starmux 0.11.0 → 0.13.0

package/dist/src/cli/mac-mcp-gateway.js.map

@@ -1 +1 @@
-{"version":3,"file":"mac-mcp-gateway.js","sourceRoot":"","sources":["../../../src/cli/mac-mcp-gateway.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,aAAa,EAAC,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,IAAI,QAAQ,EAAC,WAAW,EAAC,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AACnG,OAAO,EAAE,SAAS,EAAC,YAAY,EAAC,SAAS,EAAC,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9E,MAAM,aAAa,GAAC,CAAC,CAAC,MAAM,CAAC,EAAC,OAAO,EAAC,CAAC,CAAC,MAAM,EAAE,EAAC,YAAY,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAC,CAAC,CAAC;AACrF,kFAAkF;AAClF,OAAO,EAAE,MAAM,EAAC,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,OAAO,GAAC,WAAW,CAAC;AAC1B,MAAM,GAAG,GAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAC,cAAc,CAAC,EAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACnG,MAAM,OAAO,GAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAE,MAAM,CAAC;AAEtC,SAAS,IAAI;IACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,GAAG,CAAC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0DpD,CAAC,CAAC;AACH,CAAC;AACD,KAAK,UAAU,MAAM;IACnB,MAAM,KAAK,GAAuR,EAAC,KAAK,EAAC,gBAAgB,EAAC,IAAI,EAAC,OAAO,CAAC,OAAO,EAAC,QAAQ,EAAC,OAAO,CAAC,QAAQ;QACtW,mBAAmB,EAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;QAC7D,IAAI,EAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAE,WAAW;QACpD,WAAW,EAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAE,SAAS;QACvD,eAAe,EAAC,GAAG,CAAC,YAAY,EAAE,CAAC,iCAAiC,CAAC,IAAE,IAAI,EAAC,CAAC;IAC/E,IAAI,IAAI,GAAC,CAAC,CAAC;IACX,IAAG,CAAC;QACF,MAAM,EAAC,mBAAmB,EAAC,GAAC,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAC;QAC3E,MAAM,EAAC,qBAAqB,EAAC,GAAC,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAC;QAC7E,aAAa,EAAE,CAAC;QAChB,IAAG,CAAC,KAAK,CAAC,mBAAmB;YAAC,MAAM,KAAK,CAAC,+BAA+B,CAAC,CAAC;QAC3E,MAAM,gBAAgB,GAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAE,WAAW,CAAC;QACvE,IAAG,CAAC,CAAC,WAAW,EAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YAClD,CAAC,gBAAgB,KAAG,QAAQ;gBAC3B,CAAC,KAAK,CAAC,WAAW,KAAG,iBAAiB,IAAE,KAAK,CAAC,IAAI,KAAG,YAAY,CAAC,CAAC;YACrE,MAAM,KAAK,CAAC,wDAAwD,CAAC,CAAC;QACxE,MAAM,MAAM,GAAC,MAAM,mBAAmB,CAAC;YACrC,IAAI,EAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB;YACrC,IAAI,EAAC,KAAK,CAAC,IAAI,EAAC,iBAAiB,EAAC,KAAK,CAAC,WAAW;YACnD,oBAAoB,EAAC,gBAAgB,KAAG,QAAQ,IAAE,KAAK,CAAC,WAAW,KAAG,iBAAiB;SACxF,CAAC,CAAC;QACH,KAAK,CAAC,kBAAkB,GAAC,IAAI,CAAC;QAC9B,KAAK,CAAC,aAAa,GAAC,MAAM,CAAC,IAAI,CAAC;QAChC,MAAM,WAAW,GAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAE,IAAI,CAAC,CAAC;QACjE,IAAG,CAAC,SAAS,CAAC,WAAW,CAAC,IAAE,WAAW,GAAC,CAAC,IAAE,WAAW,GAAC,KAAK;YAC1D,MAAM,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACtC,MAAM,OAAO,GAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAE,KAAK,CAAC;QAClD,IAAG,CAAC,CAAC,KAAK,EAAC,QAAQ,EAAC,OAAO,EAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAC,MAAM,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACtF,KAAK,CAAC,OAAO,GAAC,OAAO,CAAC;QACtB,MAAM,YAAY,GAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAE,KAAK,CAAC;QAC5D,IAAG,CAAC,CAAC,KAAK,EAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC;YAAC,MAAM,KAAK,CAAC,uBAAuB,CAAC,CAAC;QACjF,KAAK,CAAC,YAAY,GAAC,YAAY,CAAC;QAChC,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;QACpC,MAAM,EAAE,GAAC,IAAI,qBAAqB,CAAC;YACjC,UAAU,EAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAE,cAAc;SAC9D,CAAC,CAAC;QACH,IAAG,CAAC;YACF,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;YACnB,KAAK,CAAC,qBAAqB,GAAC,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC;YACtD,IAAG,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,IAAI,KAAG,eAAe,CAAC;gBACtD,MAAM,KAAK,CAAC,yCAAyC,CAAC,CAAC;YACzD,KAAK,CAAC,MAAM,GAAC,MAAM,CAAC;QACtB,CAAC;gBAAO,CAAC;YAAA,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAE,EAAE,GAAC,CAAC,CAAC,CAAC;QAAA,CAAC;IAC3C,CAAC;IAAA,OAAM,KAAK,EAAC,CAAC;QACZ,KAAK,CAAC,MAAM,GAAC,MAAM,CAAC;QACpB,KAAK,CAAC,MAAM,GAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAE,YAAY,CAAC,KAAK,CAAC,IAAE,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,EAAC,GAAG,CAAC,CAAC;QACnF,IAAI,GAAC,CAAC,CAAC;IACT,CAAC;IACD,sFAAsF;IACtF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAC,IAAI,CAAC,CAAC;IACjD,OAAO,CAAC,QAAQ,GAAC,IAAI,CAAC;AACxB,CAAC;AACD,IAAG,MAAM,CAAC,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAC,CAAC;IACrF,+DAA+D;AACjE,CAAC;KAAK,IAAG,OAAO,KAAG,OAAO,EAAC,CAAC;IAC1B,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAC,CAAC,CAAC,CAAC;IACzB,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;AACpC,CAAC;KAAK,IAAG,OAAO,KAAG,QAAQ,EAAC,CAAC;IAC3B,IAAG,CAAC;QAAA,MAAM,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAAA,CAAC;IAC9E,OAAM,KAAK,EAAC,CAAC;QAAA,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,GAAC,YAAY,CAAC,KAAK,CAAC,GAAC,IAAI,CAAC,CAAC;QAAA,OAAO,CAAC,QAAQ,GAAC,CAAC,CAAC;IAAA,CAAC;AAC1G,CAAC;KAAK,IAAG,OAAO,KAAG,QAAQ,EAAC,CAAC;IAC3B,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;AACpC,CAAC;KAAK,IAAG,OAAO,KAAG,MAAM,IAAE,OAAO,KAAG,QAAQ,IAAE,OAAO,KAAG,IAAI,EAAC,CAAC;IAC7D,IAAI,EAAE,CAAC;AACT,CAAC;KAAK,IAAG,OAAO,KAAG,QAAQ,EAAC,CAAC;IAC3B,IAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB;QAAC,MAAM,MAAM,EAAE,CAAC;SAC/C,CAAC;QACH,IAAG,CAAC;YACF,MAAM,EAAC,eAAe,EAAC,eAAe,EAAC,GAAC,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC;YAClF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAC,eAAe,CAAC,MAAM,eAAe,EAAE,CAAC,CAAC,CAAC;YACpE,MAAM,MAAM,EAAE,CAAC;QACjB,CAAC;QAAA,OAAM,KAAK,EAAC,CAAC;YACZ,IAAG,SAAS,CAAC,KAAK,CAAC,KAAG,QAAQ;gBAAC,MAAM,MAAM,EAAE,CAAC;;gBACzC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAC,KAAK,EAAC,gBAAgB,EAAC,MAAM,EAAC,MAAM;oBAC5E,MAAM,EAAC,SAAS,CAAC,KAAK,CAAC,IAAE,YAAY,CAAC,KAAK,CAAC,EAAC,CAAC,GAAC,IAAI,CAAC,CAAC;YACvD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAC;YAC/E,OAAO,CAAC,QAAQ,GAAC,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;AACF,CAAC;KAAK,IAAG,CAAC,KAAK,EAAC,SAAS,EAAC,OAAO,EAAC,MAAM,EAAC,SAAS,EAAC,QAAQ,EAAC,MAAM,EAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAC,CAAC;IAChG,IAAG,CAAC;QACF,MAAM,EAAC,SAAS,EAAC,eAAe,EAAC,GAAC,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;QACrE,MAAM,EAAC,OAAO,EAAC,GAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACjD,MAAM,MAAM,GAAC,MAAM,eAAe,CAAC,OAAO,EAAC;YACzC,GAAG,OAAO,EAAC,KAAK,EAAC,QAAQ,EAAE;SAC5B,CAAC,CAAC;QACH,IAAG,MAAM,CAAC,KAAK,KAAG,cAAc;YAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;aAChE,IAAG,MAAM,CAAC,KAAK,KAAG,kBAAkB,IAAE,CAAC,OAAO,CAAC,IAAI,IAAE,OAAO,CAAC,YAAY,KAAG,SAAS;YACxF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,KAAG,CAAC,CAAA,CAAC,CAAA,sBAAsB,CAAA,CAAC,CAAA,8BAA8B,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC;aACzG,IAAG,MAAM,CAAC,KAAK,KAAG,gBAAgB,IAAE,CAAC,OAAO,CAAC,IAAI,EAAC,CAAC;YACtD,MAAM,EAAC,mBAAmB,EAAC,GAAC,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;YACxE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,MAAM,EAAC;gBAC9C,OAAO,EAAC,GAAG,CAAC,OAAO,EAAC,KAAK,EAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAE,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ;aAC/E,CAAC,CAAC,CAAC;QACN,CAAC;;YAAK,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAC,IAAI,CAAC,CAAC;QACxD,IAAG,MAAM,CAAC,KAAK,KAAG,kBAAkB;YAAC,OAAO,CAAC,QAAQ,GAAC,MAAM,CAAC,IAAI,CAAC;IACpE,CAAC;IAAA,OAAM,KAAK,EAAC,CAAC;QACZ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB;YACvC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAE,YAAY,CAAC,KAAK,CAAC,IAAE,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,EAAC,GAAG,CAAC,GAAC,IAAI,CAAC,CAAC;QAC9E,OAAO,CAAC,QAAQ,GAAC,CAAC,CAAC;IACrB,CAAC;AACH,CAAC;KAAK,IAAG,OAAO,KAAG,WAAW,EAAC,CAAC;IAC9B,wEAAwE;IACxE,oEAAoE;IACpE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;IACrE,OAAO,CAAC,QAAQ,GAAC,CAAC,CAAC;AACrB,CAAC;KAAK,IAAG,OAAO,KAAG,cAAc,IAAE,OAAO,KAAG,aAAa,EAAC,CAAC;IAC1D,IAAG,CAAC;QACF,MAAM,EAAC,eAAe,EAAC,eAAe,EAAC,GAAC,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC;QAClF,IAAG,OAAO,KAAG,aAAa,EAAC,CAAC;YAC1B,MAAM,QAAQ,GAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;YACpE,MAAM,KAAK,GAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC;YACtD,MAAM,KAAK,GAAC,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;YACrD,MAAM,kBAAkB,GAAC,OAAO,CAAC,QAAQ,IAAE,KAAK,IAAE,KAAK,CAAC,CAAC;YACzD,IAAG,CAAC,kBAAkB,EAAC,CAAC;gBACtB,8DAA8D;gBAC9D,MAAM,EAAC,eAAe,EAAC,GAAC,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;gBAC3D,MAAM,MAAM,GAAC,MAAM,eAAe,CAAC,KAAK,EAAC;oBACvC,OAAO,EAAC,OAAO,EAAC,KAAK,EAAC,QAAQ,EAAE;iBACjC,CAAC,CAAC;gBACH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAC,IAAI,CAAC,CAAC;gBAClD,IAAG,MAAM,CAAC,KAAK,KAAG,kBAAkB;oBAAC,OAAO,CAAC,QAAQ,GAAC,MAAM,CAAC,IAAI,CAAC;YACpE,CAAC;iBAAI,CAAC;gBACJ,MAAM,EAAC,yBAAyB,EAAC,GAAC,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC;gBAC5E,MAAM,MAAM,GAAC,MAAM,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;gBACnE,yBAAyB,CAAC;oBACxB,IAAI,EAAC,MAAM,CAAC,IAAI,EAAC,QAAQ,EAAC,KAAK,EAAC,KAAK;iBACtC,CAAC,CAAC;gBACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;gBACnD,OAAO,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;gBAC1C,MAAM,EAAC,UAAU,EAAC,GAAC,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;gBAC3D,MAAM,UAAU,EAAE,CAAC;YACrB,CAAC;QACH,CAAC;aAAI,CAAC;YACJ,MAAM,MAAM,GAAC,MAAM,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;YACnE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;YACnD,OAAO,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;YAC1C,MAAM,MAAM,EAAE,CAAC;QACjB,CAAC;IACH,CAAC;IAAA,OAAM,KAAK,EAAC,CAAC;QACZ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB;YAC3C,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAE,YAAY,CAAC,KAAK,CAAC,IAAE,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,EAAC,EAAE,CAAC,GAAC,IAAI,CAAC,CAAC;QAC7E,OAAO,CAAC,QAAQ,GAAC,CAAC,CAAC;IACrB,CAAC;AACH,CAAC;KAAI,CAAC;IACJ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACvD,OAAO,CAAC,QAAQ,GAAC,CAAC,CAAC;AACrB,CAAC","sourcesContent":["import {supportedHost} from \"../platform.js\";\nimport { z } from \"zod\";\nimport { legacyCliEntry as cliEntry,packageRoot,desktopCommanderEntry } from \"../runtime-paths.js\";\nimport { errorCode,errorMessage,isInteger,parseJSON } from \"../validation.js\";\nconst packageSchema=z.object({version:z.string(),dependencies:z.record(z.string())});\n// Minimal, portable local Gateway entrypoint. No implicit public network binding.