visionclaw 0.1.193-dev.fix-replace-image-placeholders-with-text.1 → 0.1.193

package/CHANGELOG.md

@@ -1,3 +1,13 @@
+## [0.1.193](https://github.com/babelcloud/visionclaw/compare/v0.1.192...v0.1.193) (2026-05-11)
+
+### Bug Fixes
+
+### Features
+
+* Improve agent speed and more stable
+* Better /refresh command to avoid stuck
+
+
 ## [0.1.192](https://github.com/babelcloud/visionclaw/compare/v0.1.191...v0.1.192) (2026-05-06)
 
 ### Bug Fixes

package/dist/agent/api-proxy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-proxy.d.ts","sourceRoot":"","sources":["../../src/agent/api-proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AASH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,IAAI,CAAC;CACnB;AAuDD;;;GAGG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE;IACxC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CAAC,cAAc,CAAC,CA8H1B"}
+{"version":3,"file":"api-proxy.d.ts","sourceRoot":"","sources":["../../src/agent/api-proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAUH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,IAAI,CAAC;CACnB;AAiND;;;GAGG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE;IACxC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CAAC,cAAc,CAAC,CAmK1B"}

package/dist/agent/api-proxy.js

@@ -15,6 +15,7 @@ import http from "node:http";
 import https from "node:https";
 import fs from "node:fs";
 import path from "node:path";
+import zlib from "node:zlib";
 import { URL } from "node:url";
 import { logger } from "../logger.js";
 let singleton = null;
@@ -27,13 +28,6 @@ const httpsAgent = new https.Agent({
     maxSockets: 10,
     ALPNProtocols: ["http/1.1"],
 });
-/**
- * Extract `<system-reminder>` text blocks from messages.
- *
- * The Claude Agent SDK injects these into user messages to provide the model
- * with skill descriptions, context reminders, and other metadata.  We extract
- * them so the API log captures what the model actually sees.
- */
 function extractSystemReminders(messages) {
     const reminders = [];
     for (const msg of messages) {
@@ -50,6 +44,140 @@ function extractSystemReminders(messages) {
     }
     return reminders;
 }
+function getHeaderValue(headers, name) {
+    const value = headers[name];
+    if (Array.isArray(value))
+        return value[0];
+    return value;
+}
+/**
+ * Decompress a buffered upstream response body for logging only.
+ *
+ * The proxy forwards the original (possibly compressed) bytes to the SDK
+ * client verbatim, so the SDK's transparent decompression keeps working.
+ * For our JSONL log we want the readable text instead, so we honor
+ * `content-encoding` here.
+ */
+function decodeResponseBodyForLogging(responseBody, headers) {
+    if (responseBody.length === 0)
+        return "";
+    const encoding = getHeaderValue(headers, "content-encoding");
+    const normalized = encoding?.toLowerCase().trim();
+    try {
+        if (normalized === "gzip" || normalized === "x-gzip") {
+            return zlib.gunzipSync(responseBody).toString("utf-8");
+        }
+        if (normalized === "deflate") {
+            return zlib.inflateSync(responseBody).toString("utf-8");
+        }
+        if (normalized === "br") {
+            return zlib.brotliDecompressSync(responseBody).toString("utf-8");
+        }
+    }
+    catch (err) {
+        logger.warn(`[api-proxy] failed to decompress upstream body (encoding=${normalized ?? "none"}): ${err instanceof Error ? err.message : String(err)}`);
+    }
+    return responseBody.toString("utf-8");
+}
+function getUpstreamRequestId(headers) {
+    return getHeaderValue(headers, "request-id")
+        ?? getHeaderValue(headers, "x-request-id")
+        ?? getHeaderValue(headers, "anthropic-request-id")
+        ?? getHeaderValue(headers, "cf-request-id")
+        ?? getHeaderValue(headers, "x-amzn-trace-id")
+        ?? getHeaderValue(headers, "cf-ray")
+        ?? null;
+}
+function parseAnthropicResponseBody(responseBodyRaw) {
+    try {
+        return JSON.parse(responseBodyRaw);
+    }
+    catch {
+        return parseAnthropicSseFinalMessage(responseBodyRaw) ?? responseBodyRaw;
+    }
+}
+function parseAnthropicSseFinalMessage(responseBodyRaw) {
+    const events = responseBodyRaw.split(/\n\n+/u);
+    let finalMessage;
+    const contentBlocks = [];
+    let stopReason;
+    let stopSequence;
+    let usage;
+    for (const event of events) {
+        const dataLines = event
+            .split("\n")
+            .filter((line) => line.startsWith("data:"))
+            .map((line) => line.slice("data:".length).trim())
+            .filter((line) => line.length > 0 && line !== "[DONE]");
+        for (const dataLine of dataLines) {
+            let payload;
+            try {
+                payload = JSON.parse(dataLine);
+            }
+            catch {
+                continue;
+            }
+            if (payload.type === "message_start") {
+                finalMessage = payload.message;
+                continue;
+            }
+            if (payload.type === "content_block_start") {
+                const index = payload.index;
+                if (typeof index === "number") {
+                    contentBlocks[index] = payload.content_block;
+                }
+                continue;
+            }
+            if (payload.type === "content_block_delta") {
+                const index = payload.index;
