propr-cli 0.8.3 → 0.8.5

package/dist/tui/SetupApp.test.js

@@ -0,0 +1,172 @@
+/**
+ * Tests for the setup prompt bridge. Run with:
+ * `npx tsx --test src/tui/SetupApp.test.tsx` (from packages/cli). These exercise
+ * the bridge and the engine→bridge prompt mapping without rendering Ink — the
+ * React component is driven by the same events these assert on.
+ */
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import { SetupBridge, SetupCancelledError, buildSetupPrompts } from "./SetupApp.js";
+/** Subscribe and capture every event the bridge emits. */
+function capture(bridge) {
+    const prompts = [];
+    bridge.subscribe((event) => {
+        if (event.type === "prompt")
+            prompts.push(event.prompt);
+    });
+    return prompts;
+}
+test("confirm resolves with the chosen boolean", async () => {
+    const bridge = new SetupBridge();
+    const prompts = capture(bridge);
+    const answer = bridge.confirm({ title: "Start?", defaultValue: true });
+    assert.equal(prompts.length, 1);
+    assert.equal(prompts[0].kind, "confirm");
+    bridge.resolve(prompts[0].id, false);
+    assert.equal(await answer, false);
+});
+test("input resolves with the entered text", async () => {
+    const bridge = new SetupBridge();
+    const prompts = capture(bridge);
+    const answer = bridge.input({ title: "Root", defaultValue: "/x" });
+    bridge.resolve(prompts[0].id, "/custom");
+    assert.equal(await answer, "/custom");
+});
+test("select returns the chosen option value", async () => {
+    const bridge = new SetupBridge();
+    const prompts = capture(bridge);
+    const answer = bridge.select({
+        title: "Auth",
+        options: [
+            { label: "Keep", value: "keep" },
+            { label: "App", value: "app" },
+        ],
+    });
+    bridge.resolve(prompts[0].id, "app");
+    assert.equal(await answer, "app");
+});
+test("multiSelect returns the chosen values", async () => {
+    const bridge = new SetupBridge();
+    const prompts = capture(bridge);
+    const answer = bridge.multiSelect({
+        title: "Agents",
+        options: [
+            { label: "claude", value: "claude" },
+            { label: "codex", value: "codex" },
+        ],
+    });
+    bridge.resolve(prompts[0].id, ["claude"]);
+    assert.deepEqual(await answer, ["claude"]);
+});
+test("cancel rejects the in-flight prompt and all later ones", async () => {
+    const bridge = new SetupBridge();
+    capture(bridge);
+    const pending = bridge.confirm({ title: "Start?" });
+    bridge.cancel();
+    await assert.rejects(pending, (error) => error instanceof SetupCancelledError);
+    // A prompt requested after cancellation rejects immediately.
+    await assert.rejects(bridge.input({ title: "Root" }), (error) => error instanceof SetupCancelledError);
+});
+test("late subscribers still receive earlier events via history replay", async () => {
+    const bridge = new SetupBridge();
+    const answer = bridge.confirm({ title: "Start?" });
+    // Subscribe only after the prompt was emitted.
+    const prompts = capture(bridge);
+    assert.equal(prompts.length, 1, "history replay delivers the prompt to a late subscriber");
+    bridge.resolve(prompts[0].id, true);
+    assert.equal(await answer, true);
+});
+test("buildSetupPrompts maps agent selection to a multi-choice prompt", async () => {
+    const bridge = new SetupBridge();
+    const prompts = capture(bridge);
+    const hooks = buildSetupPrompts(bridge);
+    const chosen = hooks.selectAgents({ available: ["claude", "codex"], detected: ["claude"] });
+    assert.equal(prompts[0].kind, "multi");
+    if (prompts[0].kind === "multi") {
+        assert.deepEqual(prompts[0].defaultSelected, ["claude"]);
+        assert.equal(prompts[0].options.find((o) => o.value === "claude")?.hint, "detected");
+    }
+    bridge.resolve(prompts[0].id, ["claude", "codex"]);
+    assert.deepEqual(await chosen, ["claude", "codex"]);
+});
