xaq-cli 0.0.0 → 0.1.0-nightly.71

package/dist/listen-B9iO7HgQ.js

@@ -0,0 +1,1568 @@
+#!/usr/bin/env node
+import { i as underService, n as envVar } from "./brand--ZB8jTn1.js";
+import { n as version, t as NPX } from "./version-BxH7OuWD.js";
+import { d as tighten, f as writePrivateFile, i as saveProfile, l as ensurePrivateDir, n as loadProfile } from "./profile-NmMKAczz.js";
+import { f as statusPath, i as deadPath, l as profileStateDir, o as logPath, p as validProfileName, s as oneOffLogPath } from "./paths-yzOKD6ow.js";
+import { m as writeClaudeMcpConfig, t as claudeMcpConfigPath } from "./mcpheader-C9H4vudu.js";
+import { S as insecureBanner, a as TOOL_LABELS, f as isHermesRoute, g as recipeToolFor, h as recipeOf, o as hermesChangeNote, r as SILENT_MARKER, v as shellQuote, x as checkTransport } from "./recipes-DG_-doGq.js";
+import { i as safeText, r as formatDuration } from "./ui-B8Sd4Y7Y.js";
+import { A as clientHeader, C as commandInput, D as ApiError, E as skipReason, I as userAgent, L as abortable, M as describeFetchError, N as getSelf, O as ackEvents, S as batchEnv, T as parsePayload, _ as throwawayConsumer, b as forwardEvent, d as THROWAWAY_SUFFIXES, f as categoryNote, g as resolveListen, k as apiError, m as describeFilter, o as routeWarning, r as gatewayWarning, v as typesNotes, w as eventEnv, x as UNTRUSTED_NOTICE } from "./hermes-DHnDTYJp.js";
+import { appendFileSync, closeSync, constants, existsSync, mkdtempSync, openSync, readFileSync, renameSync, rmSync, statSync, writeFileSync, writeSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { hostname, tmpdir } from "node:os";
+import { spawn } from "node:child_process";
+import pc from "picocolors";
+//#region server/listen/grants.ts
+/**
+* A grant in plain words, e.g. "ops@acme.dev: read, draft, send; sends need your approval in the
+* console". Uses the same wording as the console's approval choices (Read only, Read and draft,
+* Send with my approval, Full access) so the human recognizes what they picked. Calendar access is
+* described after the mail part.
+*/
+function describeGrant(g) {
+	const all = g.capabilities;
+	const caps = all.filter((c) => !c.startsWith("calendar."));
+	const parts = [];
+	const readOnly = caps.length === 1 && caps[0] === "read";
+	if (readOnly) parts.push(all.length > 1 ? `${all.join(", ")}; mail read only (can't draft or send)` : "read only (can't draft or send)");
+	else parts.push(all.join(", ") || "no capabilities");
+	if (caps.includes("send")) {
+		if (g.sendMode === "approval") parts.push("sends need your approval in the console");
+		else if (g.sendMode === "direct") parts.push(g.allowTo?.length ? "sends go out directly to allowed recipients" : "sends go out directly");
+		else parts.push("sends become Gmail drafts for you to send");
+		if (g.allowTo?.length) {
+			const shown = g.allowTo.slice(0, 3).map((a) => safeText(a, 80));
+			parts.push(`only to ${shown.join(", ")}${g.allowTo.length > 3 ? ` and ${g.allowTo.length - 3} more` : ""}`);
+		}
+		if (g.replyOnly) parts.push("replies in existing threads only");
+		const limits = [g.maxSendsPerHour ? `${g.maxSendsPerHour}/hour` : null, g.maxSendsPerDay ? `${g.maxSendsPerDay}/day` : null].filter(Boolean);
