portmind-monorepo 0.3.0 → 0.3.1

package/CHANGELOG.md

@@ -6,6 +6,19 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [0.3.1] - 2026-09-06
+
+### Added
+- `@portmind/core`: AI `explain` feature - provider abstraction for Anthropic (`/v1/messages`) and OpenAI (`/v1/chat/completions`), selected via `ai.provider` config with no code changes needed to switch; explicit field allowlist enforcement (`buildExplainPayload`, only sends fields named in `ai.fields_sent`); cmdline secret/token redaction (`sanitizeCmdline`) before anything is sent; SQLite response cache (`ai_explanations` table) keyed by `(process_name, port)` so repeat queries don't re-call the API.
+- `@portmind/cli`: `portmind explain <port>` - opt-in, requires `ai.enabled: true` and an API key in `ANTHROPIC_API_KEY`/`OPENAI_API_KEY`; fails with a clear config error (exit code `2`) rather than doing nothing if unconfigured.
+- `@portmind/web`: `POST /api/explain` endpoint; the dashboard's "Explain with AI" button now makes a real request instead of showing a disabled placeholder.
+- Web dashboard UX fixes: sticky header (title, filter toolbar, and column labels stay pinned while scrolling a long port list) and the detail panel is now a fixed slide-in panel from the right edge with a dimmed overlay, appearing instantly regardless of scroll position, instead of a block at the bottom of the page requiring a scroll to find. The panel now shows "Service name" and "Description" as two separate labeled fields.
+- Vitest coverage: cmdline sanitization patterns, allowlist field selection, provider request-shape verification (mocked `fetch`, exact URL/headers/body per each provider's documented API), cache get/set/overwrite, and the full `explainPort` orchestration (disabled, missing key, cache hit, cache miss - all mocked).
+
+### Known limitations
+- **AI explain has not been tested against a real API key.** Every test mocks the HTTP layer; the request shapes match each provider's documented API as of this writing, but end-to-end correctness against the actual Anthropic/OpenAI services is unverified.
+- The table's DESCRIPTION column and detail panel's "Description" field only populate for ports IANA has actually registered - most macOS system/app processes (e.g. rapportd, ControlCenter, Spotify) aren't registered services, so they correctly show "-" or, for genuinely coincidental port-number matches, an unrelated IANA description for that number.
+
 ## [0.3.0] - 2026-09-06
 
 ### Added

package/README.md

@@ -19,8 +19,9 @@ Local-first CLI + web dashboard that scans listening ports on your machine, enri
 - Real known-port descriptions via the official IANA Service Name and Port Number Registry (11,394 entries bundled, fetched and verified from `iana.org` — e.g. port 5432 shows "PostgreSQL Database", not a placeholder)
 - A real, working config file loader — `~/.portmind/config.yaml` (user) and `.portmind.yaml` (project) are both read and merged over the defaults; `portmind config show`/`config path` expose the resolved result and file locations
 - `known_ports.source: custom` or `both` in config lets you point at your own JSON file to override or add service descriptions IANA doesn't have (internal services, dev conventions like Redis/MongoDB that aren't officially IANA-registered)
+- AI `explain` (opt-in, off by default) — `portmind explain <port>` and the web dashboard's "Explain with AI" button both make a real call to Anthropic or OpenAI (your choice, via `ai.provider`), sending only the explicit field allowlist (never full env vars or file contents), with cmdline secrets/tokens redacted first and results cached in SQLite so repeat queries don't re-call the API. **Not tested against a live API key** — the request-construction logic (allowlist, sanitization, exact payload shape) is unit-tested with a mocked HTTP layer, but no real call to Anthropic/OpenAI has been made to confirm end-to-end correctness.
 
-**Not implemented yet** (see [Next steps](#next-steps)): Docker cross-reference, local history/"usual" detection, risk flags, `watch`/`free`/`explain`/`history`/`ssh`/`tui` commands. Until those land, every `PortEntry.docker` and `.riskFlags` will be empty, and `.history.usual` is always `true` — so the web dashboard's Docker/unusual filters currently have nothing to filter.
+**Not implemented yet** (see [Next steps](#next-steps)): Docker cross-reference, local history/"usual" detection, risk flags, `watch`/`free`/`history`/`ssh`/`tui` commands. Until those land, every `PortEntry.docker` and `.riskFlags` will be empty, and `.history.usual` is always `true` — so the web dashboard's Docker/unusual filters currently have nothing to filter.
 
 See [CHANGELOG.md](./CHANGELOG.md) for a dated record of what shipped when.
 
@@ -72,7 +73,15 @@ portmind web --port 4401       # use a different port for the dashboard itself
 portmind web --no-open         # don't open the browser automatically
 ```
 
-Why a plain server + vanilla JS instead of a framework: the dashboard is two routes (the page, and `/api/ports`), it never leaves your machine, and there's no build pipeline to maintain — consistent with the "local-first, no telemetry" design of the rest of the tool. The page polls `/api/ports` on load and on manual refresh (or a 5-second auto-refresh you opt into); clicking a row expands full detail including an "Explain with AI" button that's currently a disabled placeholder, since AI `explain` (Phase 9) isn't built yet.
+Why a plain server + vanilla JS instead of a framework: the dashboard is three routes (the page, `/api/ports`, `/api/explain`), it never leaves your machine except for the explicit opt-in AI call, and there's no build pipeline to maintain — consistent with the "local-first, no telemetry" design of the rest of the tool. The page polls `/api/ports` on load and on manual refresh (or a 5-second auto-refresh you opt into). Clicking a row opens a fixed panel from the right edge of the screen (with a dimmed overlay behind it) showing full detail — no scrolling required regardless of where in the table you clicked. Its "Explain with AI" button only fires `/api/explain` when clicked, never automatically.
+
+### AI explain
+
+```bash
+portmind explain 5432   # runs AI deep-search for whatever is currently on port 5432
+```
+
+Requires `ai.enabled: true` in config and an API key in the matching environment variable (`ANTHROPIC_API_KEY` or `OPENAI_API_KEY` depending on `ai.provider` — never put the key in the config file itself). Disabled by default; both the CLI command and the web button fail with a clear config error (exit code `2` for the CLI) rather than silently doing nothing if it's not configured. Results are cached in SQLite keyed by `(process_name, port)`, so asking about the same shape of thing twice doesn't re-call the API.