+test("buildSetupPrompts keeps existing GitHub auth when 'keep' is chosen", async () => {
+    const bridge = new SetupBridge();
+    const prompts = capture(bridge);
+    const hooks = buildSetupPrompts(bridge);
+    const current = { mode: "app", warnings: [] };
+    const decision = hooks.configureGithubAuth({ current });
+    assert.equal(prompts[0].kind, "select");
+    bridge.resolve(prompts[0].id, "keep");
+    assert.deepEqual(await decision, { keep: true });
+});
+test("buildSetupPrompts collects GitHub App vars across chained inputs", async () => {
+    const bridge = new SetupBridge();
+    const seen = [];
+    bridge.subscribe((event) => {
+        if (event.type === "prompt") {
+            seen.push(event.prompt);
+            // Answer each prompt as it arrives so the chained hook can proceed.
+            const prompt = event.prompt;
+            queueMicrotask(() => {
+                if (prompt.kind === "select")
+                    bridge.resolve(prompt.id, "app");
+                else if (prompt.kind === "input")
+                    bridge.resolve(prompt.id, `val-${prompt.title.length}`);
+            });
+        }
+    });
+    const hooks = buildSetupPrompts(bridge);
+    const decision = await hooks.configureGithubAuth({ current: { mode: "none", warnings: [] } });
+    assert.equal(decision.mode, "app");
+    assert.equal(decision.vars?.GH_AUTH_MODE, "app");
+    assert.ok(decision.vars?.GH_APP_ID);
+    assert.ok(decision.vars?.HOST_GH_PRIVATE_KEY);
+    assert.ok(decision.vars?.GH_INSTALLATION_ID);
+});
+test("buildSetupPrompts maps intake selection and chains a masked webhook secret", async () => {
+    const bridge = new SetupBridge();
+    const seen = [];
+    bridge.subscribe((event) => {
+        if (event.type === "prompt") {
+            seen.push(event.prompt);
+            const prompt = event.prompt;
+            queueMicrotask(() => {
+                if (prompt.kind === "select")
+                    bridge.resolve(prompt.id, "direct_webhook");
+                else if (prompt.kind === "input")
+                    bridge.resolve(prompt.id, "hook-secret");
+            });
+        }
+    });
+    const hooks = buildSetupPrompts(bridge);
+    const decision = await hooks.configureIntake({ authMode: "app", defaultMode: "polling", currentMode: "polling" });
+    assert.deepEqual(decision, { mode: "direct_webhook", webhookSecret: "hook-secret" });
+    assert.equal(seen[0].kind, "select", "the intake mode is a single-choice prompt");
+    const secretPrompt = seen.find((p) => p.kind === "input");
+    assert.equal(secretPrompt?.kind === "input" && secretPrompt.mask, true, "the secret input is masked");
+});
+test("buildSetupPrompts keeps the current intake when 'keep' is chosen", async () => {
+    const bridge = new SetupBridge();
+    const prompts = capture(bridge);
+    const hooks = buildSetupPrompts(bridge);
+    const decision = hooks.configureIntake({ authMode: "none", defaultMode: "polling", currentMode: "direct_webhook" });
+    assert.equal(prompts[0].kind, "select");
+    bridge.resolve(prompts[0].id, "keep");
+    assert.deepEqual(await decision, { keep: true });
+});
+test("buildSetupPrompts skips the whitelist prompt in demo mode", async () => {
+    const bridge = new SetupBridge();
+    const prompts = capture(bridge);
+    const hooks = buildSetupPrompts(bridge);
+    const result = await hooks.configureWhitelist({ current: [], demoMode: true });
+    assert.equal(result, null);
+    assert.equal(prompts.length, 0, "demo mode needs no whitelist input");
+});
+test("buildSetupPrompts parses a comma-separated whitelist", async () => {
+    const bridge = new SetupBridge();
+    const prompts = capture(bridge);
+    const hooks = buildSetupPrompts(bridge);
+    const result = hooks.configureWhitelist({ current: ["alice"], demoMode: false });
+    bridge.resolve(prompts[0].id, " alice, bob ,, carol ");
+    assert.deepEqual(await result, ["alice", "bob", "carol"]);
+});