+		if (limits.length) parts.push(`at most ${limits.join(", ")}`);
+	} else if (!readOnly && caps.length) parts.push("can't send");
+	if (g.labelScope?.length) parts.push(`only label${g.labelScope.length > 1 ? "s" : ""} ${g.labelScope.map((l) => safeText(l, 60)).join(", ")}`);
+	if (all.includes("calendar.write")) parts.push(g.calendarWriteMode === "direct" ? "calendar changes apply directly" : "calendar changes need your approval in the console");
+	if (g.calendarScope?.length && all.some((c) => c.startsWith("calendar."))) parts.push(`only calendar${g.calendarScope.length > 1 ? "s" : ""} ${g.calendarScope.map((c) => safeText(c, 80)).join(", ")}`);
+	return `${safeText(g.accountEmail || g.accountId, 120)}: ${parts.join("; ")}`;
+}
+const LEVEL_WORDS = {
+	full: "full access",
+	ask: "ask before risky actions",
+	read: "read only"
+};
+/** A connection grant in plain words, e.g. "Notion (notion__… tools): ask before risky actions". */
+const describeConnection = (c) => `${safeText(c.name, 80)} (${safeText(c.slug, 24)}__… tools): ${LEVEL_WORDS[c.level] ?? safeText(String(c.level), 20)}`;
+/** One line per mailbox grant and per connection, or a hint when there are none. */
+function describeGrants(grants, connections = []) {
+	if (!grants.length && !connections.length) return ["no mailbox or calendar access yet: add a grant for this agent in the console (Agents page)"];
+	return [...grants.map(describeGrant), ...connections.map(describeConnection)];
+}
+/** Whether there's anything to describe (else describeGrants' single line is the "nothing yet" hint). */
+const hasAccess = (self) => self.grants.length > 0 || (self.connections?.length ?? 0) > 0;
+/** Stable key for "did the grants change?" (order-independent; connections too). */
+const grantsKey = (grants, connections = []) => JSON.stringify(connections.length ? [grantsList(grants), connections.map((c) => [c.slug, c.level]).sort()] : grantsList(grants));
+const grantsList = (grants) => grants.map((g) => [
+	g.accountId,
+	[...g.capabilities].sort(),
+	g.sendMode,
+	g.labelScope ? [...g.labelScope].sort() : null,
+	g.allowTo ? [...g.allowTo].sort() : null,
+	g.replyOnly ?? null,
+	g.maxSendsPerHour ?? null,
+	g.maxSendsPerDay ?? null,
+	g.calendarScope ? [...g.calendarScope].sort() : null,
+	g.calendarWriteMode ?? null
+]).sort((a, b) => String(a[0]).localeCompare(String(b[0])));
+//#endregion
+//#region server/listen/dispatcher.ts
+const defaultRetryDelay = (attempt) => Math.min(5e3 * 2 ** (attempt - 1), 3e5) * (.8 + Math.random() * .4);
+/**
+* Runs events with bounded concurrency and retries, and tracks the **contiguous prefix** of finished
+* events (succeeded, dead or filtered out). Only that prefix is acknowledged, so a crash never loses
+* an event that was still running, collecting into a batch, or waiting to retry: it is delivered
+* again on restart (at-least-once; handlers dedupe on the event id). Events can finish out of order
+* when concurrency is above 1 or an event is waiting for a retry. A batch job takes its first event's
+* place in that order, so nothing after it is acknowledged before the whole batch has finished.