\nimport { access,readFile } from \"node:fs/promises\";\nimport path from \"node:path\";\n\nconst project=packageRoot;\nconst pkg=packageSchema.parse(parseJSON(await readFile(path.join(project,\"package.json\"),\"utf8\")));\nconst command=process.argv[2]||\"help\";\n\nfunction help(){\n  process.stdout.write(`Mac MCP Gateway ${pkg.version}\n\nUsage:\n  mac-mcp-gateway instance create NAME --project /absolute/path\n  mac-mcp-gateway instance list [--json]\n  mac-mcp-gateway instance import FILE --name NAME [--link]\n  mac-mcp-gateway instance copy|rename NAME NEW_NAME\n  mac-mcp-gateway instance default|archive|restore NAME\n  mac-mcp-gateway instance migrate [setup|live] [--confirm]\n  mac-mcp-gateway config path|show|edit|validate|diff|apply --instance NAME\n  mac-mcp-gateway run|stop|status|doctor|verify|logs --instance NAME\n  mac-mcp-gateway status --all --json\n\n  mac-mcp-gateway run [--port N]         Foreground; Ctrl+C stops; current OS account\n  mac-mcp-gateway run --app-parent-pid PID  App-owned foreground; stops if GUI parent exits\n  mac-mcp-gateway stop                 Stop the Core at the configured local endpoint\n  mac-mcp-gateway status               Human-readable health for the configured Core\n  mac-mcp-gateway status --json        Original structured status for scripts/agents\n  mac-mcp-gateway logs [--lines N]     Inspect local Gateway logs (owner only)\n  mac-mcp-gateway privacy [--all] [--target /absolute/path]\n                                          macOS only: compare terminal and Gateway protected-directory access\n\n  mac-mcp-gateway access              Show access mode and client credentials\n  mac-mcp-gateway access create \"Name\" Create a key (displayed once)\n  mac-mcp-gateway access mode api-key Require a key on every MCP request\n  mac-mcp-gateway access mode ingress Delegate access control to ingress\n  mac-mcp-gateway access revoke ID    Revoke one credential immediately\n  mac-mcp-gateway access oauth configure --issuer URL --resource URL --client-id ID --subjects SUBJECT\n                                      Discover and save OAuth settings; does not enable auth\n  mac-mcp-gateway access oauth doctor  Check OAuth discovery and PKCE support\n  mac-mcp-gateway access mode oauth    Require OAuth on MCP requests\n  mac-mcp-gateway access revoke-oauth ID Revoke an OAuth session locally\n  mac-mcp-gateway access owner-token  Show the local Dashboard management token\n\n  mac-mcp-gateway setup               Configure local access and connection preference\n  mac-mcp-gateway doctor              Check saved configuration and Desktop Commander\n  mac-mcp-gateway verify              Verify the running local MCP endpoint\n\n  --profile auto|live|setup            Advanced configuration selection only\n  run --json                          Structured startup identity and lifecycle events\n\nConfiguration:\n  Saved onboarding settings take precedence over legacy installation settings.\n  run always starts the Core shipped with this CLI and displays its build identity.\n\nAdvanced environment-based doctor:\n  MAC_MCP_PROJECT_ROOT=/absolute/canonical/project\n\nOptional:\n  MAC_MCP_WORKSPACE_MODE=read-only|read-write       (default read-only)\n  MAC_MCP_PROJECT_PORT=8793                         (127.0.0.1 only)\n  MAC_MCP_DEV_COMMANDS=presets|trusted-project      (default presets)\n  MAC_MCP_GIT_MODE=off|review|write|push             (default off)\n  MAC_MCP_WORKTREE_MODE=off|linked                  (default off)\n\nIMPORTANT: trusted-project Shell inherits the current OS account's permissions.\nThe Core binds loopback. Configure protected HTTPS or Tunnel for remote access.\nGateway key authentication is optional; access defaults to managed by ingress.\n`);\n}\nasync function doctor(){\n  const facts: {event:string;node:string;platform:string;workspaceConfigured:boolean;mode:string;devCommands:string;upstreamVersion:string|null;workspaceValidated?:boolean;workspaceMode?:string;gitMode?:string;worktreeMode?:string;desktopCommanderTools?:number;result?:string;reason?:string}={event:\"GATEWAY_DOCTOR\",node:process.version,platform:process.platform,\n    workspaceConfigured:Boolean(process.env.MAC_MCP_PROJECT_ROOT),\n    mode:process.env.MAC_MCP_WORKSPACE_MODE||\"read-only\",\n    devCommands:process.env.MAC_MCP_DEV_COMMANDS||\"presets\",\n    upstreamVersion:pkg.dependencies?.[\"@wonderwhy-er/desktop-commander\"]||null};\n  let code=0;\n  try{\n    const {createProjectPolicy}=await import(\"../project-workspace-policy.js\");\n    const {LocalDesktopReadProbe}=await import(\"../local-desktop-read-probe.js\");\n    supportedHost();\n    if(!facts.workspaceConfigured)throw Error(\"MAC_MCP_PROJECT_ROOT_REQUIRED\");\n    const nativeAccessMode=process.env.MAC_MCP_DC_ACCESS_MODE||\"workspace\";\n    if(![\"workspace\",\"native\"].includes(nativeAccessMode)||\n       (nativeAccessMode===\"native\"&&\n        (facts.devCommands!==\"trusted-project\"||facts.mode!==\"read-write\")))\n      throw Error(\"NATIVE_ACCESS_REQUIRES_OWNER_TRUSTED_DEVELOPER_PROFILE\");\n    const policy=await createProjectPolicy({\n      root:process.env.MAC_MCP_PROJECT_ROOT,\n      mode:facts.mode,developerCommands:facts.devCommands,\n      allowTrustedHomeRoot:nativeAccessMode===\"native\"&&facts.devCommands===\"trusted-project\"\n    });\n    facts.workspaceValidated=true;\n    facts.workspaceMode=policy.mode;\n    const desiredPort=Number(process.env.MAC_MCP_PROJECT_PORT||8793);\n    if(!isInteger(desiredPort)||desiredPort<0||desiredPort>65535)\n      throw Error(\"INVALID_PROJECT_PORT\");\n    const gitMode=process.env.MAC_MCP_GIT_MODE||\"off\";\n    if(![\"off\",\"review\",\"write\",\"push\"].includes(gitMode))throw Error(\"INVALID_GIT_MODE\");\n    facts.gitMode=gitMode;\n    const worktreeMode=process.env.MAC_MCP_WORKTREE_MODE||\"off\";\n    if(![\"off\",\"linked\"].includes(worktreeMode))throw Error(\"INVALID_WORKTREE_MODE\");\n    facts.worktreeMode=worktreeMode;\n    await access(desktopCommanderEntry);\n    const dc=new LocalDesktopReadProbe({\n      writeScope:process.env.MAC_MCP_DC_WRITE_SCOPE||\"unrestricted\"\n    });\n    try{\n      await dc.connect();\n      facts.desktopCommanderTools=dc.upstreamCatalog.length;\n      if(!dc.upstreamCatalog.some(t=>t.name===\"start_process\"))\n        throw Error(\"DESKTOP_COMMANDER_START_PROCESS_MISSING\");\n      facts.result=\"PASS\";\n    }finally{await dc.close().catch(()=>{});}\n  }catch(error){\n    facts.result=\"FAIL\";\n    facts.reason=String(errorCode(error)||errorMessage(error)||\"UNKNOWN\").slice(0,100);\n    code=1;\n  }\n  // Never include access tokens, project paths, command arguments or private filenames.\n  process.stdout.write(JSON.stringify(facts)+\"\\n\");\n  process.exitCode=code;\n}\nif(await (await import(\"./instances.js\")).maybeHandleInstances(process.argv.slice(2))){\n  // Shared named-instance commands own their complete lifecycle.\n}else if(command===\"setup\"){\n  process.argv.splice(2,1);\n  await import(\"./setup-wizard.js\");\n}else if(command===\"access\"){\n  try{await (await import(\"./access.js\")).accessCommand(process.argv.slice(3));}\n  catch(error){process.stderr.write(\"GATEWAY_ACCESS_ERROR \"+errorMessage(error)+\"\\n\");process.exitCode=1;}\n}else if(command===\"verify\"){\n  await import(\"./verify-setup.js\");\n}else if(command===\"help\"||command===\"--help\"||command===\"-h\"){\n  help();\n}else if(command===\"doctor\"){\n  if(process.env.MAC_MCP_PROJECT_ROOT)await doctor();\n  else{\n    try{\n      const {loadSetupConfig,setupRuntimeEnv}=await import(\"../release1-onboarding.js\");\n      Object.assign(process.env,setupRuntimeEnv(await loadSetupConfig()));\n      await doctor();\n    }catch(error){\n      if(errorCode(error)===\"ENOENT\")await doctor();\n      else process.stdout.write(JSON.stringify({event:\"GATEWAY_DOCTOR\",result:\"FAIL\",\n        reason:errorCode(error)||errorMessage(error)})+\"\\n\");\n      process.stderr.write(\"Run mac-mcp-gateway setup to configure local access.