patchwork-os 0.2.0-beta.9.canary.92 → 1.1.0-beta.1

package/dist/index.js

@@ -13,9 +13,24 @@
         const envPath = candidates.find(existsSync);
         if (envPath) {
             for (const line of readFileSync(envPath, "utf-8").split("\n")) {
-                const m = /^([A-Z_][A-Z0-9_]*)=(.*)$/.exec(line.trim());
+                const trimmed = line.trim();
+                // Skip blank lines and full-line comments outright.
+                if (!trimmed || trimmed.startsWith("#"))
+                    continue;
+                const m = /^([A-Z_][A-Z0-9_]*)=(.*)$/.exec(trimmed);
                 if (m?.[1] && !process.env[m[1]]) {
-                    process.env[m[1]] = m[2]?.replace(/^["']|["']$/g, "");
+                    let raw = m[2] ?? "";
+                    // Strip an inline comment, but only when the value is NOT quoted —
+                    // a quoted value may legitimately contain '#' (cli-commands-6).
+                    const isQuoted = (raw.startsWith('"') && raw.endsWith('"') && raw.length >= 2) ||
+                        (raw.startsWith("'") && raw.endsWith("'") && raw.length >= 2);
+                    if (!isQuoted) {
+                        const hashIdx = raw.indexOf("#");
+                        if (hashIdx !== -1)
+                            raw = raw.slice(0, hashIdx);
+                        raw = raw.trim();
+                    }
+                    process.env[m[1]] = raw.replace(/^["']|["']$/g, "");
                 }
             }
         }
@@ -38,6 +53,7 @@ import readline from "node:readline";
 import { fileURLToPath } from "node:url";
 import { getAnalyticsPref, setAnalyticsPref } from "./analyticsPrefs.js";
 import { Bridge } from "./bridge.js";
+import { findAllLiveBridges, findBridgeLock, } from "./bridgeLockDiscovery.js";
 import { isBridgeToolsFileValid, repairBridgeToolsRulesIfStale, } from "./bridgeToolsRules.js";
 import { findEditor, parseConfig } from "./config.js";
 import { detectWorkspaceSymlinkInstall, PATCHWORK_PACKAGE_NAME, SYMLINK_INSTALL_FIX, } from "./installGuard.js";
@@ -124,12 +140,18 @@ const KNOWN_SUBCOMMANDS = [
     "install",
     "status",
     "shim",
+    "quick-task",
+    "start-task",
+    "continue-handoff",
+    "token-efficiency",
     "recipe",
+    "connect",
     "traces",
     "suggest",
     "dashboard",
     "launchd",
     "start",
+    "orchestrator",
     "kill-switch",
     "panic",
     "halts",
@@ -137,6 +159,10 @@ const KNOWN_SUBCOMMANDS = [
     "analytics",
     "doctor",
     "shadow-scan",
+    "workers",
+    "approvals",
+    "gate",
+    "outcomes",
 ];
 const __invokedSubcommand = (() => {
     const sub = process.argv[2];
@@ -194,6 +220,11 @@ if (process.argv[2] === "--help" ||
         `  recipe run <name> [--vars k=v]            Run a recipe by name\n` +
         `  recipe install <source>                   Install from a path or GitHub source\n` +
         `  recipe --help                             Full recipe subcommand index\n\n` +
+        `Connectors\n` +
+        `  connect [list]                            List connectors + connection status\n` +
+        `  connect <vendor>                          OAuth: print authorize URL / PAT: connect\n` +
+        `  connect test <vendor>                     Health-probe a connector\n` +
+        `  connect disconnect <vendor>               Revoke a connector\n\n` +
         `Operate\n` +
         `  start [--port N] [--workspace <dir>]      Start a single bridge (no tmux)\n` +
         `  status                                    One-line bridge status (port, uptime)\n` +
@@ -306,20 +337,7 @@ This is a thin wrapper over \`start-all\`. For advanced flags see:
     process.exit(result.status ?? 1);
 }
 function writeRulesFileAtomic(rulesFilePath, content) {
-    const tmpPath = `${rulesFilePath}.tmp`;
-    writeFileSync(tmpPath, content, { encoding: "utf-8", flag: "wx" });
-    try {
-        renameSync(tmpPath, rulesFilePath);
-    }
-    catch (err) {
-        try {
-            unlinkSync(tmpPath);
-        }
-        catch {
-            /* best-effort cleanup */
-        }
-        throw err;
-    }
+    writeFileAtomicSync(rulesFilePath, content, { encoding: "utf-8" });
 }
 /**
  * Handles errors from rules file write operations. EACCES → warning + instructions.
@@ -335,7 +353,7 @@ function handleRulesWriteError(err, rulesFilePath, indent) {
             `${indent}       Run with elevated permissions or create the file manually.\n\n`);
         return 0;
     }
-    if (code === "ELOOP" || code === "EEXIST") {
+    if (code === "ELOOP") {
         process.stderr.write(`${indent}[error] Bridge rules — suspicious path condition (${code}): ${rulesFilePath}\n\n`);
         return 1;
     }
@@ -424,7 +442,25 @@ Options:
         const backupPath = `${targetPath}.${ts}.bak`;
         try {
             renameSync(targetPath, backupPath);
-            renameSync(tmpPath, targetPath);
+            try {
+                renameSync(tmpPath, targetPath);
+            }
+            catch (renameErr) {
+                if (renameErr.code === "EEXIST" &&
+                    process.platform === "win32") {
+                    // Concurrent writer recreated targetPath between the two renames.