+                const delta = payload.delta;
+                if (typeof index !== "number" || !delta)
+                    continue;
+                const block = contentBlocks[index] ?? {};
+                contentBlocks[index] = block;
+                if (delta.type === "text_delta" && typeof delta.text === "string") {
+                    block.text = `${typeof block.text === "string" ? block.text : ""}${delta.text}`;
+                }
+                else if (delta.type === "input_json_delta" && typeof delta.partial_json === "string") {
+                    block.partial_json = `${typeof block.partial_json === "string" ? block.partial_json : ""}${delta.partial_json}`;
+                }
+                continue;
+            }
+            if (payload.type === "message_delta") {
+                const delta = payload.delta;
+                stopReason = delta?.stop_reason;
+                stopSequence = delta?.stop_sequence;
+                usage = payload.usage;
+            }
+        }
+    }
+    if (!finalMessage)
+        return undefined;
+    return {
+        ...finalMessage,
+        content: contentBlocks.filter(Boolean).map(finalizeContentBlock),
+        stop_reason: stopReason,
+        stop_sequence: stopSequence,
+        usage: usage ?? finalMessage.usage,
+    };
+}
+function finalizeContentBlock(block) {
+    if (typeof block.partial_json !== "string")
+        return block;
+    const { partial_json: partialJson, ...rest } = block;
+    try {
+        return {
+            ...rest,
+            input: JSON.parse(partialJson),
+        };
+    }
+    catch {
+        return {
+            ...rest,
+            input_json_raw: partialJson,
+        };
+    }
+}
 /**
  * Start the API logging proxy.  Returns a handle with the assigned port.
  * Subsequent calls return the same singleton.
@@ -87,25 +215,11 @@ export async function startApiProxy(opts) {
         });
         req.on("end", () => {
             const body = Buffer.concat(chunks);
-            // Log the request (best-effort)
+            const requestBodyRaw = body.toString("utf-8");
+            let parsedRequestBody;
             if (isMessagesEndpoint && body.length > 0) {
                 try {
-                    const parsed = JSON.parse(body.toString("utf-8"));
-                    const messages = parsed.messages;
-                    const tools = parsed.tools;
-                    const entry = {
-                        timestamp: new Date().toISOString(),
-                        model: parsed.model,
-                        system: parsed.system,
-                        tools: tools ?? [],
-                        system_reminders: messages ? extractSystemReminders(messages) : [],
-                        messages_count: messages?.length ?? 0,
-                        messages_roles: messages?.map((m) => m.role ?? "unknown") ?? [],
-                        request_size_bytes: body.length,
-                    };
-                    const date = new Date().toISOString().slice(0, 10);
-                    const logPath = path.join(logDir, `api-calls-${date}.jsonl`);
-                    fs.appendFileSync(logPath, JSON.stringify(entry) + "\n", "utf-8");
+                    parsedRequestBody = JSON.parse(requestBodyRaw);
                 }
                 catch {
                     // Best-effort logging — don't break the proxy
@@ -122,8 +236,54 @@ export async function startApiProxy(opts) {
                 headers: fwdHeaders,
                 agent: httpsAgent,
             }, (proxyRes) => {
+                const responseChunks = [];
                 res.writeHead(proxyRes.statusCode ?? 502, proxyRes.headers);
-                proxyRes.pipe(res);
+                proxyRes.on("data", (chunk) => {
+                    responseChunks.push(chunk);
+                    res.write(chunk);
+                });
+                proxyRes.on("end", () => {
+                    if (!res.writableEnded) {
+                        res.end();
+                    }
+                    if (isMessagesEndpoint && body.length > 0) {
+                        try {
+                            const responseBody = Buffer.concat(responseChunks);
+                            const responseBodyRaw = decodeResponseBodyForLogging(responseBody, proxyRes.headers);
+                            const parsedResponseBody = parseAnthropicResponseBody(responseBodyRaw);
+                            const messages = parsedRequestBody?.messages;
+                            const entry = {
+                                timestamp: new Date().toISOString(),
+                                method: req.method,
+                                url: req.url,
+                                model: parsedRequestBody?.model,
+                                request_body: parsedRequestBody ?? requestBodyRaw,
+                                request_body_raw: requestBodyRaw,
+                                system_reminders: messages ? extractSystemReminders(messages) : [],
+                                messages_count: messages?.length ?? 0,
+                                request_size_bytes: body.length,
+                                response_status_code: proxyRes.statusCode,
+                                upstream_request_id: getUpstreamRequestId(proxyRes.headers),
