hostwares-cli 2.4.1 → 2.4.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hostwares-cli",
-  "version": "2.4.1",
+  "version": "2.4.3",
   "description": "Hostwares CLI - AI DevOps in your terminal",
   "type": "module",
   "main": "dist/index.js",
@@ -16,7 +16,7 @@
     "node": ">=18"
   },
   "scripts": {
-    "build": "tsc && chmod +x dist/index.js",
+    "build": "node scripts/build.mjs",
     "typecheck": "tsc -p tsconfig.test.json --noEmit",
     "test": "tsc -p tsconfig.test.json && node --test \"dist-test/**/*.test.js\"",
     "start": "node dist/index.js"
@@ -41,10 +41,9 @@
     "url": "https://github.com/Hostwares/hostwares-cli/issues"
   },
   "devDependencies": {
+    "@hostwares/agent-client": "github:Hostwares/hostwares-agent-client#v1",
     "@types/node": "^20.0.0",
+    "esbuild": "^0.28.2",
     "typescript": "^5.5.0"
-  },
-  "dependencies": {
-    "@hostwares/agent-client": "github:Hostwares/hostwares-agent-client#v1"
   }
 }

package/dist/agent/permissions.js

@@ -1,230 +0,0 @@
-import { getConfig, saveConfig } from "../config.js";
-import { readKey, pickScope } from "../ui/input.js";
-import { c, glyph } from "../ui/theme.js";
-import { breakLine, humanTool } from "../ui/render.js";
-import { decidePermission, loadPermissionRules } from "@hostwares/agent-client";
-/**
- * Whether a local tool may run, and how the user says so.
- *
- * Trust has two scopes, and the distinction matters:
- *
- *   session  - in memory, gone when the process exits. What `t` grants.
- *   project  - persisted per absolute project path in the config file. What
- *              `a` grants, and what `/trust` toggles.
- *
- * The old version had only the first, and `/trust` / `/untrust` did not
- * actually touch it - they printed "✓ All actions trusted this session" and
- * returned, while `trustMode` stayed false and `resetTrust` was exported twice
- * and called nowhere. A user who ran `/trust` was told they had trusted the
- * session and was then prompted for every single tool.
- */
-/** Read-only tools. Prompting for these is noise that trains users to hit `t`. */
-const READ_ONLY = new Set([
-    "read_file", "list_directory", "get_system_info",
-    "git_status", "git_log", "git_diff", "check_github_auth",
-    "docker_ps", "list_processes", "check_port",
-    "get_process_output", "open_browser", "wait_for_url",
-    "web_search", "web_fetch",
-]);
-/**
- * Tools that always prompt, even under trust.
- *
- * `search_files` and `curl_request` are NOT auto-allowed despite being
- * read-only in intent: the first walks arbitrary paths and the second is an
- * outbound request to a model-chosen URL, which is how local data leaves the
- * machine. Neither is dangerous enough to always prompt, so they sit in the
- * normal prompting tier rather than here.
- *
- * These four are irreversible or reach outside this machine, so a blanket
- * "trust everything" must not cover them silently.
- */
-const ALWAYS_ASK = new Set(["delete_path", "kill_process", "ssh_run", "git_push"]);
-let sessionTrust = false;
-let sessionRules = [];
-export function isSessionTrusted() { return sessionTrust; }
-export function setSessionTrust(on) { sessionTrust = on; }
-export function getSessionRules() { return sessionRules; }
-export function addSessionRule(rule) { sessionRules.push(rule); }
-// Glob permission rules from ~/.hostwares/permissions.json and the project's
-// .hostwares/permissions.json. Loaded once and reused; a user who edits them
-// mid-session can restart. Lets `allow: npm *` and `deny: sudo *` be honoured
-// without a prompt, and enforces the non-negotiable hard denies (rm -rf /, ...).
-let cachedRules = null;
-function permissionRules() {
-    if (cachedRules === null) {
-        try {
-            cachedRules = loadPermissionRules(process.cwd());
-        }
-        catch {
-            cachedRules = [];
-        }
-    }
-    return cachedRules;
-}
-export function reloadPermissionRules() { cachedRules = null; }
-export function isProjectTrusted(cwd = process.cwd()) {
-    return (getConfig().trustedProjects ?? []).includes(cwd);
-}
-export function setProjectTrust(on, cwd = process.cwd()) {
-    const current = new Set(getConfig().trustedProjects ?? []);
-    if (on)
-        current.add(cwd);
-    else
-        current.delete(cwd);
-    saveConfig({ trustedProjects: [...current] });
-}
-/**
- * Ask whether `tool` may run.
