talon-agent 5.14.0 → 5.18.2

package/src/core/backup/sources/plugins.ts

@@ -0,0 +1,223 @@
+/**
+ * Plugins — what a clone needs to run the same tools.
+ *
+ * Two kinds of plugin entry in config.json, two ways to carry them:
+ *
+ *   - Local code (`path`, or an MCP `command` whose argument is a path on
+ *     disk): the checkout itself goes into the snapshot as
+ *     `plugin-src/<n>-<name>`, minus what an install or build recreates
+ *     (node_modules, venvs, dist/, build/, caches — see plan.ts). Lockfiles
+ *     and package.json stay, so `npm ci` gets the same tree back.
+ *   - Fetched packages (`npx`/`bunx`/`pnpm dlx`, `uvx`/`pipx run`,
+ *     `docker run`): nothing to copy, so `plugins-manifest.json` records
+ *     the exact spec — package@version or image:tag — to reinstall from.
+ *     An unpinned npm package is resolved against the local npx cache and
+ *     the version found is written down, marked `pinned: false`.
+ *
+ * Plugins under the Talon home (`talon plugin install` puts them in
+ * ~/.talon/plugins) are already captured with the home and are listed in
+ * the manifest only.
+ */
+
+import { readFile, readdir, stat } from "node:fs/promises";
+import { basename, dirname, isAbsolute, join } from "node:path";
+import { isInside } from "../plan.js";
+import type { ExternalRoot } from "../types.js";
+import { pathExists, type SourceContext } from "./sessions.js";
+
+type PluginEntry = {
+  path?: string;
+  name?: string;
+  command?: string;
+  args?: string[];
+  enabled?: boolean;
+};
+
+/** One line of plugins-manifest.json. */
+type PluginRecord = {
+  name: string;
+  enabled: boolean;
+  source:
+    | { type: "local"; path: string; archiveRoot?: string; version?: string }
+    | { type: "npm"; spec: string; version?: string; pinned: boolean }
+    | { type: "python"; spec: string; pinned: boolean }
+    | { type: "docker"; image: string; pinned: boolean }
+    | { type: "command"; command: string };
+};
+
+export type PluginsManifest = { schema: 1; plugins: PluginRecord[] };
+
+const NPM_RUNNERS = new Set(["npx", "bunx"]);
+const PY_RUNNERS = new Set(["uvx", "pipx"]);
+const DOCKER_RUNNERS = new Set(["docker", "podman"]);
+const PACKAGE_MARKERS = ["package.json", "pyproject.toml", "setup.py"];
+
+function pluginEntries(config: Record<string, unknown>): PluginEntry[] {
+  const list = config.plugins;
+  return Array.isArray(list)
+    ? list.filter((e): e is PluginEntry => typeof e === "object" && e !== null)
+    : [];
+}
+
+function displayName(entry: PluginEntry): string {
+  if (entry.name) return entry.name;
+  if (entry.path) return basename(entry.path.replace(/[\\/]+$/, ""));
+  return entry.command ?? "(invalid entry)";
+}
+
+/** Non-flag arguments, in order. */
+function positional(args: readonly string[]): string[] {
+  return args.filter((arg) => !arg.startsWith("-"));
+}
+
+async function isFile(path: string): Promise<boolean> {
+  try {
+    return (await stat(path)).isFile();
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * The package root of a plugin path: the nearest directory at or above
+ * it that holds a package.json/pyproject.toml, never climbing past the
+ * user's home. A path pointing into `src/` still captures the lockfile.
+ */
+async function packageRoot(
+  path: string,
+  userHome: string | null,
+): Promise<string> {
+  let dir = (await isFile(path)) ? dirname(path) : path;
+  const start = dir;
+  for (let depth = 0; depth < 4; depth++) {
+    for (const marker of PACKAGE_MARKERS) {
+      if (await isFile(join(dir, marker))) return dir;
+    }
+    const parent = dirname(dir);
+    if (parent === dir || (userHome && parent === userHome)) break;
+    dir = parent;
+  }
+  return start;
+}
+
+async function readVersion(dir: string): Promise<string | undefined> {
+  try {
+    const pkg = JSON.parse(await readFile(join(dir, "package.json"), "utf8"));
+    return typeof pkg.version === "string" ? pkg.version : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+/** `pkg@1.2.3` → pinned; `pkg`, `pkg@latest`, `pkg@^1` → not. */