package/dist/tui/app.js

@@ -1,9 +1,93 @@
 import { jsx as _jsx } from "react/jsx-runtime";
 import { render } from "ink";
 import { StartApp } from "./StartApp.js";
+import { CheckApp, CheckHub } from "./CheckApp.js";
+import { AgentTableApp, AgentTableHub } from "./AgentTableApp.js";
+import { SetupApp, SetupBridge, buildSetupPrompts } from "./SetupApp.js";
+import { runChecks } from "../commands/checkCommands.js";
+import { validateAgents, agentTypesFor } from "../commands/agentValidation.js";
+import { runSetup } from "../commands/setup/engine.js";
 export async function renderDashboard(props) {
     const result = { outcome: "background" };
     const instance = render(_jsx(StartApp, { orch: props.orch, cfg: props.cfg, configManager: props.configManager, onResult: (o) => { result.outcome = o; } }), { exitOnCtrlC: false });
     await instance.waitUntilExit();
     return result.outcome;
 }
+/**
+ * Render a single live check pass in an interactive terminal. The check engine
+ * streams results into the Ink view (spinners while slow checks run); with
+ * `fix`, the view ends in an arrow-key remediation menu. Resolves with the
+ * finished outcome and the remediation key the user selected (if any) so the
+ * caller can run that action outside the Ink tree.
+ */
+export async function renderLiveChecks(runOptions, opts) {
+    const hub = new CheckHub();
+    let selectedKey;
+    let cancelled = false;
+    const instance = render(_jsx(CheckApp, { hub: hub, fix: Boolean(opts.fix), getActions: opts.getActions, onSelect: (key) => { selectedKey = key; }, onCancel: () => { cancelled = true; }, showAgentValidationHint: Boolean(opts.showAgentValidationHint) }), { exitOnCtrlC: false });
+    let engineError;
+    const outcomePromise = runChecks({
+        ...runOptions,
+        onPending: (slot) => hub.emit({ type: "pending", slot }),
+        onResult: (result) => hub.emit({ type: "result", result }),
+    })
+        .then((outcome) => {
+        hub.emit({ type: "done", outcome });
+        return outcome;
+    })
+        .catch((error) => {
+        engineError = error;
+        hub.emit({ type: "error", error });
+        return undefined;
+    });
+    await instance.waitUntilExit();
+    if (cancelled)
+        return { outcome: undefined, selectedKey: undefined };
+    const outcome = await outcomePromise;
+    if (engineError)
+        throw engineError;
+    return { outcome, selectedKey };
+}
+/**
+ * Render the agent validation as a live table: rows appear immediately with
+ * spinners and each cell fills in as its check resolves. Returns the finished
+ * rows so the caller can print the raw responses below.
+ */
+export async function renderAgentValidation(orch, cfg, agentsFilter) {
+    const hub = new AgentTableHub();
+    const instance = render(_jsx(AgentTableApp, { agents: agentTypesFor(agentsFilter, cfg), hub: hub }), { exitOnCtrlC: false });
+    const rows = await validateAgents(orch, cfg, {
+        agents: agentsFilter,
+        onUpdate: (agent, update) => hub.emit({ type: "update", agent, update }),
+    });
+    hub.emit({ type: "done" });
+    await instance.waitUntilExit();
+    return rows;
+}
+/**
+ * Run `propr setup` interactively. The setup engine is UI-agnostic: it streams
+ * state through a reporter and collects decisions through prompt hooks. Here we
+ * bridge both to an Ink view ({@link SetupApp}) — the step list updates live as
+ * the engine emits state, and the engine's prompt hooks render confirm / input /
+ * single-choice / multi-choice prompts the user drives with the keyboard.
+ *
+ * Resolves with the final {@link SetupRunResult} once the engine finishes (and
+ * the view has painted its last frame). On Ctrl-C the view cancels any in-flight
+ * prompt — which unwinds the engine so `runSetup` still resolves — and exits the
+ * Ink session, so nothing is left running. Callers should use
+ * `result.completed` to decide what to print afterwards.
+ */
+export async function renderSetupWizard(options = {}) {
+    const bridge = new SetupBridge();
+    const instance = render(_jsx(SetupApp, { bridge: bridge }), { exitOnCtrlC: false });
+    const reporter = {
+        onState: (state) => bridge.emitState(state),
+        onLog: (line) => bridge.emitLog(line),
+    };
+    // runSetup never throws for cancellation: a cancelled prompt rejects, the
+    // engine catches it, settles the step, and returns its (incomplete) state.
+    const result = await runSetup({ ...options, prompts: buildSetupPrompts(bridge), reporter });
+    bridge.finish(result.state);
+    await instance.waitUntilExit();
+    return result;
+}