+*/
+var Dispatcher = class {
+	opts;
+	jobs = [];
+	running = 0;
+	highestSeen = 0;
+	advancedTo = 0;
+	stopped = false;
+	controller = new AbortController();
+	timers = /* @__PURE__ */ new Set();
+	idleWaiters = [];
+	/** The batch still collecting events, if any. */
+	open = null;
+	constructor(opts) {
+		this.opts = opts;
+	}
+	/** Highest seq received this session (sent as Last-Event-ID on reconnect). */
+	get lastSeq() {
+		return this.highestSeen;
+	}
+	/** Seq the finished prefix reaches. */
+	get finishedThrough() {
+		return this.advancedTo;
+	}
+	/** Events received but not yet started (for stream backpressure). */
+	get backlog() {
+		return this.jobs.filter((j) => j.state === "queued" || j.state === "collecting").reduce((n, j) => n + j.payloads.length, 0);
+	}
+	get inFlight() {
+		return this.jobs.filter((j) => j.state !== "done").length;
+	}
+	/** Seeds the position (the server's acked cursor) so older replays are ignored. */
+	seed(seq) {
+		this.highestSeen = Math.max(this.highestSeen, seq);
+		this.advancedTo = Math.max(this.advancedTo, seq);
+	}
+	/** Adds an event. Returns false when it is a duplicate of one already seen this session. */
+	push(payload, opts = {}) {
+		const seq = payload.data.seq;
+		if (this.stopped || seq <= this.highestSeen) return false;
+		this.highestSeen = seq;
+		const remaining = new Set(opts.targets ? this.opts.targets.filter((t) => opts.targets.includes(t)) : this.opts.targets);
+		const batch = this.opts.batch && !opts.targets ? this.opts.batch : null;
+		if (!opts.skip && remaining.size && batch && this.open) {
+			const job = this.open.job;
+			job.payloads.push(payload);
+			job.lastSeq = seq;
+			if (job.payloads.length >= batch.max) this.close();
+			return true;
+		}
+		const job = {
+			seq,
+			payload,
+			payloads: [payload],
+			lastSeq: seq,
+			remaining,
+			forwarded: /* @__PURE__ */ new Set(),
+			attempts: 0,
+			deferrals: 0,
+			lastError: null,
+			state: "queued",
+			firstSeenAt: Date.now()
+		};
+		this.jobs.push(job);
+		if (opts.skip || remaining.size === 0) {
+			job.state = "done";
+			job.outcome = "skipped";
+			this.advance();
+		} else if (batch && batch.max > 1) {
+			job.state = "collecting";
+			const timer = setTimeout(() => this.close(), batch.windowMs);
+			this.open = {
+				job,
+				timer
+			};
+		} else this.pump();
+		return true;
+	}
+	/** Ends the collecting batch: it runs as soon as a slot is free. */
+	close() {
+		if (!this.open) return;
+		clearTimeout(this.open.timer);
+		this.open.job.state = "queued";
+		this.open = null;
+		this.pump();
+	}
+	pump() {
+		if (this.stopped) return;
+		for (const job of this.jobs) {
+			if (this.running >= this.opts.concurrency) break;
+			if (job.state === "queued") this.start(job);
+		}
+	}
+	async start(job) {
+		job.state = "running";
+		job.attempts++;
+		job.retryAfterMs = void 0;
+		this.running++;
+		let errors;
+		try {
+			errors = await this.opts.run(job, this.controller.signal);
+		} catch (err) {
+			errors = [err instanceof Error ? err.message : String(err)];
+		}
+		this.running--;
+		if (this.stopped) {
+			job.state = "queued";
+			this.notifyIdle();
+			return;
+		}
+		if (job.remaining.size === 0) {
+			job.state = "done";
+			job.outcome = "succeeded";
+			this.opts.onFinished?.(job);
+		} else {
+			job.lastError = errors.join("; ") || "failed";
+			const deferred = job.retryAfterMs !== void 0 && errors.length === 1 && job.deferrals < 20;
+			if (deferred) {
+				job.deferrals++;
+				job.attempts--;
+			}
+			if (job.attempts >= this.opts.maxAttempts) {
+				job.state = "done";
+				job.outcome = "dead";
+				this.opts.onDead(job);
+				this.opts.onFinished?.(job);
+			} else {
+				job.state = "waiting";
+				const delay = deferred ? job.retryAfterMs : (this.opts.retryDelayMs ?? defaultRetryDelay)(job.attempts);
+				this.opts.onRetry?.(job, delay);