\\n\");\n      process.exitCode=1;\n    }\n  }\n }else if([\"run\",\"install\",\"start\",\"stop\",\"restart\",\"status\",\"logs\",\"privacy\"].includes(command)){\n  try{\n    const {parseArgs,operatorCommand}=await import(\"../operator-cli.js\");\n    const {options}=parseArgs(process.argv.slice(2));\n    const result=await operatorCommand(command,{\n      ...options,entry:cliEntry()\n    });\n    if(result.event===\"GATEWAY_LOGS\")process.stdout.write(result.output);\n    else if(result.event===\"GATEWAY_RUN_EXIT\"&&!options.json&&options.appParentPid===undefined)\n      process.stdout.write(result.code===0?\"  Gateway stopped.\\n\":`  Gateway exited with code ${result.code}.\\n`);\n    else if(result.event===\"GATEWAY_STATUS\"&&!options.json){\n      const {formatGatewayStatus}=await import(\"../gateway-status-format.js\");\n      process.stdout.write(formatGatewayStatus(result,{\n        version:pkg.version,color:Boolean(process.stdout.isTTY)&&!process.env.NO_COLOR\n      }));\n    }else process.stdout.write(JSON.stringify(result)+\"\\n\");\n    if(result.event===\"GATEWAY_RUN_EXIT\")process.exitCode=result.code;\n  }catch(error){\n    process.stderr.write(\"GATEWAY_CLI_ERROR \"+\n      String(errorCode(error)||errorMessage(error)||\"UNKNOWN\").slice(0,240)+\"\\n\");\n    process.exitCode=1;\n  }\n}else if(command===\"start-raw\"){\n  // Legacy direct entry bypassed global one-Core arbitration. Never allow\n  // a public subprocess to start a second ungoverned production Core.\n  process.stderr.write(\"LEGACY_DIRECT_BOOTSTRAP_DISABLED_USE_SETUP\\n\");\n  process.exitCode=2;\n}else if(command===\"doctor-setup\"||command===\"start-setup\"){\n  try{\n    const {loadSetupConfig,setupRuntimeEnv}=await import(\"../release1-onboarding.js\");\n    if(command===\"start-setup\"){\n      const ownerPid=Number(process.env.MAC_MCP_INTERNAL_SETUP_OWNER_PID);\n      const runId=process.env.MAC_MCP_INTERNAL_SETUP_RUN_ID;\n      const token=process.env.MAC_MCP_INTERNAL_SETUP_TOKEN;\n      const internallyLaunched=Boolean(ownerPid&&runId&&token);\n      if(!internallyLaunched){\n        // Legacy user command is now an alias for supervised CLI Run.\n        const {operatorCommand}=await import(\"../operator-cli.js\");\n        const result=await operatorCommand(\"run\",{\n          profile:\"setup\",entry:cliEntry()\n        });\n        process.stdout.write(JSON.stringify(result)+\"\\n\");\n        if(result.event===\"GATEWAY_RUN_EXIT\")process.exitCode=result.code;\n      }else{\n        const {verifyInternalSetupWorker}=await import(\"../global-core-control.js\");\n        const config=await loadSetupConfig(process.env.MAC_MCP_SETUP_FILE);\n        verifyInternalSetupWorker({\n          port:config.port,ownerPid,runId,token\n        });\n        Object.assign(process.env,setupRuntimeEnv(config));\n        delete process.env.MAC_MCP_UPSTREAMS_FILE;\n        const {runGateway}=await import(\"../dc-workspace-http.js\");\n        await runGateway();\n      }\n    }else{\n      const config=await loadSetupConfig(process.env.MAC_MCP_SETUP_FILE);\n      Object.assign(process.env,setupRuntimeEnv(config));\n      delete process.env.MAC_MCP_UPSTREAMS_FILE;\n      await doctor();\n    }\n  }catch(error){\n    process.stderr.write(\"SETUP_PROFILE_INVALID \"+\n      String(errorCode(error)||errorMessage(error)||\"UNKNOWN\").slice(0,90)+\"\\n\");\n    process.exitCode=1;\n  }\n}else{\n  process.stderr.write(\"Unknown command. Use --help.\\n\");\n  process.exitCode=2;\n}\n"]}
+{"version":3,"file":"mac-mcp-gateway.js","sourceRoot":"","sources":["../../../src/cli/mac-mcp-gateway.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,aAAa,EAAC,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,IAAI,QAAQ,EAAC,WAAW,EAAC,qBAAqB,EAAC,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAC/H,OAAO,EAAE,SAAS,EAAC,YAAY,EAAC,SAAS,EAAC,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9E,MAAM,aAAa,GAAC,CAAC,CAAC,MAAM,CAAC,EAAC,OAAO,EAAC,CAAC,CAAC,MAAM,EAAE,EAAC,YAAY,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAC,eAAe,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAC,CAAC,CAAC;AACrI,kFAAkF;AAClF,OAAO,EAAE,MAAM,EAAC,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,OAAO,GAAC,WAAW,CAAC;AAC1B,MAAM,GAAG,GAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAC,cAAc,CAAC,EAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACnG,MAAM,OAAO,GAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAE,MAAM,CAAC;AAEtC,SAAS,IAAI;IACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,GAAG,CAAC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0DpD,CAAC,CAAC;AACH,CAAC;AACD,KAAK,UAAU,MAAM;IACnB,MAAM,SAAS,GAAC,MAAM,QAAQ,CAAC,2BAA2B,EAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,MAAM,CAAC,EAAC,OAAO,EAAC,CAAC,CAAC,MAAM,EAAE,EAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAE,EAAE,CAAA,IAAI,CAAC,CAAC;IAC/I,MAAM,KAAK,GAAuR,EAAC,KAAK,EAAC,gBAAgB,EAAC,IAAI,EAAC,OAAO,CAAC,OAAO,EAAC,QAAQ,EAAC,OAAO,CAAC,QAAQ;QACtW,mBAAmB,EAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;QAC7D,IAAI,EAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAE,WAAW;QACpD,WAAW,EAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAE,SAAS;QACvD,eAAe,EAAC,SAAS,EAAE,OAAO,IAAE,GAAG,CAAC,YAAY,EAAE,CAAC,iCAAiC,CAAC,IAAE,GAAG,CAAC,eAAe,EAAE,CAAC,iCAAiC,CAAC,IAAE,IAAI,EAAC,CAAC;IAC7J,IAAI,IAAI,GAAC,CAAC,CAAC;IACX,IAAG,CAAC;QACF,MAAM,EAAC,mBAAmB,EAAC,GAAC,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAC;QAC3E,MAAM,EAAC,qBAAqB,EAAC,GAAC,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAC;QAC7E,aAAa,EAAE,CAAC;QAChB,IAAG,CAAC,KAAK,CAAC,mBAAmB;YAAC,MAAM,KAAK,CAAC,+BAA+B,CAAC,CAAC;QAC3E,MAAM,gBAAgB,GAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAE,WAAW,CAAC;QACvE,IAAG,CAAC,CAAC,WAAW,EAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YAClD,CAAC,gBAAgB,KAAG,QAAQ;gBAC3B,CAAC,KAAK,CAAC,WAAW,KAAG,iBAAiB,IAAE,KAAK,CAAC,IAAI,KAAG,YAAY,CAAC,CAAC;YACrE,MAAM,KAAK,CAAC,wDAAwD,CAAC,CAAC;QACxE,MAAM,MAAM,GAAC,MAAM,mBAAmB,CAAC;YACrC,IAAI,EAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB;YACrC,IAAI,EAAC,KAAK,CAAC,IAAI,EAAC,iBAAiB,EAAC,KAAK,CAAC,WAAW;YACnD,oBAAoB,EAAC,gBAAgB,KAAG,QAAQ,IAAE,KAAK,CAAC,WAAW,KAAG,iBAAiB;SACxF,CAAC,CAAC;QACH,KAAK,CAAC,kBAAkB,GAAC,IAAI,CAAC;QAC9B,KAAK,CAAC,aAAa,GAAC,MAAM,CAAC,IAAI,CAAC;QAChC,MAAM,WAAW,GAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAE,IAAI,CAAC,CAAC;QACjE,IAAG,CAAC,SAAS,CAAC,WAAW,CAAC,IAAE,WAAW,GAAC,CAAC,IAAE,WAAW,GAAC,KAAK;YAC1D,MAAM,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACtC,MAAM,OAAO,GAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAE,KAAK,CAAC;QAClD,IAAG,CAAC,CAAC,KAAK,EAAC,QAAQ,EAAC,OAAO,EAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAC,MAAM,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACtF,KAAK,CAAC,OAAO,GAAC,OAAO,CAAC;QACtB,MAAM,YAAY,GAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAE,KAAK,CAAC;QAC5D,IAAG,CAAC,CAAC,KAAK,EAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC;YAAC,MAAM,KAAK,CAAC,uBAAuB,CAAC,CAAC;QACjF,KAAK,CAAC,YAAY,GAAC,YAAY,CAAC;QAChC,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;QACpC,MAAM,EAAE,GAAC,IAAI,qBAAqB,CAAC;YACjC,UAAU,EAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAE,cAAc;SAC9D,CAAC,CAAC;QACH,IAAG,CAAC;YACF,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;YACnB,KAAK,CAAC,qBAAqB,GAAC,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC;YACtD,IAAG,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,IAAI,KAAG,eAAe,CAAC;gBACtD,MAAM,KAAK,CAAC,yCAAyC,CAAC,CAAC;YACzD,KAAK,CAAC,MAAM,GAAC,MAAM,CAAC;QACtB,CAAC;gBAAO,CAAC;YAAA,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAE,EAAE,GAAC,CAAC,CAAC,CAAC;QAAA,CAAC;IAC3C,CAAC;IAAA,OAAM,KAAK,EAAC,CAAC;QACZ,KAAK,CAAC,MAAM,GAAC,MAAM,CAAC;QACpB,KAAK,CAAC,MAAM,GAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAE,YAAY,CAAC,KAAK,CAAC,IAAE,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,EAAC,GAAG,CAAC,CAAC;QACnF,IAAI,GAAC,CAAC,CAAC;IACT,CAAC;IACD,sFAAsF;IACtF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAC,IAAI,CAAC,CAAC;IACjD,OAAO,CAAC,QAAQ,GAAC,IAAI,CAAC;AACxB,CAAC;AACD,IAAG,MAAM,CAAC,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAC,CAAC;IACrF,+DAA+D;AACjE,CAAC;KAAK,IAAG,OAAO,KAAG,OAAO,EAAC,CAAC;IAC1B,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAC,CAAC,CAAC,CAAC;IACzB,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;AACpC,CAAC;KAAK,IAAG,OAAO,KAAG,QAAQ,EAAC,CAAC;IAC3B,IAAG,CAAC;QAAA,MAAM,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAAA,CAAC;IAC9E,OAAM,KAAK,EAAC,CAAC;QAAA,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,GAAC,YAAY,CAAC,KAAK,CAAC,GAAC,IAAI,CAAC,CAAC;QAAA,OAAO,CAAC,QAAQ,GAAC,CAAC,CAAC;IAAA,CAAC;AAC1G,CAAC;KAAK,IAAG,OAAO,KAAG,QAAQ,EAAC,CAAC;IAC3B,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;AACpC,CAAC;KAAK,IAAG,OAAO,KAAG,MAAM,IAAE,OAAO,KAAG,QAAQ,IAAE,OAAO,KAAG,IAAI,EAAC,CAAC;IAC7D,IAAI,EAAE,CAAC;AACT,CAAC;KAAK,IAAG,OAAO,KAAG,QAAQ,EAAC,CAAC;IAC3B,IAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB;QAAC,MAAM,MAAM,EAAE,CAAC;SAC/C,CAAC;QACH,IAAG,CAAC;YACF,MAAM,EAAC,eAAe,EAAC,eAAe,EAAC,GAAC,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC;YAClF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAC,eAAe,CAAC,MAAM,eAAe,EAAE,CAAC,CAAC,CAAC;YACpE,MAAM,MAAM,EAAE,CAAC;QACjB,CAAC;QAAA,OAAM,KAAK,EAAC,CAAC;YACZ,IAAG,SAAS,CAAC,KAAK,CAAC,KAAG,QAAQ;gBAAC,MAAM,MAAM,EAAE,CAAC;;gBACzC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAC,KAAK,EAAC,gBAAgB,EAAC,MAAM,EAAC,MAAM;oBAC5E,MAAM,EAAC,SAAS,CAAC,KAAK,CAAC,IAAE,YAAY,CAAC,KAAK,CAAC,EAAC,CAAC,GAAC,IAAI,CAAC,CAAC;YACvD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAC;YAC/E,OAAO,CAAC,QAAQ,GAAC,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;AACF,CAAC;KAAK,IAAG,CAAC,KAAK,EAAC,SAAS,EAAC,OAAO,EAAC,MAAM,EAAC,SAAS,EAAC,QAAQ,EAAC,MAAM,EAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAC,CAAC;IAChG,IAAG,CAAC;QACF,MAAM,EAAC,SAAS,EAAC,eAAe,EAAC,GAAC,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;QACrE,MAAM,EAAC,OAAO,EAAC,GAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACjD,MAAM,MAAM,GAAC,MAAM,eAAe,CAAC,OAAO,EAAC;YACzC,GAAG,OAAO,EAAC,KAAK,EAAC,QAAQ,EAAE;SAC5B,CAAC,CAAC;QACH,IAAG,MAAM,CAAC,KAAK,KAAG,cAAc;YAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;aAChE,IAAG,MAAM,CAAC,KAAK,KAAG,kBAAkB,IAAE,CAAC,OAAO,CAAC,IAAI,IAAE,OAAO,CAAC,YAAY,KAAG,SAAS;YACxF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,KAAG,CAAC,CAAA,CAAC,CAAA,sBAAsB,CAAA,CAAC,CAAA,8BAA8B,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC;aACzG,IAAG,MAAM,CAAC,KAAK,KAAG,gBAAgB,IAAE,CAAC,OAAO,CAAC,IAAI,EAAC,CAAC;YACtD,MAAM,EAAC,mBAAmB,EAAC,GAAC,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;YACxE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,MAAM,EAAC;gBAC9C,OAAO,EAAC,GAAG,CAAC,OAAO,EAAC,KAAK,EAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAE,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ;aAC/E,CAAC,CAAC,CAAC;QACN,CAAC;;YAAK,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAC,IAAI,CAAC,CAAC;QACxD,IAAG,MAAM,CAAC,KAAK,KAAG,kBAAkB;YAAC,OAAO,CAAC,QAAQ,GAAC,MAAM,CAAC,IAAI,CAAC;IACpE,CAAC;IAAA,OAAM,KAAK,EAAC,CAAC;QACZ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB;YACvC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAE,YAAY,CAAC,KAAK,CAAC,IAAE,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,EAAC,GAAG,CAAC,GAAC,IAAI,CAAC,CAAC;QAC9E,OAAO,CAAC,QAAQ,GAAC,CAAC,CAAC;IACrB,CAAC;AACH,CAAC;KAAK,IAAG,OAAO,KAAG,WAAW,EAAC,CAAC;IAC9B,wEAAwE;IACxE,oEAAoE;IACpE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;IACrE,OAAO,CAAC,QAAQ,GAAC,CAAC,CAAC;AACrB,CAAC;KAAK,IAAG,OAAO,KAAG,cAAc,IAAE,OAAO,KAAG,aAAa,EAAC,CAAC;IAC1D,IAAG,CAAC;QACF,MAAM,EAAC,eAAe,EAAC,eAAe,EAAC,GAAC,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC;QAClF,IAAG,OAAO,KAAG,aAAa,EAAC,CAAC;YAC1B,MAAM,QAAQ,GAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;YACpE,MAAM,KAAK,GAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC;YACtD,MAAM,KAAK,GAAC,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;YACrD,MAAM,kBAAkB,GAAC,OAAO,CAAC,QAAQ,IAAE,KAAK,IAAE,KAAK,CAAC,CAAC;YACzD,IAAG,CAAC,kBAAkB,EAAC,CAAC;gBACtB,8DAA8D;gBAC9D,MAAM,EAAC,eAAe,EAAC,GAAC,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;gBAC3D,MAAM,MAAM,GAAC,MAAM,eAAe,CAAC,KAAK,EAAC;oBACvC,OAAO,EAAC,OAAO,EAAC,KAAK,EAAC,QAAQ,EAAE;iBACjC,CAAC,CAAC;gBACH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAC,IAAI,CAAC,CAAC;gBAClD,IAAG,MAAM,CAAC,KAAK,KAAG,kBAAkB;oBAAC,OAAO,CAAC,QAAQ,GAAC,MAAM,CAAC,IAAI,CAAC;YACpE,CAAC;iBAAI,CAAC;gBACJ,MAAM,EAAC,yBAAyB,EAAC,GAAC,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC;gBAC5E,MAAM,MAAM,GAAC,MAAM,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;gBACnE,yBAAyB,CAAC;oBACxB,IAAI,EAAC,MAAM,CAAC,IAAI,EAAC,QAAQ,EAAC,KAAK,EAAC,KAAK;iBACtC,CAAC,CAAC;gBACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;gBACnD,OAAO,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;gBAC1C,MAAM,EAAC,UAAU,EAAC,GAAC,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;gBAC3D,MAAM,UAAU,EAAE,CAAC;YACrB,CAAC;QACH,CAAC;aAAI,CAAC;YACJ,MAAM,MAAM,GAAC,MAAM,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;YACnE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;YACnD,OAAO,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;YAC1C,MAAM,MAAM,EAAE,CAAC;QACjB,CAAC;IACH,CAAC;IAAA,OAAM,KAAK,EAAC,CAAC;QACZ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB;YAC3C,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAE,YAAY,CAAC,KAAK,CAAC,IAAE,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,EAAC,EAAE,CAAC,GAAC,IAAI,CAAC,CAAC;QAC7E,OAAO,CAAC,QAAQ,GAAC,CAAC,CAAC;IACrB,CAAC;AACH,CAAC;KAAI,CAAC;IACJ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACvD,OAAO,CAAC,QAAQ,GAAC,CAAC,CAAC;AACrB,CAAC","sourcesContent":["import {supportedHost} from \"../platform.js\";\nimport { z } from \"zod\";\nimport { legacyCliEntry as cliEntry,packageRoot,desktopCommanderEntry,desktopCommanderPackageJson } from \"../runtime-paths.js\";\nimport { errorCode,errorMessage,isInteger,parseJSON } from \"../validation.js\";\nconst packageSchema=z.object({version:z.string(),dependencies:z.record(z.string()),devDependencies:z.record(z.string()).optional()});\n// Minimal, portable local Gateway entrypoint. No implicit public network binding.\nimport { access,readFile } from \"node:fs/promises\";\nimport path from \"node:path\";\n\nconst project=packageRoot;\nconst pkg=packageSchema.parse(parseJSON(await readFile(path.join(project,\"package.json\"),\"utf8\")));\nconst command=process.argv[2]||\"help\";\n\nfunction help(){\n  process.stdout.write(`Mac MCP Gateway ${pkg.version}\n\nUsage:\n  mac-mcp-gateway instance create NAME --project /absolute/path\n  mac-mcp-gateway instance list [--json]\n  mac-mcp-gateway instance import FILE --name NAME [--link]\n  mac-mcp-gateway instance copy|rename NAME NEW_NAME\n  mac-mcp-gateway instance default|archive|restore NAME\n  mac-mcp-gateway instance migrate [setup|live] [--confirm]\n  mac-mcp-gateway config path|show|edit|validate|diff|apply --instance NAME\n  mac-mcp-gateway run|stop|status|doctor|verify|logs --instance NAME\n  mac-mcp-gateway status --all --json\n\n  mac-mcp-gateway run [--port N]         Foreground; Ctrl+C stops; current OS account\n  mac-mcp-gateway run --app-parent-pid PID  App-owned foreground; stops if GUI parent exits\n  mac-mcp-gateway stop                 Stop the Core at the configured local endpoint\n  mac-mcp-gateway status               Human-readable health for the configured Core\n  mac-mcp-gateway status --json        Original structured status for scripts/agents\n  mac-mcp-gateway logs [--lines N]     Inspect local Gateway logs (owner only)\n  mac-mcp-gateway privacy [--all] [--target /absolute/path]\n                                          macOS only: compare terminal and Gateway protected-directory access\n\n  mac-mcp-gateway access              Show access mode and client credentials\n  mac-mcp-gateway access create \"Name\" Create a key (displayed once)\n  mac-mcp-gateway access mode api-key Require a key on every MCP request\n  mac-mcp-gateway access mode ingress Delegate access control to ingress\n  mac-mcp-gateway access revoke ID    Revoke one credential immediately\n  mac-mcp-gateway access oauth configure --issuer URL --resource URL --client-id ID --subjects SUBJECT\n                                      Discover and save OAuth settings; does not enable auth\n  mac-mcp-gateway access oauth doctor  Check OAuth discovery and PKCE support\n  mac-mcp-gateway access mode oauth    Require OAuth on MCP requests\n  mac-mcp-gateway access revoke-oauth ID Revoke an OAuth session locally\n  mac-mcp-gateway access owner-token  Show the local Dashboard management token\n\n  mac-mcp-gateway setup               Configure local access and connection preference\n  mac-mcp-gateway doctor              Check saved configuration and Desktop Commander\n  mac-mcp-gateway verify              Verify the running local MCP endpoint\n\n  --profile auto|live|setup            Advanced configuration selection only\n  run --json                          Structured startup identity and lifecycle events\n\nConfiguration:\n  Saved onboarding settings take precedence over legacy installation settings.\n  run always starts the Core shipped with this CLI and displays its build identity.\n\nAdvanced environment-based doctor:\n  MAC_MCP_PROJECT_ROOT=/absolute/canonical/project\n\nOptional:\n  MAC_MCP_WORKSPACE_MODE=read-only|read-write       (default read-only)\n  MAC_MCP_PROJECT_PORT=8793                         (127.0.0.1 only)\n  MAC_MCP_DEV_COMMANDS=presets|trusted-project      (default presets)\n  MAC_MCP_GIT_MODE=off|review|write|push             (default off)\n  MAC_MCP_WORKTREE_MODE=off|linked                  (default off)\n\nIMPORTANT: trusted-project Shell inherits the current OS account's permissions.\nThe Core binds loopback. Configure protected HTTPS or Tunnel for remote access.\nGateway key authentication is optional; access defaults to managed by ingress.