+                    try {
+                        unlinkSync(targetPath);
+                    }
+                    catch {
+                        /* best-effort */
+                    }
+                    renameSync(tmpPath, targetPath);
+                }
+                else {
+                    throw renameErr;
+                }
+            }
         }
         catch (err) {
             try {
@@ -443,7 +479,30 @@ Options:
             encoding: "utf-8",
             flag: "wx",
         });
-        renameSync(`${targetPath}.tmp`, targetPath);
+        try {
+            renameSync(`${targetPath}.tmp`, targetPath);
+        }
+        catch (renameErr) {
+            if (renameErr.code === "EEXIST" &&
+                process.platform === "win32") {
+                try {
+                    unlinkSync(targetPath);
+                }
+                catch {
+                    /* best-effort */
+                }
+                renameSync(`${targetPath}.tmp`, targetPath);
+            }
+            else {
+                try {
+                    unlinkSync(`${targetPath}.tmp`);
+                }
+                catch {
+                    /* best-effort */
+                }
+                throw renameErr;
+            }
+        }
     }
     process.stderr.write(`✓ Bridge workflow section written to ${targetPath} (v${PACKAGE_VERSION})\n`);
     // Also write bridge-tools rules file alongside CLAUDE.md
@@ -493,50 +552,31 @@ Options:
     const portIdx = argv.indexOf("--port");
     const portArg = portIdx !== -1 ? argv[portIdx + 1] : undefined;
     const lockDir = path.join(process.env.CLAUDE_CONFIG_DIR ?? path.join(os.homedir(), ".claude"), "ide");
-    let lockFile;
+    // Select a *running bridge* lock (isBridge:true + live PID) rather than the
+    // most-recently-touched lock in ~/.claude/ide, which can be an IDE-owned
+    // lock or a dead bridge.
+    let bridgeLock;
     if (portArg) {
-        lockFile = path.join(lockDir, `${portArg}.lock`);
-        if (!existsSync(lockFile)) {
-            process.stderr.write(`Error: No lock file found for port ${portArg} at ${lockFile}\n`);
+        const port = Number(portArg);
+        bridgeLock = findAllLiveBridges().find((b) => b.port === port) ?? null;
+        if (!bridgeLock) {
+            process.stderr.write(`Error: No running bridge found for port ${portArg} (no lock file for that port, the lock is IDE-owned, or its process is not alive).\n`);
             process.exit(1);
         }
     }
     else {
-        // Find the most recently modified lock file
-        let bestMtime = 0;
-        try {
-            for (const f of readdirSync(lockDir)) {
-                if (!f.endsWith(".lock"))
-                    continue;
-                const full = path.join(lockDir, f);
-                const mtime = statSync(full).mtimeMs;
-                if (mtime > bestMtime) {
-                    bestMtime = mtime;
-                    lockFile = full;
-                }
-            }
-        }
-        catch {
-            // lock dir doesn't exist — handled below
-        }
+        bridgeLock = findBridgeLock();
     }
-    if (!lockFile) {
-        process.stderr.write(`Error: No bridge lock file found in ${lockDir}\n`);
+    if (!bridgeLock) {
+        process.stderr.write(`Error: No running bridge lock file found in ${lockDir}\n`);
         process.stderr.write("Make sure the bridge is running first, or pass --port <port>.\n");
         process.exit(1);
     }
-    try {
-        const data = JSON.parse(readFileSync(lockFile, "utf-8"));
-        if (!data.authToken) {
-            process.stderr.write(`Error: Lock file ${lockFile} has no authToken field\n`);
-            process.exit(1);
-        }
-        process.stdout.write(`${data.authToken}\n`);
-    }
-    catch {
-        process.stderr.write(`Error: Could not read lock file ${lockFile}\n`);
+    if (!bridgeLock.authToken) {
+        process.stderr.write(`Error: Bridge lock for port ${bridgeLock.port} has no authToken field\n`);
         process.exit(1);
     }
+    process.stdout.write(`${bridgeLock.authToken}\n`);
     process.exit(0);
 }
 // Handle notify subcommand — called from CC hooks to fire bridge automation
@@ -558,63 +598,51 @@ if (process.argv[2] === "notify") {
     }
     const notifyRest = notifyArgv.slice(1);
     const namedArgs = {};
-    for (let i = 0; i < notifyRest.length - 1; i++) {
+    // Iterate the full list (not length-1) so a trailing bare `--flag` with no
+    // following value is still recorded rather than silently dropped
+    // (cli-commands-5). A flag whose next token is another `--flag` (or which is
+    // last) is treated as an empty-valued flag, matching the existing `?? ""`.
+    for (let i = 0; i < notifyRest.length; i++) {
         const arg = notifyRest[i];
         if (arg?.startsWith("--")) {
             const key = arg.slice(2);
-            const val = notifyRest[i + 1] ?? "";
-            namedArgs[key] = val;
-            i++;
+            const next = notifyRest[i + 1];
+            if (next !== undefined && !next.startsWith("--")) {
+                namedArgs[key] = next;
+                i++;
+            }
+            else {
+                namedArgs[key] = "";
+            }
         }
     }
     const notifyLockDir = path.join(process.env.CLAUDE_CONFIG_DIR ?? path.join(os.homedir(), ".claude"), "ide");
-    let notifyLockFile;
+    // Select a *running bridge* lock (isBridge:true + live PID) rather than the
+    // most-recently-touched lock, which can be an IDE-owned or dead-bridge lock.
     let notifyPort;
+    let notifyToken;
     if (namedArgs.port) {
-        notifyPort = Number(namedArgs.port);
-        notifyLockFile = path.join(notifyLockDir, `${notifyPort}.lock`);
-        if (!existsSync(notifyLockFile)) {
-            process.stderr.write(`Error: No lock file found for port ${notifyPort}\n`);
+        const port = Number(namedArgs.port);
+        const lock = findAllLiveBridges().find((b) => b.port === port);
+        if (!lock) {
+            process.stderr.write(`Error: No running bridge found for port ${namedArgs.port} (no lock for that port, the lock is IDE-owned, or its process is not alive).\n`);
             process.exit(1);
         }
+        notifyPort = lock.port;
+        notifyToken = lock.authToken;
     }
     else {
-        let bestMtime = 0;
-        try {
-            for (const f of readdirSync(notifyLockDir)) {
-                if (!f.endsWith(".lock"))
-                    continue;
-                const full = path.join(notifyLockDir, f);
-                const mtime = statSync(full).mtimeMs;
-                if (mtime > bestMtime) {
-                    bestMtime = mtime;
-                    notifyLockFile = full;
-                    notifyPort = Number(path.basename(f, ".lock"));
-                }
-            }
-        }
-        catch {
-            // lock dir doesn't exist
+        const lock = findBridgeLock();
+        if (lock) {
+            notifyPort = lock.port;
+            notifyToken = lock.authToken;
         }
     }
-    if (!notifyLockFile || !notifyPort) {
-        process.stderr.write(`Error: No bridge lock file found in ${notifyLockDir}\n`);
+    if (!notifyPort || !notifyToken) {
+        process.stderr.write(`Error: No running bridge lock file found in ${notifyLockDir}\n`);
         process.stderr.write("Make sure the bridge is running first (claude-ide-bridge --watch ...).\n");
         process.exit(1);
     }
-    let notifyToken;
-    try {
-        const data = JSON.parse(readFileSync(notifyLockFile, "utf-8"));
-        if (!data.authToken) {
-            process.stderr.write(`Error: Lock file has no authToken field\n`);
-            process.exit(1);
-        }
-        notifyToken = data.authToken;
-    }
-    catch {
-        process.stderr.write(`Error: Could not read lock file ${notifyLockFile}\n`);
-        process.exit(1);
-    }
     try {
         const resp = await fetch(`http://127.0.0.1:${notifyPort}/notify`, {
             method: "POST",
@@ -1171,18 +1199,41 @@ if (process.argv[2] === "recipe" && process.argv[3] === "run") {
             const { findBridgeLock } = await import("./bridgeLockDiscovery.js");
             const lock = localFlag ? null : findBridgeLock();
             if (lock && !dryRun && !step && !explicitFile && !attemptId) {
-                const res = await fetch(`http://127.0.0.1:${lock.port}/recipes/run`, {
-                    method: "POST",
-                    headers: {
-                        Authorization: `Bearer ${lock.authToken}`,
-                        "Content-Type": "application/json",
-                    },
-                    body: JSON.stringify({
-                        name: recipeArg,
-                        ...(seedVars ? { vars: seedVars } : {}),
-                    }),
-                });
-                const body = (await res.json());
+                // 30s per-request deadline — the bridge can pass the findBridgeLock
+                // PID check yet be wedged on HTTP. Without this abort the fetch
+                // blocks forever. Mirrors the AbortController pattern used by every
+                // sibling bridge call (halts, judgments, recipe doctor, kill-switch).