+                                response_headers: proxyRes.headers,
+                                response_body: parsedResponseBody,
+                                response_body_raw: responseBodyRaw,
+                                response_size_bytes: responseBody.length,
+                            };
+                            const date = new Date().toISOString().slice(0, 10);
+                            const logPath = path.join(logDir, `api-calls-${date}.jsonl`);
+                            fs.appendFileSync(logPath, `${JSON.stringify(entry)}\n`, "utf-8");
+                        }
+                        catch {
+                            // Best-effort logging — don't break the proxy
+                        }
+                    }
+                });
+                proxyRes.on("error", (err) => {
+                    logger.warn(`[api-proxy] upstream response error: ${err.message}`);
+                    if (!res.writableEnded) {
+                        res.destroy(err);
+                    }
+                });
             });
             proxyReq.on("error", (err) => {
                 if (!req.destroyed) {

package/dist/agent/api-proxy.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-proxy.js","sourceRoot":"","sources":["../../src/agent/api-proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,KAAK,MAAM,YAAY,CAAC;AAC/B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAqBtC,IAAI,SAAS,GAA0B,IAAI,CAAC;AAE5C,wEAAwE;AACxE,0EAA0E;AAC1E,qEAAqE;AACrE,qDAAqD;AACrD,MAAM,UAAU,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC;IACjC,SAAS,EAAE,KAAK;IAChB,UAAU,EAAE,EAAE;IACd,aAAa,EAAE,CAAC,UAAU,CAAC;CAC5B,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,SAAS,sBAAsB,CAC7B,QAAmC;IAEnC,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,SAAS;QACtC,KAAK,MAAM,KAAK,IAAI,OAAoC,EAAE,CAAC;YACzD,IACE,KAAK,CAAC,IAAI,KAAK,MAAM;gBACrB,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;gBAC9B,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EACxC,CAAC;gBACD,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAGnC;IACC,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC;IAEhC,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,IAAI,2BAA2B,CAAC;IACrE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAE3B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,mCAAmC;IACnC,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;QAC5B,MAAM,EAAE,YAAY,EAAE,mBAAmB;KAC1C,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC5C,MAAM,kBAAkB,GACtB,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,cAAc,CAAC,CAAC;QAE/D,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,CAAC,CAAC;QAEtD,yBAAyB;QACzB,MAAM,UAAU,GAAkD,EAAE,CAAC;QACrE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACvD,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YACrC,UAAU,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAC1B,CAAC;QACD,UAAU,CAAC,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC;QAEjC,iDAAiD;QACjD,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAC/B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACtB,MAAM,CAAC,IAAI,CAAC,qCAAqC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACjB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAEnC,gCAAgC;YAChC,IAAI,kBAAkB,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1C,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAA4B,CAAC;oBAC7E,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAiD,CAAC;oBAC1E,MAAM,KAAK,GAAG,MAAM,CAAC,KAA8B,CAAC;oBAEpD,MAAM,KAAK,GAAgB;wBACzB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;wBACnC,KAAK,EAAE,MAAM,CAAC,KAA2B;wBACzC,MAAM,EAAE,MAAM,CAAC,MAAM;wBACrB,KAAK,EAAE,KAAK,IAAI,EAAE;wBAClB,gBAAgB,EAAE,QAAQ,CAAC,CAAC,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE;wBAClE,cAAc,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC;wBACrC,cAAc,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAC,CAAC,IAA2B,IAAI,SAAS,CAAC,IAAI,EAAE;wBACvF,kBAAkB,EAAE,IAAI,CAAC,MAAM;qBAChC,CAAC;oBAEF,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACnD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,IAAI,QAAQ,CAAC,CAAC;oBAC7D,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;gBACpE,CAAC;gBAAC,MAAM,CAAC;oBACP,8CAA8C;gBAChD,CAAC;YACH,CAAC;YAED,2DAA2D;YAC3D,gEAAgE;YAChE,UAAU,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAEnD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAC5B;gBACE,QAAQ,EAAE,SAAS,CAAC,QAAQ;gBAC5B,IAAI,EAAE,GAAG;gBACT,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,MAAM;gBAC3C,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,OAAO,EAAE,UAAU;gBACnB,KAAK,EAAE,UAAU;aAClB,EACD,CAAC,QAAQ,EAAE,EAAE;gBACX,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,IAAI,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;gBAC5D,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACrB,CAAC,CACF,CAAC;YAEF,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBAC3B,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;oBACnB,MAAM,CAAC,IAAI,CAAC,+BAA+B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC5D,CAAC;gBACD,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;oBACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC7D,CAAC;gBACD,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;oBACvB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;gBAC1E,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,6CAA6C;YAC7C,