFrom(bundlePath) {
+	try {
+		let bytes;
+		try {
+			bytes = readFileSync(bundlePath);
+		} catch {
+			return;
+		}
+		const digest = sha256(bytes);
+		const expected = expectedDigest(bundlePath);
+		if (!expected) {
+			consola.debug("[hook-launcher] no digest sidecar beside the bundle; not publishing");
+			return;
+		}
+		if (expected !== digest) {
+			consola.debug("[hook-launcher] bundle digest does not match the build; not publishing");
+			return;
+		}
+		const dir = PATHS.HOOK_LAUNCHER_DIR;
+		mkdirSync(dir, {
+			recursive: true,
+			mode: 448
+		});
+		try {
+			chmodSync(dir, 448);
+		} catch {}
+		const target = path.join(dir, `hooks-${digest}.mjs`);
+		if (!publish(target, bytes, digest)) return void 0;
+		try {
+			const now = /* @__PURE__ */ new Date();
+			utimesSync(target, now, now);
+		} catch {}
+		sweepStaleLaunchers(dir, target);
+		return target;
+	} catch (err) {
+		consola.debug("[hook-launcher] provisioning skipped:", err);
+		return;
+	}
+}
+//#endregion
+//#region src/lib/hook-launcher/self-invocation.ts
+/**
+* How this process names ITSELF in a command string that gets persisted to
+* disk and executed later by someone else.
+*
+* Every Claude Code hook, the MCP `headersHelper`, and the worker-guard are
+* registered as shell commands inside a settings.json that outlives the
+* process that wrote it. They were built from `(process.execPath,
+* process.argv[1])`, which under `bunx` points into `$TMPDIR` — a directory
+* macOS reaps and `bunx pkg@latest` re-extracts in place. A persisted command
+* pointing there stops working mid-session (see
+* `src/lib/hook-launcher/provision.ts` for the failure in full).
+*
+* So the pair is resolved ONCE per launch, through the stable relocated
+* launcher when one can be published, and every builder composes its command
+* from that single answer.
+*/
+function quote(s) {
+	return `"${s}"`;
+}
+/**
+* Compose a persisted command string: the binary, the script when it differs
+* from the binary, the baked package root when there is one, then the args.
+*
+* Every builder in the codebase routes through here so the three parts cannot
+* drift apart — and so a future part is added in one place, not eleven.
+*/
+function buildSelfCommand(inv, args) {
+	const parts = [quote(inv.execPath)];
+	if (inv.scriptPath && inv.scriptPath !== inv.execPath) parts.push(quote(inv.scriptPath));
+	if (inv.packageRoot) parts.push(PACKAGE_ROOT_FLAG, quote(inv.packageRoot));
+	if (args) parts.push(args);
+	return parts.join(" ");
+}
+/** The invocation describing the currently running entrypoint, unrelocated. */
+function currentInvocation() {
+	return {
+		execPath: process.execPath,
+		scriptPath: process.argv[1]
+	};
+}
+let _resolved;
+/**
+* Resolve the invocation to bake into every persisted command this launch
+* writes. Awaited BEFORE the settings are written, never fire-and-forget: a
+* command persisted while provisioning is still pending would name the very
+* temp path this exists to avoid, and the session would stay broken however
+* well provisioning later went.
+*
+* Falls back to the running entrypoint if the launcher cannot be published, so
+* a provisioning failure degrades rather than breaking a launch. The caller is
+* responsible for surfacing that fallback — see `hookLauncherDegradedWarning`.
+*/
+async function resolveSelfInvocation() {
+	if (_resolved) return _resolved;
+	const launcher = await provisionHookLauncher();
+	_resolved = launcher ? {
+		execPath: process.execPath,
+		scriptPath: launcher,
+		packageRoot: currentPackageRoot()
+	} : currentInvocation();
+	return _resolved;
+}
+/**
+* A human-facing warning when this launch is about to persist hook commands
+* pointing into a directory the OS may reap — the exact configuration that
+* produced the original bug.
+*
+* Returns the message rather than logging it, mirroring
+* `colbertDegradedWarning`: `claude` and `codex` call `enableFileLogging()`,
+* which redirects `consola.warn` to the error log, so a warning logged here
+* would be invisible on the one path where it matters most. The caller writes
+* it to stderr next to the readiness line instead.
+*
+* Silent when running from source, which has no bundle to publish and is not a
+* degraded state.
+*/
+function hookLauncherDegradedWarning(inv) {
+	if (!inv.scriptPath) return null;
+	if (inv.scriptPath.startsWith(PATHS.HOOK_LAUNCHER_DIR)) {
+		if (inv.packageRoot) return null;
+		return "Hook launcher published without a package root; hook version reporting will be degraded. This usually means the install tree is partially missing — reinstall github-router.";
+	}
+	if (isUnderVolatileRoot(inv.scriptPath)) return "Hook commands point into a temporary directory and will stop working when the OS reaps it (the stable launcher could not be published). Reinstall with `npm install -g github-router` to avoid this.";
+	return null;
+}
+/**
+* The package root of the RUNNING code, derived while we are still inside the
+* package tree — the one moment it is knowable without guessing.
+*
+* The name is checked, not just the presence of a package.json: this value is
+* baked into a persisted command and consumed by `packageRoot()` as the
+* highest-priority source, so handing it the WRONG root would be worse than
+* handing it none. Matches `findPackageRoot()` in
+* `browser-mcp/native-host-installer.ts`, whose fallbacks this supersedes.
+*/
+function currentPackageRoot() {
+	const entry = typeof process.argv[1] === "string" ? process.argv[1] : void 0;
+	if (!entry) return void 0;
+	let cur = path.dirname(entry);
+	for (let i = 0; i < 10; i++) {
+		try {
+			const pkg = JSON.parse(readFileSync(path.join(cur, "package.json"), "utf8"));
+			if (typeof pkg.name === "string" && pkg.name.includes("github-router")) return cur;
+		} catch {}
+		const parent = path.dirname(cur);
+		if (parent === cur) break;
+		cur = parent;
+	}
+}
+/**
+* Whether a path sits under a directory the OS is entitled to clean out from
+* under a running session: the per-user temp dir on every platform, which is
+* where `bunx` (unlike `npx`, which uses a cache under $HOME) installs.
+*
+* Both sides are compared in resolved AND unresolved form. macOS reports
+* `$TMPDIR` as `/var/folders/…` while a process sees `/private/var/folders/…`,
+* so a single-form prefix test silently never matches; and `realpathSync`
+* fails on a path that does not exist, which would otherwise make the answer
+* depend on whether the file happens to be there.