package/dist/tui/render.js

@@ -6,7 +6,8 @@
  * In all cases the containers run detached, so the stack outlives this process.
  */
 import { getHostConfig } from "../orchestrator/index.js";
-import { renderStatusTable } from "../orchestrator/format.js";
+import { renderStatusTable, renderTunnelEndpointSummary } from "../orchestrator/format.js";
+import { ensureVibePromptCacheDir } from "../commands/initStack.js";
 import { createInterface } from "node:readline/promises";
 async function confirmRestart() {
     if (!process.stdin.isTTY || !process.stdout.isTTY)
@@ -26,6 +27,16 @@ export async function runStart(configManager, options) {
         console.error("Error: cannot reach the Docker daemon. Run 'propr check' for diagnostics.");
         process.exit(1);
     }
+    // Pre-create the host Vibe prompt-cache dir owned by this user before Docker
+    // can auto-create it as root on first bind-mount. Without this, a stack that
+    // has run once leaves a root-owned cache dir that trips the writability check
+    // below and blocks every subsequent `propr start`.
+    try {
+        ensureVibePromptCacheDir(cfg.hostVibePromptCacheDir);
+    }
+    catch {
+        /* best-effort: validateEnv will surface an actionable error if needed */
+    }
     const validation = orch.validateEnv(cfg);
     for (const w of validation.warnings)
         console.warn(`warning: ${w}`);
@@ -60,8 +71,23 @@ export async function runStart(configManager, options) {
     }
     const ui = configManager.getUiEnabled();
     const docs = cfg.docsEnabled;
+    // cfg.uiTunnelEnabled already reflects a persisted `propr tunnel on|off`
+    // toggle (forwarded as an override in getHostConfig), falling back to the
+    // env-derived default when the toggle has never been set.
+    const tunnel = cfg.uiTunnelEnabled;
     orch.ensureNetwork(cfg, (l) => console.log(l));
-    const status = orch.startStack(cfg, { ui, docs, onLog: (l) => console.log(l) });
+    const status = orch.startStack(cfg, { ui, docs, tunnel, onLog: (l) => console.log(l) });
+    // When the tunnel is on, surface the concrete routed endpoints (not the base
+    // URL as a health target) so the operator can see where the hosted UI reaches
+    // this stack.
+    if (tunnel) {
+        const summary = renderTunnelEndpointSummary(cfg.uiPublicApiUrl);
+        if (summary.length > 0) {
+            console.log("");
+            for (const line of summary)
+                console.log(line);
+        }
+    }
     const interactive = options.tui !== false && Boolean(process.stdout.isTTY);
     if (!interactive) {
         console.log("");

