skillwiki 0.10.111 → 0.10.113

package/dist/chunk-K3M6OSUW.js

@@ -0,0 +1,77 @@
+#!/usr/bin/env node
+
+// src/clip-outbox/files.ts
+import { constants } from "fs";
+import { lstat, mkdir, open, realpath } from "fs/promises";
+import { dirname, isAbsolute, relative, resolve, sep } from "path";
+async function readRegular(root, path, maxBytes) {
+  const rel = relative(root, path);
+  if (!rel || rel.startsWith(`..${sep}`) || rel === ".." || isAbsolute(rel)) throw new Error("unsafe input path");
+  let current = resolve(root);
+  for (const part of ["", ...rel.split(sep)]) {
+    current = resolve(current, part);
+    const st = await lstat(current);
+    if (st.isSymbolicLink()) throw new Error("symlink input refused");
+    if (current !== path && !st.isDirectory()) throw new Error("invalid input parent");
+  }
+  const handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+  try {
+    const before = await handle.stat();
+    if (!before.isFile() || before.size > maxBytes) throw new Error("input type or size refused");
+    const bytes = Buffer.alloc(before.size + 1);
+    let bytesRead = 0;
+    while (bytesRead < bytes.length) {
+      const chunk = await handle.read(bytes, bytesRead, bytes.length - bytesRead, bytesRead);
+      if (chunk.bytesRead === 0) break;
+      bytesRead += chunk.bytesRead;
+    }
+    const after = await handle.stat();
+    if (await realpath(path) !== path) throw new Error("input path changed during read");
+    const leaf = await lstat(path);
+    if (leaf.ino !== before.ino || leaf.dev !== before.dev) throw new Error("input identity changed during read");
+    if (bytesRead !== before.size || after.size !== before.size || after.mtimeMs !== before.mtimeMs) throw new Error("input changed during read");
+    return bytes.subarray(0, bytesRead);
+  } finally {
+    await handle.close();
+  }
+}
+async function writeRegularExclusive(root, rel, body) {
+  const dest = resolve(root, ...rel.split("/"));
+  const checked = relative(root, dest);
+  if (!checked || checked.startsWith(`..${sep}`) || checked === ".." || isAbsolute(checked)) throw new Error("unsafe dest path");
+  let current = resolve(root);
+  const parts = checked.split(sep);
+  for (let i = 0; i < parts.length - 1; i++) {
+    current = resolve(current, parts[i]);
+    try {
+      const st = await lstat(current);
+      if (st.isSymbolicLink()) throw new Error("symlink dest refused");
+      if (!st.isDirectory()) throw new Error("invalid dest parent");
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+      await mkdir(current);
+    }
+  }
+  const leaf = resolve(current, parts[parts.length - 1]);
+  if (dirname(leaf) !== current) throw new Error("unsafe dest path");
+  try {
+    const handle = await open(leaf, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 420);
+    try {
+      await handle.writeFile(body);
+    } finally {
+      await handle.close();
+    }
+    return "created";
+  } catch (error) {
+    if (error.code !== "EEXIST") throw error;
+    const st = await lstat(leaf);
+    if (st.isSymbolicLink() || !st.isFile() || st.size !== body.length) return "conflict";
+    const existing = await readRegular(root, leaf, body.length);
+    return existing.equals(body) ? "idempotent" : "conflict";
+  }
+}
+
+export {
+  readRegular,
+  writeRegularExclusive
+};

package/dist/{chunk-5IBLXGLY.js → chunk-K3YZESND.js}

@@ -4,11 +4,11 @@ import {
   readPage,
   scanSensitiveContent,
   splitFrontmatter
-} from "./chunk-X5GL2FCU.js";
+} from "./chunk-JL2SCLXT.js";
 import {
   err,
   ok
-} from "./chunk-UIEQIJXP.js";
+} from "./chunk-VNSZCK5V.js";
 