+                const controller = new AbortController();
+                const timer = setTimeout(() => controller.abort(), 30_000);
+                let res;
+                let body;
+                try {
+                    res = await fetch(`http://127.0.0.1:${lock.port}/recipes/run`, {
+                        method: "POST",
+                        headers: {
+                            Authorization: `Bearer ${lock.authToken}`,
+                            "Content-Type": "application/json",
+                        },
+                        body: JSON.stringify({
+                            name: recipeArg,
+                            ...(seedVars ? { vars: seedVars } : {}),
+                        }),
+                        signal: controller.signal,
+                    });
+                    body = (await res.json());
+                }
+                catch (err) {
+                    const aborted = err instanceof Error &&
+                        (err.name === "AbortError" || controller.signal.aborted);
+                    process.stderr.write(aborted
+                        ? `Error: bridge on port ${lock.port} did not respond within 30s — it may be wedged. Restart the bridge or re-run with --local.\n`
+                        : `Error: failed to reach bridge on port ${lock.port}: ${err instanceof Error ? err.message : String(err)}\n`);
+                    process.exit(1);
+                    return;
+                }
+                finally {
+                    clearTimeout(timer);
+                }
                 if (!body.ok) {
                     // Fall through to local YAML runner if bridge doesn't know the recipe.
                     if (!(body.error ?? "").includes("not found")) {
@@ -1442,6 +1493,8 @@ if (process.argv[2] === "traces" && process.argv[3] === "export") {
             let output;
             let patchworkDir;
             let activityDir;
+            let mode;
+            let passphrase;
             for (let i = 0; i < args.length; i++) {
                 const a = args[i];
                 if (a === "--output" || a === "-o") {
@@ -1456,10 +1509,30 @@ if (process.argv[2] === "traces" && process.argv[3] === "export") {
                     activityDir = args[i + 1];
                     i++;
                 }
+                else if (a === "--mode") {
+                    const m = args[i + 1];
+                    if (m !== "public" && m !== "keyed") {
+                        process.stderr.write(`Error: --mode must be "public" or "keyed" (got: ${m})\n`);
+                        process.exit(1);
+                    }
+                    mode = m;
+                    i++;
+                }
+                else if (a === "--passphrase") {
+                    passphrase = args[i + 1];
+                    i++;
+                }
                 else if (a === "--help" || a === "-h") {
-                    process.stdout.write("patchwork traces export [--output <path>] [--patchwork-dir <dir>] [--activity-dir <dir>]\n\n" +
+                    process.stdout.write("patchwork traces export [--output <path>] [--mode public|keyed]\n" +
+                        "                        [--passphrase <phrase>]\n" +
+                        "                        [--patchwork-dir <dir>] [--activity-dir <dir>]\n\n" +
                         "Bundles ~/.patchwork/{runs,decision_traces,commit_issue_links}.jsonl\n" +
                         "and ~/.claude/ide/activity-*.jsonl into a single gzipped JSONL file.\n\n" +
+                        "Modes:\n" +
+                        "  public  (default) Plain gzip bundle (.jsonl.gz). Anyone with the file\n" +
+                        "          can read it.\n" +
+                        "  keyed   AES-256-GCM encrypted bundle (.enc). Requires --passphrase;\n" +
+                        "          auto-detected and decrypted by `traces import --passphrase`.\n\n" +
                         "Output is a manifest line followed by one envelope per row:\n" +
                         '  {"type":"manifest", ...}\n' +
                         '  {"source":"runs", "entry":{...}}\n' +
@@ -1469,11 +1542,17 @@ if (process.argv[2] === "traces" && process.argv[3] === "export") {
                     process.exit(0);
                 }
             }
+            if (mode === "keyed" && !passphrase) {
+                process.stderr.write("Error: --mode keyed requires --passphrase <phrase>\n");
+                process.exit(1);
+            }
             const { runTracesExport } = await import("./commands/tracesExport.js");
             const result = await runTracesExport({
                 ...(output !== undefined && { output }),
                 ...(patchworkDir !== undefined && { patchworkDir }),
                 ...(activityDir !== undefined && { activityDir }),
+                ...(mode !== undefined && { mode }),
+                ...(passphrase !== undefined && { passphrase }),
             });
             process.stdout.write(`  ✓ Wrote ${result.outputPath}\n`);
             process.stdout.write(`    ${result.totalCount} rows from ${result.files.length} file${result.files.length === 1 ? "" : "s"} (${result.totalBytes} bytes read)\n`);
@@ -1569,6 +1648,17 @@ if (process.argv[2] === "traces" && process.argv[3] === "import") {
                     writeFileSync(tmp, plain, { mode: 0o600 });
                     input = tmp;
                     process.stderr.write("Decryption succeeded.\n");
+                    // Ensure tmp is removed after import regardless of success/failure.