 
 ### Config
 
@@ -83,11 +92,11 @@ portmind config path   # print ~/.portmind/config.yaml and ./.portmind.yaml, and
 
 Copy [portmind.config.example.yaml](./portmind.config.example.yaml) to `~/.portmind/config.yaml` or `./.portmind.yaml` to change behavior — only the keys you include override the defaults, anything omitted falls back. Malformed YAML in a config file that exists is a hard error (exit code `2`), not silently ignored.
 
-Planned commands not yet implemented: `watch`, `free`, `explain`, `history`, `ssh <host> list|check`, `tui`.
+Planned commands not yet implemented: `watch`, `free`, `history`, `ssh <host> list|check`, `tui`.
 
 ## Storage
 
-History will be stored locally in a SQLite database at `~/.portmind/portmind.db` (configurable) once the history feature (Phase 4) lands. Nothing leaves the machine unless you explicitly run `portmind explain <port>` with AI enabled in config, and even then only an explicit allowlist of fields is sent — never full environment variables or file contents.
+History will be stored locally in a SQLite database at `~/.portmind/portmind.db` (configurable) once the history feature (Phase 4) lands - the same db file already holds the `ai_explanations` cache table today. Nothing leaves the machine unless you explicitly run `portmind explain <port>` (or click "Explain with AI") with AI enabled in config, and even then only an explicit allowlist of fields is sent — never full environment variables or file contents, and cmdline values are scanned for secret/token-shaped substrings and redacted before sending.
 
 ## Configuration
 
@@ -160,13 +169,13 @@ Remaining phases, in build order:
 2. **Docker cross-reference** — match `docker ps` output against scanned ports, populate `PortEntry.docker`
 3. **Risk flags** — `bound_all_interfaces`, `unsigned_binary`, `no_known_service`, each independently configurable
 4. **TUI** (`ink` or `blessed` — undecided) — live table with inline `explain`/`free`
-5. **AI `explain`** (opt-in) — provider abstraction, explicit field allowlist, response caching (the web dashboard's "Explain with AI" button is wired up but disabled until this exists)
-6. **SSH remote support** — `ssh_hosts` config, same `PortEntry` shape with `host` set to the remote name
-7. **Audit logging** — log every `free`/`explain` action per `logging.audit_log`
-8. **IANA cache auto-refresh** — automate re-fetching the CSV on `known_ports.refresh_days`, rather than the current bundled-once snapshot
-9. **Polish** — full `--help` text, packaging for `npm install -g @portmind/cli`
+5. **SSH remote support** — `ssh_hosts` config, same `PortEntry` shape with `host` set to the remote name
+6. **Audit logging** — log every `free`/`explain` action per `logging.audit_log`
+7. **IANA cache auto-refresh** — automate re-fetching the CSV on `known_ports.refresh_days`, rather than the current bundled-once snapshot
+8. **Polish** — full `--help` text, packaging for `npm install -g @portmind/cli`
+9. **AI explain: real end-to-end verification** — the feature is built and unit-tested with a mocked HTTP layer, but has never actually been called against Anthropic or OpenAI with a real API key. Verifying that happens whenever a key becomes available to test with.
 
-Web dashboard, IANA enrichment, and the config file loader (were phases 6, 1, and 11 in the original spec numbering) are done — see [Status](#status).
+Web dashboard, IANA enrichment, the config file loader, and AI `explain` (untested end-to-end - see above) are done — see [Status](#status).
 
 Two decisions still open: TUI library (`ink` vs `blessed`), and whether `free` on a Docker-backed port needs anything beyond the interactive stop/kill/cancel prompt already agreed on.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "portmind-monorepo",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Local-first CLI + web dashboard that scans listening ports, enriches them with process/Docker/IANA detail, and remembers what normally runs where.",
   "keywords": [
     "cli",

package/packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@portmind/cli",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Local-first CLI that scans listening ports, enriches them with process/Docker/IANA detail, and remembers what normally runs where.",
   "keywords": [
     "cli",

package/packages/cli/src/index.ts

@@ -1,13 +1,20 @@
 #!/usr/bin/env node
 import { Command } from "commander";
 import { execFile } from "node:child_process";
-import { ConfigError, loadConfig, resolveConfigPaths, scanPorts, type PortEntry } from "@portmind/core";
+import {
+  ConfigError,
+  explainPort,
+  loadConfig,
+  resolveConfigPaths,
+  scanPorts,
+  type PortEntry,
+} from "@portmind/core";
 import { createWebServer } from "@portmind/web";
 import { renderTable } from "./renderTable.js";
 
 const program = new Command();
 
-program.name("portmind").description("Local-first port scanning, enrichment and history tool").version("0.3.0");
+program.name("portmind").description("Local-first port scanning, enrichment and history tool").version("0.3.1");
 
 interface ListOptions {
   range?: string;
@@ -89,6 +96,41 @@ program
     }
   });
 
+program
+  .command("explain")
+  .description("Run AI deep-search for a specific port (opt-in, requires ai.enabled: true)")
+  .argument("<port>", "port number to explain")
+  .action(async (portArg: string) => {
+    const port = Number.parseInt(portArg, 10);
+    if (Number.isNaN(port)) {
+      console.error(`portmind explain: invalid port "${portArg}"`);
+      process.exitCode = 2;
+      return;
+    }
+
+    try {
+      const resolvedConfig = await loadConfig();
+      const entries = await scanPorts({ includeUdp: resolvedConfig.scan.includeUdp }, resolvedConfig.knownPorts);
+      const entry = entries.find((e) => e.port === port);
+      if (!entry) {
+        console.error(`portmind explain: nothing is currently listening on port ${port}`);
+        process.exitCode = 1;
+        return;
+      }
+
+      const explanation = await explainPort(entry, resolvedConfig);
+      console.log(explanation);
+    } catch (error) {
+      if (error instanceof ConfigError) {
+        console.error(`portmind explain: ${error.message}`);
+        process.exitCode = 2;
+      } else {
+        console.error(`portmind explain: failed - ${(error as Error).message}`);
+        process.exitCode = 1;
+      }
+    }
+  });
+
 const config = program.command("config").description("Inspect resolved portmind configuration");
 
 config

package/packages/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@portmind/core",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "portmind core - scanning, enrichment, data model, config, history. No UI, no AI dependency.",
   "homepage": "https://github.com/psandis/portmind#readme",
   "bugs": "https://github.com/psandis/portmind/issues",

package/packages/core/src/ai/allowlist.ts

@@ -0,0 +1,38 @@
+import type { PortEntry } from "../types.js";
+import type { AiField } from "../config.js";
+import { sanitizeCmdline } from "./sanitize.js";
+
+/**
+ * Builds the exact payload sent to an AI provider - only fields named in
+ * `fieldsSent` are included, nothing else on PortEntry is ever touched.