+				const t = setTimeout(() => {
+					this.timers.delete(t);
+					if (job.state === "waiting") job.state = "queued";
+					this.pump();
+				}, delay);
+				this.timers.add(t);
+			}
+		}
+		this.advance();
+		this.pump();
+		this.notifyIdle();
+	}
+	advance() {
+		let to = this.advancedTo;
+		while (this.jobs.length && this.jobs[0].state === "done") to = Math.max(to, this.jobs.shift().lastSeq);
+		if (to > this.advancedTo) {
+			this.advancedTo = to;
+			this.opts.onAdvance(to);
+		}
+		this.notifyIdle();
+	}
+	notifyIdle() {
+		if (this.jobs.length === 0 && this.running === 0) {
+			const waiters = this.idleWaiters;
+			this.idleWaiters = [];
+			for (const w of waiters) w();
+		}
+	}
+	/** Resolves once every received event has finished (tests and `dead --replay`). */
+	idle() {
+		if (this.jobs.length === 0 && this.running === 0) return Promise.resolve();
+		return new Promise((r) => this.idleWaiters.push(r));
+	}
+	/** Stops starting work, aborts what is running (process groups are killed) and waits for it to unwind. A collecting batch isn't run (nor acknowledged). */
+	async stop() {
+		this.stopped = true;
+		if (this.open) clearTimeout(this.open.timer);
+		this.open = null;
+		for (const t of this.timers) clearTimeout(t);
+		this.timers.clear();
+		this.controller.abort();
+		while (this.running > 0) await new Promise((r) => setTimeout(r, 20));
+	}
+};
+//#endregion
+//#region server/listen/exec.ts
+const KILL_GRACE_MS = 5e3;
+var Tail = class {
+	buf = "";
+	push(chunk) {
+		this.buf = (this.buf + chunk.toString("utf8")).slice(-4e3);
+	}
+	toString() {
+		return this.buf;
+	}
+};
+/**
+* The child's environment: ours minus anything xaq-specific (XAQ_* and the pre-rename AGENTINBOX_*:
+* service flags, a master key that happened to be exported…), plus the safe event ids and the event file
+* path. Each of those is set as XAQ_<name> and, for commands written before the rename, AGENTINBOX_<name>.
+*/
+function childEnv(input, eventFile) {
+	const env = {};
+	for (const [k, v] of Object.entries(process.env)) if (!k.startsWith("XAQ_") && !k.startsWith("AGENTINBOX_")) env[k] = v;
+	const ids = {
+		...Array.isArray(input) ? batchEnv(input) : {
+			...eventEnv(input),
+			XAQ_EVENT_COUNT: "1"
+		},
+		XAQ_EVENT_FILE: eventFile
+	};
+	const legacy = Object.fromEntries(Object.entries(ids).map(([k, v]) => [k.replace(/^XAQ_/, "AGENTINBOX_"), v]));
+	return {
+		...env,
+		...ids,
+		...legacy
+	};
+}
+/** stdin for one event ({ notice, event }) or a --batch ({ notice, events: […] }, even for a batch of one). */
+function commandStdin(input) {
+	const body = Array.isArray(input) ? {
+		notice: UNTRUSTED_NOTICE,
+		events: input.map((p) => commandInput(p).event)
+	} : commandInput(input);
+	return JSON.stringify(body, null, 2) + "\n";
+}
+/** Running commands, so a forced exit (second Ctrl-C) can still kill their process groups and remove temp files. */
+const active = /* @__PURE__ */ new Map();
+/** Synchronous last-resort cleanup before process.exit. */
+function killAllRuns() {
+	for (const [pid, dir] of active) {
+		killGroup(pid, "SIGKILL");
+		rmSync(dir, {
+			recursive: true,
+			force: true
+		});
+	}
+	active.clear();
+}
+function groupAlive(pid) {
+	if (!pid) return false;
+	try {
+		process.kill(-pid, 0);
+		return true;
+	} catch {
+		return false;
+	}
+}
+function killGroup(pid, signal) {
+	if (!pid) return;
+	try {
+		process.kill(-pid, signal);
+	} catch {}
+}
+/**
+* Runs the configured command for one event, or for a batch (an array). The command string is fixed
+* configuration and goes to `/bin/sh -c` verbatim; it is never built from event data. The events reach
+* the command only as JSON on stdin, as a 0600 file named by XAQ_EVENT_FILE, and as a few
+* validated ids in env. On timeout the whole process group gets SIGTERM, then SIGKILL after a grace period.