+*/
+function isUnderVolatileRoot(target) {
+	try {
+		const prefixes = /* @__PURE__ */ new Set();
+		for (const root of [os.tmpdir(), realpathIfPossible(os.tmpdir())]) prefixes.add(root.endsWith(path.sep) ? root : root + path.sep);
+		return [target, realpathIfPossible(target)].some((t) => [...prefixes].some((p) => t.startsWith(p)));
+	} catch {
+		return false;
+	}
+}
+function realpathIfPossible(p) {
+	try {
+		return realpathSync(p);
+	} catch {
+		return p;
+	}
+}
+//#endregion
+export { hookLauncherDegradedWarning as n, resolveSelfInvocation as r, buildSelfCommand as t };
+
+//# sourceMappingURL=self-invocation-CKMjcA5F.js.map

package/dist/self-invocation-CKMjcA5F.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"self-invocation-CKMjcA5F.js","names":[],"sources":["../src/lib/hook-launcher/provision.ts","../src/lib/hook-launcher/self-invocation.ts"],"sourcesContent":["/**\n * Publish the self-contained hook launcher (`dist/hooks.mjs`) to a stable,\n * content-addressed path under `<APP_DIR>/hooks/`.\n *\n * Why this exists: `github-router claude` persists Claude Code hook commands\n * into a settings.json that outlives the process that wrote it, built from\n * `process.argv[1]`. Under `bunx` that path is inside `$TMPDIR`, and macOS's\n * per-user temp reaper deletes files there (keeping the directory skeleton) —\n * so `node <tmp>/…/dist/main.js` died on its first bare import with\n * `ERR_MODULE_NOT_FOUND` and EVERY hook in a long-running session failed until\n * the tree happened to be re-extracted. `bunx pkg@latest` also re-extracts in\n * place whenever npm's `latest` advances, so a live session's hooks could\n * silently start executing a different version's code.\n *\n * Deliberate departures from `provisionBrowserAssets()`, which this otherwise\n * mirrors:\n *\n *   - **Content-addressed, immutable names.** The digest IS the filename, so a\n *     new build never overwrites an old launcher and there is nothing to\n *     garbage-collect. Version-keyed names would need GC, and GC across\n *     concurrent proxies is a race: proxy N deleting N+1's launcher (or the\n *     reverse) breaks a live session's hooks. At ~1.5 MB, keeping stale\n *     launchers costs less than the race would.\n *\n *   - **The source is verified before it is published.** Hashing the bytes\n *     read from `dist/hooks.mjs` only identifies those bytes; it does not\n *     prove they are a complete artifact. A concurrent in-place `bunx`\n *     extraction can hand over a truncated file, which content-addressing\n *     would happily preserve forever under its own hash. The build writes a\n *     `dist/hooks.sha256` sidecar and we publish only on a match.\n *\n *   - **Failures are not latched.** A transient `EBUSY` (Windows antivirus, a\n *     concurrent reader) must not disable provisioning for the process\n *     lifetime, so only success is cached.\n *\n * Never throws: the caller degrades to `process.argv[1]` with a visible\n * warning rather than failing the launch.\n */\n\nimport { createHash } from \"node:crypto\"\nimport {\n  chmodSync,\n  mkdirSync,\n  readdirSync,\n  readFileSync,\n  renameSync,\n  rmSync,\n  statSync,\n  utimesSync,\n  writeFileSync,\n} from \"node:fs\"\nimport path from \"node:path\"\nimport { fileURLToPath } from \"node:url\"\n\nimport consola from \"consola\"\n\nimport { PATHS } from \"../paths\"\n\n/** Sidecar written by `scripts/stamp-hooks-digest.ts` next to the bundle. */\nconst DIGEST_SIDECAR = \"hooks.sha256\"\n\n/** Basename of the built launcher bundle. */\nconst BUNDLE_NAME = \"hooks.mjs\"\n\n/**\n * Publish retries. A rename can lose a race with another proxy publishing the\n * same digest, or hit a Windows sharing violation while an antivirus scanner\n * holds the temp file. Both clear in milliseconds.\n */\nconst PUBLISH_ATTEMPTS = 3\n\nlet _published: string | undefined\nlet _inFlight: Promise<string | undefined> | undefined\n\n/** @internal — reset module state between test cases. */\nexport function __resetHookLauncherForTests(): void {\n  _published = undefined\n  _inFlight = undefined\n}\n\n/**\n * Resolve the built bundle that sits beside the running code.\n *\n * In a built layout every chunk lives in `dist/`, so a sibling lookup finds\n * `dist/hooks.mjs`. Running from source it resolves to\n * `src/lib/hook-launcher/hooks.mjs`, which does not exist — which is exactly\n * the wanted behaviour: a `bun run dev` session must keep using\n * `process.argv[1]` rather than silently adopting a stale bundle from some\n * earlier build.\n */\nfunction bundledLauncherPath(): string | undefined {\n  try {\n    return path.join(path.dirname(fileURLToPath(import.meta.url)), BUNDLE_NAME)\n  } catch {\n    return undefined\n  }\n}\n\nfunction sha256(buf: Buffer): string {\n  return createHash(\"sha256\").update(buf).digest(\"hex\")\n}\n\n/**\n * Read the build's expected digest. Absent or malformed means \"cannot verify\",\n * which is treated as a refusal to publish rather than as permission to skip\n * the check — an unverified source is the one thing content-addressing cannot\n * recover from.