+                    // On Windows mode:0o600 is a no-op (NTFS doesn't honour POSIX bits),
+                    // so the plaintext would persist in %TEMP% until the next reboot.
+                    process.once("exit", () => {
+                        try {
+                            unlinkSync(tmp);
+                        }
+                        catch {
+                            /* best-effort */
+                        }
+                    });
                 }
             }
             const { runTracesImport } = await import("./commands/tracesImport.js");
@@ -1722,7 +1812,7 @@ if (process.argv[2] === "kill-switch") {
                         ? ` [env-locked: ${j.lockedReason ?? "yes"}]`
                         : "";
                     const wsLabel = lock.workspace
-                        ? lock.workspace.split("/").slice(-2).join("/")
+                        ? path.join(path.basename(path.dirname(lock.workspace)), path.basename(lock.workspace))
                         : `pid=${lock.pid}`;
                     process.stdout.write(`  ${engaged}  port=${lock.port} ${wsLabel}${lockedSuffix}\n`);
                 }
@@ -1738,7 +1828,7 @@ if (process.argv[2] === "kill-switch") {
                     ...(reason ? { reason } : {}),
                 });
                 const wsLabel = lock.workspace
-                    ? lock.workspace.split("/").slice(-2).join("/")
+                    ? path.join(path.basename(path.dirname(lock.workspace)), path.basename(lock.workspace))
                     : `pid=${lock.pid}`;
                 if (result.status === 409) {
                     anyFailed = true;
@@ -1948,6 +2038,20 @@ if (process.argv[2] === "halts") {
         }
     })();
 }
+// `patchwork connect` — connector front-door. Thin CLI→HTTP shim over the
+// bridge's `/connections/*` routes (list / OAuth auth / PAT connect / test /
+// disconnect). This is the command the 23 connector "Run: patchwork connect
+// <vendor>" error messages point at. Lock discovery reuses the same
+// isBridge:true + live-PID selector as `recipe run`, `quick-task`, etc.
+if (process.argv[2] === "connect") {
+    (async () => {
+        const { runConnect } = await import("./commands/connect.js");
+        const { findBridgeLockForTask } = await import("./commands/task.js");
+        await runConnect(process.argv.slice(3), {
+            findBridgeLock: (port) => findBridgeLockForTask(port),
+        });
+    })();
+}
 // `patchwork analytics` — manage the self-hosted telemetry collector config.
 // Replaces the brittle "endpoint+secret in launchd plist" pattern with a
 // proper config file the bridge reads at startup.
@@ -2415,6 +2519,134 @@ if (process.argv[2] === "recipe" && process.argv[3] === "preflight") {
         }
     })();
 }
+// `recipe simulate <name|file>` — What-If Preview. Statically simulates a
+// recipe before it is enabled: projected actions, side-effect taxonomy,
+// blast-radius risk, tier-only approval projection (honestly flagged as NOT
+// gated on recipe steps today), low-confidence cost, and undetermined
+// conditional branches. Executes nothing. See runRecipeSimulate in
+// commands/recipe.ts.
+if (process.argv[2] === "recipe" && process.argv[3] === "simulate") {
+    const args = process.argv.slice(4);
+    const usage = "Usage: patchwork recipe simulate <name|file.yaml> [--json] [--step <id>] [--var k=v]\n\n" +
+        "What-If Preview: statically simulate a recipe before enabling it.\n" +
+        "Shows projected actions, side effects, risk, approvals (tier-only),\n" +
+        "cost (low-confidence), and undetermined branches. Executes nothing.\n";
+    let json = false;
+    let step;
+    const vars = {};
+    let target;
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        if (arg === undefined)
+            continue;
+        if (arg === "--json") {
+            json = true;
+            continue;
+        }
+        if (arg === "--step" || arg.startsWith("--step=")) {
+            const value = arg === "--step" ? args[++i] : arg.slice("--step=".length);
+            if (!value) {
+                process.stderr.write(`Error: --step requires a value\n${usage}`);
+                process.exit(1);
+            }
+            step = value;
+            continue;
+        }
+        if (arg === "--var" || arg.startsWith("--var=")) {
+            const value = arg === "--var" ? args[++i] : arg.slice("--var=".length);
+            if (!value?.includes("=")) {
+                process.stderr.write(`Error: --var requires k=v\n${usage}`);
+                process.exit(1);
+            }
+            const idx = value.indexOf("=");
+            vars[value.slice(0, idx)] = value.slice(idx + 1);
+            continue;
+        }
+        if (!arg.startsWith("--")) {
+            target = arg;
+        }
+    }
+    if (!target) {
+        process.stderr.write(usage);
+        process.exit(1);
+    }
+    (async () => {
+        try {
+            const { runRecipeSimulate } = await import("./commands/recipe.js");
+            const report = await runRecipeSimulate(target, {
+                ...(step ? { step } : {}),
+                ...(Object.keys(vars).length ? { vars } : {}),
+            });
+            if (json) {
+                process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
+                process.exit(0);
+            }
+            const out = process.stdout;
+            const mark = (tier) => tier === "high" ? "●" : tier === "medium" ? "◐" : "○";
+            const fidelityLabel = report.fidelity === "mocked"
+                ? `mocked fidelity, ${report.sampleRuns ?? 0} prior run(s)`
+                : `${report.fidelity} fidelity`;
+            out.write(`\n  What-If Preview — ${report.recipe} (${report.topology}, ${fidelityLabel})\n`);
+            out.write(`  Trigger: ${report.triggerType} · ${report.summary.totalSteps} step(s)\n\n`);
+            out.write(`  Risk: ${report.risk.tier.toUpperCase()} (score ${report.risk.score}/100)\n`);
+            const c = report.risk.components;
+            out.write(`    high:${c.highSteps} medium:${c.mediumSteps} writes:${c.writeSteps} connector-writes:${c.connectorWriteSteps} http:${c.externalHttpSteps} unresolved:${c.unresolvedSteps}\n\n`);
+            out.write("  Actions:\n");
+            for (const s of report.steps) {
+                const tool = s.tool ?? s.type;
+                const when = s.condition ? `  when: ${s.condition}` : "";
+                out.write(`    ${mark(s.effectiveRisk)} ${s.id}  ${tool}  [${s.sideEffect}]${when}\n`);
+            }
+            out.write("\n");
+            const ns = report.summary.connectorNamespaces;
+            out.write(`  Side effects: ${report.summary.writeSteps} write(s) · ${report.summary.connectorSteps} connector call(s)${ns.length ? ` (${ns.join(", ")})` : ""} · ${report.summary.agentSteps} agent step(s)\n`);
+            const gating = report.approvals.projected.filter((a) => a.wouldRequireApproval).length;
+            out.write(`  Approvals: ${gating} step(s) would gate IF recipe steps were gated — they are NOT gated today\n`);
+            {
+                const c = report.cost;
+                const toks = typeof c.estInputTokens === "number"