+ * This is the sole place field selection happens, so it's the one function
+ * that needs auditing to know what leaves the machine.
+ */
+export function buildExplainPayload(
+  entry: PortEntry,
+  fieldsSent: AiField[],
+): Record<string, string | number | null> {
+  const payload: Record<string, string | number | null> = {};
+
+  for (const field of fieldsSent) {
+    switch (field) {
+      case "process_name":
+        payload.process_name = entry.processName;
+        break;
+      case "cmdline":
+        payload.cmdline = entry.cmdline ? sanitizeCmdline(entry.cmdline) : null;
+        break;
+      case "port":
+        payload.port = entry.port;
+        break;
+      case "protocol":
+        payload.protocol = entry.protocol;
+        break;
+      case "docker_image":
+        payload.docker_image = entry.docker?.image ?? null;
+        break;
+    }
+  }
+
+  return payload;
+}

package/packages/core/src/ai/cache.ts

@@ -0,0 +1,54 @@
+import Database from "better-sqlite3";
+import { mkdirSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+/** Expands a leading ~ to the user's home directory, same convention as the rest of the config. */
+function expandHome(filePath: string): string {
+  return filePath.startsWith("~") ? path.join(os.homedir(), filePath.slice(1)) : filePath;
+}
+
+/**
+ * Caches AI explanations keyed by (process_name, port), per the spec, so
+ * repeat `explain` calls for the same shape of thing don't re-call a paid
+ * API. Lazily creates the db file and table on first use.
+ */
+export class AiExplanationCache {
+  private db: Database.Database;
+
+  constructor(dbPath: string) {
+    const resolved = expandHome(dbPath);
+    mkdirSync(path.dirname(resolved), { recursive: true });
+    this.db = new Database(resolved);
+    this.db.exec(`
+      CREATE TABLE IF NOT EXISTS ai_explanations (
+        process_name TEXT NOT NULL,
+        port INTEGER NOT NULL,
+        explanation TEXT NOT NULL,
+        created_at TEXT NOT NULL,
+        PRIMARY KEY (process_name, port)
+      )
+    `);
+  }
+
+  get(processName: string, port: number): string | null {
+    const row = this.db
+      .prepare("SELECT explanation FROM ai_explanations WHERE process_name = ? AND port = ?")
+      .get(processName, port) as { explanation: string } | undefined;
+    return row?.explanation ?? null;
+  }
+
+  set(processName: string, port: number, explanation: string): void {
+    this.db
+      .prepare(
+        `INSERT INTO ai_explanations (process_name, port, explanation, created_at)
+         VALUES (?, ?, ?, ?)
+         ON CONFLICT (process_name, port) DO UPDATE SET explanation = excluded.explanation, created_at = excluded.created_at`,
+      )
+      .run(processName, port, explanation, new Date().toISOString());
+  }
+
+  close(): void {
+    this.db.close();
+  }
+}

package/packages/core/src/ai/explain.ts

@@ -0,0 +1,47 @@
+import type { PortEntry } from "../types.js";
+import type { PortmindConfig } from "../config.js";
+import { buildExplainPayload } from "./allowlist.js";
+import { createAnthropicProvider, createOpenAiProvider, type AiProvider, type FetchLike } from "./provider.js";
+import { AiExplanationCache } from "./cache.js";
+import { ConfigError } from "../configLoader.js";
+
+export interface ExplainDeps {
+  fetchImpl?: FetchLike;
+  cache?: AiExplanationCache;
+  env?: Record<string, string | undefined>;
+}
+
+/**
+ * Orchestrates AI explain: disabled/misconfigured -> ConfigError (CLI exit
+ * code 2, since this is a config problem, not a scan failure); cache hit ->
+ * returned without any network call; cache miss -> allowlisted+sanitized
+ * payload sent to the configured provider, result cached for next time.
+ */
+export async function explainPort(entry: PortEntry, config: PortmindConfig, deps: ExplainDeps = {}): Promise<string> {
+  if (!config.ai.enabled) {
+    throw new ConfigError("AI is disabled. Set ai.enabled: true in your config to use `explain`.");
+  }
+  if (config.ai.provider === "none") {
+    throw new ConfigError('ai.provider is "none". Set it to "anthropic" or "openai" to use `explain`.');
+  }
+
+  const processKey = entry.processName ?? "unknown";
+  const cache = deps.cache ?? new AiExplanationCache(config.history.dbPath);
+  const cached = cache.get(processKey, entry.port);
+  if (cached !== null) return cached;
+
+  const env = deps.env ?? process.env;
+  const apiKey = config.ai.provider === "anthropic" ? env.ANTHROPIC_API_KEY : env.OPENAI_API_KEY;
+  if (!apiKey) {
+    const envVar = config.ai.provider === "anthropic" ? "ANTHROPIC_API_KEY" : "OPENAI_API_KEY";
+    throw new ConfigError(`${envVar} is not set. AI explain requires an API key in that environment variable.`);
+  }
+
+  const payload = buildExplainPayload(entry, config.ai.fieldsSent);
+  const provider: AiProvider =
+    config.ai.provider === "anthropic" ? createAnthropicProvider(deps.fetchImpl) : createOpenAiProvider(deps.fetchImpl);
+
+  const explanation = await provider.explain(payload, apiKey, config.ai.model);
+  cache.set(processKey, entry.port, explanation);
+  return explanation;
+}

package/packages/core/src/ai/provider.ts

@@ -0,0 +1,91 @@
+/**
+ * Provider abstraction for AI `explain`. Each provider takes the already
+ * allowlisted+sanitized payload (see allowlist.ts) and returns a plain-
+ * English explanation string.