+function npmPinned(spec: string): boolean {
+  const at = spec.lastIndexOf("@");
+  return at > 0 && /^\d+\.\d+\.\d+/.test(spec.slice(at + 1));
+}
+
+function compareVersions(a: string, b: string): number {
+  const pa = a.split(/[.-]/).map((n) => Number.parseInt(n, 10) || 0);
+  const pb = b.split(/[.-]/).map((n) => Number.parseInt(n, 10) || 0);
+  for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+    const diff = (pa[i] ?? 0) - (pb[i] ?? 0);
+    if (diff !== 0) return diff;
+  }
+  return 0;
+}
+
+/** Highest version of `name` in the npx cache — what `npx` would run. */
+async function npxCachedVersion(
+  name: string,
+  userHome: string | null,
+): Promise<string | undefined> {
+  if (!userHome) return undefined;
+  const cache = join(userHome, ".npm", "_npx");
+  let hashes: string[];
+  try {
+    hashes = await readdir(cache);
+  } catch {
+    return undefined;
+  }
+  const versions: string[] = [];
+  for (const hash of hashes) {
+    const version = await readVersion(join(cache, hash, "node_modules", name));
+    if (version) versions.push(version);
+  }
+  return versions.sort(compareVersions).pop();
+}
+
+function npmName(spec: string): string {
+  const at = spec.lastIndexOf("@");
+  return at > 0 ? spec.slice(0, at) : spec;
+}
+
+async function commandSource(
+  entry: PluginEntry,
+  userHome: string | null,
+): Promise<PluginRecord["source"]> {
+  const command = basename(entry.command ?? "");
+  const args = positional(entry.args ?? []);
+  if (NPM_RUNNERS.has(command) || command === "pnpm") {
+    const spec = (command === "pnpm" ? args[1] : args[0]) ?? "";
+    const pinned = npmPinned(spec);
+    const version = pinned
+      ? undefined
+      : await npxCachedVersion(npmName(spec), userHome);
+    return { type: "npm", spec, pinned, ...(version ? { version } : {}) };
+  }
+  if (PY_RUNNERS.has(command)) {
+    const fromIndex = (entry.args ?? []).indexOf("--from");
+    const spec =
+      fromIndex >= 0
+        ? (entry.args?.[fromIndex + 1] ?? "")
+        : ((command === "pipx" ? args[1] : args[0]) ?? "");
+    return { type: "python", spec, pinned: /==|@/.test(spec) };
+  }
+  if (DOCKER_RUNNERS.has(command)) {
+    // `docker run [flags] image[:tag] [cmd]` — flag values (`-e K=V`,
+    // `-v /a:/b`) are the positional args that are not the image.
+    const image =
+      args.slice(1).find((arg) => !arg.includes("=") && !arg.startsWith("/")) ??
+      "";
+    return {
+      type: "docker",
+      image,
+      pinned: /:[^/]+$|@sha256:/.test(image),
+    };
+  }
+  const local = (entry.args ?? []).find((arg) => isAbsolute(arg));
+  if (local) return { type: "local", path: local };
+  return { type: "command", command: entry.command ?? "" };
+}
+
+/**
+ * Walk config.json's plugins into the manifest and the list of local
+ * checkouts to archive. Deterministic: config order, numbered roots.
+ */
+export async function discoverPlugins(ctx: SourceContext): Promise<{
+  manifest: PluginsManifest;
+  roots: ExternalRoot[];
+}> {
+  const plugins: PluginRecord[] = [];
+  const roots: ExternalRoot[] = [];
+  for (const [index, entry] of pluginEntries(ctx.config).entries()) {
+    const source: PluginRecord["source"] = entry.path
+      ? { type: "local", path: entry.path }
+      : await commandSource(entry, ctx.userHome);
+    if (source.type === "local") {
+      const root = await packageRoot(source.path, ctx.userHome);
+      const version = await readVersion(root);
+      if (version) source.version = version;
+      if (!isInside(ctx.home, root) && (await pathExists(root))) {
+        source.archiveRoot = `plugin-src/${index}-${basename(root)}`;
+        roots.push({ root: source.archiveRoot, source: root, kind: "plugin" });
+      }
+    }
+    plugins.push({
+      name: displayName(entry),
+      enabled: entry.enabled !== false,
+      source,
+    });
+  }
+  return { manifest: { schema: 1, plugins }, roots };
+}