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,IAAI,OAAO,CAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrD,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtC,MAAM,CAAC,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC,CAAC;gBACxD,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAmB;gBAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,KAAK,EAAE,GAAG,EAAE;oBACV,MAAM,CAAC,KAAK,EAAE,CAAC;oBACf,UAAU,CAAC,OAAO,EAAE,CAAC;oBACrB,SAAS,GAAG,IAAI,CAAC;gBACnB,CAAC;aACF,CAAC;YACF,SAAS,GAAG,MAAM,CAAC;YACnB,MAAM,CAAC,MAAM,CAAC,sCAAsC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YACjE,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"api-proxy.js","sourceRoot":"","sources":["../../src/agent/api-proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,KAAK,MAAM,YAAY,CAAC;AAC/B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AA6BtC,IAAI,SAAS,GAA0B,IAAI,CAAC;AAE5C,wEAAwE;AACxE,0EAA0E;AAC1E,qEAAqE;AACrE,qDAAqD;AACrD,MAAM,UAAU,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC;IACjC,SAAS,EAAE,KAAK;IAChB,UAAU,EAAE,EAAE;IACd,aAAa,EAAE,CAAC,UAAU,CAAC;CAC5B,CAAC,CAAC;AAEH,SAAS,sBAAsB,CAC7B,QAAmC;IAEnC,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,SAAS;QACtC,KAAK,MAAM,KAAK,IAAI,OAAoC,EAAE,CAAC;YACzD,IACE,KAAK,CAAC,IAAI,KAAK,MAAM;gBACrB,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;gBAC9B,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EACxC,CAAC;gBACD,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,cAAc,CACrB,OAAiC,EACjC,IAAY;IAEZ,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1C,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,4BAA4B,CACnC,YAAoB,EACpB,OAAiC;IAEjC,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEzC,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;IAC7D,MAAM,UAAU,GAAG,QAAQ,EAAE,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IAElD,IAAI,CAAC;QACH,IAAI,UAAU,KAAK,MAAM,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;YACrD,OAAO,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CACT,4DAA4D,UAAU,IAAI,MAAM,MAC9E,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,EAAE,CACH,CAAC;IACJ,CAAC;IAED,OAAO,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAiC;IAC7D,OAAO,cAAc,CAAC,OAAO,EAAE,YAAY,CAAC;WACvC,cAAc,CAAC,OAAO,EAAE,cAAc,CAAC;WACvC,cAAc,CAAC,OAAO,EAAE,sBAAsB,CAAC;WAC/C,cAAc,CAAC,OAAO,EAAE,eAAe,CAAC;WACxC,cAAc,CAAC,OAAO,EAAE,iBAAiB,CAAC;WAC1C,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC;WACjC,IAAI,CAAC;AACZ,CAAC;AAED,SAAS,0BAA0B,CAAC,eAAuB;IACzD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,eAAe,CAAY,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,6BAA6B,CAAC,eAAe,CAAC,IAAI,eAAe,CAAC;IAC3E,CAAC;AACH,CAAC;AAED,SAAS,6BAA6B,CAAC,eAAuB;IAC5D,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,YAAiD,CAAC;IACtD,MAAM,aAAa,GAA8B,EAAE,CAAC;IACpD,IAAI,UAAmB,CAAC;IACxB,IAAI,YAAqB,CAAC;IAC1B,IAAI,KAAc,CAAC;IAEnB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,KAAK;aACpB,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;aAC1C,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;aAChD,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,KAAK,QAAQ,CAAC,CAAC;QAE1D,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,IAAI,OAAgC,CAAC;YACrC,IAAI,CAAC;gBACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAA4B,CAAC;YAC5D,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YAED,IAAI,OAAO,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;gBACrC,YAAY,GAAG,OAAO,CAAC,OAA8C,CAAC;gBACtE,SAAS;YACX,CAAC;YAED,IAAI,OAAO,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;gBAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;gBAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;oBAC9B,aAAa,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,aAAwC,CAAC;gBAC1E,CAAC;gBACD,SAAS;YACX,CAAC;YAED,IAAI,OAAO,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;gBAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;gBAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,KAA4C,CAAC;gBACnE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK;oBAAE,SAAS;gBAElD,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;gBACzC,aAAa,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC;gBAC7B,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAClE,KAAK,CAAC,IAAI,GAAG,GAAG,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;gBAClF,CAAC;qBAAM,IAAI,KAAK,CAAC,IAAI,KAAK,kBAAkB,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;oBACvF,KAAK,CAAC,YAAY,GAAG,GAAG,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,YAAY,EAAE,CAAC;gBAClH,CAAC;gBACD,SAAS;YACX,CAAC;YAED,IAAI,OAAO,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;gBACrC,MAAM,KAAK,GAAG,OAAO,CAAC,KAA4C,CAAC;gBACnE,UAAU,GAAG,KAAK,EAAE,WAAW,CAAC;gBAChC,YAAY,GAAG,KAAK,EAAE,aAAa,CAAC;gBACpC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;YACxB,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,YAAY;QAAE,OAAO,SAAS,CAAC;IAEpC,OAAO;QACL,GAAG,YAAY;QACf,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC;QAChE,WAAW,EAAE,UAAU;QACvB,aAAa,EAAE,YAAY;QAC3B,KAAK,EAAE,KAAK,IAAI,YAAY,CAAC,KAAK;KACnC,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,KAA8B;IAC1D,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAEzD,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;IACrD,IAAI,CAAC;QACH,OAAO;YACL,GAAG,IAAI;YACP,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAY;SAC1C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