+ *
+ * `fetchImpl` is injectable so tests can verify the exact request shape
+ * (URL, headers, body) without making a real network call - there is no
+ * API key available in this environment to test a live call end to end,
+ * so correctness here rests on matching each provider's documented API
+ * shape exactly, not on having actually exercised it against the real
+ * service.
+ */
+export type FetchLike = (url: string, init: RequestInit) => Promise<Response>;
+
+export interface AiProvider {
+  explain(payload: Record<string, unknown>, apiKey: string, model: string): Promise<string>;
+}
+
+export class AiProviderError extends Error {}
+
+function buildPrompt(payload: Record<string, unknown>): string {
+  return [
+    "You are helping a developer understand what is running on a network port on their machine.",
+    "Given this data about a listening port, explain in 2-3 plain-English sentences what this process/service most likely is and why it might be running:",
+    JSON.stringify(payload, null, 2),
+  ].join("\n\n");
+}
+
+export function createAnthropicProvider(fetchImpl: FetchLike = fetch): AiProvider {
+  return {
+    async explain(payload, apiKey, model) {
+      const res = await fetchImpl("https://api.anthropic.com/v1/messages", {
+        method: "POST",
+        headers: {
+          "content-type": "application/json",
+          "x-api-key": apiKey,
+          "anthropic-version": "2023-06-01",
+        },
+        body: JSON.stringify({
+          model,
+          max_tokens: 300,
+          messages: [{ role: "user", content: buildPrompt(payload) }],
+        }),
+      });
+
+      if (!res.ok) {
+        throw new AiProviderError(`Anthropic API error: ${res.status} ${await safeText(res)}`);
+      }
+
+      const data = (await res.json()) as { content?: Array<{ type: string; text?: string }> };
+      const text = data.content?.find((block) => block.type === "text")?.text;
+      if (!text) throw new AiProviderError("Anthropic API returned no text content");
+      return text.trim();
+    },
+  };
+}
+
+export function createOpenAiProvider(fetchImpl: FetchLike = fetch): AiProvider {
+  return {
+    async explain(payload, apiKey, model) {
+      const res = await fetchImpl("https://api.openai.com/v1/chat/completions", {
+        method: "POST",
+        headers: {
+          "content-type": "application/json",
+          authorization: `Bearer ${apiKey}`,
+        },
+        body: JSON.stringify({
+          model,
+          messages: [{ role: "user", content: buildPrompt(payload) }],
+        }),
+      });
+
+      if (!res.ok) {
+        throw new AiProviderError(`OpenAI API error: ${res.status} ${await safeText(res)}`);
+      }
+
+      const data = (await res.json()) as { choices?: Array<{ message?: { content?: string } }> };
+      const text = data.choices?.[0]?.message?.content;
+      if (!text) throw new AiProviderError("OpenAI API returned no message content");
+      return text.trim();
+    },
+  };
+}
+
+async function safeText(res: Response): Promise<string> {
+  try {
+    return await res.text();
+  } catch {
+    return "";
+  }
+}

package/packages/core/src/ai/sanitize.ts

@@ -0,0 +1,19 @@
+/**
+ * Heuristic redaction of secret/token-shaped substrings in a command line,
+ * per the spec's "strip anything that looks like a secret/token pattern
+ * before sending" requirement. This is best-effort, not a guarantee - it
+ * catches common flag/env patterns, not every possible way a secret could
+ * appear in a command line.
+ */
+const SECRET_FLAG_PATTERN =
+  /(--?(?:password|passwd|pwd|token|secret|api[-_]?key|apikey|auth|access[-_]?key)[=\s]+)(\S+)/gi;
+const BEARER_PATTERN = /\bBearer\s+\S+/gi;
+const ENV_ASSIGNMENT_PATTERN =
+  /\b([A-Z0-9_]*(?:PASSWORD|SECRET|TOKEN|API_?KEY|ACCESS_?KEY)[A-Z0-9_]*)=(\S+)/g;
+
+export function sanitizeCmdline(cmdline: string): string {
+  return cmdline
+    .replace(SECRET_FLAG_PATTERN, "$1[REDACTED]")
+    .replace(BEARER_PATTERN, "Bearer [REDACTED]")
+    .replace(ENV_ASSIGNMENT_PATTERN, "$1=[REDACTED]");
+}

package/packages/core/src/index.ts

@@ -11,3 +11,7 @@ export {
   type LoadedConfigPaths,
 } from "./configLoader.js";
 export type { KnownPortsConfig, KnownPortsIndex } from "./knownPorts/lookup.js";
+export { explainPort, type ExplainDeps } from "./ai/explain.js";
+export { AiProviderError } from "./ai/provider.js";
+export { sanitizeCmdline } from "./ai/sanitize.js";
+export { buildExplainPayload } from "./ai/allowlist.js";

package/packages/core/tests/aiCache.test.ts

@@ -0,0 +1,38 @@
+import { describe, expect, it, afterEach } from "vitest";
+import { mkdtempSync, rmSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { AiExplanationCache } from "../src/ai/cache.js";
+
+let tmpDir: string | null = null;
+afterEach(() => {
+  if (tmpDir) rmSync(tmpDir, { recursive: true, force: true });
+  tmpDir = null;
+});
+
+describe("AiExplanationCache", () => {
+  it("returns null for a key that was never set", () => {
+    tmpDir = mkdtempSync(path.join(os.tmpdir(), "portmind-ai-cache-"));
+    const cache = new AiExplanationCache(path.join(tmpDir, "test.db"));
+    expect(cache.get("node", 3000)).toBeNull();
+    cache.close();
+  });
+
+  it("stores and retrieves an explanation keyed by (process_name, port)", () => {
+    tmpDir = mkdtempSync(path.join(os.tmpdir(), "portmind-ai-cache-"));
+    const cache = new AiExplanationCache(path.join(tmpDir, "test.db"));
+    cache.set("postgres", 5432, "This is a PostgreSQL database.");
+    expect(cache.get("postgres", 5432)).toBe("This is a PostgreSQL database.");
+    expect(cache.get("postgres", 9999)).toBeNull();
+    cache.close();
+  });
+
+  it("overwrites an existing entry for the same key", () => {
+    tmpDir = mkdtempSync(path.join(os.tmpdir(), "portmind-ai-cache-"));
+    const cache = new AiExplanationCache(path.join(tmpDir, "test.db"));
+    cache.set("node", 3000, "First explanation.");
+    cache.set("node", 3000, "Updated explanation.");