package/src/core/backup/sources/relocate.ts

@@ -0,0 +1,136 @@
+/**
+ * Clone — putting a snapshot's outside-the-home roots where they belong
+ * on a different machine.
+ *
+ * Everything under the Talon home restores relative to whatever home the
+ * new machine has. The external roots (session stores, plugin checkouts)
+ * were recorded by absolute path, and two things about those paths are
+ * host-specific:
+ *
+ *   - the user's home directory (`/home/alice` → `/Users/alice`), and
+ *   - Claude Code's project slug, which IS the absolute cwd with its
+ *     separators flattened — a transcript filed under the old workspace
+ *     path is invisible to a session started in the new one.
+ *
+ * A clone rewrites both, and rewrites the same prefixes inside
+ * config.json (plugin paths, a passphrase file) so the restored config
+ * points at the restored files.
+ */
+
+import { readFile } from "node:fs/promises";
+import { basename, isAbsolute, join, relative } from "node:path";
+import writeFileAtomic from "write-file-atomic";
+import { isInside } from "../plan.js";
+import type { ExternalRoot, SnapshotOrigin } from "../types.js";
+import {
+  claudeProjectSlug,
+  claudeProjectsDir,
+  sessionCwds,
+  type SourceContext,
+} from "./sessions.js";
+
+/** The machine a clone lands on. */
+export type CloneTarget = Pick<SourceContext, "home" | "env"> & {
+  userHome: string;
+};
+
+/** Move `path` from one prefix to another; unchanged when outside it. */
+function reprefix(path: string, from: string, to: string): string {
+  if (from === to || !isInside(from, path)) return path;
+  const rest = relative(from, path);
+  return rest ? join(to, rest) : to;
+}
+
+/** Re-slug a Claude project directory name for the new Talon home. */
+export function relocateClaudeSlug(
+  name: string,
+  originHome: string,
+  targetHome: string,
+): string {
+  const pairs = sessionCwds(originHome).map((cwd, i) => [
+    claudeProjectSlug(cwd),
+    claudeProjectSlug(sessionCwds(targetHome)[i]),
+  ]);
+  // Longest first: agent-workspace's slug must not be matched as a
+  // prefix-extension of some shorter one.
+  pairs.sort((a, b) => b[0].length - a[0].length);
+  for (const [from, to] of pairs) {
+    if (name === from || name.startsWith(`${from}-`))
+      return to + name.slice(from.length);
+  }
+  return name;
+}
+
+/** Where one external root lands on the clone target. */
+export function relocateRoot(
+  root: ExternalRoot,
+  origin: SnapshotOrigin,
+  target: CloneTarget,
+): string {
+  if (root.kind === "claude-project") {
+    return join(
+      claudeProjectsDir(target.userHome, target.env),
+      relocateClaudeSlug(basename(root.source), origin.home, target.home),
+    );
+  }
+  const moved = reprefix(root.source, origin.home, target.home);
+  return moved !== root.source
+    ? moved
+    : reprefix(root.source, origin.userHome, target.userHome);
+}
+
+/** Deep-rewrite every string that is a path under the origin's homes. */
+function rewriteValue(
+  value: unknown,
+  origin: SnapshotOrigin,
+  target: CloneTarget,
+): unknown {
+  if (typeof value === "string") {
+    // Cheap "is this a path?" gate. isAbsolute, not a leading "/": on
+    // Windows an absolute path is "C:\\Users\\…", and a clone that
+    // skipped those left config.json pointing at the origin machine.
+    if (!isAbsolute(value)) return value;
+    const moved = reprefix(value, origin.home, target.home);
+    return moved !== value
+      ? moved
+      : reprefix(value, origin.userHome, target.userHome);
+  }
+  if (Array.isArray(value))
+    return value.map((item) => rewriteValue(item, origin, target));
+  if (value && typeof value === "object") {
+    return Object.fromEntries(
+      Object.entries(value).map(([key, item]) => [
+        key,
+        rewriteValue(item, origin, target),
+      ]),
+    );
+  }
+  return value;
+}
+
+/**
+ * Point the restored config.json at the clone's paths. Returns false when
+ * there was nothing to change (same homes, or no config).
+ */
+export async function rewriteConfigForClone(
+  origin: SnapshotOrigin,
+  target: CloneTarget,
+): Promise<boolean> {
+  if (origin.home === target.home && origin.userHome === target.userHome)
+    return false;
+  const path = join(target.home, "config.json");
+  let raw: string;
+  try {
+    raw = await readFile(path, "utf8");
+  } catch {
+    return false;
+  }
+  const rewritten = JSON.stringify(
+    rewriteValue(JSON.parse(raw), origin, target),
+    null,
+    2,
+  );
+  if (rewritten === JSON.stringify(JSON.parse(raw), null, 2)) return false;
+  await writeFileAtomic(path, rewritten + "\n", { mode: 0o600 });
+  return true;
+}