\n */\nfunction expectedDigest(bundlePath: string): string | undefined {\n  try {\n    const raw = readFileSync(\n      path.join(path.dirname(bundlePath), DIGEST_SIDECAR),\n      \"utf8\",\n    ).trim()\n    return /^[0-9a-f]{64}$/.test(raw) ? raw : undefined\n  } catch {\n    return undefined\n  }\n}\n\n/** True when `target` already holds exactly the bytes its name claims. */\nfunction targetIsValid(target: string, digest: string): boolean {\n  try {\n    return sha256(readFileSync(target)) === digest\n  } catch {\n    return false\n  }\n}\n\n/**\n * Write `bytes` to `target` via a unique same-directory temp file plus a\n * rename, so a crash mid-write can never leave a partial file under the name\n * a hook command points at.\n *\n * The target is never deleted first: on Windows that would open a window where\n * a concurrently-launching session finds no launcher at all. A rename onto an\n * existing path can fail there, so a losing racer validates what the winner\n * wrote and accepts it.\n */\nfunction publish(target: string, bytes: Buffer, digest: string): boolean {\n  // Checked once up front rather than per attempt: validation re-hashes ~1.5 MB\n  // and the retries exist for rename contention, which revalidating cannot fix.\n  if (targetIsValid(target, digest)) return true\n  for (let attempt = 0; attempt < PUBLISH_ATTEMPTS; attempt++) {\n    const tmp = `${target}.${process.pid}-${attempt}.tmp`\n    try {\n      writeFileSync(tmp, bytes, { mode: 0o600 })\n      renameSync(tmp, target)\n      return true\n    } catch {\n      try {\n        rmSync(tmp, { force: true })\n      } catch {\n        // Best-effort. A Windows sharing violation can strand the temp file;\n        // `sweepStaleLaunchers` reaps it later rather than leaking 1.5 MB.\n      }\n    }\n  }\n  return targetIsValid(target, digest)\n}\n\n/** A stranded publish temp is dead well inside this. */\nconst TMP_MAX_AGE_MS = 24 * 60 * 60 * 1000\n\n/**\n * Launchers older than this are reaped. Generous on purpose — see the residual\n * risk in `sweepStaleLaunchers`.\n */\nconst LAUNCHER_MAX_AGE_MS = 30 * 24 * 60 * 60 * 1000\n\n/**\n * Reap stranded publish temps and long-unused launchers.\n *\n * Without this the directory grows by ~1.5 MB per shipped version forever, and\n * this project ships a patch release per PR with self-update on by default.\n *\n * The immutable content-addressed naming exists to avoid a GC race, so the\n * sweep is built to not reintroduce one: it never touches the digest THIS\n * launch resolved, and every launch refreshes its own launcher's mtime, so a\n * file survives for as long as some proxy keeps launching against it. Residual\n * risk, stated plainly: a single proxy running continuously for more than 30\n * days without relaunching could have its launcher reaped by a newer proxy.\n * That is bounded and far rarer than the unbounded growth it prevents, but it\n * is not zero — a PID-liveness marker would close it if it ever bites.\n */\nfunction sweepStaleLaunchers(dir: string, keep: string): void {\n  const now = Date.now()\n  let entries: Array<string>\n  try {\n    entries = readdirSync(dir)\n  } catch {\n    return\n  }\n  for (const name of entries) {\n    if (name === path.basename(keep)) continue\n    const isTmp = name.endsWith(\".tmp\")\n    // Strict shape match, like sweepAgedWorkerDiffs: this directory is ours,\n    // but a name-shape check means a false positive can only ever cost a file\n    // the next launch regenerates.\n    const isLauncher = /^hooks-[0-9a-f]{64}\\.mjs$/.test(name)\n    if (!isTmp && !isLauncher) continue\n    const target = path.join(dir, name)\n    try {\n      const age = now - statSync(target).mtimeMs\n      if (age > (isTmp ? TMP_MAX_AGE_MS : LAUNCHER_MAX_AGE_MS)) {\n        rmSync(target, { force: true })\n      }\n    } catch {\n      /* best-effort */\n    }\n  }\n}\n\n/**\n * Materialize the launcher and return its stable absolute path, or undefined\n * when it could not be published (running from source, bundle missing or\n * unverifiable, filesystem refusing the write).\n *\n * Single-flight so the startup call and any lazy caller collapse to one run.\n */\nexport function provisionHookLauncher(): Promise<string | undefined> {\n  if (_published) return Promise.resolve(_published)\n  if (_inFlight) return _inFlight\n  _inFlight = Promise.resolve()\n    .then(() => provisionImpl())\n    .then((result) => {\n      // Cache SUCCESS only. Latching a transient failure would disable the\n      // stable launcher for the whole process lifetime.\n      if (result) _published = result\n      return result\n    })\n    .finally(() => {\n      _inFlight = undefined\n    })\n  return _inFlight\n}\n\nfunction provisionImpl(): string | undefined {\n  const bundlePath = bundledLauncherPath()\n  if (!bundlePath) return undefined\n  return publishLauncherFrom(bundlePath)\n}\n\n/**\n * Verify and publish one specific bundle. Split out from the source resolution\n * above so the publication semantics are testable: running from source,\n * `bundledLauncherPath()` deliberately points at a file that does not exist,\n * which is the right behaviour but leaves nothing to exercise.