+                    ? ` ~${c.estInputTokens} in / ${c.estOutputTokens ?? 0} out tokens`
+                    : typeof c.estPromptTokens === "number"
+                        ? ` ~${c.estPromptTokens} input tokens`
+                        : "";
+                const usd = typeof c.usd === "number"
+                    ? ` ≈$${c.usd.toFixed(4)}${typeof c.minUsd === "number" && typeof c.maxUsd === "number"
+                        ? ` ($${c.minUsd.toFixed(4)}–$${c.maxUsd.toFixed(4)})`
+                        : ""}`
+                    : "";
+                const conf = c.confidence ? `/${c.confidence}` : "";
+                out.write(`  Cost [${c.basis}${conf}]:${toks}${usd}\n`);
+                out.write(`    ${c.note}\n`);
+            }
+            if (report.branches.length > 0) {
+                if (report.fidelity === "mocked") {
+                    const taken = report.branches.filter((b) => b.outcome === "taken").length;
+                    const skipped = report.branches.filter((b) => b.outcome === "skipped").length;
+                    const undet = report.branches.filter((b) => b.outcome === "undetermined").length;
+                    out.write(`  Branches: ${report.branches.length} conditional — ${taken} taken, ${skipped} skipped, ${undet} undetermined\n`);
+                    for (const b of report.branches) {
+                        out.write(`    ${b.outcome.padEnd(12)} ${b.stepId}  ${b.condition}\n`);
+                    }
+                }
+                else {
+                    out.write(`  Branches: ${report.branches.length} conditional — undetermined (resolve in a later sandbox phase)\n`);
+                }
+            }
+            if (report.lint.errors.length > 0 || report.lint.warnings.length > 0) {
+                out.write(`  Lint: ${report.lint.errors.length} error(s), ${report.lint.warnings.length} warning(s)\n`);
+            }
+            out.write("\n  Notes:\n");
+            for (const n of report.notes)
+                out.write(`    • ${n}\n`);
+            out.write("\n");
+            process.exit(0);
+        }
+        catch (err) {
+            process.stderr.write(`Error: ${err instanceof Error ? err.message : String(err)}\n`);
+            process.exit(1);
+        }
+    })();
+}
 // `recipe doctor <name|file>` — one-screen "why is this recipe unhealthy
 // + how do I fix it" diagnosis. Composes the static preflight check with
 // the recipe-scoped runtime halt summary from a live bridge (fail-soft:
@@ -2473,7 +2705,42 @@ if (process.argv[2] === "recipe" && process.argv[3] === "doctor") {
                     }
                     return null;
                 };
-            const result = await runRecipeDoctor(ref, { fetchHalts });
+            // Connector auth fetcher: walk live bridges, GET /connections to read
+            // each connector's status. Returns null when no bridge is reachable so
+            // doctor degrades to static-only (lists required connectors, no auth).
+            const fetchConnections = localOnly
+                ? undefined
+                : async () => {
+                    const { findAllLiveBridges } = await import("./bridgeLockDiscovery.js");
+                    const liveLocks = findAllLiveBridges();
+                    if (liveLocks.length === 0)
+                        return null;
+                    for (const lock of liveLocks) {
+                        const controller = new AbortController();
+                        const timer = setTimeout(() => controller.abort(), 10_000);
+                        try {
+                            const res = await fetch(`http://127.0.0.1:${lock.port}/connections`, {
+                                headers: { Authorization: `Bearer ${lock.authToken}` },
+                                signal: controller.signal,
+                            });
+                            if (res.ok) {
+                                const body = (await res.json());
+                                return body.connectors ?? [];
+                            }
+                        }
+                        catch {
+                            /* unreachable lock — try next */
+                        }
+                        finally {
+                            clearTimeout(timer);
+                        }
+                    }
+                    return null;
+                };
+            const result = await runRecipeDoctor(ref, {
+                fetchHalts,
+                fetchConnections,
+            });
             if (wantJson) {
                 process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
             }
@@ -2943,9 +3210,19 @@ Steps performed:
             // claude -p spawns the stdio command via Node's child_process, which
             // can't resolve a bare `.cmd` shim on Windows. Record the `.cmd` form
             // on win32 so the bridge binary is findable by the spawned process.
+            //
+            // This global entry stays even though the project also gets a
+            // `patchwork` MCP server (project .mcp.json / project config) covering
+            // this same workspace — VS Code/Windsurf/Cursor launches inject
+            // --mcp-config, which overrides any project .mcp.json entirely, so
+            // this ~/.claude.json entry is the ONLY way bridge tools are wired
+            // under an IDE launch. Pin --workspace so that when multiple bridges
+            // are running (this one plus others elsewhere), the workspace-aware
+            // lock discovery in mcp-stdio-shim.cjs picks THIS project's lock
+            // instead of falling back to cwd-based guessing or the wrong bridge.
             mcpServers["claude-ide-bridge"] = {
                 command: ensureCmdShim("claude-ide-bridge"),
-                args: ["shim"],
+                args: ["shim", "--workspace", workspace],
                 type: "stdio",
             };
             claudeJson.mcpServers = mcpServers;
@@ -2956,10 +3233,21 @@ Steps performed:
         }
     }
     catch {
-        process.stderr.write(`  [warn] Could not update ${claudeJsonAbs} — add manually:\n         { "mcpServers": { "claude-ide-bridge": { "command": "claude-ide-bridge", "args": ["shim"] } } }\n\n`);
+        process.stderr.write(`  [warn] Could not update ${claudeJsonAbs} — add manually:\n         { "mcpServers": { "claude-ide-bridge": { "command": "claude-ide-bridge", "args": ["shim", "--workspace", "${workspace}"] } } }\n\n`);
     }
     // Step 3b: Wire CC hooks in ~/.claude/settings.json
-    const ccSettingsPath = path.join(process.env.CLAUDE_CONFIG_DIR ?? path.join(os.homedir(), ".claude"), "settings.json");
+    const ccConfigDir = process.env.CLAUDE_CONFIG_DIR ?? path.join(os.homedir(), ".claude");
+    const ccSettingsPath = path.join(ccConfigDir, "settings.json");
+    // On a truly fresh machine ~/.claude/ may not exist yet. Every settings.json
+    // writer below (CC hooks, the IDE-skip env step, the PreToolUse hook) does an
+    // atomic write that needs the parent dir to exist — without this, all three
+    // silently fail with ENOENT and the user's onboarding state is never persisted.