+*/
+function runCommand(command, payload, opts) {
+	const started = performance.now();
+	const input = commandStdin(payload);
+	const dir = mkdtempSync(join(tmpdir(), "xaq-event-"));
+	const eventFile = join(dir, "event.json");
+	writeFileSync(eventFile, input, {
+		mode: 384,
+		flag: "wx"
+	});
+	return new Promise((resolve) => {
+		const stdout = new Tail();
+		const stderr = new Tail();
+		let timedOut = false;
+		let settled = false;
+		let killTimer;
+		const child = spawn("/bin/sh", ["-c", command], {
+			cwd: opts.cwd,
+			env: childEnv(payload, eventFile),
+			stdio: [
+				"pipe",
+				"pipe",
+				"pipe"
+			],
+			detached: true
+		});
+		if (child.pid) active.set(child.pid, dir);
+		let terminatedAt = null;
+		const finish = (r) => {
+			if (settled) return;
+			settled = true;
+			clearTimeout(timer);
+			clearTimeout(killTimer);
+			opts.signal?.removeEventListener("abort", onAbort);
+			(async () => {
+				if (terminatedAt !== null) {
+					while (groupAlive(child.pid) && Date.now() - terminatedAt < KILL_GRACE_MS) await new Promise((res) => setTimeout(res, 100));
+					killGroup(child.pid, "SIGKILL");
+				}
+				if (child.pid) active.delete(child.pid);
+				await new Promise((res) => setTimeout(res, 50));
+				child.stdout?.destroy();
+				child.stderr?.destroy();
+				rmSync(dir, {
+					recursive: true,
+					force: true
+				});
+				resolve({
+					...r,
+					ok: r.ok && !timedOut,
+					timedOut,
+					durationMs: Math.round(performance.now() - started),
+					stdoutTail: stdout.toString(),
+					stderrTail: stderr.toString()
+				});
+			})();
+		};
+		const terminate = () => {
+			if (terminatedAt !== null) return;
+			terminatedAt = Date.now();
+			killGroup(child.pid, "SIGTERM");
+			killTimer = setTimeout(() => killGroup(child.pid, "SIGKILL"), KILL_GRACE_MS);
+			killTimer.unref();
+		};
+		const timer = setTimeout(() => {
+			timedOut = true;
+			terminate();
+		}, opts.timeoutMs);
+		const onAbort = () => terminate();
+		opts.signal?.addEventListener("abort", onAbort, { once: true });
+		child.stdout.on("data", (c) => stdout.push(c));
+		child.stderr.on("data", (c) => stderr.push(c));
+		child.stdin.on("error", () => {});
+		child.stdin.end(input);
+		child.on("error", (err) => finish({
+			ok: false,
+			exitCode: null,
+			signal: null,
+			error: `Could not start /bin/sh: ${err.message}`
+		}));
+		child.on("exit", (code, signal) => {
+			const error = timedOut ? `Timed out after ${Math.round(opts.timeoutMs / 1e3)} s; the process group was killed` : signal ? `Killed by ${signal}` : code !== 0 ? `Exited with code ${code}` : null;
+			finish({
+				ok: code === 0 && !signal,
+				exitCode: code,
+				signal: signal ?? null,
+				error
+			});
+		});
+	});
+}
+//#endregion
+//#region server/listen/logfile.ts
+const ANSI = /\x1b\[[0-9;]*m/g;
+/**
+* Structured JSONL log in the state dir (rotated by size, 0600) plus friendly console lines.
+* Meta values go to the file only; the console shows the message.