\n *\n * @internal — production callers go through `provisionHookLauncher()`.\n */\nexport function publishLauncherFrom(bundlePath: string): string | undefined {\n  try {\n    let bytes: Buffer\n    try {\n      bytes = readFileSync(bundlePath)\n    } catch {\n      // Running from source, or the package tree was reaped out from under us.\n      // Either way there is nothing to publish; a launcher published by an\n      // earlier launch still stands.\n      return undefined\n    }\n\n    const digest = sha256(bytes)\n    const expected = expectedDigest(bundlePath)\n    if (!expected) {\n      // \"Cannot verify\" and \"verified bad\" both mean do-not-publish. Treating\n      // an absent sidecar as permission would delete the integrity check in\n      // exactly the degraded conditions it exists for.\n      consola.debug(\n        \"[hook-launcher] no digest sidecar beside the bundle; not publishing\",\n      )\n      return undefined\n    }\n    if (expected !== digest) {\n      // The classic cause is reading mid-`bunx`-re-extraction. Publishing here\n      // would freeze a torn bundle under a stable name forever, because\n      // content-addressing gives a truncated file its own perfectly valid hash.\n      consola.debug(\n        \"[hook-launcher] bundle digest does not match the build; not publishing\",\n      )\n      return undefined\n    }\n\n    const dir = PATHS.HOOK_LAUNCHER_DIR\n    // 0o700 / 0o600, matching the convention for the runtime dir in paths.ts.\n    // This is not incidental hygiene: the published file is EXECUTED by node on\n    // every prompt of every session, so a group- or world-writable path here\n    // would let a local attacker swap the launcher and run code inside the\n    // user's agent. chmod is best-effort — it is a no-op on Windows, where the\n    // ACL inherited from APP_DIR governs.\n    mkdirSync(dir, { recursive: true, mode: 0o700 })\n    try {\n      chmodSync(dir, 0o700)\n    } catch {\n      /* best-effort: Windows, or a dir we do not own */\n    }\n    const target = path.join(dir, `hooks-${digest}.mjs`)\n    if (!publish(target, bytes, digest)) return undefined\n\n    // Mark this launcher as still in use before sweeping, so a long-lived\n    // install that keeps relaunching against an old version is never reaped by\n    // a newer proxy's sweep.\n    try {\n      const now = new Date()\n      utimesSync(target, now, now)\n    } catch {\n      /* best-effort */\n    }\n    sweepStaleLaunchers(dir, target)\n    return target\n  } catch (err) {\n    consola.debug(\"[hook-launcher] provisioning skipped:\", err)\n    return undefined\n  }\n}\n","/**\n * How this process names ITSELF in a command string that gets persisted to\n * disk and executed later by someone else.\n *\n * Every Claude Code hook, the MCP `headersHelper`, and the worker-guard are\n * registered as shell commands inside a settings.json that outlives the\n * process that wrote it. They were built from `(process.execPath,\n * process.argv[1])`, which under `bunx` points into `$TMPDIR` — a directory\n * macOS reaps and `bunx pkg@latest` re-extracts in place. A persisted command\n * pointing there stops working mid-session (see\n * `src/lib/hook-launcher/provision.ts` for the failure in full).\n *\n * So the pair is resolved ONCE per launch, through the stable relocated\n * launcher when one can be published, and every builder composes its command\n * from that single answer.\n */\n\nimport { readFileSync, realpathSync } from \"node:fs\"\nimport os from \"node:os\"\nimport path from \"node:path\"\n\nimport { PACKAGE_ROOT_FLAG } from \"../package-root\"\nimport { PATHS } from \"../paths\"\nimport { provisionHookLauncher } from \"./provision\"\n\n/** The binary + script + package root a persisted command should name. */\nexport interface SelfInvocation {\n  /** The node/bun binary to exec. */\n  execPath: string\n  /** Script to pass to it, omitted for a packaged single-file build. */\n  scriptPath?: string\n  /**\n   * The github-router package root, baked in only when `scriptPath` is the\n   * relocated launcher. From `<APP_DIR>/hooks/` nothing can derive it: the\n   * pre-existing walk in `browser-mcp/native-host-installer.ts` falls back to\n   * `process.cwd()`, which would silently resolve to the USER'S WORKSPACE.\n   */\n  packageRoot?: string\n}\n\nfunction quote(s: string): string {\n  return `\"${s}\"`\n}\n\n/**\n * Compose a persisted command string: the binary, the script when it differs\n * from the binary, the baked package root when there is one, then the args.\n *\n * Every builder in the codebase routes through here so the three parts cannot\n * drift apart — and so a future part is added in one place, not eleven.\n */\nexport function buildSelfCommand(inv: SelfInvocation, args: string): string {\n  const parts = [quote(inv.execPath)]\n  if (inv.scriptPath && inv.scriptPath !