 // src/utils/vault-path-safety.ts
 import { lstatSync, realpathSync } from "fs";

package/dist/chunk-OGEAFXON.js

@@ -0,0 +1,60 @@
+#!/usr/bin/env node
+import {
+  parseDotenvFile,
+  resolveSkillwikiHome
+} from "./chunk-IJKJGQKL.js";
+
+// src/utils/mcp-auth-env.ts
+import { join } from "path";
+var MCP_URL_ENV = "SKILLWIKI_MCP_URL";
+var MCP_TOKEN_ENV = "SKILLWIKI_MCP_TOKEN";
+var MCP_HOST_ID_ENV = "SKILLWIKI_HOST_ID";
+function nonEmptyEnvValue(value) {
+  if (typeof value !== "string") return void 0;
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : void 0;
+}
+function mcpAuthFromEnv(env) {
+  return {
+    url: nonEmptyEnvValue(env[MCP_URL_ENV]),
+    token: nonEmptyEnvValue(env[MCP_TOKEN_ENV]),
+    hostId: nonEmptyEnvValue(env[MCP_HOST_ID_ENV])
+  };
+}
+async function resolveMcpAuthEnv(input) {
+  const processAuth = mcpAuthFromEnv(input.env ?? process.env);
+  const dotenv = await parseDotenvFile(join(resolveSkillwikiHome(input.home, input.env), ".skillwiki", ".env"));
+  const fileAuth = mcpAuthFromEnv(dotenv);
+  return {
+    url: processAuth.url ?? fileAuth.url,
+    token: processAuth.token ?? fileAuth.token,
+    hostId: processAuth.hostId ?? fileAuth.hostId
+  };
+}
+async function mergeMcpAuthIntoEnv(home, env) {
+  const auth = await resolveMcpAuthEnv({ home, env });
+  const merged = { ...env };
+  if (auth.url && !nonEmptyEnvValue(env[MCP_URL_ENV])) merged[MCP_URL_ENV] = auth.url;
+  if (auth.token && !nonEmptyEnvValue(env[MCP_TOKEN_ENV])) merged[MCP_TOKEN_ENV] = auth.token;
+  if (auth.hostId && !nonEmptyEnvValue(env[MCP_HOST_ID_ENV])) merged[MCP_HOST_ID_ENV] = auth.hostId;
+  return merged;
+}
+function redactMcpSecret(text, secret) {
+  if (!secret || secret.length === 0 || !text.includes(secret)) return text;
+  return text.split(secret).join("[REDACTED]");
+}
+function isMcpOnlyLeaf(input) {
+  return !input.resolvedPath && Boolean(input.token) && !input.vaultSyncInstalled;
+}
+
+export {
+  MCP_URL_ENV,
+  MCP_TOKEN_ENV,
+  MCP_HOST_ID_ENV,
+  nonEmptyEnvValue,
+  mcpAuthFromEnv,
+  resolveMcpAuthEnv,
+  mergeMcpAuthIntoEnv,
+  redactMcpSecret,
+  isMcpOnlyLeaf
+};

package/dist/{chunk-6OQLBNKR.js → chunk-OWWWO2XS.js}

@@ -1,17 +1,22 @@
 #!/usr/bin/env node
+import {
+  defaultLookup
+} from "./chunk-5D5HFQ76.js";
 import {
   parseDotenvFile,
   resolveSkillwikiHome
-} from "./chunk-PYPPG7RF.js";
+} from "./chunk-IJKJGQKL.js";
 import {
   CLIP_OUTBOX_DEFAULTS,
+  ipv4InCidr,
   isClipOutboxKey,
   parseClipOutboxKeyValue
-} from "./chunk-UIEQIJXP.js";
+} from "./chunk-VNSZCK5V.js";
 
 // src/clip-outbox/runtime.ts
 import { existsSync as existsSync2 } from "fs";
 import { lstat, readFile } from "fs/promises";
+import { isIP } from "net";
 import { join as join2 } from "path";
 import { execFileSync } from "child_process";
 import { z } from "zod";
@@ -22,6 +27,7 @@ import { homedir } from "os";
 import { isAbsolute, join, resolve, sep } from "path";
 var CLIP_NOT_CONFIGURED = "clip channel not configured";
 var PRODUCTION_WATCHER_LABEL = CLIP_OUTBOX_DEFAULTS.watcher_label;
+var PRODUCTION_MIRROR_LABEL = "com.karlchow.skillwiki-mirror-sse";
 var RETIRED_WATCHER_LABELS = [
   "com.karlchow.wiki-dev-outbox",
   "com.karlchow.wiki-dev-sse",
@@ -188,6 +194,23 @@ async function loadClipOutboxConfig(home) {
 