\n`);\n}\nasync function doctor(){\n  const vendorPkg=await readFile(desktopCommanderPackageJson,\"utf8\").then(t=>z.object({version:z.string()}).parse(parseJSON(t))).catch(()=>null);\n  const facts: {event:string;node:string;platform:string;workspaceConfigured:boolean;mode:string;devCommands:string;upstreamVersion:string|null;workspaceValidated?:boolean;workspaceMode?:string;gitMode?:string;worktreeMode?:string;desktopCommanderTools?:number;result?:string;reason?:string}={event:\"GATEWAY_DOCTOR\",node:process.version,platform:process.platform,\n    workspaceConfigured:Boolean(process.env.MAC_MCP_PROJECT_ROOT),\n    mode:process.env.MAC_MCP_WORKSPACE_MODE||\"read-only\",\n    devCommands:process.env.MAC_MCP_DEV_COMMANDS||\"presets\",\n    upstreamVersion:vendorPkg?.version||pkg.dependencies?.[\"@wonderwhy-er/desktop-commander\"]||pkg.devDependencies?.[\"@wonderwhy-er/desktop-commander\"]||null};\n  let code=0;\n  try{\n    const {createProjectPolicy}=await import(\"../project-workspace-policy.js\");\n    const {LocalDesktopReadProbe}=await import(\"../local-desktop-read-probe.js\");\n    supportedHost();\n    if(!facts.workspaceConfigured)throw Error(\"MAC_MCP_PROJECT_ROOT_REQUIRED\");\n    const nativeAccessMode=process.env.MAC_MCP_DC_ACCESS_MODE||\"workspace\";\n    if(![\"workspace\",\"native\"].includes(nativeAccessMode)||\n       (nativeAccessMode===\"native\"&&\n        (facts.devCommands!==\"trusted-project\"||facts.mode!==\"read-write\")))\n      throw Error(\"NATIVE_ACCESS_REQUIRES_OWNER_TRUSTED_DEVELOPER_PROFILE\");\n    const policy=await createProjectPolicy({\n      root:process.env.MAC_MCP_PROJECT_ROOT,\n      mode:facts.mode,developerCommands:facts.devCommands,\n      allowTrustedHomeRoot:nativeAccessMode===\"native\"&&facts.devCommands===\"trusted-project\"\n    });\n    facts.workspaceValidated=true;\n    facts.workspaceMode=policy.mode;\n    const desiredPort=Number(process.env.MAC_MCP_PROJECT_PORT||8793);\n    if(!isInteger(desiredPort)||desiredPort<0||desiredPort>65535)\n      throw Error(\"INVALID_PROJECT_PORT\");\n    const gitMode=process.env.MAC_MCP_GIT_MODE||\"off\";\n    if(![\"off\",\"review\",\"write\",\"push\"].includes(gitMode))throw Error(\"INVALID_GIT_MODE\");\n    facts.gitMode=gitMode;\n    const worktreeMode=process.env.MAC_MCP_WORKTREE_MODE||\"off\";\n    if(![\"off\",\"linked\"].includes(worktreeMode))throw Error(\"INVALID_WORKTREE_MODE\");\n    facts.worktreeMode=worktreeMode;\n    await access(desktopCommanderEntry);\n    const dc=new LocalDesktopReadProbe({\n      writeScope:process.env.MAC_MCP_DC_WRITE_SCOPE||\"unrestricted\"\n    });\n    try{\n      await dc.connect();\n      facts.desktopCommanderTools=dc.upstreamCatalog.length;\n      if(!dc.upstreamCatalog.some(t=>t.name===\"start_process\"))\n        throw Error(\"DESKTOP_COMMANDER_START_PROCESS_MISSING\");\n      facts.result=\"PASS\";\n    }finally{await dc.close().catch(()=>{});}\n  }catch(error){\n    facts.result=\"FAIL\";\n    facts.reason=String(errorCode(error)||errorMessage(error)||\"UNKNOWN\").slice(0,100);\n    code=1;\n  }\n  // Never include access tokens, project paths, command arguments or private filenames.\n  process.stdout.write(JSON.stringify(facts)+\"\\n\");\n  process.exitCode=code;\n}\nif(await (await import(\"./instances.js\")).maybeHandleInstances(process.argv.slice(2))){\n  // Shared named-instance commands own their complete lifecycle.\n}else if(command===\"setup\"){\n  process.argv.splice(2,1);\n  await import(\"./setup-wizard.js\");\n}else if(command===\"access\"){\n  try{await (await import(\"./access.js\")).accessCommand(process.argv.slice(3));}\n  catch(error){process.stderr.write(\"GATEWAY_ACCESS_ERROR \"+errorMessage(error)+\"\\n\");process.exitCode=1;}\n}else if(command===\"verify\"){\n  await import(\"./verify-setup.js\");\n}else if(command===\"help\"||command===\"--help\"||command===\"-h\"){\n  help();\n}else if(command===\"doctor\"){\n  if(process.env.MAC_MCP_PROJECT_ROOT)await doctor();\n  else{\n    try{\n      const {loadSetupConfig,setupRuntimeEnv}=await import(\"../release1-onboarding.js\");\n      Object.assign(process.env,setupRuntimeEnv(await loadSetupConfig()));\n      await doctor();\n    }catch(error){\n      if(errorCode(error)===\"ENOENT\")await doctor();\n      else process.stdout.write(JSON.stringify({event:\"GATEWAY_DOCTOR\",result:\"FAIL\",\n        reason:errorCode(error)||errorMessage(error)})+\"\\n\");\n      process.stderr.write(\"Run mac-mcp-gateway setup to configure local access.\\n\");\n      process.exitCode=1;\n    }\n  }\n }else if([\"run\",\"install\",\"start\",\"stop\",\"restart\",\"status\",\"logs\",\"privacy\"].includes(command)){\n  try{\n    const {parseArgs,operatorCommand}=await import(\"../operator-cli.js\");\n    const {options}=parseArgs(process.argv.slice(2));\n    const result=await operatorCommand(command,{\n      ...options,entry:cliEntry()\n    });\n    if(result.event===\"GATEWAY_LOGS\")process.stdout.write(result.output);\n    else if(result.event===\"GATEWAY_RUN_EXIT\"&&!options.json&&options.appParentPid===undefined)\n      process.stdout.write(result.code===0?\"  Gateway stopped.\\n\":`  Gateway exited with code ${result.code}.\\n`);\n    else if(result.event===\"GATEWAY_STATUS\"&&!options.json){\n      const {formatGatewayStatus}=await import(\"../gateway-status-format.js\");\n      process.stdout.write(formatGatewayStatus(result,{\n        version:pkg.version,color:Boolean(process.stdout.isTTY)&&!process.env.NO_COLOR\n      }));\n    }else process.stdout.write(JSON.stringify(result)+\"\\n\");\n    if(result.event===\"GATEWAY_RUN_EXIT\")process.exitCode=result.code;\n  }catch(error){\n    process.stderr.write(\"GATEWAY_CLI_ERROR \"+\n      String(errorCode(error)||errorMessage(error)||\"UNKNOWN\").slice(0,240)+\"\\n\");\n    process.exitCode=1;\n  }\n}else if(command===\"start-raw\"){\n  // Legacy direct entry bypassed global one-Core arbitration. Never allow\n  // a public subprocess to start a second ungoverned production Core.\n  process.stderr.write(\"LEGACY_DIRECT_BOOTSTRAP_DISABLED_USE_SETUP\\n\");\n  process.exitCode=2;\n}else if(command===\"doctor-setup\"||command===\"start-setup\"){\n  try{\n    const {loadSetupConfig,setupRuntimeEnv}=await import(\"../release1-onboarding.js\");\n    if(command===\"start-setup\"){\n      const ownerPid=Number(process.env.MAC_MCP_INTERNAL_SETUP_OWNER_PID);\n      const runId=process.env.MAC_MCP_INTERNAL_SETUP_RUN_ID;\n      const token=process.env.MAC_MCP_INTERNAL_SETUP_TOKEN;\n      const internallyLaunched=Boolean(ownerPid&&runId&&token);\n      if(!internallyLaunched){\n        // Legacy user command is now an alias for supervised CLI Run.\n        const {operatorCommand}=await import(\"../operator-cli.js\");\n        const result=await operatorCommand(\"run\",{\n          profile:\"setup\",entry:cliEntry()\n        });\n        process.stdout.write(JSON.stringify(result)+\"\\n\");\n        if(result.event===\"GATEWAY_RUN_EXIT\")process.exitCode=result.code;\n      }else{\n        const {verifyInternalSetupWorker}=await import(\"../global-core-control.js\");\n        const config=await loadSetupConfig(process.env.MAC_MCP_SETUP_FILE);\n        verifyInternalSetupWorker({\n          port:config.port,ownerPid,runId,token\n        });\n        Object.assign(process.env,setupRuntimeEnv(config));\n        delete process.env.MAC_MCP_UPSTREAMS_FILE;\n        const {runGateway}=await import(\"../dc-workspace-http.js\");\n        await runGateway();\n      }\n    }else{\n      const config=await loadSetupConfig(process.env.MAC_MCP_SETUP_FILE);\n      Object.assign(process.env,setupRuntimeEnv(config));\n      delete process.env.MAC_MCP_UPSTREAMS_FILE;\n      await doctor();\n    }\n  }catch(error){\n    process.stderr.write(\"SETUP_PROFILE_INVALID \"+\n      String(errorCode(error)||errorMessage(error)||\"UNKNOWN\").slice(0,90)+\"\\n\");\n    process.exitCode=1;\n  }\n}else{\n  process.stderr.write(\"Unknown command. Use --help.\\n\");\n  process.exitCode=2;\n}\n"]}

package/dist/src/cli/starmux-status.js

@@ -0,0 +1,122 @@
+import { createAccessControl } from '../access-control.js';
+import { exists, instancePaths } from '../instance-store.js';
+import { shellQuote } from '../platform.js';
+async function authentication(instance, status) {
+    const file = instancePaths(instance).access;
+    try {
+        const state = await (await createAccessControl(file, { initialize: false })).snapshot();
+        if (status.phase === 'running' && status.health === 'ok' && status.accessMode !== state.mode) {
+            return { mode: null, activeKeys: 0, oauth: null, problem: 'Authentication changed while checking. Run status again.' };
+        }
+        const incomplete = status.phase !== 'running' && instance.requiredAccess !== 'ingress' && state.mode !== instance.requiredAccess;
+        return { mode: state.mode, activeKeys: state.credentials.filter(c => c.status === 'active').length,
+            oauth: state.oauth ? { issuer: state.oauth.issuer, resource: state.oauth.resource, clientId: state.oauth.clientId, scope: state.oauth.scope, tokenAuth: state.oauth.tokenEndpointAuthMethod } : null,
+            problem: incomplete ? `This instance requires ${instance.requiredAccess} authentication before starting.` : null };
+    }
+    catch (error) {
+        // A new, never-started instance has an ingress default, but a lost store must
+        // never be presented as an intentional switch to unauthenticated access.