package/dist/utils/envFile.js

@@ -63,3 +63,48 @@ export function upsertEnvVars(envPath, vars) {
         console.warn(`Note: tightened ${envPath} permissions from ${tightenedFrom.toString(8)} to 600 (secrets file).`);
     }
 }
+/**
+ * Remove the given keys from a .env file entirely.
+ *
+ * Deletes every uncommented `KEY=` assignment for each key — so a key that was
+ * accidentally assigned more than once is fully cleared, not just thinned to its
+ * last duplicate; every other line — comments, blanks, and unrelated keys — is
+ * preserved verbatim. A missing file, an empty key list, and keys that aren't
+ * present are all no-ops.
+ *
+ * This exists because {@link upsertEnvVars} can only *set* a value: writing a
+ * blank (e.g. `GITHUB_USER_WHITELIST=`) still leaves the key in the file, where
+ * it reads back as an empty value rather than as "unset". Setup flows that must
+ * genuinely clear a stale key (clearing the user whitelist, dropping a key when
+ * switching auth/intake modes) use this so the value does not silently return on
+ * the next read or restart.
+ */
+export function clearEnvKeys(envPath, keys) {
+    if (keys.length === 0 || !existsSync(envPath))
+        return;
+    const lines = readFileSync(envPath, "utf-8").split(/\r?\n/);
+    const patterns = keys.map((key) => new RegExp(`^\\s*(export\\s+)?${escapeRegExp(key)}\\s*=`));
+    const kept = lines.filter((line) => !patterns.some((pattern) => pattern.test(line)));
+    // Nothing matched → leave the file (and its mode) untouched.
+    if (kept.length === lines.length)
+        return;
+    // Tighten permissions like upsertEnvVars does — this is still the secrets file.
+    let tightenedFrom = null;
+    try {
+        const before = statSync(envPath).mode & 0o777;
+        if (before !== 0o600) {
+            chmodSync(envPath, 0o600);
+            tightenedFrom = before;
+        }
+    }
+    catch {
+        // Best-effort — may fail on Windows or non-owned files.
+    }
+    // Drop trailing blank lines, then re-add exactly one terminating newline.
+    while (kept.length > 0 && kept[kept.length - 1] === "")
+        kept.pop();
+    writeFileSync(envPath, `${kept.join("\n")}\n`, "utf-8");
+    if (tightenedFrom !== null) {
+        console.warn(`Note: tightened ${envPath} permissions from ${tightenedFrom.toString(8)} to 600 (secrets file).`);
+    }
+}

package/dist/vendor/shared/githubEventIntakeMode.js

@@ -0,0 +1,41 @@
+/**
+ * GitHub event intake mode resolution, shared so the backend boot path and
+ * any tooling agree on how GitHub events are delivered.
+ *
+ * Auth mode (see githubAuthMode) and event delivery mode are now independent:
+ * how ProPR authenticates to GitHub no longer dictates how it receives events.
+ *
+ * Event intake is configured one of three ways:
+ *   routing_websocket — events arrive over a routing WebSocket (the default)
+ *   polling           — events are pulled by polling the GitHub API
+ *   direct_webhook    — events are delivered to a local webhook endpoint
+ * An explicit GITHUB_EVENT_INTAKE_MODE selects the mode; unset defaults to
+ * routing_websocket. The legacy boolean ENABLE_GITHUB_WEBHOOKS is deprecated
+ * and no longer selects the mode.
+ */
+export const GITHUB_EVENT_INTAKE_MODES = [
+    'routing_websocket',
+    'polling',
+    'direct_webhook',
+];
+export const DEFAULT_GITHUB_EVENT_INTAKE_MODE = 'routing_websocket';
+function isGithubEventIntakeMode(value) {
+    return GITHUB_EVENT_INTAKE_MODES.includes(value);
+}
+export function resolveGithubEventIntakeMode(env) {
+    const warnings = [];
+    // The legacy boolean no longer selects the mode — surface a deprecation
+    // notice whenever it is present so operators can migrate off it.
+    if (env.enableGithubWebhooks !== undefined) {
+        warnings.push('ENABLE_GITHUB_WEBHOOKS is deprecated and no longer selects the GitHub event intake mode. Set GITHUB_EVENT_INTAKE_MODE to "routing_websocket", "polling", or "direct_webhook" instead.');
+    }
+    const explicit = (env.eventIntakeMode || '').trim().toLowerCase();
+    if (!explicit) {
+        return { mode: DEFAULT_GITHUB_EVENT_INTAKE_MODE, warnings };
+    }
+    if (isGithubEventIntakeMode(explicit)) {
+        return { mode: explicit, warnings };
+    }
+    throw new Error(`GITHUB_EVENT_INTAKE_MODE="${env.eventIntakeMode}" is not a recognized value (expected ${GITHUB_EVENT_INTAKE_MODES.map((m) => `"${m}"`).join(', ')}).`);
+}
+//# sourceMappingURL=githubEventIntakeMode.js.map