 // src/clip-outbox/runtime.ts
 var s3Schema = z.object({ endpoint: z.string().url(), region: z.string().default("us-east-1"), accessKeyId: z.string().min(1), secretAccessKey: z.string().min(1), sessionToken: z.string().optional() }).strict();
+function isRfc1918OrLoopback(address) {
+  const version = isIP(address);
+  if (version === 4) {
+    return ipv4InCidr(address, "10.0.0.0", 8) || ipv4InCidr(address, "172.16.0.0", 12) || ipv4InCidr(address, "192.168.0.0", 16) || ipv4InCidr(address, "127.0.0.0", 8);
+  }
+  return version === 6 && address.toLowerCase() === "::1";
+}
+async function assertClipS3Endpoint(endpoint, lookup = defaultLookup) {
+  const url = new URL(endpoint);
+  if (url.username || url.password || url.search || url.hash) throw new Error("invalid clip S3 endpoint");
+  if (url.protocol === "https:") return;
+  if (url.protocol !== "http:") throw new Error("invalid clip S3 endpoint");
+  const addresses = isIP(url.hostname) ? [url.hostname] : await lookup(url.hostname);
+  if (addresses.length === 0 || !addresses.every(isRfc1918OrLoopback)) {
+    throw new Error("http clip S3 endpoint must resolve only to RFC1918 or loopback");
+  }
+}
 async function loadClipCredentials(home, config, env = process.env) {
   let providers = {};
   const path = join2(home, ".skillwiki", "clip-outbox-credentials.json");
@@ -201,8 +224,7 @@ async function loadClipCredentials(home, config, env = process.env) {
   try {
     const rawS3 = env[config.s3CredentialRef] ?? providers[config.s3CredentialRef];
     const s3 = s3Schema.parse(typeof rawS3 === "string" ? JSON.parse(rawS3) : rawS3);
-    const endpoint = new URL(s3.endpoint);
-    if (endpoint.protocol !== "https:" || endpoint.username || endpoint.password || endpoint.search || endpoint.hash) throw new Error();
+    await assertClipS3Endpoint(s3.endpoint);
     const hostConfig = await parseDotenvFile(join2(home, ".skillwiki", ".env"));
     const readyToken = env[config.readyCredentialRef] ?? providers[config.readyCredentialRef];
     if (typeof readyToken !== "string" || !readyToken || config.readyCredentialRef === "SKILLWIKI_MCP_TOKEN" || readyToken === env.SKILLWIKI_MCP_TOKEN || readyToken === hostConfig.SKILLWIKI_MCP_TOKEN || config.readyCredentialRef === config.s3CredentialRef) throw new Error();
@@ -238,11 +260,14 @@ async function validateRuntime(home, config, endpoint) {
 export {
   CLIP_NOT_CONFIGURED,
   PRODUCTION_WATCHER_LABEL,
+  PRODUCTION_MIRROR_LABEL,
   RETIRED_WATCHER_LABELS,
   expandUserPath,
   nestedOrEqual,
   resolveClipOutboxConfig,
   loadClipOutboxConfig,
+  isRfc1918OrLoopback,
+  assertClipS3Endpoint,
   loadClipCredentials,
   evidencePath,
   conditionalCreateProven,

package/dist/{chunk-KWEYA3OE.js → chunk-SEY4N4CT.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   atomicWriteText
-} from "./chunk-GQWCTJTU.js";
+} from "./chunk-6VUK2FTX.js";
 
 // src/clip-outbox/journal.ts
 import { mkdir, readFile, open } from "fs/promises";

package/dist/{chunk-UIEQIJXP.js → chunk-VNSZCK5V.js}

@@ -62,7 +62,8 @@ var ExitCode = {
   APPROVAL_MISMATCH: 57,
   TARGET_DRIFT: 58,
   RECOVERY_EVIDENCE_MISSING: 59,
-  SYNC_PARTIAL_DECLINE: 60
+  SYNC_PARTIAL_DECLINE: 60,
+  HTML_RENDER_NOT_OPTED_IN: 61
 };
 
 // ../shared/src/json-output.ts
@@ -73,6 +74,48 @@ function err(error, detail) {
   return detail === void 0 ? { ok: false, error } : { ok: false, error, detail };
 }
 