package/src/core/backup/sources/sessions.ts

@@ -0,0 +1,198 @@
+/**
+ * Backend session stores — the conversations themselves.
+ *
+ * Talon's database knows which session a chat is on; the transcript that
+ * session resumes from lives with the backend that ran it, outside the
+ * Talon home. A snapshot without these restores every chat to a session
+ * id that points at nothing, so they are captured here:
+ *
+ *   - Claude Agent SDK: `~/.claude/projects/<slug>/` for every cwd Talon
+ *     runs sessions in — the workspace and agent-workspace/, plus any
+ *     directory beneath them (the slug is the path with every
+ *     non-alphanumeric character turned into `-`, so a subdirectory's
+ *     slug extends its parent's).
+ *   - Codex: `$CODEX_HOME/sessions` (default `~/.codex`).
+ *   - OpenCode / Kilo: `$XDG_DATA_HOME/<name>/storage` plus the session
+ *     database, copied through SQLite rather than byte-wise.
+ *   - Antigravity (agy): the CLI's conversations, brain and summaries.
+ *
+ * Only stores of backends the config enables are captured — a Codex
+ * install used for unrelated work is not Talon's state. Claude is always
+ * considered: it is the default backend and its store is scoped by cwd.
+ *
+ * Pure discovery: this reads directory listings, never file contents.
+ */
+
+import { readdir, stat } from "node:fs/promises";
+import { join } from "node:path";
+import type { ExternalRoot } from "../types.js";
+
+/** What discovery needs to know about this machine. */
+export type SourceContext = {
+  /** Talon home (`~/.talon`). */
+  home: string;
+  /** The OS user's home; null = do not look outside the Talon home. */
+  userHome: string | null;
+  env: Readonly<Record<string, string | undefined>>;
+  /** Parsed config.json (untyped: the snapshot reads what it archives). */
+  config: Record<string, unknown>;
+};
+
+/** Claude Code's project directory name for a cwd. */
+export function claudeProjectSlug(cwd: string): string {
+  return cwd.replace(/[^A-Za-z0-9]/g, "-");
+}
+
+/** Where Claude Code keeps per-cwd transcripts. */
+export function claudeProjectsDir(
+  userHome: string,
+  env: SourceContext["env"],
+): string {
+  const configDir = env.CLAUDE_CONFIG_DIR?.trim();
+  return join(configDir || join(userHome, ".claude"), "projects");
+}
+
+/** The cwds Talon starts Claude sessions in. */
+export function sessionCwds(home: string): string[] {
+  return [join(home, "workspace"), join(home, "agent-workspace")];
+}
+
+/** Every backend id the config can route a turn to. */
+function enabledBackends(config: Record<string, unknown>): Set<string> {
+  const ids = new Set<string>();
+  for (const key of [
+    "backend",
+    "defaultBackend",
+    "heartbeatBackend",
+    "dreamBackend",
+  ]) {
+    const value = config[key];
+    if (typeof value === "string") ids.add(value);
+  }
+  const list = config.enabledBackends;
+  if (Array.isArray(list)) {
+    for (const id of list) if (typeof id === "string") ids.add(id);
+  }
+  return ids;
+}
+
+export async function pathExists(path: string): Promise<boolean> {
+  try {
+    await stat(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/** Claude project directories for the Talon cwds, sorted for a stable plan. */
+async function claudeRoots(
+  userHome: string,
+  ctx: SourceContext,
+): Promise<ExternalRoot[]> {
+  const projects = claudeProjectsDir(userHome, ctx.env);
+  let names: string[];
+  try {
+    names = await readdir(projects);
+  } catch {
+    return [];
+  }
+  const slugs = sessionCwds(ctx.home).map(claudeProjectSlug);
+  return names