== inv.execPath) {\n    parts.push(quote(inv.scriptPath))\n  }\n  if (inv.packageRoot) {\n    parts.push(PACKAGE_ROOT_FLAG, quote(inv.packageRoot))\n  }\n  if (args) parts.push(args)\n  return parts.join(\" \")\n}\n\n/** The invocation describing the currently running entrypoint, unrelocated. */\nexport function currentInvocation(): SelfInvocation {\n  return { execPath: process.execPath, scriptPath: process.argv[1] }\n}\n\nlet _resolved: SelfInvocation | undefined\n\n/** @internal — reset module state between test cases. */\nexport function __resetSelfInvocationForTests(): void {\n  _resolved = undefined\n}\n\n/**\n * Resolve the invocation to bake into every persisted command this launch\n * writes. Awaited BEFORE the settings are written, never fire-and-forget: a\n * command persisted while provisioning is still pending would name the very\n * temp path this exists to avoid, and the session would stay broken however\n * well provisioning later went.\n *\n * Falls back to the running entrypoint if the launcher cannot be published, so\n * a provisioning failure degrades rather than breaking a launch. The caller is\n * responsible for surfacing that fallback — see `hookLauncherDegradedWarning`.\n */\nexport async function resolveSelfInvocation(): Promise<SelfInvocation> {\n  if (_resolved) return _resolved\n  const launcher = await provisionHookLauncher()\n  _resolved =\n    launcher ?\n      {\n        execPath: process.execPath,\n        scriptPath: launcher,\n        packageRoot: currentPackageRoot(),\n      }\n    : currentInvocation()\n  return _resolved\n}\n\n/**\n * A human-facing warning when this launch is about to persist hook commands\n * pointing into a directory the OS may reap — the exact configuration that\n * produced the original bug.\n *\n * Returns the message rather than logging it, mirroring\n * `colbertDegradedWarning`: `claude` and `codex` call `enableFileLogging()`,\n * which redirects `consola.warn` to the error log, so a warning logged here\n * would be invisible on the one path where it matters most. The caller writes\n * it to stderr next to the readiness line instead.\n *\n * Silent when running from source, which has no bundle to publish and is not a\n * degraded state.\n */\nexport function hookLauncherDegradedWarning(\n  inv: SelfInvocation,\n): string | null {\n  if (!inv.scriptPath) return null\n  // Our own published launcher is checked FIRST, and is authoritative: we know\n  // we published it, so it can never warrant the \"could not publish\" message\n  // below even if APP_DIR itself sits somewhere unusual.\n  if (inv.scriptPath.startsWith(PATHS.HOOK_LAUNCHER_DIR)) {\n    if (inv.packageRoot) return null\n    // Relocated but rootless. Today this only degrades `--version` inside the\n    // launcher, because nothing in the hook graph consumes the package root for\n    // anything else. It is reported anyway because it is a trap rather than a\n    // bug: the day a hook subcommand pulls in code_search or the browser\n    // installer, `packageRoot()` falls through to `process.cwd()` and starts\n    // resolving against the user's REPO with no signal at all.\n    return (\n      \"Hook launcher published without a package root; hook version reporting \"\n      + \"will be degraded. This usually means the install tree is partially \"\n      + \"missing — reinstall github-router.\"\n    )\n  }\n  if (isUnderVolatileRoot(inv.scriptPath)) {\n    return (\n      \"Hook commands point into a temporary directory and will stop working \"\n      + \"when the OS reaps it (the stable launcher could not be published). \"\n      + \"Reinstall with `npm install -g github-router` to avoid this.\"\n    )\n  }\n  return null\n}\n\n/**\n * The package root of the RUNNING code, derived while we are still inside the\n * package tree — the one moment it is knowable without guessing.\n *\n * The name is checked, not just the presence of a package.json: this value is\n * baked into a persisted command and consumed by `packageRoot()` as the\n * highest-priority source, so handing it the WRONG root would be worse than\n * handing it none. Matches `findPackageRoot()` in\n * `browser-mcp/native-host-installer.ts`, whose fallbacks this supersedes.\n */\nfunction currentPackageRoot(): string | undefined {\n  const entry = typeof process.argv[1] === \"string\" ? process.argv[1] : undefined\n  if (!entry) return undefined\n  let cur = path.dirname(entry)\n  for (let i = 0; i < 10; i++) {\n    try {\n      const pkg = JSON.parse(\n        readFileSync(path.join(cur, \"package.json\"), \"utf8\"),\n      ) as { name?: unknown }\n      if (typeof pkg.name === \"string\" && pkg.name.includes(\"github-router\")) {\n        return cur\n      }\n    } catch {\n      // Not here, or unreadable; walk up.\n    }\n    const parent = path.dirname(cur)\n    if (parent === cur) break\n    cur = parent\n  }\n  return undefined\n}\n\n/**\n * Whether a path sits under a directory the OS is entitled to clean out from\n * under a running session: the per-user temp dir on every platform, which is\n * where `bunx` (unlike `npx`, which uses a cache under $HOME) installs.\n *\n * Both sides are compared in resolved AND unresolved form. macOS reports\n * `$TMPDIR` as `/var/folders/…` while a process sees `/private/var/folders/…`,\n * so a single-form prefix test silently never matches; and `realpathSync`\n * fails on a path that does not exist, which would otherwise make the answer\n * depend on whether the file happens to be there.