,GAAG,IAAI;YACP,cAAc,EAAE,WAAW;SAC5B,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAGnC;IACC,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC;IAEhC,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,IAAI,2BAA2B,CAAC;IACrE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAE3B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,mCAAmC;IACnC,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;QAC5B,MAAM,EAAE,YAAY,EAAE,mBAAmB;KAC1C,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC5C,MAAM,kBAAkB,GACtB,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,cAAc,CAAC,CAAC;QAE/D,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,CAAC,CAAC;QAEtD,yBAAyB;QACzB,MAAM,UAAU,GAAkD,EAAE,CAAC;QACrE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACvD,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YACrC,UAAU,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAC1B,CAAC;QACD,UAAU,CAAC,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC;QAEjC,iDAAiD;QACjD,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAC/B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACtB,MAAM,CAAC,IAAI,CAAC,qCAAqC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACjB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACnC,MAAM,cAAc,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC9C,IAAI,iBAAsD,CAAC;YAC3D,IAAI,kBAAkB,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1C,IAAI,CAAC;oBACH,iBAAiB,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAA4B,CAAC;gBAC5E,CAAC;gBAAC,MAAM,CAAC;oBACP,8CAA8C;gBAChD,CAAC;YACH,CAAC;YAED,2DAA2D;YAC3D,gEAAgE;YAChE,UAAU,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAEnD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAC5B;gBACE,QAAQ,EAAE,SAAS,CAAC,QAAQ;gBAC5B,IAAI,EAAE,GAAG;gBACT,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,MAAM;gBAC3C,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,OAAO,EAAE,UAAU;gBACnB,KAAK,EAAE,UAAU;aAClB,EACD,CAAC,QAAQ,EAAE,EAAE;gBACX,MAAM,cAAc,GAAa,EAAE,CAAC;gBACpC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,IAAI,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;gBAE5D,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;oBACpC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBAC3B,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACnB,CAAC,CAAC,CAAC;gBAEH,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;oBACtB,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;wBACvB,GAAG,CAAC,GAAG,EAAE,CAAC;oBACZ,CAAC;oBAED,IAAI,kBAAkB,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBAC1C,IAAI,CAAC;4BACH,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;4BACnD,MAAM,eAAe,GAAG,4BAA4B,CAClD,YAAY,EACZ,QAAQ,CAAC,OAAO,CACjB,CAAC;4BACF,MAAM,kBAAkB,GAAG,0BAA0B,CAAC,eAAe,CAAC,CAAC;4BAEvE,MAAM,QAAQ,GAAG,iBAAiB,EAAE,QAAiD,CAAC;4BACtF,MAAM,KAAK,GAAgB;gCACzB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gCACnC,MAAM,EAAE,GAAG,CAAC,MAAM;gCAClB,GAAG,EAAE,GAAG,CAAC,GAAG;gCACZ,KAAK,EAAE,iBAAiB,EAAE,KAA2B;gCACrD,YAAY,EAAE,iBAAiB,IAAI,cAAc;gCACjD,gBAAgB,EAAE,cAAc;gCAChC,gBAAgB,EAAE,QAAQ,CAAC,CAAC,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE;gCAClE,cAAc,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC;gCACrC,kBAAkB,EAAE,IAAI,CAAC,MAAM;gCAC/B,oBAAoB,EAAE,QAAQ,CAAC,UAAU;gCACzC,mBAAmB,EAAE,oBAAoB,CAAC,QAAQ,CAAC,OAAO,CAAC;gCAC3D,gBAAgB,EAAE,QAAQ,CAAC,OAAO;gCAClC,aAAa,EAAE,kBAAkB;gCACjC,iBAAiB,EAAE,eAAe;gCAClC,mBAAmB,EAAE,YAAY,CAAC,MAAM;6BACzC,CAAC;4BAEF,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;4BACnD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,IAAI,QAAQ,CAAC,CAAC;4BAC7D,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;wBACpE,CAAC;wBAAC,MAAM,CAAC;4BACP,8CAA8C;wBAChD,CAAC;oBACH,CAAC;gBACH,CAAC,CAAC,CAAC;gBAEH,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;oBAC3B,MAAM,CAAC,IAAI,CAAC,wCAAwC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;oBACnE,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;wBACvB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;oBACnB,CAAC;gBACH,CAAC,CAAC,CAAC;YACL,CAAC,CACF,CAAC;YAEF,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBAC3B,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;oBACnB,MAAM,CAAC,IAAI,CAAC,+BAA+B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC5D,CAAC;gBACD,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;oBACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC7D,CAAC;gBACD,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;oBACvB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;gBAC1E,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,6CAA6C;YAC7C,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,IAAI,OAAO,CAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrD,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtC,MAAM,CAAC,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC,CAAC;gBACxD,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAmB;gBAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,KAAK,EAAE,GAAG,EAAE;oBACV,MAAM,CAAC,KAAK,EAAE,CAAC;oBACf,UAAU,CAAC,OAAO,EAAE,CAAC;oBACrB,SAAS,GAAG,IAAI,CAAC;gBACnB,CAAC;aACF,CAAC;YACF,SAAS,GAAG,MAAM,CAAC;YACnB,MAAM,CAAC,MAAM,CAAC,sCAAsC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YACjE,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/agent/applied-credential-signature.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Applied-credential signature manifest.