+    try {
+        mkdirSync(ccConfigDir, { recursive: true });
+    }
+    catch {
+        // best-effort — the individual writers below surface their own warnings
+    }
     const CC_HOOK_NOTIFY_CMDS = {
         PreCompact: "claude-ide-bridge notify PreCompact",
         PostCompact: "claude-ide-bridge notify PostCompact",
@@ -3021,6 +3309,33 @@ Steps performed:
         process.stderr.write(`  [warn] Could not update ${ccSettingsPath} — add CC hook entries manually.\n` +
             `         See CLAUDE.md Automation Policy section for the settings.json snippet.\n\n`);
     }
+    // Step 3c: Persist CLAUDE_CODE_IDE_SKIP_VALID_CHECK into the settings.json
+    // `env` block so `claude --ide` connects without the user prefixing the var
+    // on every launch. The bridge writes its own ~/.claude/ide/<port>.lock, but
+    // Claude Code's `--ide` "valid check" is an in-IDE-terminal detection that a
+    // standalone bridge can't satisfy by lock-file shape alone — so we set the
+    // skip flag where Patchwork already manages CC config (NOT the shell rc).
+    try {
+        const { registerSkipIdeValidCheckEnv } = await import("./settingsEnv.js");
+        const envResult = registerSkipIdeValidCheckEnv(ccSettingsPath);
+        if (envResult.action === "added") {
+            process.stderr.write(`  ✓ IDE connect — set CLAUDE_CODE_IDE_SKIP_VALID_CHECK=true in ${ccSettingsPath}\n     You can now run a plain \`claude --ide\` — no env-var prefix needed.\n\n`);
+        }
+        else if (envResult.action === "already-present") {
+            process.stderr.write(`  ✓ IDE connect — CLAUDE_CODE_IDE_SKIP_VALID_CHECK already set in ${ccSettingsPath}\n\n`);
+        }
+        else if (envResult.action === "preserved-user-value") {
+            process.stderr.write(`  [info] IDE connect — left your CLAUDE_CODE_IDE_SKIP_VALID_CHECK="${envResult.existingValue}" untouched.\n` +
+                `         If \`claude --ide\` won't connect, set it to "true" in ${ccSettingsPath}.\n\n`);
+        }
+        else {
+            process.stderr.write(`  [warn] IDE connect — could not set CLAUDE_CODE_IDE_SKIP_VALID_CHECK (${envResult.error}).\n` +
+                `         Add { "env": { "CLAUDE_CODE_IDE_SKIP_VALID_CHECK": "true" } } to ${ccSettingsPath} manually.\n\n`);
+        }
+    }
+    catch (err) {
+        process.stderr.write(`  [warn] IDE connect — ${err instanceof Error ? err.message : String(err)}\n\n`);
+    }
     // Patchwork: register PreToolUse approval hook so the dashboard can
     // approve/reject CC tool calls in real time.
     try {
@@ -3077,8 +3392,14 @@ Steps performed:
         "Next steps:\n" +
         `  1. Start the bridge:    claude-ide-bridge --watch   (runs in this workspace)\n` +
         "  2. Restart your IDE once so it picks up the new extension + MCP config.\n" +
-        "  3. Open Claude Code and type /mcp — the claude-ide-bridge server should show as connected.\n" +
-        "  4. Type /ide to see live workspace state (open editors, diagnostics, git status).\n\n");
+        "  3. Connect Claude Code: claude --ide   (the IDE-detection skip flag is\n" +
+        "       already set in ~/.claude/settings.json — no env-var prefix needed).\n" +
+        "  4. Type /mcp — the claude-ide-bridge server should show as connected,\n" +
+        "       then /ide to see live workspace state (open editors, diagnostics, git).\n" +
+        "  5. Run your first recipe (no connectors needed — local git + a brief):\n" +
+        "       patchwork recipe run daily-status --local\n" +
+        "       Writes a morning brief to ~/.patchwork/inbox/. Try --dry-run first to\n" +
+        "       see the plan without spending tokens.\n\n");
     if (inWorktree) {
         process.stdout.write("⚠ This workspace is a linked git worktree. If this is a Cowork session,\n" +
             "  bridge MCP tools are unreachable from inside Cowork itself — run\n" +
@@ -3126,11 +3447,19 @@ Steps performed:
                 ? fallbackDocs
                 : null;
         if (target) {
-            // Use execFile with argv (no shell) — exec(`code "${target}"`) was
-            // shell-evaluated and could be injected via `--workspace '"; ...'`
-            // since path.resolve preserves shell metachars. Audit 2026-05-17.
-            const { execFile } = await import("node:child_process");
-            execFile("code", [target], { timeout: 3000 }, () => { });
+            // Use execFile with argv — exec(`code "${target}"`) was shell-evaluated
+            // and could be injected via `--workspace '"; ...'`. Audit 2026-05-17.
+            // Windows: code is a .cmd shim; shell:true lets cmd.exe resolve it
+            // without needing ensureCmdShim (args-as-array prevents injection).
+            // Wrap in try-catch: in Node 22 on Windows, spawn errors can throw
+            // synchronously before the callback is registered.
+            try {
+                const { execFile } = await import("node:child_process");
+                execFile("code", [target], { timeout: 3000, shell: process.platform === "win32" }, () => { });
+            }
+            catch {
+                // best-effort — VS Code may not be installed
+            }
         }
     }
     // Analytics opt-in prompt — only ask once; skip if preference already set
@@ -3298,12 +3627,25 @@ Options:
         process.exit(0);
     }
     const portIdx = argv.indexOf("--port");
-    const portArg = portIdx !== -1 ? argv[portIdx + 1] : undefined;
+    // --port wins over PATCHWORK_BRIDGE_PORT wins over workspace-aware discovery.