- *
- * Returns "abort" for Ctrl-C / Esc so the caller can stop the whole turn rather
- * than treating it as a denial of this one tool and carrying on - the old code
- * mapped every non-`y`/`t` key, Ctrl-C included, to a silent "no" and continued
- * to the next tool.
- */
-export async function askPermission(tool) {
-    // Session-scoped rules (from Kiro-style `t` → scope picker) are checked first
-    if (sessionRules.length) {
-        const v = decidePermission(tool.name, tool.input, sessionRules, "none", tool.destructive);
-        if (v === "allow")
-            return "allow";
-        if (v === "deny")
-            return "deny";
-    }
-    const trust = sessionTrust ? "session" : isProjectTrusted() ? "project" : "none";
-    // Glob rules and hard denies decide first, when they have an opinion.
-    const verdict = decidePermission(tool.name, tool.input, permissionRules(), trust, tool.destructive);
-    if (verdict === "deny") {
-        // A denied command (hard safety rule, or a user's own deny rule) is refused
-        // outright, not offered as a prompt - there is no safe "yes".
-        process.stdout.write(`\n${c.red(glyph.warn)} ${c.red("Refused:")} ${describe(tool)} ${c.dim("(blocked by a permission rule)")}\n`);
-        return "deny";
-    }
-    if (verdict === "allow")
-        return "allow";
-    // verdict === "ask" falls through to the interactive prompt below.
-    if (READ_ONLY.has(tool.name))
-        return "allow";
-    const alwaysAsk = ALWAYS_ASK.has(tool.name) || tool.destructive;
-    if (!alwaysAsk && (sessionTrust || isProjectTrusted()))
-        return "allow";
-    breakLine();
-    process.stdout.write(`\n${c.yellow(glyph.caret)} ${describe(tool)}\n`);
-    const consequence = consequenceOf(tool);
-    if (consequence)
-        process.stdout.write(`  ${c.red(glyph.warn)} ${c.dim(consequence)}\n`);
-    // `t` and `a` are withheld for always-ask tools: offering "trust everything"
-    // on the prompt for `rm -rf` invites exactly the reflex that makes the prompt
-    // worthless.
-    const options = alwaysAsk
-        ? `${c.bold("y")} yes  ${c.bold("n")} no  ${c.dim("esc cancel")}`
-        : `${c.bold("y")} yes  ${c.bold("n")} no  ${c.bold("t")} trust this session  ${c.bold("a")} always in this project  ${c.dim("esc cancel")}`;
-    process.stdout.write(`  ${c.dim(options)}: `);
-    const key = await readKey(alwaysAsk ? ["y", "n"] : ["y", "n", "t", "a"]);
-    switch (key) {
-        case "y": return "allow";
-        case "t": {
-            // Kiro-style scoped trust: Specific paths / Directory / Entire Tool
-            const toolPath = String(tool.input.path ?? tool.input.localPath ?? "");
-            const rel = toolPath ? shortRel(toolPath) : "";
-            const dir = rel ? rel.split("/").slice(0, -1).join("/") || "." : "";
-            const scopeOpts = [
-                `Specific paths      → ${rel || tool.name}  ${c.dim("(this file only)")}`,
-                `Complete directory  → ${dir || "."}  ${c.dim("(all files here)")}`,
-                `Entire Tool         → *  ${c.dim(`(always allow '${tool.name}')`)}`,
-            ];
-            // Strip dim codes for pickScope display — we render with codes ourselves
-            const displayOpts = [
-                `Specific paths      → ${rel || tool.name}`,
-                `Complete directory  → ${dir || "."}`,
-                `Entire Tool         → *`,
-            ];
-            const choice = await pickScope(displayOpts);
-            if (choice === -1)
-                return "abort";
-            if (choice === 0) {
-                const match = rel || "*";
-                addSessionRule({ tool: tool.name, match, effect: "allow" });
-                process.stdout.write(`  ${c.dim(`Trusted '${tool.name}' for ${match} this session.`)}\n`);
-            }
-            else if (choice === 1) {
-                const match = dir ? `${dir}/*` : "*";
-                addSessionRule({ tool: tool.name, match, effect: "allow" });
-                process.stdout.write(`  ${c.dim(`Trusted '${tool.name}' for ${match} this session.`)}\n`);
-            }
-            else {
-                // Entire Tool → blanket session trust for this tool only (narrower than old global)
-                addSessionRule({ tool: tool.name, match: "*", effect: "allow" });
-                // Also keep old global for file tools that have no path? For now tool-scoped is enough.