package/dist/vendor/shared/index.js

@@ -7,8 +7,25 @@ export { DEMO_MODE_READ_ONLY_CODE, parseTruthyEnvValue } from './demoMode.js';
 export { getGithubUserWhitelist, isGithubUserWhitelisted, } from './userWhitelist.js';
 // Export relay URL validation
 export { validateRelayUrl } from './validateRelayUrl.js';
+// Export the hosted propr-routing service default URLs (one source of truth for
+// the webhook.propr.dev host shared by the CLI, the daemon dialer, and the
+// boot/check prerequisite validators)
+export { DEFAULT_PROPR_ROUTING_URL, DEFAULT_PROPR_GH_RELAY_URL, DEFAULT_PROPR_UI_ORIGIN, PROPR_UI_PROXY_SUFFIX, DEFAULT_CLOUDFLARED_IMAGE, proprInstanceProxyUrl, isValidProprInstanceId, isProprProxyUrl, proprTunnelEndpoints, } from './proprServiceUrls.js';
+// Export routing URL validation (shared by intake prerequisites and the daemon
+// routing service so the boot/CLI checks and the dialer agree on one policy)
+export { validateRoutingUrl } from './validateRoutingUrl.js';
 // Export GitHub auth mode inference (shared by backend boot and `propr check`)
 export { resolveGithubAuthMode, } from './githubAuthMode.js';
+// Export GitHub event intake mode resolution (auth mode and event delivery
+// mode evolve independently; replaces the legacy ENABLE_GITHUB_WEBHOOKS boolean)
+export { GITHUB_EVENT_INTAKE_MODES, DEFAULT_GITHUB_EVENT_INTAKE_MODE, resolveGithubEventIntakeMode, } from './githubEventIntakeMode.js';
+// Export mode-specific GitHub intake prerequisite validation (shared by backend
+// boot and `propr check` so the two agree on what each intake mode requires)
+export { validateIntakeModePrerequisites, } from './intakeModePrerequisites.js';
+// Export shared Redis status keys (one source of truth for cross-process status
+// keys so the daemon publisher, API status route, and CLI cannot drift)
+export { ROUTING_STATUS_REDIS_KEY } from './statusKeys.js';
+export { PROPR_VERSION, PROPR_API_COMPATIBILITY, PROPR_UI_COMPATIBILITY, PROPR_UI_SUPPORTED_API_COMPATIBILITY, getProprCompatibilityMetadata, evaluateProprApiCompatibility, } from './proprCompatibility.js';
 export { shortHash, buildDynamicLlmLabel, MAX_GITHUB_LABEL_LENGTH } from './labelUtils.js';
 // Export the default review guidance (the overridable part of the /review prompt)
 export { DEFAULT_REVIEW_GUIDANCE } from './reviewPrompt.js';