+// ../shared/src/blocked-hosts.ts
+var METADATA_HOSTS = /* @__PURE__ */ new Set([
+  "metadata.google.internal",
+  "metadata"
+]);
+var METADATA_IPS = /* @__PURE__ */ new Set(["169.254.169.254"]);
+function ipv4ToInt(ip) {
+  const parts = ip.split(".");
+  if (parts.length !== 4) return null;
+  let n = 0;
+  for (const p of parts) {
+    const v = Number(p);
+    if (!Number.isInteger(v) || v < 0 || v > 255) return null;
+    n = (n << 8) + v;
+  }
+  return n >>> 0;
+}
+function inRange(ip, baseStr, prefix) {
+  const ipN = ipv4ToInt(ip);
+  const baseN = ipv4ToInt(baseStr);
+  if (ipN === null || baseN === null) return false;
+  const mask = prefix === 0 ? 0 : ~0 << 32 - prefix >>> 0;
+  return (ipN & mask) === (baseN & mask);
+}
+function ipv4InCidr(ip, base, prefix) {
+  return inRange(ip, base, prefix);
+}
+function isBlockedHost(host) {
+  const lower = host.toLowerCase();
+  if (METADATA_HOSTS.has(lower)) return true;
+  if (METADATA_IPS.has(host)) return true;
+  if (lower === "::1") return true;
+  if (lower.startsWith("fe80:")) return true;
+  if (ipv4ToInt(host) === null) return false;
+  if (inRange(host, "10.0.0.0", 8)) return true;
+  if (inRange(host, "172.16.0.0", 12)) return true;
+  if (inRange(host, "192.168.0.0", 16)) return true;
+  if (inRange(host, "169.254.0.0", 16)) return true;
+  if (inRange(host, "127.0.0.0", 8)) return true;
+  return false;
+}
+
 // ../shared/src/session-kind.ts
 function resolveSessionKind(input = {}) {
   const env = input.env ?? {};
@@ -154,7 +197,9 @@ var TypedKnowledgeSchema = z.object({
   provenance: z.enum(["research", "project", "mixed"]).optional(),
   provenance_projects: z.array(wikilink).optional(),
   work_items: z.array(wikilink).optional(),
-  stale_ttl: z.number().int().positive().optional()
+  stale_ttl: z.number().int().positive().optional(),
+  output_standard: z.literal("v2").optional(),
+  html_render: z.boolean().optional()
 }).superRefine((v, ctx) => {
   if (v.provenance && v.provenance !== "research" && (!v.provenance_projects || v.provenance_projects.length === 0)) {
     ctx.addIssue({ code: z.ZodIssueCode.custom, path: ["provenance_projects"], message: "required when provenance != research" });
@@ -531,48 +576,6 @@ function detectSchema(fm) {
   return { schema: null };
 }
 
-// ../shared/src/blocked-hosts.ts
-var METADATA_HOSTS = /* @__PURE__ */ new Set([
-  "metadata.google.internal",
-  "metadata"
-]);
-var METADATA_IPS = /* @__PURE__ */ new Set(["169.254.169.254"]);
-function ipv4ToInt(ip) {
-  const parts = ip.split(".");
-  if (parts.length !== 4) return null;
-  let n = 0;
-  for (const p of parts) {
-    const v = Number(p);
-    if (!Number.isInteger(v) || v < 0 || v > 255) return null;
-    n = (n << 8) + v;
-  }
-  return n >>> 0;
-}
-function inRange(ip, baseStr, prefix) {
-  const ipN = ipv4ToInt(ip);
-  const baseN = ipv4ToInt(baseStr);
-  if (ipN === null || baseN === null) return false;
-  const mask = prefix === 0 ? 0 : ~0 << 32 - prefix >>> 0;
-  return (ipN & mask) === (baseN & mask);
-}
-function ipv4InCidr(ip, base, prefix) {
-  return inRange(ip, base, prefix);
-}
-function isBlockedHost(host) {
-  const lower = host.toLowerCase();
-  if (METADATA_HOSTS.has(lower)) return true;
-  if (METADATA_IPS.has(host)) return true;
-  if (lower === "::1") return true;
-  if (lower.startsWith("fe80:")) return true;
-  if (ipv4ToInt(host) === null) return false;
-  if (inRange(host, "10.0.0.0", 8)) return true;
-  if (inRange(host, "172.16.0.0", 12)) return true;
-  if (inRange(host, "192.168.0.0", 16)) return true;
-  if (inRange(host, "169.254.0.0", 16)) return true;
-  if (inRange(host, "127.0.0.0", 8)) return true;
-  return false;
-}
-
 // ../shared/src/error-message.ts
 function getErrorMessage(e) {
   return e instanceof Error ? e.message : String(e);