-                process.stdout.write(`  ${c.dim(`Trusted '${tool.name}' (*) this session.`)}` + "\n");
-            }
-            return "allow";
-        }
-        case "a":
-            setProjectTrust(true);
-            process.stdout.write(`  ${c.dim(`Always allowed in ${process.cwd()}.`)}\n`);
-            return "allow";
-        case "ctrl-c":
-        case "escape": return "abort";
-        // Includes "" from a non-TTY: with no interactive user there is nobody to
-        // grant permission, and defaulting to allow would let a piped script run
-        // arbitrary commands unattended.
-        default: return "deny";
-    }
-}
-function shortRel(absPath) {
-    const cwd = process.cwd();
-    if (absPath.startsWith(cwd + "/"))
-        return absPath.slice(cwd.length + 1);
-    const home = process.env.HOME;
-    if (home && absPath.startsWith(home + "/"))
-        return "~/" + absPath.slice(home.length + 1);
-    return absPath;
-}
-/** One line saying exactly what will happen, in the user's terms. */
-function describe(tool) {
-    const i = tool.input;
-    const s = (k) => (i[k] === undefined ? "" : String(i[k]));
-    const t = (v, n = 70) => (v.length > n ? `${v.slice(0, n - 1)}…` : v);
-    switch (tool.name) {
-        case "run_command": return `Run ${c.bold(t(s("command"), 90))}`;
-        case "start_process": return `Start in background ${c.bold(t(s("command"), 80))}${s("name") ? c.dim(` (as ${s("name")})`) : ""}`;
-        case "stop_process": return `Stop background process ${c.bold(s("name"))}`;
-        case "write_file": return `Write ${c.bold(s("path"))} ${c.dim(`(${String(i.content ?? "").length} chars)`)}`;
-        case "append_file": return `Append to ${c.bold(s("path"))}`;
-        case "str_replace_file": {
-            const old = String(i.oldStr ?? "").split("\n")[0]?.slice(0, 60) ?? "";
-            return `Edit ${c.bold(s("path"))}${old ? c.dim(` — replace "${old}…"`) : ""}`;
-        }
-        case "delete_path": return `Delete ${c.bold(s("path"))}`;
-        case "search_files": return `Search for ${c.bold(t(s("pattern")))}`;
-        case "install_package": return `Install package ${c.bold(s("name"))}`;
-        case "git_add": return `Stage ${c.bold(s("files"))}`;
-        case "git_commit": return `Commit: ${c.bold(t(s("message")))}`;
-        case "git_push": return `Push to ${c.bold(s("remote") || "origin")}${s("branch") ? `/${s("branch")}` : ""}`;
-        case "git_pull": return `Pull from ${c.bold(s("remote") || "origin")}`;
-        case "git_clone": return `Clone ${c.bold(s("url"))}`;
-        case "git_branch": return `Branch: ${c.bold(s("action"))}${s("name") ? ` ${s("name")}` : ""}`;
-        case "ssh_run": return `Run on ${c.bold(`${s("user")}@${s("host")}`)}: ${c.bold(t(s("command")))}`;
-        case "ssh_upload": return `Upload ${c.bold(s("localPath"))} to ${c.bold(`${s("user")}@${s("host")}:${s("remotePath")}`)}`;
-        case "ssh_download": return `Download ${c.bold(`${s("user")}@${s("host")}:${s("remotePath")}`)}`;
-        case "kill_process": return `Kill process ${c.bold(s("target"))}`;
-        case "docker_exec": return `Run in container ${c.bold(s("container"))}: ${c.bold(t(s("command")))}`;
-        case "docker_logs": return `Read logs from ${c.bold(s("container"))}`;
-        case "curl_request": return `${c.bold(s("method") || "GET")} ${c.bold(t(s("url")))}`;
-        default: return humanTool(tool.name);
-    }
-}
-/** Stated plainly, and only where there is a real consequence to state. */
-function consequenceOf(tool) {
-    const i = tool.input;
-    switch (tool.name) {
-        case "delete_path": return "Permanently removes this path and everything under it. There is no recycle bin.";
-        case "git_push": return "Publishes commits to the remote, where others may already have pulled from it.";