package/dist/vendor/shared/intakeModePrerequisites.js

@@ -0,0 +1,76 @@
+/**
+ * Mode-specific GitHub intake prerequisite validation, shared so the backend
+ * boot path and the CLI (`propr check`) agree on what each intake mode needs
+ * before the daemon or API starts partially configured.
+ *
+ * Mode resolution (see githubEventIntakeMode) decides which intake path runs;
+ * this helper validates the environment that path requires:
+ *   routing_websocket — needs relay auth plus relay/routing credentials
+ *   polling           — needs usable GitHub auth (relay or app)
+ *   direct_webhook     — needs an own GitHub App plus a webhook secret
+ *
+ * Validation is intentionally side-effect free (no logging, no process exit)
+ * so CLI checks and the boot path can both reuse it.
+ */
+import { validateRoutingUrl } from './validateRoutingUrl.js';
+import { DEFAULT_PROPR_ROUTING_URL } from './proprServiceUrls.js';
+function isPresent(value) {
+    return typeof value === 'string' && value.trim() !== '';
+}
+/**
+ * Validate the environment prerequisites for the resolved intake mode.
+ * Returns structured errors and warnings; never throws and never has side effects.
+ */
+export function validateIntakeModePrerequisites(env) {
+    const errors = [];
+    const warnings = [];
+    // Demo mode disables GitHub entirely, so no intake prerequisites apply.
+    if (env.authMode === 'demo') {
+        return { valid: true, errors, warnings };
+    }
+    switch (env.intakeMode) {
+        case 'routing_websocket': {
+            if (env.authMode !== 'relay') {
+                errors.push('routing_websocket intake requires relay auth mode. Set GH_AUTH_MODE=relay (or configure PROPR_GH_RELAY_URL + PROPR_GH_RELAY_TOKEN so relay mode is inferred).');
+            }
+            // PROPR_ROUTING_URL / PROPR_GH_RELAY_URL default to the hosted relay
+            // (webhook.propr.dev) — the same fallbacks the daemon dialer and
+            // `propr relay enroll` apply — so an unset value is not an error here; it
+            // resolves to the default. Only the relay TOKEN (a secret, minted by
+            // enrollment) cannot be defaulted.
+            const routingUrl = isPresent(env.routingUrl) ? env.routingUrl : DEFAULT_PROPR_ROUTING_URL;
+            // validateRoutingUrl is the single source of truth for the routing-URL
+            // policy — the same function the daemon service uses before it dials —
+            // so the boot/CLI check and the dialer can never disagree. It accepts
+            // the default wss:// origin (and https://), rejecting insecure non-local
+            // schemes and path-bearing origins.
+            const routingUrlError = validateRoutingUrl(routingUrl);
+            if (routingUrlError) {
+                errors.push(`PROPR_ROUTING_URL is invalid: ${routingUrlError}`);
+            }
+            if (!isPresent(env.relayToken)) {
+                errors.push('PROPR_GH_RELAY_TOKEN must be set for routing_websocket intake.');
+            }
+            break;
+        }
+        case 'polling': {
+            // Polling pulls events from the GitHub API, so any usable GitHub auth
+            // works — both the relay (shared-app) and app (own-app) paths qualify.
+            if (env.authMode !== 'relay' && env.authMode !== 'app') {
+                errors.push('polling intake requires usable GitHub auth. Configure relay mode (PROPR_GH_RELAY_URL + PROPR_GH_RELAY_TOKEN) or app mode (GH_APP_ID + GH_PRIVATE_KEY_PATH + GH_INSTALLATION_ID).');
+            }
+            break;
+        }
+        case 'direct_webhook': {
+            if (env.authMode !== 'app') {
+                errors.push('direct_webhook intake requires app auth mode (an own GitHub App). Set GH_AUTH_MODE=app and configure GH_APP_ID + GH_PRIVATE_KEY_PATH + GH_INSTALLATION_ID.');
+            }
+            if (!isPresent(env.webhookSecret)) {
+                errors.push('GH_WEBHOOK_SECRET must be set for direct_webhook intake.');
+            }
+            break;
+        }
+    }
+    return { valid: errors.length === 0, errors, warnings };
+}
+//# sourceMappingURL=intakeModePrerequisites.js.map

package/dist/vendor/shared/modelDefinitions.js

@@ -100,7 +100,7 @@ export const AGENT_DEFAULTS = {
         defaultModels: CLAUDE_MODELS.map(m => m.id),
         defaultAlias: 'claude',
         npmPackage: '@anthropic-ai/claude-code',
-        defaultCliVersion: '2.1.170'
+        defaultCliVersion: '2.1.191'
     },
     codex: {
         dockerImage: 'propr/agent-codex:latest',
@@ -108,7 +108,7 @@ export const AGENT_DEFAULTS = {
         defaultModels: CODEX_MODELS.map(m => m.id),
         defaultAlias: 'codex',
         npmPackage: '@openai/codex',
-        defaultCliVersion: '0.137.0'
+        defaultCliVersion: '0.142.1'
     },
     antigravity: {
         dockerImage: 'propr/agent-antigravity:latest',
@@ -124,7 +124,7 @@ export const AGENT_DEFAULTS = {
         defaultModels: OPENCODE_MODELS.map(m => m.id),
         defaultAlias: 'opencode',
         npmPackage: 'opencode-ai',
-        defaultCliVersion: '1.16.2'
+        defaultCliVersion: '1.17.10'
     },
     vibe: {
         dockerImage: 'propr/agent-vibe:latest',
@@ -132,7 +132,7 @@ export const AGENT_DEFAULTS = {
         defaultModels: VIBE_MODELS.map(m => m.id),
         defaultAlias: 'vibe',
         npmPackage: 'mistral-vibe',
-        defaultCliVersion: '2.12.1'
+        defaultCliVersion: '2.17.1'
     }
 };
 // Badge colors for each agent type (for UI)