package/dist/{chunk-TDBUJUYH.js → chunk-XJ5VEIH7.js}

@@ -1,5 +1,9 @@
 #!/usr/bin/env node
 import {
+  atomicWriteText
+} from "./chunk-6VUK2FTX.js";
+import {
+  PRODUCTION_MIRROR_LABEL,
   PRODUCTION_WATCHER_LABEL,
   evidencePath,
   expandUserPath,
@@ -7,25 +11,22 @@ import {
   nestedOrEqual,
   resolveClipOutboxConfig,
   validateRuntime
-} from "./chunk-6OQLBNKR.js";
+} from "./chunk-OWWWO2XS.js";
 import {
   parseDotenvFile
-} from "./chunk-PYPPG7RF.js";
-import {
-  atomicWriteText
-} from "./chunk-GQWCTJTU.js";
+} from "./chunk-IJKJGQKL.js";
 
 // src/clip-outbox/migrate.ts
 import { access, mkdir, readFile } from "fs/promises";
 import { constants } from "fs";
 import { basename, dirname, isAbsolute, join } from "path";
 import { execFileSync } from "child_process";
-var CLIP_MIGRATION_HINT = "Clip channel requires attended setup: run skillwiki clip-outbox install-or-migrate, then skillwiki doctor. Installation/update never sets clip_outbox.enabled=true or loads launchd. Prove deployed SeaweedFS If-None-Match:* create-only before operator enablement.";
+var CLIP_MIGRATION_HINT = "Clip channel requires attended setup: run skillwiki clip-outbox install-or-migrate, then skillwiki doctor. Installation/update never sets clip_outbox.enabled=true or loads launchd. Prove deployed SeaweedFS If-None-Match:* create-only before --load. Inbound SSE uses a separate --load-mirror and never watches ~/wiki as clip input.";
 var xml = (s) => s.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&apos;");
-async function packagedPlist() {
+async function packagedPlist(label = PRODUCTION_WATCHER_LABEL) {
   for (const rel of ["../templates/launchd/", "../../templates/launchd/"]) {
     try {
-      return await readFile(new URL(`${rel}${PRODUCTION_WATCHER_LABEL}.plist`, import.meta.url), "utf8");
+      return await readFile(new URL(`${rel}${label}.plist`, import.meta.url), "utf8");
     } catch {
     }
   }
@@ -48,6 +49,7 @@ async function migrateClipOutbox(input) {
   const resolved = resolveClipOutboxConfig(map, input.home);
   if (!resolved.ok) throw new Error(resolved.message);
   if (input.load && (!resolved.enabled || !input.conditionalCreateProven)) throw new Error("--load requires existing clip_outbox.enabled=true and --conditional-create-proven after the operator's deployed create-only race test");
+  if (input.loadMirror && !resolved.enabled) throw new Error("--load-mirror requires existing clip_outbox.enabled=true; upgrades never auto-load the inbound SSE listener");
   if ((input.platform ?? process.platform) !== "darwin") throw new Error("clip launchd migration requires macOS");
   const rawRoot = map["clip_outbox.root"] ?? "~/Obsidian/clip-outbox";
   const root = resolved.enabled ? resolved.config.root : expandUserPath(rawRoot, input.home);
@@ -58,9 +60,16 @@ async function migrateClipOutbox(input) {
   if (!isAbsolute(binary) || !isAbsolute(input.nodePath ?? process.execPath)) throw new Error("absolute executable paths required");
   const logRoot = join(input.home, "Library", "Logs", "SkillWiki");
   const plistPath = join(input.home, "Library", "LaunchAgents", `${PRODUCTION_WATCHER_LABEL}.plist`);
-  const template = await packagedPlist();
-  let plist = template;
-  for (const [key, value] of Object.entries({ NODE_BINARY: input.nodePath ?? process.execPath, CLI_BINARY: binary, OUTBOX_ROOT: root, HOME: input.home, LOG_ROOT: logRoot })) plist = plist.replaceAll(`@${key}@`, xml(value));