-        case "git_branch": return i.action === "delete" ? "Deletes the branch. Unmerged commits on it become unreachable." : null;
-        case "ssh_run": return "Runs on a remote server, outside this machine.";
-        case "kill_process": return "Terminates the process immediately; unsaved work in it is lost.";
-        case "write_file": return "Overwrites the file if it already exists.";
-        case "docker_exec": return "Runs inside a container, which may hold live data.";
-        default: return null;
-    }
-}

package/dist/agent/run.js

@@ -1,185 +0,0 @@
-import { runTurn } from "@hostwares/agent-client";
-import { getConfig } from "../config.js";
-import { reauthenticate } from "../auth/device.js";
-import { askPermission, isSessionTrusted, isProjectTrusted } from "./permissions.js";
-import { confirm } from "../ui/input.js";
-import { c } from "../ui/theme.js";
-import * as ui from "../ui/render.js";
-export async function runCliTurn(opts) {
-    const config = getConfig();
-    const spinner = new ui.Spinner();
-    // Tool-call ids whose command was already shown in an approval prompt, so
-    // tool:start does not render the same command a second time.
-    const promptedIds = new Set();
-    /**
-     * Live output, bounded.
-     *
-     * A running command has to look like it is working - that is the whole point
-     * of streaming - but the terminal must never become the file. Asking for a
-     * todo app used to print the entire 300-line HTML document, because the tool
-     * result WAS the file and nothing decided what to show instead.
-     *
-     * So: the first lines stream as they arrive, then output is counted rather
-     * than printed, and the tail is reported as a number. The model still
-     * receives the full result; only the screen is bounded.
-     */
-    const MAX_LIVE_LINES = 12;
-    const live = new Map();
-    const track = (id) => {
-        let s = live.get(id);
-        if (!s) {
-            s = { shown: 0, total: 0, partial: "" };
-            live.set(id, s);
-        }
-        return s;
-    };
-    const feed = (id, chunk) => {
-        const st = track(id);
-        st.partial += chunk;
-        const lines = st.partial.split("\n");
-        st.partial = lines.pop() ?? "";
-        for (const line of lines) {
-            st.total++;
-            if (st.shown < MAX_LIVE_LINES) {
-                ui.toolOutputLine(line);
-                st.shown++;
-            }
-            else if (st.shown === MAX_LIVE_LINES) {
-                ui.toolOutputLine(ui.dim("… still running, output hidden"));
-                st.shown++;
-            }
-        }
-    };
-    const finish = (id) => {
-        const st = live.get(id);
-        if (!st)
-            return { hidden: 0 };
-        if (st.partial.trim()) {
-            st.total++;
-            if (st.shown < MAX_LIVE_LINES) {
-                ui.toolOutputLine(st.partial);
-                st.shown++;
-            }
-        }
-        live.delete(id);
-        return { hidden: Math.max(0, st.total - Math.min(st.shown, MAX_LIVE_LINES)) };
-    };
-    const host = {
-        cwd: process.cwd(),
-        askPermission: (call) => {
-            // Record that this tool showed its command in the approval prompt, so the
-            // subsequent tool:start does not print the same command a second time.
-            promptedIds.add(call.id);
-            return askPermission(call);
-        },
-        confirmAction: async (action) => {
-            ui.breakLine();
-            const risk = action.risk === "critical" ? c.red(action.risk)
-                : action.risk === "high" ? c.yellow(action.risk)
-                    : c.dim(action.risk);
-            ui.line(`${c.yellow("▸")} ${action.description} ${c.dim(`(${risk})`)}`);
-            // Default no: a queued action changes live infrastructure, and Enter
-            // should never be the thing that deploys something.