package/dist/vendor/shared/proprCompatibility.js

@@ -0,0 +1,70 @@
+// Public ProPR version surfaced to the hosted UI via `/api/compatibility`. This
+// must track the release version. The shared package is bundled for the browser
+// (no fs/JSON-import of package.json available within rootDir), so it is kept as
+// a constant rather than read from package.json at runtime. A release bump that
+// updates packages/shared/package.json or docker/launcher/manifest.json but
+// forgets this constant is caught by the drift test in
+// test/orchestratorProprUrlsDrift.test.ts, which asserts all three agree.
+export const PROPR_VERSION = '0.8.5';
+// Bump this only when the API/UI contract changes in a way the hosted UI must
+// account for. Patch releases that do not change the browser-facing contract can
+// keep the same compatibility version.
+export const PROPR_API_COMPATIBILITY = '2026-06-27';
+export const PROPR_UI_COMPATIBILITY = PROPR_API_COMPATIBILITY;
+export const PROPR_UI_SUPPORTED_API_COMPATIBILITY = [PROPR_API_COMPATIBILITY];
+export function getProprCompatibilityMetadata() {
+    return {
+        version: PROPR_VERSION,
+        apiCompatibility: PROPR_API_COMPATIBILITY,
+        uiCompatibility: PROPR_UI_COMPATIBILITY,
+    };
+}
+export function evaluateProprApiCompatibility(input) {
+    const apiCompatibility = input.apiCompatibility?.trim() || null;
+    const apiVersion = input.version?.trim() || null;
+    if (!apiCompatibility) {
+        return {
+            compatible: false,
+            apiCompatibility,
+            apiVersion,
+            reason: 'missing',
+            message: 'This ProPR instance does not publish API compatibility metadata. Update the local ProPR stack before using the hosted UI.',
+        };
+    }
+    if (PROPR_UI_SUPPORTED_API_COMPATIBILITY.includes(apiCompatibility)) {
+        return { compatible: true, apiCompatibility, apiVersion };
+    }
+    // PROPR_UI_SUPPORTED_API_COMPATIBILITY currently holds a single value, so
+    // oldest === newest and only the too_old / too_new branches below can fire (the
+    // final `unsupported` branch is unreachable today). These are forward-looking:
+    // once the UI supports a range with gaps, an in-range-but-unsupported value can
+    // occur and the `unsupported` branch covers it.
+    const oldestSupported = PROPR_UI_SUPPORTED_API_COMPATIBILITY[0];
+    const newestSupported = PROPR_UI_SUPPORTED_API_COMPATIBILITY[PROPR_UI_SUPPORTED_API_COMPATIBILITY.length - 1];
+    if (apiCompatibility < oldestSupported) {
+        return {
+            compatible: false,
+            apiCompatibility,
+            apiVersion,
+            reason: 'too_old',
+            message: `This ProPR instance is too old for the hosted UI. Update the local ProPR stack to API compatibility ${oldestSupported} or newer.`,
+        };
+    }
+    if (apiCompatibility > newestSupported) {
+        return {
+            compatible: false,
+            apiCompatibility,
+            apiVersion,
+            reason: 'too_new',
+            message: `This ProPR instance is newer than the hosted UI supports. Update the hosted UI or use the matching local UI for API compatibility ${apiCompatibility}.`,
+        };
+    }
+    return {
+        compatible: false,
+        apiCompatibility,
+        apiVersion,
+        reason: 'unsupported',
+        message: `This hosted UI supports API compatibility ${PROPR_UI_SUPPORTED_API_COMPATIBILITY.join(', ')}, but the local ProPR instance reports ${apiCompatibility}.`,
+    };
+}
+//# sourceMappingURL=proprCompatibility.js.map