+        if (error.code === 'ENOENT' && status.phase === 'stopped' && instance.requiredAccess === 'ingress' && !await exists(file + '.initialized')) {
+            return { mode: 'ingress', activeKeys: 0, oauth: null, problem: null };
+        }
+        return { mode: null, activeKeys: 0, oauth: null, problem: 'Authentication settings are unavailable. Inspect them with the Auth command below.' };
+    }
+}
+export async function formatStarmuxStatus(instance, status, config, options = {}) {
+    const auth = await authentication(instance, status);
+    // Omit `-i default` for the default instance to keep everyday single-instance output clean.
+    const omitSelector = options.isDefault === true && instance.name === 'default';
+    const selector = /^[A-Za-z0-9_.-]+$/.test(instance.name) && !instance.name.startsWith('-') ? instance.name : shellQuote(instance.name);
+    const flag = omitSelector ? '' : (instance.name.startsWith('-') ? ` --instance=${selector}` : ` -i ${selector}`);
+    const command = (action) => `starmux ${action}${flag}`;
+    const ready = status.phase === 'running' && status.health === 'ok';
+    const hasProblem = Boolean(status.configProblem || status.runtimeProblem || auth.problem);
+    const indicator = hasProblem ? '!' : ready ? '●' : status.phase === 'running' ? '◐' : '○';
+    const labels = {
+        ingress: 'None (no token required)',
+        'api-key': `API key (Bearer token; ${auth.activeKeys} active ${auth.activeKeys === 1 ? 'key' : 'keys'})`,
+        oauth: 'OAuth (browser sign-in)'
+    };
+    const saved = status.phase === 'running' ? ' (saved; live state unavailable)' : ' (saved for next start)';
+    const row = (label, value) => '  ' + label.padEnd(16) + value;
+    const codingCmd = command('up --code');
+    const mode = !config
+        ? 'Unavailable'
+        : config.accessRole === 'trusted'
+            ? (config.writeScope === 'home-only' ? 'Coding (Home sandbox · edits, shell & git)' : 'Coding (OS account · edits, shell & git)')
+            : config.mode === 'read-write'
+                ? 'File writes (restricted)'
+                : `Read-only  (run '${codingCmd}' to enable edits & shell)`;
+    const runtime = status.executionMode === 'background'
+        ? 'Background · continues after this terminal closes'
+        : status.executionMode === 'foreground-owned'
+            ? (status.runtime?.launcher === 'app' ? 'App-owned · stops when the app closes' : 'Foreground · Ctrl+C stops this instance')
+            : 'Stopped';
+    const title = omitSelector
+        ? `${indicator} Starmux is ${status.phase}`
+        : `${indicator} Starmux is ${status.phase}  (instance: ${instance.name})`;
+    const lines = ['', title];
+    if (ready && status.port) {
+        lines.push(row('Listen', `http://127.0.0.1:${status.port}/mcp  (this computer only)`));
+    }
+    lines.push(row('Workspace', config?.projectRoot ?? 'Unavailable'), row('Mode', mode), row('Auth', auth.mode ? labels[auth.mode] + (ready ? '' : saved) : 'Unavailable'), row('Runtime', runtime));
+    if (ready && status.port && auth.mode === 'oauth' && auth.oauth) {
+        lines.push(row('Client URL', auth.oauth.resource), row('Issuer', auth.oauth.issuer));
+    }
+    if (status.configProblem || status.runtimeProblem)
+        lines.push(row('Problem', status.configProblem ?? status.runtimeProblem));
+    if (auth.problem)
+        lines.push(row('Auth issue', auth.problem));
+    const keyCommand = command('auth key "My AI Client"');
+    if (ready && !auth.problem) {
+        lines.push('', 'Connect an AI client (MCP settings)');
+        lines.push(row('Transport', 'Streamable HTTP'));
+        if (auth.mode === 'ingress') {
+            lines.push(row('URL (Local)', `http://127.0.0.1:${status.port}/mcp  (AI client on this computer)`), row('URL (Remote)', `https://<your-domain-or-tunnel>/mcp  (via protected HTTPS proxy or tunnel -> 127.0.0.1:${status.port})`), row('Authentication', `None  (optional Bearer API key: ${keyCommand})`));
+        }
+        else if (auth.mode === 'api-key') {
+            lines.push(row('URL (Local)', `http://127.0.0.1:${status.port}/mcp  (AI client on this computer)`), row('URL (Remote)', `https://<your-domain-or-tunnel>/mcp  (via protected HTTPS proxy or tunnel -> 127.0.0.1:${status.port})`), row('Authentication', `Bearer API key  (${auth.activeKeys} active ${auth.activeKeys === 1 ? 'key' : 'keys'})`), row('Header', 'Authorization: Bearer <YOUR_API_KEY>'));
+            if (!auth.activeKeys) {
+                lines.push(row('Create key', `${keyCommand}  (no active keys; required before connecting)`));
+            }
+        }
+        else if (auth.mode === 'oauth' && auth.oauth) {
+            lines.push(row('URL (Remote)', auth.oauth.resource), row('Authentication', 'OAuth (browser sign-in)'), row('Issuer', auth.oauth.issuer), row('Client ID', `${auth.oauth.clientId}  (Scope: ${auth.oauth.scope} · Token auth: ${auth.oauth.tokenAuth})`));
+        }
+    }
+    lines.push('', 'Commands');
+    if (auth.problem) {
+        lines.push(row('Check auth', command('auth')));
+    }
+    else if (!ready) {
+        if (status.phase === 'stopped' && !status.configProblem && !status.runtimeProblem) {
+            if (auth.mode === 'api-key' && !auth.activeKeys)
+                lines.push(row('Create key', keyCommand));
+            lines.push(row('Start', command('up')), row('Start coding', codingCmd));
+        }
+        else {
+            lines.push(row('Diagnose', command('doctor')));
+        }
+    }
+    else {
+        if (auth.mode === 'api-key' && auth.activeKeys) {
+            lines.push(row('Verify', `STARMUX_TOKEN=<key> ${command('verify')}`), row('New API key', keyCommand));
+        }
+        else if (auth.mode === 'oauth') {
+            lines.push(row('Check OAuth', command('auth oauth doctor')), row('Verify', command('verify')));
+        }
+        else {
+            lines.push(row('Verify', command('verify')));
+        }
+    }
+    if (status.configState === 'pending')
+        lines.push(row('Apply config', command('config apply')));
+    lines.push(row('Auth & keys', command('auth')));
+    if (ready)
+        lines.push(row('Dashboard', `${command('dashboard')}  (view & copy settings in browser)`));
+    lines.push(row('Logs', command('logs -f')));
+    if (status.phase === 'running')
+        lines.push(row('Stop', command('down')));
+    return lines.join('\n') + '\n';
+}
+//# sourceMappingURL=starmux-status.js.map