\n */\nexport function isUnderVolatileRoot(target: string): boolean {\n  try {\n    const prefixes = new Set<string>()\n    for (const root of [os.tmpdir(), realpathIfPossible(os.tmpdir())]) {\n      prefixes.add(root.endsWith(path.sep) ? root : root + path.sep)\n    }\n    const targets = [target, realpathIfPossible(target)]\n    return targets.some((t) => [...prefixes].some((p) => t.startsWith(p)))\n  } catch {\n    return false\n  }\n}\n\nfunction realpathIfPossible(p: string): string {\n  try {\n    return realpathSync(p)\n  } catch {\n    return p\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2DA,MAAM,iBAAiB;;AAGvB,MAAM,cAAc;;;;;;AAOpB,MAAM,mBAAmB;AAEzB,IAAI;AACJ,IAAI;;;;;;;;;;;AAkBJ,SAAS,sBAA0C;CACjD,IAAI;EACF,OAAO,KAAK,KAAK,KAAK,QAAQ,cAAc,YAAY,GAAG,CAAC,GAAG,WAAW;CAC5E,QAAQ;EACN;CACF;AACF;AAEA,SAAS,OAAO,KAAqB;CACnC,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,KAAK;AACtD;;;;;;;AAQA,SAAS,eAAe,YAAwC;CAC9D,IAAI;EACF,MAAM,MAAM,aACV,KAAK,KAAK,KAAK,QAAQ,UAAU,GAAG,cAAc,GAClD,MACF,CAAC,CAAC,KAAK;EACP,OAAO,iBAAiB,KAAK,GAAG,IAAI,MAAM,KAAA;CAC5C,QAAQ;EACN;CACF;AACF;;AAGA,SAAS,cAAc,QAAgB,QAAyB;CAC9D,IAAI;EACF,OAAO,OAAO,aAAa,MAAM,CAAC,MAAM;CAC1C,QAAQ;EACN,OAAO;CACT;AACF;;;;;;;;;;;AAYA,SAAS,QAAQ,QAAgB,OAAe,QAAyB;CAGvE,IAAI,cAAc,QAAQ,MAAM,GAAG,OAAO;CAC1C,KAAK,IAAI,UAAU,GAAG,UAAU,kBAAkB,WAAW;EAC3D,MAAM,MAAM,GAAG,OAAO,GAAG,QAAQ,IAAI,GAAG,QAAQ;EAChD,IAAI;GACF,cAAc,KAAK,OAAO,EAAE,MAAM,IAAM,CAAC;GACzC,WAAW,KAAK,MAAM;GACtB,OAAO;EACT,QAAQ;GACN,IAAI;IACF,OAAO,KAAK,EAAE,OAAO,KAAK,CAAC;GAC7B,QAAQ,CAGR;EACF;CACF;CACA,OAAO,cAAc,QAAQ,MAAM;AACrC;;AAGA,MAAM,iBAAiB;;;;;AAMvB,MAAM,sBAAsB;;;;;;;;;;;;;;;;AAiB5B,SAAS,oBAAoB,KAAa,MAAoB;CAC5D,MAAM,MAAM,KAAK,IAAI;CACrB,IAAI;CACJ,IAAI;EACF,UAAU,YAAY,GAAG;CAC3B,QAAQ;EACN;CACF;CACA,KAAK,MAAM,QAAQ,SAAS;EAC1B,IAAI,SAAS,KAAK,SAAS,IAAI,GAAG;EAClC,MAAM,QAAQ,KAAK,SAAS,MAAM;EAIlC,MAAM,aAAa,4BAA4B,KAAK,IAAI;EACxD,IAAI,CAAC,SAAS,CAAC,YAAY;EAC3B,MAAM,SAAS,KAAK,KAAK,KAAK,IAAI;EAClC,IAAI;GAEF,IADY,MAAM,SAAS,MAAM,CAAC,CAAC,WACxB,QAAQ,iBAAiB,sBAClC,OAAO,QAAQ,EAAE,OAAO,KAAK,CAAC;EAElC,QAAQ,CAER;CACF;AACF;;;;;;;;AASA,SAAgB,wBAAqD;CACnE,IAAI,YAAY,OAAO,QAAQ,QAAQ,UAAU;CACjD,IAAI,WAAW,OAAO;CACtB,YAAY,QAAQ,QAAQ,CAAC,CAC1B,WAAW,cAAc,CAAC,CAAC,CAC3B,MAAM,WAAW;EAGhB,IAAI,QAAQ,aAAa;EACzB,OAAO;CACT,CAAC,CAAC,CACD,cAAc;EACb,YAAY,KAAA;CACd,CAAC;CACH,OAAO;AACT;AAEA,SAAS,gBAAoC;CAC3C,MAAM,aAAa,oBAAoB;CACvC,IAAI,CAAC,YAAY,OAAO,KAAA;CACxB,OAAO,oBAAoB,UAAU;AACvC;;;;;;;;;AAUA,SAAgB,oBAAoB,YAAwC;CAC1E,IAAI;EACF,IAAI;EACJ,IAAI;GACF,QAAQ,aAAa,UAAU;EACjC,QAAQ;GAIN;EACF;EAEA,MAAM,SAAS,OAAO,KAAK;EAC3B,MAAM,WAAW,eAAe,UAAU;EAC1C,IAAI,CAAC,UAAU;GAIb,QAAQ,MACN,qEACF;GACA;EACF;EACA,IAAI,aAAa,QAAQ;GAIvB,QAAQ,MACN,wEACF;GACA;EACF;EAEA,MAAM,MAAM,MAAM;EAOlB,UAAU,KAAK;GAAE,WAAW;GAAM,MAAM;EAAM,CAAC;EAC/C,IAAI;GACF,UAAU,KAAK,GAAK;EACtB,QAAQ,CAER;EACA,MAAM,SAAS,KAAK,KAAK,KAAK,SAAS,OAAO,KAAK;EACnD,IAAI,CAAC,QAAQ,QAAQ,OAAO,MAAM,GAAG,OAAO,KAAA;EAK5C,IAAI;GACF,MAAM,sBAAM,IAAI,KAAK;GACrB,WAAW,QAAQ,KAAK,GAAG;EAC7B,QAAQ,CAER;EACA,oBAAoB,KAAK,MAAM;EAC/B,OAAO;CACT,SAAS,KAAK;EACZ,QAAQ,MAAM,yCAAyC,GAAG;EAC1D;CACF;AACF;;;;;;;;;;;;;;;;;;;ACnRA,SAAS,MAAM,GAAmB;CAChC,OAAO,IAAI,EAAE;AACf;;;;;;;;AASA,SAAgB,iBAAiB,KAAqB,MAAsB;CAC1E,MAAM,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC;CAClC,IAAI,IAAI,cAAc,IAAI,eAAe,IAAI,UAC3C,MAAM,KAAK,MAAM,IAAI,UAAU,CAAC;CAElC,IAAI,IAAI,aACN,MAAM,KAAK,mBAAmB,MAAM,IAAI,WAAW,CAAC;CAEtD,IAAI,MAAM,MAAM,KAAK,IAAI;CACzB,OAAO,MAAM,KAAK,GAAG;AACvB;;AAGA,SAAgB,oBAAoC;CAClD,OAAO;EAAE,UAAU,QAAQ;EAAU,YAAY,QAAQ,KAAK;CAAG;AACnE;AAEA,IAAI;;;;;;;;;;;;AAkBJ,eAAsB,wBAAiD;CACrE,IAAI,WAAW,OAAO;CACtB,MAAM,WAAW,MAAM,sBAAsB;CAC7C,YACE,WACE;EACE,UAAU,QAAQ;EAClB,YAAY;EACZ,aAAa,mBAAmB;CAClC,IACA,kBAAkB;CACtB,OAAO;AACT;;;;;;;;;;;;;;;AAgBA,SAAgB,4BACd,KACe;CACf,IAAI,CAAC,IAAI,YAAY,OAAO;CAI5B,IAAI,IAAI,WAAW,WAAW,MAAM,iBAAiB,GAAG;EACtD,IAAI,IAAI,aAAa,OAAO;EAO5B,OACE;CAIJ;CACA,IAAI,oBAAoB,IAAI,UAAU,GACpC,OACE;CAKJ,OAAO;AACT;;;;;;;;;;;AAYA,SAAS,qBAAyC;CAChD,MAAM,QAAQ,OAAO,QAAQ,KAAK,OAAO,WAAW,QAAQ,KAAK,KAAK,KAAA;CACtE,IAAI,CAAC,OAAO,OAAO,KAAA;CACnB,IAAI,MAAM,KAAK,QAAQ,KAAK;CAC5B,KAAK,IAAI,IAAI,GAAG,IAAI,IAAI,KAAK;EAC3B,IAAI;GACF,MAAM,MAAM,KAAK,MACf,aAAa,KAAK,KAAK,KAAK,cAAc,GAAG,MAAM,CACrD;GACA,IAAI,OAAO,IAAI,SAAS,YAAY,IAAI,KAAK,SAAS,eAAe,GACnE,OAAO;EAEX,QAAQ,CAER;EACA,MAAM,SAAS,KAAK,QAAQ,GAAG;EAC/B,IAAI,WAAW,KAAK;EACpB,MAAM;CACR;AAEF;;;;;;;;;;;;AAaA,SAAgB,oBAAoB,QAAyB;CAC3D,IAAI;EACF,MAAM,2BAAW,IAAI,IAAY;EACjC,KAAK,MAAM,QAAQ,CAAC,GAAG,OAAO,GAAG,mBAAmB,GAAG,OAAO,CAAC,CAAC,GAC9D,SAAS,IAAI,KAAK,SAAS,KAAK,GAAG,IAAI,OAAO,OAAO,KAAK,GAAG;EAG/D,OAAO,CADU,QAAQ,mBAAmB,MAAM,CACrC,CAAC,CAAC,MAAM,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,MAAM,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;CACvE,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,mBAAmB,GAAmB;CAC7C,IAAI;EACF,OAAO,aAAa,CAAC;CACvB,QAAQ;EACN,OAAO;CACT;AACF"}

package/dist/{serve-CM3OmF4I.js → serve-CXUf7RtJ.js}

@@ -1,15 +1,16 @@