+    expect(cache.get("node", 3000)).toBe("Updated explanation.");
+    cache.close();
+  });
+});

package/packages/core/tests/allowlist.test.ts

@@ -0,0 +1,63 @@
+import { describe, expect, it } from "vitest";
+import { buildExplainPayload } from "../src/ai/allowlist.js";
+import type { PortEntry } from "../src/types.js";
+
+function makeEntry(overrides: Partial<PortEntry> = {}): PortEntry {
+  return {
+    host: "localhost",
+    port: 3000,
+    protocol: "tcp",
+    bindAddress: "127.0.0.1",
+    pid: 123,
+    processName: "node",
+    cmdline: "node server.js --token secret123",
+    cwd: "/Users/dev/app",
+    startedAt: null,
+    docker: { containerId: "abc", containerName: "my-app", image: "node:22" },
+    knownService: null,
+    history: { usual: true, observationCount: 1, firstSeen: null, usualOccupant: null },
+    riskFlags: [],
+    aiExplanation: null,
+    ...overrides,
+  };
+}
+
+describe("buildExplainPayload", () => {
+  it("only includes fields named in fieldsSent", () => {
+    const payload = buildExplainPayload(makeEntry(), ["port", "process_name"]);
+    expect(Object.keys(payload).sort()).toEqual(["port", "process_name"]);
+  });
+
+  it("never includes cwd, host, pid, or riskFlags even if entry has them", () => {
+    const payload = buildExplainPayload(makeEntry(), [
+      "process_name",
+      "cmdline",
+      "port",
+      "protocol",
+      "docker_image",
+    ]);
+    expect(payload).not.toHaveProperty("cwd");
+    expect(payload).not.toHaveProperty("host");
+    expect(payload).not.toHaveProperty("pid");
+    expect(payload).not.toHaveProperty("riskFlags");
+  });
+
+  it("sanitizes cmdline before including it", () => {
+    const payload = buildExplainPayload(makeEntry(), ["cmdline"]);
+    expect(payload.cmdline).toBe("node server.js --token [REDACTED]");
+  });
+
+  it("extracts docker_image from the docker object, not the whole object", () => {
+    const payload = buildExplainPayload(makeEntry(), ["docker_image"]);
+    expect(payload.docker_image).toBe("node:22");
+  });
+
+  it("returns null for docker_image when not docker-backed", () => {
+    const payload = buildExplainPayload(makeEntry({ docker: null }), ["docker_image"]);
+    expect(payload.docker_image).toBeNull();
+  });
+
+  it("returns an empty object for an empty fieldsSent list", () => {
+    expect(buildExplainPayload(makeEntry(), [])).toEqual({});
+  });
+});

package/packages/core/tests/explain.test.ts

@@ -0,0 +1,119 @@
+import { describe, expect, it, afterEach } from "vitest";
+import { mkdtempSync, rmSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { explainPort } from "../src/ai/explain.js";
+import { AiExplanationCache } from "../src/ai/cache.js";
+import { ConfigError } from "../src/configLoader.js";
+import { DEFAULT_CONFIG } from "../src/config.js";
+import type { PortEntry } from "../src/types.js";
+
+function makeEntry(overrides: Partial<PortEntry> = {}): PortEntry {
+  return {
+    host: "localhost",
+    port: 5432,
+    protocol: "tcp",
+    bindAddress: "127.0.0.1",
+    pid: 1,
+    processName: "postgres",
+    cmdline: "postgres -D /data",
+    cwd: "/data",
+    startedAt: null,
+    docker: null,
+    knownService: null,
+    history: { usual: true, observationCount: 1, firstSeen: null, usualOccupant: null },
+    riskFlags: [],
+    aiExplanation: null,
+    ...overrides,
+  };
+}
+
+let tmpDir: string | null = null;
+afterEach(() => {
+  if (tmpDir) rmSync(tmpDir, { recursive: true, force: true });
+  tmpDir = null;
+});
+
+function tmpDbPath(): string {
+  tmpDir = mkdtempSync(path.join(os.tmpdir(), "portmind-explain-"));
+  return path.join(tmpDir, "test.db");
+}
+
+describe("explainPort", () => {
+  it("throws ConfigError when ai.enabled is false", async () => {
+    const config = { ...DEFAULT_CONFIG, ai: { ...DEFAULT_CONFIG.ai, enabled: false } };
+    await expect(explainPort(makeEntry(), config)).rejects.toThrow(ConfigError);
+  });
+
+  it("throws ConfigError when provider is none", async () => {
+    const config = { ...DEFAULT_CONFIG, ai: { ...DEFAULT_CONFIG.ai, enabled: true, provider: "none" as const } };
+    await expect(explainPort(makeEntry(), config)).rejects.toThrow(ConfigError);
+  });
+
+  it("throws ConfigError when the API key env var is missing", async () => {
+    const dbPath = tmpDbPath();
+    const config = {
+      ...DEFAULT_CONFIG,
+      ai: { ...DEFAULT_CONFIG.ai, enabled: true, provider: "anthropic" as const },
+      history: { ...DEFAULT_CONFIG.history, dbPath },
+    };
+    await expect(explainPort(makeEntry(), config, { env: {} })).rejects.toThrow(/ANTHROPIC_API_KEY/);
+  });
+
+  it("returns a cached explanation without calling fetch", async () => {
+    const dbPath = tmpDbPath();
+    const cache = new AiExplanationCache(dbPath);
+    cache.set("postgres", 5432, "Cached explanation.");
+
+    const config = {
+      ...DEFAULT_CONFIG,
+      ai: { ...DEFAULT_CONFIG.ai, enabled: true, provider: "anthropic" as const },
+      history: { ...DEFAULT_CONFIG.history, dbPath },
+    };
+
+    let fetchCalled = false;
+    const fetchImpl = async () => {
+      fetchCalled = true;
+      throw new Error("should not be called");
+    };
+
+    const result = await explainPort(makeEntry(), config, {
+      cache,
+      fetchImpl: fetchImpl as unknown as typeof fetch,
+      env: { ANTHROPIC_API_KEY: "test-key" },
+    });
+
+    expect(result).toBe("Cached explanation.");
+    expect(fetchCalled).toBe(false);
+    cache.close();
+  });
+
+  it("calls the provider and caches the result on a cache miss", async () => {
+    const dbPath = tmpDbPath();
+    const cache = new AiExplanationCache(dbPath);
+
+    const config = {
+      ...DEFAULT_CONFIG,
+      ai: { ...DEFAULT_CONFIG.ai, enabled: true, provider: "anthropic" as const },
+      history: { ...DEFAULT_CONFIG.history, dbPath },
+    };
+
+    const fetchImpl = async () =>
+      ({
+        ok: true,
+        status: 200,