-            return confirm("  Run this?", false);
-        },
-        trustLevel: () => (isSessionTrusted() || isProjectTrusted()) ? "session" : "none",
-        onActivity: (e) => {
-            switch (e.type) {
-                case "thinking":
-                    spinner.start("Working");
-                    break;
-                case "text":
-                    spinner.stop();
-                    ui.write(e.chunk);
-                    break;
-                case "tool:start":
-                    spinner.stop();
-                    // If the user was just asked to approve this exact tool, its command
-                    // was already shown in the prompt — don't print the header again.
-                    if (promptedIds.has(e.id)) {
-                        promptedIds.delete(e.id);
-                    }
-                    else {
-                        ui.toolRunning(e.tool, e.target);
-                    }
-                    break;
-                case "tool:output":
-                    spinner.stop();
-                    feed(e.id, e.chunk);
-                    break;
-                case "tool:end": {
-                    // A loop-guard short-circuit is not a tool failure — it's HW
-                    // catching itself re-reading. Show it as a note, not a red ✗.
-                    if (e.summary && /loop guard/i.test(e.summary)) {
-                        spinner.stop();
-                        ui.note("Skipped a repeated read (already have it) — moving on.");
-                        break;
-                    }
-                    const { hidden } = finish(e.id);
-                    if (hidden > 0)
-                        ui.toolOutputLine(ui.dim(`… +${hidden} more line${hidden === 1 ? "" : "s"}`));
-                    // One completion line, with the file verb + size folded in — no
-                    // separate chip printing after "Completed" and reading backwards.
-                    ui.toolDone(e.tool, e.ok ? "success" : "failed", e.durationMs, e.effect, e.bytes);
-                    break;
-                }
-                case "tool:denied":
-                    ui.toolSkipped(e.tool);
-                    break;
-                case "action:done":
-                    if (e.ok)
-                        ui.success(e.detail?.split("\n")[0] ?? "Done");
-                    else
-                        ui.note(e.detail ?? "Cancelled");
-                    break;
-                case "turn:end":
-                    spinner.stop();
-                    ui.breakLine();
-                    ui.statusLine({
-                        balance: e.usage.balance,
-                        turnCredits: e.usage.credits,
-                        elapsedMs: e.usage.elapsedMs,
-                        context: e.usage,
-                        model: e.usage.model,
-                    });
-                    break;
-                case "reauth":
-                    spinner.stop();
-                    break;
-                case "error":
-                    spinner.stop();
-                    ui.error(e.message);
-                    break;
-                // tool:pending is not drawn: askPermission is about to print a prompt
-                // for this exact tool, and a row plus a prompt for one action reads as
-                // two things happening.
-            }
-        },
-    };
-    try {
-        const result = await runTurn({
-            credentials: { apiKey: config.apiKey, baseUrl: config.baseUrl, userAgent: `hostwares-cli/${VERSION}` },
-            message: opts.message,
-            conversationId: opts.session.conversationId,
-            model: config.model,
-            signal: opts.signal,
-            host,
-            onAuthFailure: () => reauthenticate(opts.signal),
-        });
-        if (result.aborted) {
-            ui.breakLine();
-            ui.note("Stopped.");
-        }
-        return {
-            conversationId: result.conversationId,
-            creditsSpent: result.creditsSpent,
-            aborted: result.aborted,
-        };
-    }
-    finally {
-        spinner.stop();
-    }
-}
-/** Set once at startup from package.json, for the User-Agent header. */
-let VERSION = "0.0.0";
-export function setVersion(v) { VERSION = v; }

package/dist/auth/device.js

@@ -1,131 +0,0 @@
-import { exec } from "@hostwares/agent-client";
-import { saveConfig, reloadConfig, getConfig, DEFAULT_BASE_URL } from "../config.js";
-import { c, glyph } from "../ui/theme.js";
-import { line, note, success, error } from "../ui/render.js";
-import { AbortedError } from "@hostwares/agent-client";
-/**
- * Run the full device flow and persist the key.
- *
- * Returns true on success. Never throws for an ordinary failure (expired code,
- * user gave up) - the caller decides what a failed login means in context.
- */
-export async function login(opts = {}) {
-    // baseUrl comes from config so a self-hosted or staging install keeps
-    // working. The old code hardcoded https://hostwares.com inside the login
-    // action, which silently overwrote any custom baseUrl on every login.