+*/
+function createListenLogger(opts) {
+	const maxBytes = opts.maxBytes ?? 5242880;
+	const keep = opts.keep ?? 3;
+	let size = -1;
+	if (opts.path) {
+		ensurePrivateDir(dirname(opts.path));
+		tighten(opts.path);
+	}
+	const rotate = (path) => {
+		rmSync(`${path}.${keep}`, { force: true });
+		for (let i = keep - 1; i >= 1; i--) if (existsSync(`${path}.${i}`)) renameSync(`${path}.${i}`, `${path}.${i + 1}`);
+		renameSync(path, `${path}.1`);
+		size = 0;
+	};
+	const toFile = (level, msg, meta) => {
+		if (!opts.path) return;
+		const line = JSON.stringify({
+			ts: (/* @__PURE__ */ new Date()).toISOString(),
+			level,
+			msg: msg.replace(ANSI, ""),
+			...meta
+		}) + "\n";
+		try {
+			if (size < 0) size = existsSync(opts.path) ? statSync(opts.path).size : 0;
+			if (size + line.length > maxBytes && size > 0) rotate(opts.path);
+			appendFileSync(opts.path, line, { mode: 384 });
+			size += Buffer.byteLength(line);
+		} catch {}
+	};
+	const colors = {
+		debug: pc.gray,
+		info: (s) => s,
+		warn: pc.yellow,
+		error: pc.red
+	};
+	const toConsole = (level, msg) => {
+		if (opts.console === false || level === "debug" && !opts.debug) return;
+		const ts = pc.gray((/* @__PURE__ */ new Date()).toTimeString().slice(0, 8));
+		const tag = level === "warn" ? pc.yellow("warn ") : level === "error" ? pc.red("error ") : "";
+		const text = msg.split("\n").join("\n  ");
+		(level === "error" || level === "warn" ? process.stderr : process.stdout).write(`${ts} ${tag}${colors[level](text)}\n`);
+	};
+	const emit = (level) => (msg, meta) => {
+		toFile(level, msg, meta);
+		toConsole(level, msg);
+	};
+	return {
+		debug: emit("debug"),
+		info: emit("info"),
+		warn: emit("warn"),
+		error: emit("error")
+	};
+}
+//#endregion
+//#region server/listen/state.ts
+function appendDead(profile, entry) {
+	const path = deadPath(profile);
+	ensurePrivateDir(dirname(path));
+	appendFileSync(path, JSON.stringify(entry) + "\n", { mode: 384 });
+	tighten(path);
+}
+function readDead(profile) {
+	const path = deadPath(profile);
+	if (!existsSync(path)) return [];
+	const out = [];
+	for (const line of readFileSync(path, "utf8").split("\n")) {
+		if (!line.trim()) continue;
+		try {
+			out.push(JSON.parse(line));
+		} catch {}
+	}
+	return out;
+}
+function writeDead(profile, entries) {
+	writePrivateFile(deadPath(profile), entries.map((e) => JSON.stringify(e) + "\n").join(""));
+}
+const consumersPath = (profile) => join(profileStateDir(profile), "consumers.json");
+function knownConsumers(profile) {
+	const list = [];
+	try {
+		const parsed = JSON.parse(readFileSync(consumersPath(profile), "utf8"));
+		if (Array.isArray(parsed)) list.push(...parsed.filter((c) => typeof c === "string"));
+	} catch {}
+	const last = readStatus(profile)?.consumer;
+	if (last && !list.includes(last)) list.push(last);
+	return list;
+}
+function rememberConsumer(profile, consumer) {
+	const list = knownConsumers(profile);
+	if (list.includes(consumer)) return;
+	try {
+		writePrivateFile(consumersPath(profile), JSON.stringify([...list, consumer]) + "\n");
+	} catch {}
+}
+function readStatus(profile) {
+	try {
+		return JSON.parse(readFileSync(statusPath(profile), "utf8"));
+	} catch {
+		return null;
+	}
+}
+/** Writes status.json at most once a second (and immediately on `flush`). */
+var StatusWriter = class {
+	profile;
+	status;
+	persist;
+	timer = null;
+	constructor(profile, status, persist = true) {
+		this.profile = profile;
+		this.status = status;
+		this.persist = persist;
+	}
+	update(patch) {
+		Object.assign(this.status, patch);
+		if (this.timer) return;
+		this.timer = setTimeout(() => this.flush(), 1e3);
+		this.timer.unref();
+	}
+	addRecent(e) {
+		this.status.recent = [e, ...this.status.recent.filter((r) => r.seq !== e.seq)].slice(0, 20);
+		this.update({});
+	}
+	flush() {
+		if (this.timer) clearTimeout(this.timer);
+		this.timer = null;
+		if (!this.persist) return;
+		try {
+			writePrivateFile(statusPath(this.profile), JSON.stringify(this.status, null, 2) + "\n");
+		} catch {}
+	}
+};
+/** Whether a process with this pid is alive (status.json may be left over from a crash). */
+function pidAlive(pid) {
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch (err) {
+		return err.code === "EPERM";
+	}
+}
+//#endregion
+//#region server/listen/lock.ts
+/**
+* One listener per profile: two would share a consumer cursor and run every event twice. The lock is
+* a file with the owner's pid and start time, created exclusively; a lock whose process is gone is
+* stale and taken over.