+    .filter((name) =>
+      slugs.some((slug) => name === slug || name.startsWith(`${slug}-`)),
+    )
+    .sort()
+    .map((name) => ({
+      root: `sessions/claude/${name}`,
+      source: join(projects, name),
+      kind: "claude-project" as const,
+    }));
+}
+
+/** One backend's store: directories plus (optionally) SQLite files. */
+type StoreSpec = {
+  backend: string;
+  dir: (userHome: string, env: SourceContext["env"]) => string;
+  dirs: readonly string[];
+  databases: readonly string[];
+};
+
+const xdgData = (userHome: string, env: SourceContext["env"]): string =>
+  env.XDG_DATA_HOME?.trim() || join(userHome, ".local", "share");
+
+const STORES: readonly StoreSpec[] = [
+  {
+    backend: "codex",
+    dir: (userHome, env) => env.CODEX_HOME?.trim() || join(userHome, ".codex"),
+    dirs: ["sessions"],
+    databases: [],
+  },
+  {
+    backend: "opencode",
+    dir: (userHome, env) => join(xdgData(userHome, env), "opencode"),
+    dirs: ["storage"],
+    databases: ["opencode.db"],
+  },
+  {
+    backend: "kilo",
+    dir: (userHome, env) => join(xdgData(userHome, env), "kilo"),
+    dirs: ["storage"],
+    databases: ["kilo.db"],
+  },
+  {
+    backend: "agy",
+    dir: (userHome) => join(userHome, ".gemini", "antigravity-cli"),
+    dirs: ["conversations", "brain", "annotations", "implicit"],
+    databases: ["conversation_summaries.db"],
+  },
+];
+
+async function storeRoots(
+  spec: StoreSpec,
+  userHome: string,
+  env: SourceContext["env"],
+): Promise<ExternalRoot[]> {
+  const base = spec.dir(userHome, env);
+  const roots: ExternalRoot[] = [];
+  for (const name of spec.dirs) {
+    const source = join(base, name);
+    if (await pathExists(source)) {
+      roots.push({
+        root: `sessions/${spec.backend}/${name}`,
+        source,
+        kind: "session-store",
+      });
+    }
+  }
+  for (const name of spec.databases) {
+    const source = join(base, name);
+    if (await pathExists(source)) {
+      roots.push({
+        root: `sessions/${spec.backend}/${name}`,
+        source,
+        kind: "session-store",
+        sqlite: true,
+      });
+    }
+  }
+  return roots;
+}
+
+/**
+ * Every session root this machine has for the configured backends, in a
+ * deterministic order. Nothing outside the Talon home is looked at when
+ * `userHome` is null (tests that only fake a Talon home).
+ */
+export async function discoverSessionRoots(
+  ctx: SourceContext,
+): Promise<ExternalRoot[]> {
+  if (!ctx.userHome) return [];
+  const roots = await claudeRoots(ctx.userHome, ctx);
+  const backends = enabledBackends(ctx.config);
+  for (const spec of STORES) {
+    if (!backends.has(spec.backend)) continue;
+    roots.push(...(await storeRoots(spec, ctx.userHome, ctx.env)));
+  }
+  return roots;
+}

package/src/core/backup/store.ts

@@ -6,6 +6,7 @@
  *
  *   backups/<id>/manifest.json          what this snapshot is
  *   backups/<id>/state.tar.zst          identity + state + database
+ *   backups/<id>/logins.tar.zst         WhatsApp auth + userbot session
  *   backups/<id>/palace-<hash12>.tar.zst  the memory palace, when present
  *
  * The manifest on disk is authoritative. SQLite is a cache so `/backup`
@@ -100,10 +101,11 @@ export async function writeManifest(
   home: string = dirs.root,
 ): Promise<void> {
   const dir = snapshotDir(manifest.id, home);
-  await mkdir(dir, { recursive: true });
+  await mkdir(dir, { recursive: true, mode: 0o700 });
   await writeFileAtomic(
     join(dir, MANIFEST_NAME),
     JSON.stringify(manifest, null, 2) + "\n",
+    { mode: 0o600 },
   );
 }
 