+    const portArg = portIdx !== -1 ? argv[portIdx + 1] : process.env.PATCHWORK_BRIDGE_PORT;
     const jsonFlag = argv.includes("--json");
     const lockDir = path.join(process.env.CLAUDE_CONFIG_DIR ?? path.join(os.homedir(), ".claude"), "ide");
     let lockFile;
     let lockPort;
     if (portArg) {
+        // Validate before path.join — path.join does not block traversal, so an
+        // unsanitized `--port ../../../etc/passwd` would read an arbitrary
+        // `*.lock` file outside lockDir and leak its JSON contents
+        // (cli-commands-1).
+        const portNum = Number(portArg);
+        if (!/^\d{1,5}$/.test(portArg) ||
+            !Number.isInteger(portNum) ||
+            portNum < 1 ||
+            portNum > 65535) {
+            process.stderr.write("Error: --port must be a valid port number\n");
+            process.exit(1);
+        }
         lockFile = path.join(lockDir, `${portArg}.lock`);
         lockPort = portArg;
         if (!existsSync(lockFile)) {
@@ -3312,22 +3654,17 @@ Options:
         }
     }
     else {
-        let bestMtime = 0;
-        try {
-            for (const f of readdirSync(lockDir)) {
-                if (!f.endsWith(".lock"))
-                    continue;
-                const full = path.join(lockDir, f);
-                const mtime = statSync(full).mtimeMs;
-                if (mtime > bestMtime) {
-                    bestMtime = mtime;
-                    lockFile = full;
-                    lockPort = f.replace(".lock", "");
-                }
-            }
-        }
-        catch {
-            // lock dir doesn't exist
+        // Workspace-aware, isBridge-filtered, live-PID-filtered discovery — the
+        // same helper the MCP shim and task runner use (#1052/#1054 fixed the
+        // shim's copy of this bug; this was a separate, unfixed copy that instead
+        // picked the newest-mtime `.lock` file in the directory with no isBridge
+        // check, so an unrelated editor's IDE-owned lock — or a stale bridge from
+        // a different workspace — could shadow the real bridge's status).
+        const { findBridgeLock } = await import("./bridgeLockDiscovery.js");
+        const found = findBridgeLock({ lockDir });
+        if (found) {
+            lockFile = path.join(lockDir, `${found.port}.lock`);
+            lockPort = String(found.port);
         }
     }
     if (!lockFile) {
@@ -3510,6 +3847,206 @@ if (process.argv[2] === "shadow-scan") {
         }
     })();
 }
+// Handle workers subcommand — read-only worker trust-dial (shadow). Replays the
+// recipe run log + gate decision log through the (worker × action-class) ramp
+// and prints the dial + a "ramp would vs gate did" comparison. Changes nothing.
+if (process.argv[2] === "workers") {
+    const args = process.argv.slice(3);
+    const sub = args[0];
+    if ((sub !== "shadow" && sub !== "backtest") ||
+        args.includes("--help") ||
+        args.includes("-h")) {
+        process.stdout.write("Usage: patchwork workers <shadow|backtest> [--workers-dir <path>]\n\n" +
+            "  shadow    Read-only worker trust dial: replays ~/.patchwork/runs.jsonl\n" +
+            "            + the gate decision log through the (worker × action-class)\n" +
+            "            ramp. Computes what the ramp WOULD decide vs what the gate DID.\n" +
+            "  backtest  Replays each worker's history and reports DIVERGENCE: where the\n" +
+            "            ramp would have auto-run a bad action (false-allow, the risk) or\n" +
+            "            gated a good one (false-gate, the cost). Calibration, not a\n" +
+            "            success rate. Neither command changes a live decision.\n\n" +
+            "  --workers-dir <path>  Where *.worker.yaml live (default ~/.patchwork/workers)\n");
+        process.exit(0);
+    }
+    (async () => {
+        try {
+            const dirIdx = args.indexOf("--workers-dir");
+            const workersDir = dirIdx !== -1 ? args[dirIdx + 1] : undefined;
+            const { runWorkerShadowReport, runWorkerBacktest } = await import("./workers/runWorkerShadow.js");
+            const opts = workersDir ? { workersDir } : {};
+            process.stdout.write(sub === "backtest"
+                ? runWorkerBacktest(opts)
+                : runWorkerShadowReport(opts));
+        }
+        catch (err) {
+            process.stderr.write(`Error: ${err instanceof Error ? err.message : String(err)}\n`);
+            process.exit(1);
+        }
+    })();
+}
+// Handle approvals subcommand — considered-approval KPI. Reads the local
+// approval-decision log directly (like `workers shadow`); no bridge round-trip.
+// The lens that tells you whether the trust climbing the worker dial was EARNED
+// or rubber-stamped: reject rate, latency-to-decision, abandoned, channel split.
+if (process.argv[2] === "approvals") {
+    const args = process.argv.slice(3);
+    if (args.includes("--help") || args.includes("-h")) {
+        process.stdout.write("Usage: patchwork approvals [--window 1h|24h|overnight|7d|any] [--json]\n\n" +
+            "Considered-approval KPI from the local approval-decision log:\n" +
+            "  reject rate · latency-to-decision · abandoned · dashboard-vs-phone.\n\n" +
+            "  --window <name>  lookback (default: any). overnight = since 6pm yesterday.\n" +
+            "  --json           emit raw JSON (for scripting)\n");
+        process.exit(0);
+    }
+    (async () => {
+        try {
+            const wIdx = args.findIndex((a) => a === "--window" || a === "-w");
+            const win = wIdx >= 0 && wIdx + 1 < args.length
+                ? args[wIdx + 1]
+                : "any";
+            const fixed = {
+                "1h": 3_600_000,
+                "24h": 86_400_000,
+                "7d": 604_800_000,
+                any: null,
+            };
+            let sinceMs;
+            if (win === "overnight") {
+                const d = new Date();
+                d.setHours(18, 0, 0, 0);
+                if (d.getTime() > Date.now())
+                    d.setDate(d.getDate() - 1);
+                sinceMs = d.getTime();
+            }
+            else if (Object.hasOwn(fixed, win)) {
+                const dur = fixed[win];
+                sinceMs = dur == null ? undefined : Date.now() - dur;
+            }
+            else {
+                process.stderr.write(`Unknown --window value: "${win}"\n`);
+                process.exit(1);
+            }
+            const { readConsideredDecisions, computeConsideredApprovalKpi, formatConsideredApprovalKpi, } = await import("./approvalKpi.js");
+            const decisions = readConsideredDecisions(sinceMs !== undefined ? { sinceMs } : {});
+            const kpi = computeConsideredApprovalKpi(decisions);
+            process.stdout.write(args.includes("--json")
+                ? `${JSON.stringify(kpi, null, 2)}\n`
+                : `${formatConsideredApprovalKpi(kpi, { windowLabel: win })}\n`);
+            process.exit(0);
+        }
+        catch (err) {
+            process.stderr.write(`Error: ${err instanceof Error ? err.message : String(err)}\n`);
+            process.exit(1);
+        }
+    })();
+}
+// Handle gate subcommand — "why did the worker allow/gate THIS action" over
+// the local Decision Record (worker_gate_decisions.jsonl). Reads the log
+// directly (like `workers shadow` / `approvals`); no bridge round-trip needed
+// since the record is a local file, not live state.