+ *
+ * Persisted alongside materialised tunnel credentials at
+ * `<profileTunnelDir>/.applied-signature.json`. Records the signature
+ * the server handed us with the last bundle we successfully applied.
+ *
+ * The manifest is the *only* piece of state the agent has to remember
+ * across process restarts about credential bundles — everything else
+ * (creds JSON, config.yml) is reconstructable from a fresh server
+ * delivery. The signature is opaque to us; we just echo it back on the
+ * next heartbeat so the server can decide whether to re-ship the body.
+ *
+ * Self-healing properties (intentional):
+ *   - Manifest missing on disk → no signature sent → server sends
+ *     bundle → we re-apply and rewrite the manifest. Recovers any
+ *     install where the manifest was deleted but credentials weren't,
+ *     or vice versa.
+ *   - Manifest present but probe says no live tunnel files → we treat
+ *     the manifest as unusable (return null from `loadIfValid`), the
+ *     next heartbeat goes signature-free, the server re-ships the
+ *     bundle, and we land back in a coherent state.
+ *   - Process restart with everything intact → manifest signature is
+ *     sent on the startup heartbeat, server replies with no
+ *     `credentialBundle`, no disk writes, no tunnel restart.
+ */
+/**
+ * Read the persisted signature, if any. Returns `null` when the file
+ * does not exist, fails to parse, has the wrong shape, or refers to a
+ * tunnel state that no longer matches what's on disk.
+ *
+ * The on-disk-coherence check (`probeLocalTunnelCredential()`) is what
+ * gives us self-healing: a stranded manifest from a wiped tunnel dir
+ * gets ignored, forcing a fresh bundle on the next heartbeat.
+ */
+export declare function loadAppliedSignatureIfValid(): string | null;
+/**
+ * Persist the signature for the most recently applied bundle. Best-
+ * effort: a write failure is logged but does not throw, since the
+ * worst case is just an extra full-bundle delivery on the next
+ * heartbeat.
+ *
+ * The file is written with 0o600 to match the credentials sitting next
+ * to it; the directory itself is already 0o700 from
+ * `runtime-credentials.ts`.
+ */
+export declare function writeAppliedSignature(signature: string): void;
+/**
+ * Forget the persisted signature. Used by tests; production code never
+ * needs to delete it explicitly because writes overwrite in place.
+ */
+export declare function __clearAppliedSignatureForTests(): void;
+//# sourceMappingURL=applied-credential-signature.d.ts.map

package/dist/agent/applied-credential-signature.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"applied-credential-signature.d.ts","sourceRoot":"","sources":["../../src/agent/applied-credential-signature.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAwBH;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,IAAI,MAAM,GAAG,IAAI,CA2C3D;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAgC7D;AAED;;;GAGG;AACH,wBAAgB,+BAA+B,IAAI,IAAI,CAMtD"}

package/dist/agent/applied-credential-signature.js

@@ -0,0 +1,137 @@
+/**
+ * Applied-credential signature manifest.
+ *
+ * Persisted alongside materialised tunnel credentials at
+ * `<profileTunnelDir>/.applied-signature.json`. Records the signature
+ * the server handed us with the last bundle we successfully applied.
+ *
+ * The manifest is the *only* piece of state the agent has to remember
+ * across process restarts about credential bundles — everything else
+ * (creds JSON, config.yml) is reconstructable from a fresh server
+ * delivery. The signature is opaque to us; we just echo it back on the
+ * next heartbeat so the server can decide whether to re-ship the body.