+        json: async () => ({ content: [{ type: "text", text: "It is a database." }] }),
+        text: async () => "",
+      }) as Response;
+
+    const result = await explainPort(makeEntry(), config, {
+      cache,
+      fetchImpl,
+      env: { ANTHROPIC_API_KEY: "test-key" },
+    });
+
+    expect(result).toBe("It is a database.");
+    expect(cache.get("postgres", 5432)).toBe("It is a database.");
+    cache.close();
+  });
+});

package/packages/core/tests/provider.test.ts

@@ -0,0 +1,72 @@
+import { describe, expect, it, vi } from "vitest";
+import { createAnthropicProvider, createOpenAiProvider, AiProviderError } from "../src/ai/provider.js";
+
+function jsonResponse(body: unknown, ok = true, status = 200): Response {
+  return {
+    ok,
+    status,
+    json: async () => body,
+    text: async () => JSON.stringify(body),
+  } as Response;
+}
+
+describe("createAnthropicProvider", () => {
+  it("sends the documented Anthropic Messages API request shape", async () => {
+    const fetchMock = vi.fn().mockResolvedValue(
+      jsonResponse({ content: [{ type: "text", text: "This is postgres, a database." }] }),
+    );
+    const provider = createAnthropicProvider(fetchMock);
+
+    const result = await provider.explain({ port: 5432 }, "test-key", "claude-sonnet-4-6");
+
+    expect(result).toBe("This is postgres, a database.");
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    const [url, init] = fetchMock.mock.calls[0] as [string, RequestInit];
+    expect(url).toBe("https://api.anthropic.com/v1/messages");
+    expect(init.method).toBe("POST");
+    const headers = init.headers as Record<string, string>;
+    expect(headers["x-api-key"]).toBe("test-key");
+    expect(headers["anthropic-version"]).toBe("2023-06-01");
+    const body = JSON.parse(init.body as string);
+    expect(body.model).toBe("claude-sonnet-4-6");
+    expect(body.messages[0].role).toBe("user");
+    expect(body.messages[0].content).toContain('"port": 5432');
+  });
+
+  it("throws AiProviderError on a non-ok response", async () => {
+    const fetchMock = vi.fn().mockResolvedValue(jsonResponse({ error: "bad key" }, false, 401));
+    const provider = createAnthropicProvider(fetchMock);
+    await expect(provider.explain({}, "bad-key", "claude-sonnet-4-6")).rejects.toThrow(AiProviderError);
+  });
+
+  it("throws AiProviderError when the response has no text content", async () => {
+    const fetchMock = vi.fn().mockResolvedValue(jsonResponse({ content: [] }));
+    const provider = createAnthropicProvider(fetchMock);
+    await expect(provider.explain({}, "key", "model")).rejects.toThrow(AiProviderError);
+  });
+});
+
+describe("createOpenAiProvider", () => {
+  it("sends the documented OpenAI Chat Completions request shape", async () => {
+    const fetchMock = vi.fn().mockResolvedValue(
+      jsonResponse({ choices: [{ message: { content: "This is mysql." } }] }),
+    );
+    const provider = createOpenAiProvider(fetchMock);
+
+    const result = await provider.explain({ port: 3306 }, "test-key", "gpt-4o");
+
+    expect(result).toBe("This is mysql.");
+    const [url, init] = fetchMock.mock.calls[0] as [string, RequestInit];
+    expect(url).toBe("https://api.openai.com/v1/chat/completions");
+    const headers = init.headers as Record<string, string>;
+    expect(headers.authorization).toBe("Bearer test-key");
+    const body = JSON.parse(init.body as string);
+    expect(body.model).toBe("gpt-4o");
+  });
+
+  it("throws AiProviderError on a non-ok response", async () => {
+    const fetchMock = vi.fn().mockResolvedValue(jsonResponse({}, false, 500));
+    const provider = createOpenAiProvider(fetchMock);
+    await expect(provider.explain({}, "key", "gpt-4o")).rejects.toThrow(AiProviderError);
+  });
+});

package/packages/core/tests/sanitize.test.ts

@@ -0,0 +1,25 @@
+import { describe, expect, it } from "vitest";
+import { sanitizeCmdline } from "../src/ai/sanitize.js";
+
+describe("sanitizeCmdline", () => {
+  it("redacts --password=X style flags", () => {
+    expect(sanitizeCmdline("mysqld --password=hunter2")).toBe("mysqld --password=[REDACTED]");
+  });
+
+  it("redacts --token flags with a space separator", () => {
+    expect(sanitizeCmdline("mycli --token abc123xyz")).toBe("mycli --token [REDACTED]");
+  });
+
+  it("redacts Bearer tokens", () => {
+    expect(sanitizeCmdline("curl -H Authorization:Bearer sk-abc123")).toContain("Bearer [REDACTED]");
+  });
+
+  it("redacts SECRET/TOKEN/KEY environment-style assignments", () => {
+    expect(sanitizeCmdline("node server.js API_KEY=sk-live-abc123")).toBe("node server.js API_KEY=[REDACTED]");
+  });
+
+  it("leaves ordinary command lines untouched", () => {
+    const cmd = "node server.js --port 3000 --host 0.0.0.0";
+    expect(sanitizeCmdline(cmd)).toBe(cmd);
+  });
+});

package/packages/web/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@portmind/web",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Local-only web dashboard for portmind - static HTML/JS over @portmind/core's /api/ports.",
   "homepage": "https://github.com/psandis/portmind#readme",
   "bugs": "https://github.com/psandis/portmind/issues",

package/packages/web/src/server.ts

@@ -2,7 +2,7 @@ import { createServer as createHttpServer, type Server } from "node:http";
 import { readFile } from "node:fs/promises";
 import { fileURLToPath } from "node:url";
 import path from "node:path";
-import { scanPorts, loadConfig } from "@portmind/core";
+import { scanPorts, loadConfig, explainPort, ConfigError, type PortEntry } from "@portmind/core";
 
 const packageRoot = path.join(path.dirname(fileURLToPath(import.meta.url)), "..");
 const indexHtmlPath = path.join(packageRoot, "static", "index.html");
@@ -15,9 +15,11 @@ export interface WebServerOptions {
 
 /**
  * Local-only dashboard server. Binds to 127.0.0.1 by default (per spec:
- * "no external network exposure by default"). Only two routes: the static
- * page, and a JSON API that returns the same PortEntry[] shape as
- * `portmind list --json`.