-import { $ as browserToolsEnabled, C as buildToolbeltAwareness, Ct as provisionBrowserAssets, Et as provisionAndIndexColbert, Ft as DEFAULT_CLAUDE_MODEL_FALLBACKS, Ht as pickClaudeDefault, J as agentToolsEnabled, Q as browserCompoundToolsEnabled, S as availableToolCommands, X as brainstormModel, Z as browseAgentEnabled, a as buildPeerAwarenessSnippet, at as nativeSubagentModel, ct as scribeModel, et as fleetToolsEnabled, it as genericModel, lt as standInToolEnabled, nt as genericCheapModel, ot as reviewerModel, rt as genericFastModel, s as enumerateInjectedMcpToolNames, st as scoutModel, tt as geminiAvailable, ut as workerToolsEnabled, w as toolbeltEnabled, x as buildEnv } from "./peer-mcp-personas-DRL_xT4h.js";
-import { t as getPackageVersion } from "./version-_Q1WpsQp.js";
-import { o as removeOwnClaudeConfigMirror, r as ensureClaudeConfigMirror, t as PATHS } from "./paths-j2B7b0DZ.js";
-import { A as state, d as resolveModel, m as getGitHubUser } from "./token-CxPaBEUS.js";
+import { $t as resolveLeadSlugArg, C as availableToolCommands, Mt as provisionAndIndexColbert, Qt as pickClaudeDefault, S as buildEnv, T as toolbeltEnabled, Wt as DEFAULT_CLAUDE_MODEL_FALLBACKS, a as buildPeerAwarenessSnippet, at as browserCompoundToolsEnabled, ct as geminiAvailable, dt as nativeSubagentModel, ft as reviewerModel, gt as workerToolsEnabled, ht as standInToolEnabled, it as browseAgentEnabled, kt as provisionBrowserAssets, lt as generalPurposeFastModel, mt as scribeModel, ot as browserToolsEnabled, pt as scoutModel, rt as brainstormModel, s as enumerateInjectedMcpToolNames, st as fleetToolsEnabled, tt as agentToolsEnabled, ut as implementerFastModel, w as buildToolbeltAwareness } from "./peer-mcp-personas-V6stFvpq.js";
+import { t as getPackageVersion } from "./version-C8x2hQrZ.js";
+import { o as removeOwnClaudeConfigMirror, r as ensureClaudeConfigMirror, t as PATHS } from "./paths-wLC0InjX.js";
+import { A as state, d as resolveModel, m as getGitHubUser } from "./token-CnlB0884.js";
 import { a as resolveExecutable, o as runCommandCapture, t as killChildProcessTree } from "./exec-y8C_MU8A.js";
-import { a as sharedServerArgs, i as setupAndServe, o as startKeepAwake, r as parseSharedArgs, s as stopKeepAwake, t as getClaudeCodeEnvVars, u as runSelfUpdate } from "./server-setup-C9r7jYnz.js";
-import { r as getCodexVersion, t as provisionToolbelt } from "./provision-HzZ547dW.js";
-import { s as injectStopHookIntoSettingsFile } from "./stop-gate-hook-CaUrldLh.js";
-import { l as guardToolMatcher, n as activeDispatchModes, r as buildWorkerGuardHookCommand } from "./worker-dispatch-Bj1uYyG9.js";
-import { _ as injectPeerMcpIntoMirror, a as appendPeerAwarenessToMirroredClaudeMd, b as workersKeyOf, d as SEAMLESS_BUILTIN_TOOLS, f as configureServeDefaultPermissionMode, g as BUILTIN_SUBAGENT_DEFINITIONS, h as sanitizeServeSettingsEnv, l as prependOperatingDefaultsToMirroredClaudeMd, m as planModeAllowRules, n as INJECTED_SKILLS, o as appendToolbeltAwarenessToMirroredClaudeMd, p as injectAllowRules, r as writeInjectedSkill, s as buildOperatingDefaultsDirective, t as injectAttributionSuppressionIntoSettingsFile, u as prependStyleDirectiveToMirroredClaudeMd, v as resolveCodexCliBackend, x as writePeerMcpRuntimeFiles, y as resolveGroupKeysFromMirror } from "./attribution-settings-VOPvSn6v.js";
-import { i as planReviewEnabled, t as buildPlanReviewHookCommand } from "./plan-review-hook-Dk5zTNke.js";
-import { t as buildPromptSubmitHookCommand } from "./prompt-submit-hook-lvTWwaTV.js";
+import { a as sharedServerArgs, i as setupAndServe, o as startKeepAwake, r as parseSharedArgs, s as stopKeepAwake, t as getClaudeCodeEnvVars, u as runSelfUpdate } from "./server-setup-Bppjt9xO.js";
+import { n as hookLauncherDegradedWarning, r as resolveSelfInvocation } from "./self-invocation-CKMjcA5F.js";
+import { r as getCodexVersion, t as provisionToolbelt } from "./provision-BpL6gZIt.js";
+import { s as injectStopHookIntoSettingsFile } from "./stop-gate-hook-DgJ6sW8N.js";
+import { l as guardToolMatcher, n as activeDispatchModes, r as buildWorkerGuardHookCommand } from "./worker-dispatch-zW8Zi69V.js";
+import { _ as injectPeerMcpIntoMirror, a as appendPeerAwarenessToMirroredClaudeMd, b as workersKeyOf, d as SEAMLESS_BUILTIN_TOOLS, f as configureServeDefaultPermissionMode, g as BUILTIN_SUBAGENT_DEFINITIONS, h as sanitizeServeSettingsEnv, l as prependOperatingDefaultsToMirroredClaudeMd, m as planModeAllowRules, n as INJECTED_SKILLS, o as appendToolbeltAwarenessToMirroredClaudeMd, p as injectAllowRules, r as writeInjectedSkill, s as buildOperatingDefaultsDirective, t as injectAttributionSuppressionIntoSettingsFile, u as prependStyleDirectiveToMirroredClaudeMd, v as resolveCodexCliBackend, x as writePeerMcpRuntimeFiles, y as resolveGroupKeysFromMirror } from "./attribution-settings-B8M2fvhz.js";
+import { i as planReviewEnabled, t as buildPlanReviewHookCommand } from "./plan-review-hook-Lf9ISdF6.js";
+import { t as buildPromptSubmitHookCommand } from "./prompt-submit-hook-BlijaOn7.js";
 import { defineCommand } from "citty";
 import consola from "consola";
 import fs from "node:fs";
@@ -523,7 +524,7 @@ const NOOP = { cleanup: async () => {} };
 * Tab-specific bits (ai-or-die hooks, artifact review) are intentionally left
 * out — they don't apply to the serve control plane.