+ *
+ * Self-healing properties (intentional):
+ *   - Manifest missing on disk → no signature sent → server sends
+ *     bundle → we re-apply and rewrite the manifest. Recovers any
+ *     install where the manifest was deleted but credentials weren't,
+ *     or vice versa.
+ *   - Manifest present but probe says no live tunnel files → we treat
+ *     the manifest as unusable (return null from `loadIfValid`), the
+ *     next heartbeat goes signature-free, the server re-ships the
+ *     bundle, and we land back in a coherent state.
+ *   - Process restart with everything intact → manifest signature is
+ *     sent on the startup heartbeat, server replies with no
+ *     `credentialBundle`, no disk writes, no tunnel restart.
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { getProfileTunnelDir } from "../config/index.js";
+import { probeLocalTunnelCredential } from "./runtime-credentials.js";
+import { logger } from "../logger.js";
+const MANIFEST_FILENAME = ".applied-signature.json";
+const MANIFEST_VERSION = 1;
+function getManifestPath() {
+    return path.join(getProfileTunnelDir(), MANIFEST_FILENAME);
+}
+/**
+ * Read the persisted signature, if any. Returns `null` when the file
+ * does not exist, fails to parse, has the wrong shape, or refers to a
+ * tunnel state that no longer matches what's on disk.
+ *
+ * The on-disk-coherence check (`probeLocalTunnelCredential()`) is what
+ * gives us self-healing: a stranded manifest from a wiped tunnel dir
+ * gets ignored, forcing a fresh bundle on the next heartbeat.
+ */
+export function loadAppliedSignatureIfValid() {
+    const manifestPath = getManifestPath();
+    if (!fs.existsSync(manifestPath))
+        return null;
+    let raw;
+    try {
+        raw = fs.readFileSync(manifestPath, "utf-8");
+    }
+    catch (err) {
+        logger.warn(`Applied-signature manifest unreadable: ${err instanceof Error ? err.message : String(err)}`);
+        return null;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        logger.warn(`Applied-signature manifest malformed; ignoring`);
+        return null;
+    }
+    if (!parsed ||
+        typeof parsed !== "object" ||
+        !("signature" in parsed) ||
+        typeof parsed.signature !== "string" ||
+        parsed.signature.trim() === "") {
+        return null;
+    }
+    const signature = parsed.signature.trim();
+    // Coherence: a manifest is only meaningful when the credentials it
+    // refers to actually still exist on disk. If the tunnel files were
+    // wiped (e.g. operator deleted `~/.visionclaw/profiles/default/tunnel`)
+    // the stored signature lies about our state, so pretend we have none
+    // and let the server reissue the bundle.
+    if (probeLocalTunnelCredential() === null) {
+        return null;
+    }
+    return signature;
+}
+/**
+ * Persist the signature for the most recently applied bundle. Best-
+ * effort: a write failure is logged but does not throw, since the
+ * worst case is just an extra full-bundle delivery on the next
+ * heartbeat.
+ *
+ * The file is written with 0o600 to match the credentials sitting next
+ * to it; the directory itself is already 0o700 from
+ * `runtime-credentials.ts`.
+ */
+export function writeAppliedSignature(signature) {
+    if (typeof signature !== "string" || signature.trim() === "")
+        return;
+    const manifestPath = getManifestPath();
+    const dir = path.dirname(manifestPath);
+    try {
+        fs.mkdirSync(dir, { recursive: true });
+    }
+    catch {
+        // best-effort; the credential apply path will have created it
+    }
+    const payload = {
+        version: MANIFEST_VERSION,
+        signature: signature.trim(),
+        appliedAt: new Date().toISOString(),
+    };
+    try {
+        fs.writeFileSync(manifestPath, JSON.stringify(payload, null, 2), "utf-8");
+        if (process.platform !== "win32") {
+            try {
+                fs.chmodSync(manifestPath, 0o600);
+            }
+            catch {
+                // best-effort; directory perms still protect
+            }
+        }
+    }
+    catch (err) {
+        logger.warn(`Failed to persist applied-signature manifest: ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
+/**
+ * Forget the persisted signature. Used by tests; production code never
+ * needs to delete it explicitly because writes overwrite in place.