package/dist/src/cli/starmux-status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"starmux-status.js","sourceRoot":"","sources":["../../../src/cli/starmux-status.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,mBAAmB,EAAC,MAAM,sBAAsB,CAAC;AAEzD,OAAO,EAAC,MAAM,EAAC,aAAa,EAAmC,MAAM,sBAAsB,CAAC;AAC5F,OAAO,EAAC,UAAU,EAAC,MAAM,gBAAgB,CAAC;AAO1C,KAAK,UAAU,cAAc,CAAC,QAAiB,EAAC,MAAa;IAC3D,MAAM,IAAI,GAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;IAC1C,IAAG,CAAC;QACF,MAAM,KAAK,GAAC,MAAM,CAAC,MAAM,mBAAmB,CAAC,IAAI,EAAC,EAAC,UAAU,EAAC,KAAK,EAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAClF,IAAG,MAAM,CAAC,KAAK,KAAG,SAAS,IAAE,MAAM,CAAC,MAAM,KAAG,IAAI,IAAE,MAAM,CAAC,UAAU,KAAG,KAAK,CAAC,IAAI,EAAC,CAAC;YACjF,OAAO,EAAC,IAAI,EAAC,IAAI,EAAC,UAAU,EAAC,CAAC,EAAC,KAAK,EAAC,IAAI,EAAC,OAAO,EAAC,0DAA0D,EAAC,CAAC;QAChH,CAAC;QACD,MAAM,UAAU,GAAC,MAAM,CAAC,KAAK,KAAG,SAAS,IAAE,QAAQ,CAAC,cAAc,KAAG,SAAS,IAAE,KAAK,CAAC,IAAI,KAAG,QAAQ,CAAC,cAAc,CAAC;QACrH,OAAO,EAAC,IAAI,EAAC,KAAK,CAAC,IAAI,EAAC,UAAU,EAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,MAAM,KAAG,QAAQ,CAAC,CAAC,MAAM;YACxF,KAAK,EAAC,KAAK,CAAC,KAAK,CAAA,CAAC,CAAA,EAAC,MAAM,EAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAC,QAAQ,EAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAC,QAAQ,EAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAC,KAAK,EAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAC,SAAS,EAAC,KAAK,CAAC,KAAK,CAAC,uBAAuB,EAAC,CAAA,CAAC,CAAA,IAAI;YACpL,OAAO,EAAC,UAAU,CAAA,CAAC,CAAA,0BAA0B,QAAQ,CAAC,cAAc,kCAAkC,CAAA,CAAC,CAAA,IAAI,EAAC,CAAC;IACjH,CAAC;IAAA,OAAM,KAAK,EAAC,CAAC;QACZ,8EAA8E;QAC9E,yEAAyE;QACzE,IAAI,KAA+B,CAAC,IAAI,KAAG,QAAQ,IAAE,MAAM,CAAC,KAAK,KAAG,SAAS,IAAE,QAAQ,CAAC,cAAc,KAAG,SAAS,IAAE,CAAC,MAAM,MAAM,CAAC,IAAI,GAAC,cAAc,CAAC,EAAC,CAAC;YACtJ,OAAO,EAAC,IAAI,EAAC,SAAS,EAAC,UAAU,EAAC,CAAC,EAAC,KAAK,EAAC,IAAI,EAAC,OAAO,EAAC,IAAI,EAAC,CAAC;QAC/D,CAAC;QACD,OAAO,EAAC,IAAI,EAAC,IAAI,EAAC,UAAU,EAAC,CAAC,EAAC,KAAK,EAAC,IAAI,EAAC,OAAO,EAAC,oFAAoF,EAAC,CAAC;IAC1I,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,QAAiB,EAAC,MAAa,EAAC,MAA+B,EAAC,UAA6B,EAAE;IACvI,MAAM,IAAI,GAAC,MAAM,cAAc,CAAC,QAAQ,EAAC,MAAM,CAAC,CAAC;IACjD,4FAA4F;IAC5F,MAAM,YAAY,GAAC,OAAO,CAAC,SAAS,KAAG,IAAI,IAAE,QAAQ,CAAC,IAAI,KAAG,SAAS,CAAC;IACvE,MAAM,QAAQ,GAAC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA,CAAC,CAAA,QAAQ,CAAC,IAAI,CAAA,CAAC,CAAA,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC/H,MAAM,IAAI,GAAC,YAAY,CAAA,CAAC,CAAA,EAAE,CAAA,CAAC,CAAA,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA,CAAC,CAAA,eAAe,QAAQ,EAAE,CAAA,CAAC,CAAA,OAAO,QAAQ,EAAE,CAAC,CAAC;IACvG,MAAM,OAAO,GAAC,CAAC,MAAa,EAAC,EAAE,CAAA,WAAW,MAAM,GAAG,IAAI,EAAE,CAAC;IAC1D,MAAM,KAAK,GAAC,MAAM,CAAC,KAAK,KAAG,SAAS,IAAE,MAAM,CAAC,MAAM,KAAG,IAAI,CAAC;IAC3D,MAAM,UAAU,GAAC,OAAO,CAAC,MAAM,CAAC,aAAa,IAAE,MAAM,CAAC,cAAc,IAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACpF,MAAM,SAAS,GAAC,UAAU,CAAA,CAAC,CAAA,GAAG,CAAA,CAAC,CAAA,KAAK,CAAA,CAAC,CAAA,GAAG,CAAA,CAAC,CAAA,MAAM,CAAC,KAAK,KAAG,SAAS,CAAA,CAAC,CAAA,GAAG,CAAA,CAAC,CAAA,GAAG,CAAC;IAC1E,MAAM,MAAM,GAAC;QACX,OAAO,EAAC,0BAA0B;QAClC,SAAS,EAAC,0BAA0B,IAAI,CAAC,UAAU,WAAW,IAAI,CAAC,UAAU,KAAG,CAAC,CAAA,CAAC,CAAA,KAAK,CAAA,CAAC,CAAA,MAAM,GAAG;QACjG,KAAK,EAAC,yBAAyB;KAChC,CAAC;IACF,MAAM,KAAK,GAAC,MAAM,CAAC,KAAK,KAAG,SAAS,CAAA,CAAC,CAAA,kCAAkC,CAAA,CAAC,CAAA,yBAAyB,CAAC;IAClG,MAAM,GAAG,GAAC,CAAC,KAAY,EAAC,KAAY,EAAC,EAAE,CAAA,IAAI,GAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,GAAC,KAAK,CAAC;IACnE,MAAM,SAAS,GAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACrC,MAAM,IAAI,GAAC,CAAC,MAAM;QAChB,CAAC,CAAA,aAAa;QACd,CAAC,CAAA,MAAM,CAAC,UAAU,KAAG,SAAS;YAC9B,CAAC,CAAA,CAAC,MAAM,CAAC,UAAU,KAAG,WAAW,CAAA,CAAC,CAAA,4CAA4C,CAAA,CAAC,CAAA,0CAA0C,CAAC;YAC1H,CAAC,CAAA,MAAM,CAAC,IAAI,KAAG,YAAY;gBAC3B,CAAC,CAAA,0BAA0B;gBAC3B,CAAC,CAAA,oBAAoB,SAAS,4BAA4B,CAAC;IAC7D,MAAM,OAAO,GAAC,MAAM,CAAC,aAAa,KAAG,YAAY;QAC/C,CAAC,CAAA,mDAAmD;QACpD,CAAC,CAAA,MAAM,CAAC,aAAa,KAAG,kBAAkB;YAC1C,CAAC,CAAA,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,KAAG,KAAK,CAAA,CAAC,CAAA,uCAAuC,CAAA,CAAC,CAAA,yCAAyC,CAAC;YACrH,CAAC,CAAA,SAAS,CAAC;IACb,MAAM,KAAK,GAAC,YAAY;QACtB,CAAC,CAAA,GAAG,SAAS,eAAe,MAAM,CAAC,KAAK,EAAE;QAC1C,CAAC,CAAA,GAAG,SAAS,eAAe,MAAM,CAAC,KAAK,gBAAgB,QAAQ,CAAC,IAAI,GAAG,CAAC;IAC3E,MAAM,KAAK,GAAC,CAAC,EAAE,EAAC,KAAK,CAAC,CAAC;IACvB,IAAG,KAAK,IAAE,MAAM,CAAC,IAAI,EAAC,CAAC;QACrB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAC,oBAAoB,MAAM,CAAC,IAAI,4BAA4B,CAAC,CAAC,CAAC;IACxF,CAAC;IACD,KAAK,CAAC,IAAI,CACR,GAAG,CAAC,WAAW,EAAC,MAAM,EAAE,WAAW,IAAE,aAAa,CAAC,EACnD,GAAG,CAAC,MAAM,EAAC,IAAI,CAAC,EAChB,GAAG,CAAC,MAAM,EAAC,IAAI,CAAC,IAAI,CAAA,CAAC,CAAA,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAC,CAAC,KAAK,CAAA,CAAC,CAAA,EAAE,CAAA,CAAC,CAAA,KAAK,CAAC,CAAA,CAAC,CAAA,aAAa,CAAC,EACtE,GAAG,CAAC,SAAS,EAAC,OAAO,CAAC,CACvB,CAAC;IACF,IAAG,KAAK,IAAE,MAAM,CAAC,IAAI,IAAE,IAAI,CAAC,IAAI,KAAG,OAAO,IAAE,IAAI,CAAC,KAAK,EAAC,CAAC;QACtD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAC,GAAG,CAAC,QAAQ,EAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IACpF,CAAC;IACD,IAAG,MAAM,CAAC,aAAa,IAAE,MAAM,CAAC,cAAc;QAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAC,MAAM,CAAC,aAAa,IAAE,MAAM,CAAC,cAAe,CAAC,CAAC,CAAC;IACvH,IAAG,IAAI,CAAC,OAAO;QAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAE3D,MAAM,UAAU,GAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACpD,IAAG,KAAK,IAAE,CAAC,IAAI,CAAC,OAAO,EAAC,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,EAAE,EAAC,qCAAqC,CAAC,CAAC;QACrD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAC,iBAAiB,CAAC,CAAC,CAAC;QAC/C,IAAG,IAAI,CAAC,IAAI,KAAG,SAAS,EAAC,CAAC;YACxB,KAAK,CAAC,IAAI,CACR,GAAG,CAAC,aAAa,EAAC,oBAAoB,MAAM,CAAC,IAAI,oCAAoC,CAAC,EACtF,GAAG,CAAC,cAAc,EAAC,0FAA0F,MAAM,CAAC,IAAI,GAAG,CAAC,EAC5H,GAAG,CAAC,gBAAgB,EAAC,mCAAmC,UAAU,GAAG,CAAC,CACvE,CAAC;QACJ,CAAC;aAAK,IAAG,IAAI,CAAC,IAAI,KAAG,SAAS,EAAC,CAAC;YAC9B,KAAK,CAAC,IAAI,CACR,GAAG,CAAC,aAAa,EAAC,oBAAoB,MAAM,CAAC,IAAI,oCAAoC,CAAC,EACtF,GAAG,CAAC,cAAc,EAAC,0FAA0F,MAAM,CAAC,IAAI,GAAG,CAAC,EAC5H,GAAG,CAAC,gBAAgB,EAAC,oBAAoB,IAAI,CAAC,UAAU,WAAW,IAAI,CAAC,UAAU,KAAG,CAAC,CAAA,CAAC,CAAA,KAAK,CAAA,CAAC,CAAA,MAAM,GAAG,CAAC,EACvG,GAAG,CAAC,QAAQ,EAAC,sCAAsC,CAAC,CACrD,CAAC;YACF,IAAG,CAAC,IAAI,CAAC,UAAU,EAAC,CAAC;gBACnB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAC,GAAG,UAAU,gDAAgD,CAAC,CAAC,CAAC;YAC9F,CAAC;QACH,CAAC;aAAK,IAAG,IAAI,CAAC,IAAI,KAAG,OAAO,IAAE,IAAI,CAAC,KAAK,EAAC,CAAC;YACxC,KAAK,CAAC,IAAI,CACR,GAAG,CAAC,cAAc,EAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EACvC,GAAG,CAAC,gBAAgB,EAAC,yBAAyB,CAAC,EAC/C,GAAG,CAAC,QAAQ,EAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAC/B,GAAG,CAAC,WAAW,EAAC,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,aAAa,IAAI,CAAC,KAAK,CAAC,KAAK,kBAAkB,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAC9G,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,EAAC,UAAU,CAAC,CAAC;IAC1B,IAAG,IAAI,CAAC,OAAO,EAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC;SAAK,IAAG,CAAC,KAAK,EAAC,CAAC;QACf,IAAG,MAAM,CAAC,KAAK,KAAG,SAAS,IAAE,CAAC,MAAM,CAAC,aAAa,IAAE,CAAC,MAAM,CAAC,cAAc,EAAC,CAAC;YAC1E,IAAG,IAAI,CAAC,IAAI,KAAG,SAAS,IAAE,CAAC,IAAI,CAAC,UAAU;gBAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAC,UAAU,CAAC,CAAC,CAAC;YACpF,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAC,GAAG,CAAC,cAAc,EAAC,SAAS,CAAC,CAAC,CAAC;QACvE,CAAC;aAAI,CAAC;YACJ,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;SAAI,CAAC;QACJ,IAAG,IAAI,CAAC,IAAI,KAAG,SAAS,IAAE,IAAI,CAAC,UAAU,EAAC,CAAC;YACzC,KAAK,CAAC,IAAI,CACR,GAAG,CAAC,QAAQ,EAAC,uBAAuB,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,EACxD,GAAG,CAAC,aAAa,EAAC,UAAU,CAAC,CAC9B,CAAC;QACJ,CAAC;aAAK,IAAG,IAAI,CAAC,IAAI,KAAG,OAAO,EAAC,CAAC;YAC5B,KAAK,CAAC,IAAI,CACR,GAAG,CAAC,aAAa,EAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,EAC/C,GAAG,CAAC,QAAQ,EAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAChC,CAAC;QACJ,CAAC;aAAI,CAAC;YACJ,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IACD,IAAG,MAAM,CAAC,WAAW,KAAG,SAAS;QAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,EAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;IAC1F,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,EAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC/C,IAAG,KAAK;QAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAC,GAAG,OAAO,CAAC,WAAW,CAAC,qCAAqC,CAAC,CAAC,CAAC;IACnG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAC3C,IAAG,MAAM,CAAC,KAAK,KAAG,SAAS;QAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACpE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAC,IAAI,CAAC;AAC/B,CAAC","sourcesContent":["import {createAccessControl} from '../access-control.js';\nimport type {instanceStatus} from '../instance-runtime.js';\nimport {exists,instancePaths,type Instance,type InstanceConfig} from '../instance-store.js';\nimport {shellQuote} from '../platform.js';\n\ntype Status=Awaited<ReturnType<typeof instanceStatus>>;\ntype AuthMode='ingress'|'api-key'|'oauth';\ntype OAuthSummary={issuer:string;resource:string;clientId:string;scope:string;tokenAuth:string};\ntype AuthSummary={mode:AuthMode|null;activeKeys:number;oauth:OAuthSummary|null;problem:string|null};\n\nasync function authentication(instance:Instance,status:Status):Promise<AuthSummary>{\n  const file=instancePaths(instance).access;\n  try{\n    const state=await (await createAccessControl(file,{initialize:false})).snapshot();\n    if(status.phase==='running'&&status.health==='ok'&&status.accessMode!