package/src/core/backup/types.ts

@@ -29,8 +29,40 @@ export type SnapshotPart = {
    * targets may skip the upload entirely.
    */
   contentAddressed?: boolean;
+  /** Written through archive/crypt.ts (name ends in `.enc`). */
+  encrypted?: boolean;
+  /**
+   * Kept on this machine only — never handed to a remote target. Login
+   * sessions (WhatsApp, the userbot) are, unless `backup.loginSessions`
+   * is "remote". A restore from a remote copy skips a missing local-only
+   * part instead of failing.
+   */
+  localOnly?: boolean;
+};
+
+/**
+ * The MAC over a manifest (see archive/manifest-auth.ts). Present on
+ * every snapshot written with a backup passphrase.
+ */
+export type ManifestAuth = {
+  v: 1;
+  alg: "hmac-sha256";
+  kdf: "scrypt";
+  log2N: number;
+  r: number;
+  p: number;
+  /** base64 */
+  salt: string;
+  /** base64 */
+  mac: string;
 };
 
+/**
+ * Where WhatsApp and userbot login sessions may go: nowhere, the local
+ * snapshot store only, or also to remote targets.
+ */
+type LoginSessionsPolicy = "off" | "local" | "remote";
+
 /** Per-target upload state, mirrored into the `backup_remotes` table. */
 export type RemoteState = {
   status: "pending" | "uploaded" | "failed";
@@ -42,6 +74,29 @@ export type RemoteState = {
 /** Where an `extra/<n>/…` subtree came from, so restore can put it back. */
 type ExtraMapping = { n: number; source: string };
 
+/**
+ * A root captured from outside the Talon home — a backend's session
+ * store, a plugin checkout. `source` is the absolute path at snapshot
+ * time; a clone rewrites it for the new machine (see sources/relocate.ts).
+ */
+export type ExternalRoot = {
+  /** Archive path of the root (`sessions/claude/<slug>`, `plugin-src/<n>-<name>`). */
+  root: string;
+  source: string;
+  /** How a clone relocates it. */
+  kind: "claude-project" | "session-store" | "plugin";
+  /** A SQLite file captured via `VACUUM INTO`, not copied byte-wise. */
+  sqlite?: boolean;
+};
+
+/** The paths a snapshot was taken against — what a clone rewrites from. */
+export type SnapshotOrigin = {
+  /** The operating-system user's home directory. */
+  userHome: string;
+  /** The Talon home (`~/.talon`). */
+  home: string;
+};
+
 export type Manifest = {
   schema: 1;
   id: string;
@@ -60,11 +115,16 @@ export type Manifest = {
   excludes: string[];
   /** `extra/<n>` → absolute source path. */
   extras?: ExtraMapping[];
+  /** Session stores and plugin sources from outside the Talon home. */
+  external?: ExternalRoot[];
+  origin?: SnapshotOrigin;
   /** Tree fingerprint of the palace part, for content-addressed reuse. */
   palaceHash?: string;
   /** Total bytes of all parts. */
   sizeBytes: number;
   remote: Record<string, RemoteState>;
+  /** MAC under the backup passphrase; absent on plaintext/legacy snapshots. */
+  auth?: ManifestAuth;
 };
 
 /** A snapshot as the listing surfaces show it. */
@@ -87,10 +147,16 @@ export type BackupSettings = {
   keepLocal: number;
   keepRemote: number;
   includePalace: boolean;
+  /** WhatsApp auth + userbot session: see {@link LoginSessionsPolicy}. */
+  loginSessions: LoginSessionsPolicy;
+  /** Backend session transcripts and traces, in a part of their own. */
+  includeSessions: boolean;
   workspaceInclude: readonly string[];
   extraPaths: readonly string[];
   /** Unset = every registered target; `[]` = local only. */
   targets?: readonly string[];
   checkpointBeforeUpdate: boolean;
   notifyChatId?: string;
+  /** Present = snapshots must be encrypted (see passphrase.ts). */
+  encryption?: { passphraseFile?: string };
 };