-    const base = getConfig().baseUrl || DEFAULT_BASE_URL;
-    let start;
-    try {
-        const res = await fetch(`${base}/api/auth/device`, { method: "POST", signal: opts.signal });
-        if (!res.ok) {
-            error(`Could not start login (HTTP ${res.status}). Try again in a moment.`);
-            return false;
-        }
-        start = await res.json();
-    }
-    catch (e) {
-        if (opts.signal?.aborted)
-            throw new AbortedError();
-        error("Could not reach Hostwares to start login. Check your connection.");
-        return false;
-    }
-    if (!start.device_code || !start.user_code || !start.verification_url) {
-        error("Login response from the server was incomplete. Please report this.");
-        return false;
-    }
-    if (!opts.quiet)
-        line();
-    line(`  Open this URL to authorise:`);
-    line(`  ${c.cyan(start.verification_url)}`);
-    line();
-    line(`  Confirmation code: ${c.bold(start.user_code)}`);
-    line();
-    if (!opts.noBrowser)
-        openBrowser(start.verification_url);
-    // The server's own interval and expiry are honoured. The old client polled
-    // every 3s for a fixed 120 iterations regardless of what the server said, so
-    // it kept polling for six minutes against a code that expires in ten - and
-    // would have hammered a server asking it to slow down.
-    const intervalMs = Math.max(1000, (start.interval ?? 3) * 1000);
-    const deadline = Date.now() + (start.expires_in ?? 600) * 1000;
-    note(`Waiting for authorisation… ${c.dim("(Ctrl-C to cancel)")}`);
-    while (Date.now() < deadline) {
-        if (opts.signal?.aborted)
-            throw new AbortedError();
-        await sleep(intervalMs, opts.signal);
-        let poll;
-        try {
-            poll = await fetch(`${base}/api/auth/device-poll?code=${encodeURIComponent(start.device_code)}`, { signal: opts.signal });
-        }
-        catch {
-            // A transient network blip must not abandon a login the user is halfway
-            // through in their browser. Keep polling until the code actually expires.
-            continue;
-        }
-        // 429 slow_down: back off rather than treating it as a failure.
-        if (poll.status === 429) {
-            await sleep(intervalMs, opts.signal);
-            continue;
-        }
-        // The body is JSON, but a proxy can return HTML on an error status. The old
-        // client called poll.json() unguarded, so that threw an unhandled rejection
-        // and killed the CLI mid-login.
-        let data;
-        try {
-            data = await poll.json();
-        }
-        catch {
-            continue;
-        }
-        if (data.status === "approved" && data.token) {
-            saveConfig({ apiKey: data.token, baseUrl: base });
-            reloadConfig();
-            if (!opts.quiet)
-                success("Signed in.");
-            return true;
-        }
-        if (data.error === "expired" || poll.status === 410) {
-            error("That code expired. Run `hw login` again.");
-            return false;
-        }
-        if (poll.status === 404) {
-            error("That login request is no longer valid. Run `hw login` again.");
-            return false;
-        }
-        // status "pending" - keep waiting.
-    }
-    error("Login timed out. Run `hw login` to try again.");
-    return false;
-}
-/**
- * Re-authenticate mid-session, then let the caller replay.
- *
- * Deliberately terse: this interrupts something the user was already doing, so
- * it explains itself in one line and gets out of the way.
- */
-export async function reauthenticate(signal) {
-    line();
-    note(`${glyph.warn} Your sign-in expired. Reconnecting…`);
-    const ok = await login({ quiet: true, signal });
-    if (ok)
-        note(`${glyph.tick} Reconnected — carrying on.`);
-    return ok;
-}
-function openBrowser(url) {
-    // Best-effort: a headless box or a locked-down desktop has no browser to
-    // open, and the URL is already printed above, so failure is not worth
-    // reporting. Note the URL is an argv entry, never part of a shell string.
-    const [bin, args] = process.platform === "darwin" ? ["open", [url]]
-        : process.platform === "win32" ? ["cmd", ["/c", "start", "", url]]
-            : ["xdg-open", [url]];
-    try {
-        exec(bin, args, { timeoutMs: 5000 });
-    }
-    catch { /* ignore */ }
-}
-function sleep(ms, signal) {
-    return new Promise((resolve, reject) => {
-        const t = setTimeout(resolve, ms);
-        signal?.addEventListener("abort", () => { clearTimeout(t); reject(new AbortedError()); }, { once: true });
-    });
-}