+ */
+export function __clearAppliedSignatureForTests() {
+    try {
+        fs.rmSync(getManifestPath(), { force: true });
+    }
+    catch {
+        // ignore
+    }
+}
+//# sourceMappingURL=applied-credential-signature.js.map

package/dist/agent/applied-credential-signature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"applied-credential-signature.js","sourceRoot":"","sources":["../../src/agent/applied-credential-signature.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAEtC,MAAM,iBAAiB,GAAG,yBAAyB,CAAC;AACpD,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAW3B,SAAS,eAAe;IACtB,OAAO,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,iBAAiB,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,2BAA2B;IACzC,MAAM,YAAY,GAAG,eAAe,EAAE,CAAC;IACvC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IAE9C,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CACT,0CAA0C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC7F,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;QAC9D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IACE,CAAC,MAAM;QACP,OAAO,MAAM,KAAK,QAAQ;QAC1B,CAAC,CAAC,WAAW,IAAI,MAAM,CAAC;QACxB,OAAQ,MAAiC,CAAC,SAAS,KAAK,QAAQ;QAC/D,MAAgC,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EACzD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,SAAS,GAAI,MAAgC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;IAErE,mEAAmE;IACnE,mEAAmE;IACnE,wEAAwE;IACxE,qEAAqE;IACrE,yCAAyC;IACzC,IAAI,0BAA0B,EAAE,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,SAAiB;IACrD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO;IAErE,MAAM,YAAY,GAAG,eAAe,EAAE,CAAC;IACvC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAEvC,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,8DAA8D;IAChE,CAAC;IAED,MAAM,OAAO,GAAsB;QACjC,OAAO,EAAE,gBAAgB;QACzB,SAAS,EAAE,SAAS,CAAC,IAAI,EAAE;QAC3B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;IAEF,IAAI,CAAC;QACH,EAAE,CAAC,aAAa,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAC1E,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,IAAI,CAAC;gBACH,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;YAAC,MAAM,CAAC;gBACP,6CAA6C;YAC/C,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CACT,iDAAiD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACpG,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,+BAA+B;IAC7C,IAAI,CAAC;QACH,EAAE,CAAC,MAAM,CAAC,eAAe,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,SAAS;IACX,CAAC;AACH,CAAC"}

package/dist/agent/command-handlers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"command-handlers.d.ts","sourceRoot":"","sources":["../../src/agent/command-handlers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AA2BxE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,KAAK,UAAU,EAAuB,MAAM,YAAY,CAAC;AAkBlE,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,UAAU,CAAC;IACvB,cAAc,EAAE,cAAc,CAAC;IAC/B,YAAY,EAAE,YAAY,CAAC;IAC3B,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,gBAAgB,CAAC;IACzB,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,EAAE,gBAAgB,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAChC;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,kBAAkB,GAAG,IAAI,CAi3BtE"}
+{"version":3,"file":"command-handlers.d.ts","sourceRoot":"","sources":["../../src/agent/command-handlers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AA2BxE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,KAAK,UAAU,EAAuB,MAAM,YAAY,CAAC;AAkBlE,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,UAAU,CAAC;IACvB,cAAc,EAAE,cAAc,CAAC;IAC/B,YAAY,EAAE,YAAY,CAAC;IAC3B,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,gBAAgB,CAAC;IACzB,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,EAAE,gBAAgB,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAChC;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,kBAAkB,GAAG,IAAI,CA83BtE"}

package/dist/agent/command-handlers.js

@@ -386,9 +386,6 @@ export function registerCommandHandlers(deps) {
         const doRefresh = async () => {
             // Claim the `compacting` mutex upfront so the main loop's wake gate
             // won't start a new turn on the same session while we compact it.
-            // Claude's requestCompaction() also manages this flag internally; our
-            // early claim covers the window between requestStop() and the compact
-            // call, and the OpenAI provider (which doesn't touch the flag).
             agentState.compacting = true;
             try {
                 if (agentState.busy) {
@@ -421,14 +418,28 @@ export function registerCommandHandlers(deps) {
                     return;
                 }
                 await channelManager.sendMessage(req.channel, req.sender, t("cmd.refresh.refreshing", getLocale()));
-                await activeSession.requestCompaction();
-                // Enqueue a system message so the agent re-orients after compaction
-                // (task details may be lost in the summary).
+                // Summarize the current transcript before resetting
+                const transcriptPath = activeSession.getTranscriptPath();
+                let summary = null;
+                if (transcriptPath) {
+                    const { summarizeTranscript } = await import("./transcript-summarizer.js");
+                    summary = await summarizeTranscript(transcriptPath, config);
+                }
+                // If LLM summary failed, use a fallback instruction
+                const finalSummary = summary ??
+                    "The previous session transcript could not be summarized automatically. " +
+                        "Use the `memory_transcript_search` tool to look up your recent activity " +
+                        "and rebuild context. Also check your memory directory and todo list.";
+                // Perform the full session reset
+                session.resetActiveSession(finalSummary);
+                // Re-enqueue pending messages so they're delivered to the new session
                 messageQueue.enqueue({
                     id: `refresh_cmd_${Date.now()}`,
                     channel: "system",
                     sender: "system",
-                    text: "The owner manually triggered a context refresh (compaction). Review your current task and todo list to make sure you haven't lost track of what you were working on.",
+                    text: "The owner manually triggered a full context refresh. A new session has been created. " +
+                        "The summary of your previous session has been injected as context above. " +
+                        "Review it, check your memory and todo list, and continue where you left off.",
                     attachments: [],
                     timestamp: new Date().toISOString(),
                 });