 */
-async function provisionServeEnhancements(serverUrl, opts = {}) {
+async function provisionServeEnhancements(serverUrl, opts) {
 	try {
 		const tunnelExposed = opts.tunnelExposed === true;
 		const browseAllowed = browserToolsEnabled() && (!tunnelExposed || opts.browseOverTunnel === true);
@@ -543,12 +544,12 @@ async function provisionServeEnhancements(serverUrl, opts = {}) {
 		const { keys: groupKeys } = await resolveGroupKeysFromMirror(enabledGroups);
 		const nativeAvailability = {
 			scoutAvailable: scoutModel() != null,
-			genericAvailable: genericModel() != null,
-			genericFastAvailable: genericFastModel() != null,
-			genericCheapAvailable: genericCheapModel() != null
+			implementerFastAvailable: implementerFastModel() != null,
+			generalPurposeFastAvailable: generalPurposeFastModel() != null
 		};
 		const runtime = await writePeerMcpRuntimeFiles(serverUrl, {
 			codexCli: opts.codexCli === true,
+			selfInvocation: opts.selfInvocation,
 			geminiAvailable: gem,
 			groupKeys,
 			workerToolsAvailable: workerToolsEnabled(),
@@ -558,14 +559,14 @@ async function provisionServeEnhancements(serverUrl, opts = {}) {
 			brainstormModel: brainstormModel(),
 			scoutModel: scoutModel(),
 			scribeModel: scribeModel(),
-			genericModel: genericModel(),
-			genericFastModel: genericFastModel(),
-			genericCheapModel: genericCheapModel(),
+			implementerFastModel: implementerFastModel(),
+			generalPurposeFastModel: generalPurposeFastModel(),
 			builtinSubagents: BUILTIN_SUBAGENT_DEFINITIONS
 		});
 		state.peerMcpNonce = runtime.nonce;
 		const injected = await injectPeerMcpIntoMirror(serverUrl, {
 			codexCli: opts.codexCli === true,
+			selfInvocation: opts.selfInvocation,
 			geminiAvailable: gem,
 			groupKeys,
 			nonce: runtime.nonce
@@ -605,19 +606,19 @@ async function provisionServeEnhancements(serverUrl, opts = {}) {
 		const injectedServerKeys = injected.ok ? injected.serversAdded : [...Object.values(groupKeys).filter((k) => Boolean(k)), ...opts.codexCli === true ? ["codex-cli"] : []];
 		await injectAllowRules(settingsPath, planModeAllowRules(injectedServerKeys)).catch((err) => consola.warn(`Could not auto-approve injected tools: ${String(err)}`));
 		if (workerToolsEnabled()) {
-			const promptCmd = buildPromptSubmitHookCommand(process.execPath, process.argv[1]);
+			const promptCmd = buildPromptSubmitHookCommand(opts.selfInvocation);
 			await injectStopHookIntoSettingsFile(settingsPath, promptCmd, "UserPromptSubmit", 45).catch((err) => consola.warn(`Could not register the UserPromptSubmit hook: ${String(err)}`));
 			if (!injected.ok) consola.warn("Workers non-blocking guard NOT registered: subagent MCP injection fell back to parent-only, so worker-* dispatchers cannot reach the workers server. Raw worker tools remain usable on the main thread.");
 			else if (process.env.GH_ROUTER_DISABLE_WORKER_GUARD !== "1") {
 				const workersKey = workersKeyOf(groupKeys);
 				const modes = activeDispatchModes({ browse: browseAllowed && browseAgentEnabled() });
-				const cmd = buildWorkerGuardHookCommand(process.execPath, process.argv[1], workersKey, modes);
+				const cmd = buildWorkerGuardHookCommand(opts.selfInvocation, workersKey, modes);
 				const matcher = guardToolMatcher(workersKey, modes);
 				await injectStopHookIntoSettingsFile(settingsPath, cmd, "PreToolUse", 10, matcher).catch((err) => consola.warn(`Could not register the workers PreToolUse guard hook: ${String(err)}`));
 			} else consola.info("Workers non-blocking guard disabled via GH_ROUTER_DISABLE_WORKER_GUARD=1; raw worker tools remain callable on the main thread.");
 		}
 		if (planReviewEnabled()) try {
-			const command = buildPlanReviewHookCommand(process.execPath, process.argv[1]);
+			const command = buildPlanReviewHookCommand(opts.selfInvocation);
 			await injectStopHookIntoSettingsFile(settingsPath, command, "PostToolUse", void 0, "ExitPlanMode");
 		} catch (err) {
 			consola.warn(`Could not register the advisory plan-review hook: ${String(err)}`);
@@ -1346,14 +1347,14 @@ const serve = defineCommand({
 		provisionToolbelt().catch((err) => consola.debug("Toolbelt provisioning failed:", err));
 		startKeepAwake();
 		if (browserToolsEnabled()) provisionBrowserAssets().catch((err) => consola.debug("Browser extension provisioning failed:", err));
-		const opusFamilyShorthand = args.model?.match(/^(\d+\.\d+)$/)?.[1];
-		let chosenSlug = opusFamilyShorthand ? pickClaudeDefault(opusFamilyShorthand) : args.model ?? pickClaudeDefault();
-		if (!args.model && state.models) {
+		let chosenSlug = resolveLeadSlugArg(args.model);
+		if (!args.model?.trim() && state.models) {
 			const inCache = (slug) => state.models?.data.some((m) => m.id === resolveModel(slug)) ?? false;
 			if (!inCache(chosenSlug)) {
 				for (const fb of DEFAULT_CLAUDE_MODEL_FALLBACKS) if (inCache(fb)) {
-					consola.info(`Default model "${chosenSlug}" not in your Copilot model list; falling back to "${fb}".`);
-					chosenSlug = fb;
+					const fallbackSlug = pickClaudeDefault(fb.replace(/^claude-opus-/, ""));
+					consola.info(`Default model "${chosenSlug}" not in your Copilot model list; falling back to "${fallbackSlug}".`);
+					chosenSlug = fallbackSlug;
 					break;
 				}
 			}
@@ -1367,7 +1368,13 @@ const serve = defineCommand({
 		if (tunnelExposed && browserToolsEnabled() && args["browse-over-tunnel"] !== true) consola.info("Browser MCP is disabled over the tunnel (session-hijack/SSRF risk). Pass --browse-over-tunnel to enable it for fully-trusted access.");
 		if (tunnelExposed && state.agentsEnabled && args["agents-over-tunnel"] !== true) consola.info("first-mate is disabled over the tunnel (it mints a GitHub write token). Pass --agents-over-tunnel to enable it for fully-trusted access.");
 		if (tunnelExposed && state.fleetEnabled && args["fleet-over-tunnel"] !== true) consola.info("Fleet MCP is disabled over the tunnel (it drives remote coding sessions with your fleet credentials). Pass --fleet-over-tunnel to enable it for fully-trusted access.");
+		const selfInvocation = await resolveSelfInvocation();
+		{
+			const warning = hookLauncherDegradedWarning(selfInvocation);
+			if (warning) process.stderr.write(`${warning}\n`);
+		}
 		const enhancements = await provisionServeEnhancements(serverUrl, {
+			selfInvocation,
 			codexCli: backend === "cli",
 			tunnelExposed,
 			browseOverTunnel: args["browse-over-tunnel"] === true,
@@ -1522,4 +1529,4 @@ const serve = defineCommand({
 //#endregion
 export { serve };
 
-//# sourceMappingURL=serve-CM3OmF4I.js.map
+//# sourceMappingURL=serve-CXUf7RtJ.js.map