+ * "no external network exposure by default"). Three routes: the static
+ * page, a JSON API returning the same PortEntry[] shape as
+ * `portmind list --json`, and an AI explain endpoint that only ever fires
+ * on an explicit client request (the page's "Explain with AI" button),
+ * never automatically.
  */
 export function createWebServer(options: WebServerOptions): Server {
   const host = options.host ?? "127.0.0.1";
@@ -34,6 +36,21 @@ export function createWebServer(options: WebServerOptions): Server {
         return;
       }
 
+      if (req.method === "POST" && url.pathname === "/api/explain") {
+        const entry = (await readJsonBody(req)) as PortEntry;
+        const config = await loadConfig();
+        try {
+          const explanation = await explainPort(entry, config);
+          res.writeHead(200, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ explanation }));
+        } catch (error) {
+          const status = error instanceof ConfigError ? 400 : 502;
+          res.writeHead(status, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ error: (error as Error).message }));
+        }
+        return;
+      }
+
       if (req.method === "GET" && (url.pathname === "/" || url.pathname === "/index.html")) {
         const html = await readFile(indexHtmlPath, "utf-8");
         res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
@@ -49,3 +66,20 @@ export function createWebServer(options: WebServerOptions): Server {
     }
   }).listen(options.port, host);
 }
+
+function readJsonBody(req: import("node:http").IncomingMessage): Promise<unknown> {
+  return new Promise((resolve, reject) => {
+    let data = "";
+    req.on("data", (chunk) => {
+      data += chunk;
+    });
+    req.on("end", () => {
+      try {
+        resolve(JSON.parse(data));
+      } catch (error) {
+        reject(error);
+      }
+    });
+    req.on("error", reject);
+  });
+}

package/packages/web/static/index.html

@@ -37,16 +37,24 @@
     background: var(--bg);
     color: var(--fg);
     font: 14px/1.5 -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
-    padding: 24px;
+    padding: 0 24px 24px;
   }
   h1 { font-size: 18px; margin: 0 0 4px; }
-  .sub { color: var(--muted); margin: 0 0 20px; font-size: 13px; }
+  .sub { color: var(--muted); margin: 0 0 12px; font-size: 13px; }
+  .sticky-header {
+    position: sticky;
+    top: 0;
+    z-index: 20;
+    background: var(--bg);
+    padding-top: 20px;
+    padding-bottom: 12px;
+    border-bottom: 1px solid var(--border);
+  }
   .toolbar {
     display: flex;
     gap: 12px;
     align-items: center;
     flex-wrap: wrap;
-    margin-bottom: 16px;
   }
   .toolbar input[type="text"] {
     padding: 6px 10px;
@@ -77,38 +85,71 @@
   button:hover { background: var(--row-hover); }
   table { width: 100%; border-collapse: collapse; font-size: 13px; }
   th, td { text-align: left; padding: 8px 10px; border-bottom: 1px solid var(--border); }
-  th { color: var(--muted); font-weight: 600; cursor: pointer; user-select: none; white-space: nowrap; }
+  th {
+    position: sticky;
+    top: var(--sticky-header-h, 84px);
+    z-index: 15;
+    background: var(--bg);
+    color: var(--muted);
+    font-weight: 600;
+    cursor: pointer;
+    user-select: none;
+    white-space: nowrap;
+    box-shadow: 0 1px 0 var(--border);
+  }
   th:hover { color: var(--fg); }
   tbody tr { cursor: pointer; }
   tbody tr:hover { background: var(--row-hover); }
   .mono { font-family: var(--mono); }
   .unusual { color: var(--danger); font-weight: 600; }
   .empty { color: var(--muted); padding: 24px 0; text-align: center; }
+  .overlay {
+    display: none;
+    position: fixed;
+    inset: 0;
+    background: rgba(0, 0, 0, 0.35);
+    z-index: 90;
+  }
+  .overlay.open { display: block; }
   .detail {
-    margin-top: 16px;
-    padding: 16px;
-    border: 1px solid var(--border);
-    border-radius: 8px;
-    background: var(--panel-bg);
     display: none;
+    position: fixed;
+    top: 0;
+    right: 0;
+    bottom: 0;
+    width: min(420px, 100vw);
+    padding: 20px;
+    border-left: 1px solid var(--border);
+    background: var(--panel-bg);
+    z-index: 91;
+    overflow-y: auto;
+    box-shadow: -8px 0 24px rgba(0, 0, 0, 0.15);
   }
   .detail.open { display: block; }
-  .detail dl { display: grid; grid-template-columns: 140px 1fr; gap: 6px 12px; margin: 0; }
+  .detail-close {
+    position: absolute;
+    top: 12px;
+    right: 12px;
+  }
+  .detail h2 { font-size: 15px; margin: 0 0 16px; padding-right: 32px; }
+  .detail dl { display: grid; grid-template-columns: 120px 1fr; gap: 8px 12px; margin: 0; }
   .detail dt { color: var(--muted); }
   .detail dd { margin: 0; word-break: break-all; }
   .status { font-size: 12px; color: var(--muted); margin-top: 12px; }
 </style>
 </head>
 <body>
-  <h1>portmind</h1>
-  <p class="sub">Listening ports on <span id="host">localhost</span></p>
+  <div class="sticky-header" id="stickyHeader">
+    <h1>portmind</h1>
+    <p class="sub">Listening ports on <span id="host">localhost</span></p>
 
-  <div class="toolbar">
-    <button id="refresh">Refresh</button>
-    <label><input type="checkbox" id="autoRefresh" /> Auto-refresh (5s)</label>
-    <input type="text" id="rangeFilter" placeholder="Range e.g. 3000-9000" />