+if (process.argv[2] === "gate") {
+    const args = process.argv.slice(3);
+    const sub = args[0];
+    if (sub !== "explain" ||
+        args.includes("--help") ||
+        args.includes("-h") ||
+        args.length < 3) {
+        process.stdout.write("Usage: patchwork gate explain <workerId> <classKey> [--limit N] [--diff] [--json]\n\n" +
+            "Explain the worker-autonomy gate's most recent decision(s) for a given\n" +
+            "worker × action-class, from the local Decision Record\n" +
+            "(~/.patchwork/worker_gate_decisions.jsonl) — no bridge required.\n\n" +
+            '  <classKey>       e.g. "issue:compensable:high" (domain:reversibility:blastTier)\n' +
+            "  --limit N        show the N most recent decisions (default 1, or 2 with --diff)\n" +
+            "  --diff           compare the 2 most recent decisions and show what changed\n" +
+            "  --json            emit raw JSON (for scripting)\n");
+        process.exit(sub === "explain" ? 1 : 0);
+    }
+    (async () => {
+        try {
+            // Length checked above (args.length < 3 short-circuits to usage), so
+            // args[1]/[2] are present here — noUncheckedIndexedAccess just can't see
+            // across the `if` block above.
+            const workerId = args[1];
+            const classKey = args[2];
+            const wantDiff = args.includes("--diff");
+            const limitIdx = args.indexOf("--limit");
+            const explicitLimit = limitIdx >= 0 && limitIdx + 1 < args.length
+                ? Number.parseInt(args[limitIdx + 1], 10)
+                : undefined;
+            const limit = explicitLimit ?? (wantDiff ? 2 : 1);
+            if (!Number.isFinite(limit) || limit < 1) {
+                process.stderr.write("Error: --limit must be a positive integer\n");
+                process.exit(1);
+            }
+            const { WorkerGateDecisionLog, formatGateDecisionHistory, formatGateDecisionDiff, } = await import("./workerGateDecisionLog.js");
+            const patchworkDir = process.env.PATCHWORK_HOME ?? path.join(os.homedir(), ".patchwork");
+            const log = new WorkerGateDecisionLog({ dir: patchworkDir });
+            const decisions = log.query({ workerId, classKey, limit });
+            if (args.includes("--json")) {
+                process.stdout.write(`${JSON.stringify(decisions, null, 2)}\n`);
+                process.exit(0);
+            }
+            if (decisions.length === 0) {
+                process.stdout.write(`No gate decisions found for worker "${workerId}" on class "${classKey}".\n` +
+                    "Either the worker hasn't acted on this class yet, or worker.autonomy is off.\n");
+                process.exit(0);
+            }
+            if (wantDiff) {
+                // query() sorts most-recent-first: newer is [0], older is [1].
+                const [newer, older] = decisions;
+                if (!newer || !older) {
+                    process.stdout.write(`Only one decision found for worker "${workerId}" on class "${classKey}" — nothing to diff against yet.\n`);
+                    process.exit(0);
+                }
+                process.stdout.write(`${formatGateDecisionDiff(newer, older)}\n`);
+                process.exit(0);
+            }
+            process.stdout.write(`${formatGateDecisionHistory(decisions)}\n`);
+            process.exit(0);
+        }
+        catch (err) {
+            process.stderr.write(`Error: ${err instanceof Error ? err.message : String(err)}\n`);
+            process.exit(1);
+        }
+    })();
+}
+// Handle outcomes subcommand — operator positive-act confirmation of worker
+// filings (confirm/reject/list). Writes to ~/.patchwork/outcome-log.jsonl, the
+// same store the trust ramp reads; it is NOT a recipe step, so a worker cannot
+// self-confirm its own filings. No bridge required.
+if (process.argv[2] === "outcomes") {
+    const args = process.argv.slice(3);
+    (async () => {
+        try {
+            // `outcomes pending` — the confirm queue (join over runs + dispositions).
+            // Handled here (not in the pure runOutcomesCli) because it needs the run
+            // log + worker manifests, which live behind the shadow readers.
+            if (args[0] === "pending") {
+                const { computePendingConfirmations, formatPendingConfirmations } = await import("./workers/runWorkerShadow.js");
+                const pending = computePendingConfirmations();
+                if (args.includes("--json")) {
+                    process.stdout.write(`${JSON.stringify(pending, null, 2)}\n`);
+                }
+                else {
+                    process.stdout.write(formatPendingConfirmations(pending));
+                }
+                process.exit(0);
+            }
+            const { runOutcomesCli } = await import("./workers/outcomesCli.js");
+            const { OutcomeStore, resolveOutcomeLogDir } = await import("./workers/outcomeStore.js");
+            const store = new OutcomeStore(resolveOutcomeLogDir());
+            const res = runOutcomesCli(args, { store, now: Date.now() });
+            if (res.stdout)
+                process.stdout.write(res.stdout);
+            if (res.stderr)
+                process.stderr.write(res.stderr);
+            process.exit(res.exitCode);
+        }
+        catch (err) {
+            process.stderr.write(`Error: ${err instanceof Error ? err.message : String(err)}\n`);
+            process.exit(1);
+        }
+    })();
+}
 // Handle launchd subcommand — install/uninstall macOS LaunchAgent for auto-start
 if (process.argv[2] === "launchd") {
     const sub = process.argv[3];