==state.mode){\n      return {mode:null,activeKeys:0,oauth:null,problem:'Authentication changed while checking. Run status again.'};\n    }\n    const incomplete=status.phase!=='running'&&instance.requiredAccess!=='ingress'&&state.mode!==instance.requiredAccess;\n    return {mode:state.mode,activeKeys:state.credentials.filter(c=>c.status==='active').length,\n      oauth:state.oauth?{issuer:state.oauth.issuer,resource:state.oauth.resource,clientId:state.oauth.clientId,scope:state.oauth.scope,tokenAuth:state.oauth.tokenEndpointAuthMethod}:null,\n      problem:incomplete?`This instance requires ${instance.requiredAccess} authentication before starting.`:null};\n  }catch(error){\n    // A new, never-started instance has an ingress default, but a lost store must\n    // never be presented as an intentional switch to unauthenticated access.\n    if((error as NodeJS.ErrnoException).code==='ENOENT'&&status.phase==='stopped'&&instance.requiredAccess==='ingress'&&!await exists(file+'.initialized')){\n      return {mode:'ingress',activeKeys:0,oauth:null,problem:null};\n    }\n    return {mode:null,activeKeys:0,oauth:null,problem:'Authentication settings are unavailable. Inspect them with the Auth command below.'};\n  }\n}\n\nexport async function formatStarmuxStatus(instance:Instance,status:Status,config:InstanceConfig|undefined,options:{isDefault?:boolean}={}){\n  const auth=await authentication(instance,status);\n  // Omit `-i default` for the default instance to keep everyday single-instance output clean.\n  const omitSelector=options.isDefault===true&&instance.name==='default';\n  const selector=/^[A-Za-z0-9_.-]+$/.test(instance.name)&&!instance.name.startsWith('-')?instance.name:shellQuote(instance.name);\n  const flag=omitSelector?'':(instance.name.startsWith('-')?` --instance=${selector}`:` -i ${selector}`);\n  const command=(action:string)=>`starmux ${action}${flag}`;\n  const ready=status.phase==='running'&&status.health==='ok';\n  const hasProblem=Boolean(status.configProblem||status.runtimeProblem||auth.problem);\n  const indicator=hasProblem?'!':ready?'●':status.phase==='running'?'◐':'○';\n  const labels={\n    ingress:'None (no token required)',\n    'api-key':`API key (Bearer token; ${auth.activeKeys} active ${auth.activeKeys===1?'key':'keys'})`,\n    oauth:'OAuth (browser sign-in)'\n  };\n  const saved=status.phase==='running'?' (saved; live state unavailable)':' (saved for next start)';\n  const row=(label:string,value:string)=>'  '+label.padEnd(16)+value;\n  const codingCmd=command('up --code');\n  const mode=!config\n    ?'Unavailable'\n    :config.accessRole==='trusted'\n    ?(config.writeScope==='home-only'?'Coding (Home sandbox · edits, shell & git)':'Coding (OS account · edits, shell & git)')\n    :config.mode==='read-write'\n    ?'File writes (restricted)'\n    :`Read-only  (run '${codingCmd}' to enable edits & shell)`;\n  const runtime=status.executionMode==='background'\n    ?'Background · continues after this terminal closes'\n    :status.executionMode==='foreground-owned'\n    ?(status.runtime?.launcher==='app'?'App-owned · stops when the app closes':'Foreground · Ctrl+C stops this instance')\n    :'Stopped';\n  const title=omitSelector\n    ?`${indicator} Starmux is ${status.phase}`\n    :`${indicator} Starmux is ${status.phase}  (instance: ${instance.name})`;\n  const lines=['',title];\n  if(ready&&status.port){\n    lines.push(row('Listen',`http://127.0.0.1:${status.port}/mcp  (this computer only)`));\n  }\n  lines.push(\n    row('Workspace',config?.projectRoot??'Unavailable'),\n    row('Mode',mode),\n    row('Auth',auth.mode?labels[auth.mode]+(ready?'':saved):'Unavailable'),\n    row('Runtime',runtime)\n  );\n  if(ready&&status.port&&auth.mode==='oauth'&&auth.oauth){\n    lines.push(row('Client URL',auth.oauth.resource),row('Issuer',auth.oauth.issuer));\n  }\n  if(status.configProblem||status.runtimeProblem)lines.push(row('Problem',status.configProblem??status.runtimeProblem!));\n  if(auth.problem)lines.push(row('Auth issue',auth.problem));\n\n  const keyCommand=command('auth key \"My AI Client\"');\n  if(ready&&!auth.problem){\n    lines.push('','Connect an AI client (MCP settings)');\n    lines.push(row('Transport','Streamable HTTP'));\n    if(auth.mode==='ingress'){\n      lines.push(\n        row('URL (Local)',`http://127.0.0.1:${status.port}/mcp  (AI client on this computer)`),\n        row('URL (Remote)',`https://<your-domain-or-tunnel>/mcp  (via protected HTTPS proxy or tunnel -> 127.0.0.1:${status.port})`),\n        row('Authentication',`None  (optional Bearer API key: ${keyCommand})`)\n      );\n    }else if(auth.mode==='api-key'){\n      lines.push(\n        row('URL (Local)',`http://127.0.0.1:${status.port}/mcp  (AI client on this computer)`),\n        row('URL (Remote)',`https://<your-domain-or-tunnel>/mcp  (via protected HTTPS proxy or tunnel -> 127.0.0.1:${status.port})`),\n        row('Authentication',`Bearer API key  (${auth.activeKeys} active ${auth.activeKeys===1?'key':'keys'})`),\n        row('Header','Authorization: Bearer <YOUR_API_KEY>')\n      );\n      if(!auth.activeKeys){\n        lines.push(row('Create key',`${keyCommand}  (no active keys; required before connecting)`));\n      }\n    }else if(auth.mode==='oauth'&&auth.oauth){\n      lines.push(\n        row('URL (Remote)',auth.oauth.resource),\n        row('Authentication','OAuth (browser sign-in)'),\n        row('Issuer',auth.oauth.issuer),\n        row('Client ID',`${auth.oauth.clientId}  (Scope: ${auth.oauth.scope} · Token auth: ${auth.oauth.tokenAuth})`)\n      );\n    }\n  }\n\n  lines.push('','Commands');\n  if(auth.problem){\n    lines.push(row('Check auth',command('auth')));\n  }else if(!ready){\n    if(status.phase==='stopped'&&!status.configProblem&&!status.runtimeProblem){\n      if(auth.mode==='api-key'&&!auth.activeKeys)lines.push(row('Create key',keyCommand));\n      lines.push(row('Start',command('up')),row('Start coding',codingCmd));\n    }else{\n      lines.push(row('Diagnose',command('doctor')));\n    }\n  }else{\n    if(auth.mode==='api-key'&&auth.activeKeys){\n      lines.push(\n        row('Verify',`STARMUX_TOKEN=<key> ${command('verify')}`),\n        row('New API key',keyCommand)\n      );\n    }else if(auth.mode==='oauth'){\n      lines.push(\n        row('Check OAuth',command('auth oauth doctor')),\n        row('Verify',command('verify'))\n      );\n    }else{\n      lines.push(row('Verify',command('verify')));\n    }\n  }\n  if(status.configState==='pending')lines.push(row('Apply config',command('config apply')));\n  lines.push(row('Auth & keys',command('auth')));\n  if(ready)lines.push(row('Dashboard',`${command('dashboard')}  (view & copy settings in browser)`));\n  lines.push(row('Logs',command('logs -f')));\n  if(status.phase==='running')lines.push(row('Stop',command('down')));\n  return lines.join('\\n')+'\\n';\n}\n"]}