-    <label><input type="checkbox" id="dockerOnly" /> Docker only</label>
-    <label><input type="checkbox" id="unusualOnly" /> Unusual only</label>
+    <div class="toolbar">
+      <button id="refresh">Refresh</button>
+      <label><input type="checkbox" id="autoRefresh" /> Auto-refresh (5s)</label>
+      <input type="text" id="rangeFilter" placeholder="Range e.g. 3000-9000" />
+      <label><input type="checkbox" id="dockerOnly" /> Docker only</label>
+      <label><input type="checkbox" id="unusualOnly" /> Unusual only</label>
+    </div>
   </div>
 
   <table>
@@ -120,13 +161,14 @@
         <th data-key="pid">PID</th>
         <th data-key="docker">DOCKER</th>
         <th data-key="usual">USUAL</th>
-        <th data-key="note">NOTE</th>
+        <th data-key="note">DESCRIPTION</th>
       </tr>
     </thead>
     <tbody id="rows"></tbody>
   </table>
   <div id="empty" class="empty" hidden>No listening ports found.</div>
 
+  <div id="overlay" class="overlay"></div>
   <div id="detail" class="detail"></div>
   <div class="status" id="status"></div>
 
@@ -136,6 +178,7 @@
   var rowsEl = document.getElementById("rows");
   var emptyEl = document.getElementById("empty");
   var detailEl = document.getElementById("detail");
+  var overlayEl = document.getElementById("overlay");
   var statusEl = document.getElementById("status");
   var autoRefreshTimer = null;
 
@@ -201,8 +244,11 @@
   function showDetail(entry) {
     state.selected = entry;
     detailEl.classList.add("open");
+    overlayEl.classList.add("open");
     var explainBtn = "<button id='explainBtn'>Explain with AI</button>";
     detailEl.innerHTML =
+      "<button class='detail-close' id='detailClose'>Close</button>" +
+      "<h2>Port " + entry.port + "/" + entry.protocol + "</h2>" +
       "<dl>" +
       "<dt>Host</dt><dd>" + entry.host + "</dd>" +
       "<dt>Port</dt><dd>" + entry.port + "/" + entry.protocol + "</dd>" +
@@ -212,17 +258,45 @@
       "<dt>Working dir</dt><dd>" + (entry.cwd || "-") + "</dd>" +
       "<dt>Started</dt><dd>" + (entry.startedAt || "-") + "</dd>" +
       "<dt>Docker</dt><dd>" + (entry.docker ? entry.docker.containerName + " (" + entry.docker.image + ")" : "-") + "</dd>" +
-      "<dt>Known service</dt><dd>" + (entry.knownService ? entry.knownService.name + " - " + entry.knownService.description : "-") + "</dd>" +
+      "<dt>Service name</dt><dd>" + (entry.knownService ? entry.knownService.name : "-") + "</dd>" +
+      "<dt>Description</dt><dd>" + (entry.knownService ? entry.knownService.description : "-") + "</dd>" +
       "<dt>Risk flags</dt><dd>" + (entry.riskFlags.length ? entry.riskFlags.join(", ") : "none") + "</dd>" +
-      "<dt>AI explanation</dt><dd>" + (entry.aiExplanation || "not run - " + explainBtn) + "</dd>" +
+      "<dt>AI explanation</dt><dd id='aiExplanation'>" + (entry.aiExplanation || explainBtn) +
+      " <span id='aiError' style='color:var(--danger)'></span></dd>" +
       "</dl>";
     var btn = document.getElementById("explainBtn");
     if (btn) {
       btn.addEventListener("click", function () {
         btn.disabled = true;
-        btn.textContent = "AI explain is not implemented yet";
+        btn.textContent = "Asking AI...";
+        fetch("/api/explain", {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify(entry),
+        })
+          .then(function (r) {
+            return r.json().then(function (body) {
+              if (!r.ok) throw new Error(body.error || "request failed");
+              return body;
+            });
+          })
+          .then(function (body) {
+            btn.replaceWith(document.createTextNode(body.explanation));
+          })
+          .catch(function (err) {
+            btn.disabled = false;
+            btn.textContent = "Explain with AI";
+            document.getElementById("aiError").textContent = err.message;
+          });
       });
     }
+    document.getElementById("detailClose").addEventListener("click", closeDetail);
+  }
+
+  function closeDetail() {
+    detailEl.classList.remove("open");
+    overlayEl.classList.remove("open");
+    state.selected = null;
   }
 
   function load() {
@@ -261,6 +335,18 @@
     }
   });
 
+  overlayEl.addEventListener("click", closeDetail);
+  document.addEventListener("keydown", function (e) {
+    if (e.key === "Escape") closeDetail();
+  });
+
+  function updateStickyOffset() {
+    var header = document.getElementById("stickyHeader");
+    document.documentElement.style.setProperty("--sticky-header-h", header.offsetHeight + "px");
+  }
+  window.addEventListener("resize", updateStickyOffset);
+  updateStickyOffset();
+
   load();
 })();
 </script>

package/packages/web/tests/server.test.ts

@@ -34,4 +34,15 @@ describe("web server", () => {
     const res = await fetch(`${BASE_URL}/nope`);
     expect(res.status).toBe(404);
   });
+
+  it("POST /api/explain returns 400 when AI is disabled (the default)", async () => {
+    const res = await fetch(`${BASE_URL}/api/explain`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ port: 3000, processName: "node", protocol: "tcp" }),
+    });
+    expect(res.status).toBe(400);
+    const body = await res.json();
+    expect(body.error).toMatch(/AI is disabled/);
+  });
 });