+  const mirrorPlistPath = join(input.home, "Library", "LaunchAgents", `${PRODUCTION_MIRROR_LABEL}.plist`);
+  const replacements = { NODE_BINARY: input.nodePath ?? process.execPath, CLI_BINARY: binary, OUTBOX_ROOT: root, HOME: input.home, LOG_ROOT: logRoot };
+  const render = async (label) => {
+    let plist = await packagedPlist(label);
+    for (const [key, value] of Object.entries(replacements)) plist = plist.replaceAll(`@${key}@`, xml(value));
+    if (label === PRODUCTION_MIRROR_LABEL && plist.includes("<key>WatchPaths</key>")) throw new Error("inbound SSE plist must not watch the frozen mirror");
+    return plist;
+  };
+  const watcherPlist = await render(PRODUCTION_WATCHER_LABEL);
+  const mirrorPlist = await render(PRODUCTION_MIRROR_LABEL);
   if (input.load) {
     if (!resolved.enabled) throw new Error("--load requires existing clip_outbox.enabled=true and --conditional-create-proven after the operator's deployed create-only race test");
     const creds = await loadClipCredentials(input.home, resolved.config);
@@ -71,22 +80,37 @@ async function migrateClipOutbox(input) {
   }
   await mkdir(dirname(plistPath), { recursive: true });
   await mkdir(logRoot, { recursive: true });
-  const result = await atomicWriteText(plistPath, plist);
+  const result = await atomicWriteText(plistPath, watcherPlist);
   if (!result.ok) throw new Error("cannot refresh clip plist");
-  if (input.load) {
+  const mirrorResult = await atomicWriteText(mirrorPlistPath, mirrorPlist);
+  if (!mirrorResult.ok) throw new Error("cannot refresh inbound SSE plist");
+  const bootstrap = (label, path) => {
     if (typeof process.getuid !== "function") throw new Error("clip launchd load requires macOS");
     const domain = `gui/${process.getuid()}`;
     const launch = input.launch ?? ((args) => {
       execFileSync("launchctl", args, { stdio: "ignore", timeout: 5e3 });
     });
     try {
-      launch(["bootout", `${domain}/${PRODUCTION_WATCHER_LABEL}`]);
+      launch(["bootout", `${domain}/${label}`]);
     } catch {
     }
-    launch(["enable", `${domain}/${PRODUCTION_WATCHER_LABEL}`]);
-    launch(["bootstrap", domain, plistPath]);
-  }
-  return { plistPath, loaded: !!input.load, enabled: resolved.enabled, humanHint: `${result.data.changed ? "Refreshed" : "Current"} clip launchd plist: ${plistPath}. ${input.load ? "Operator-gated launchd bootstrap requested." : CLIP_MIGRATION_HINT}` };
+    launch(["enable", `${domain}/${label}`]);
+    launch(["bootstrap", domain, path]);
+  };
+  if (input.load) bootstrap(PRODUCTION_WATCHER_LABEL, plistPath);
+  if (input.loadMirror) bootstrap(PRODUCTION_MIRROR_LABEL, mirrorPlistPath);
+  const loadedBits = [
+    input.load ? "Operator-gated clip watcher bootstrap requested." : void 0,
+    input.loadMirror ? "Operator-gated inbound SSE bootstrap requested." : void 0
+  ].filter(Boolean).join(" ");
+  return {
+    plistPath,
+    mirrorPlistPath,
+    loaded: !!input.load,
+    mirrorLoaded: !!input.loadMirror,
+    enabled: resolved.enabled,
+    humanHint: `${result.data.changed ? "Refreshed" : "Current"} clip launchd plist: ${plistPath}. ${mirrorResult.data.changed ? "Refreshed" : "Current"} inbound SSE plist: ${mirrorPlistPath}. ${loadedBits || CLIP_MIGRATION_HINT}`
+  };
 }
 async function refreshInstalledClipPlist(home, opts) {
   const plistPath = join(home, "Library", "LaunchAgents", `${PRODUCTION_WATCHER_LABEL}.plist`);