+*/
+const lockPath = (profile) => join(profileStateDir(profile), "listen.lock");
+var ProfileLockedError = class extends Error {
+	holder;
+	constructor(holder, profile) {
+		super(`Another listener is already running profile "${profile}" (pid ${holder.pid}, since ${holder.startedAt}).\n  If it's the background service, check it with \`${NPX} listen service status${profile === "default" ? "" : ` --profile ${profile}`}\`; stop it before running one in the foreground.`);
+		this.holder = holder;
+	}
+};
+function readLock(path) {
+	try {
+		const info = JSON.parse(readFileSync(path, "utf8"));
+		return typeof info.pid === "number" ? info : null;
+	} catch {
+		return null;
+	}
+}
+/** Lock files held by this process (a second in-process holder has the same pid). */
+const held = /* @__PURE__ */ new Set();
+/**
+* Takes an exclusive lock file (pid + start time, created with O_EXCL) or throws `busy(holder)`. A lock
+* whose process is gone is stale and taken over. Returns a release function (also run on process exit).
+*/
+function acquireFileLock(path, busy) {
+	ensurePrivateDir(dirname(path));
+	const mine = {
+		pid: process.pid,
+		startedAt: (/* @__PURE__ */ new Date()).toISOString()
+	};
+	if (held.has(path)) throw busy(readLock(path) ?? mine);
+	for (let attempt = 0; attempt < 3; attempt++) {
+		try {
+			const fd = openSync(path, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 384);
+			writeSync(fd, JSON.stringify(mine));
+			closeSync(fd);
+			held.add(path);
+			let released = false;
+			const release = () => {
+				if (released) return;
+				released = true;
+				held.delete(path);
+				process.off("exit", release);
+				if (readLock(path)?.pid === process.pid) rmSync(path, { force: true });
+			};
+			process.on("exit", release);
+			return release;
+		} catch (err) {
+			if (err.code !== "EEXIST") throw err;
+		}
+		const holder = readLock(path);
+		if (holder && holder.pid !== process.pid && pidAlive(holder.pid)) throw busy(holder);
+		rmSync(path, { force: true });
+	}
+	throw new Error(`Could not take the lock ${path}.`);
+}
+/** Takes the profile's listener lock or throws ProfileLockedError. */
+function acquireProfileLock(profile) {
+	return acquireFileLock(lockPath(profile), (holder) => new ProfileLockedError(holder, profile));
+}
+/**
+* `listen --backfill` has its own lock: it uses its own cursor, so it runs fine next to the profile's
+* listener (or its service), but two backfills at once would run every stored event twice.
+*/
+const backfillLockPath = (profile) => join(profileStateDir(profile), "backfill.lock");
+function acquireBackfillLock(profile) {
+	return acquireFileLock(backfillLockPath(profile), (holder) => /* @__PURE__ */ new Error(`A backfill is already running for profile "${profile}" (pid ${holder.pid}, since ${holder.startedAt}). Let it finish, or stop it first.`));
+}
+//#endregion
+//#region server/listen/sse.ts
+var SseParser = class {
+	onMessage;
+	onComment;
+	buf = "";
+	data = [];
+	event = "";
+	id = null;
+	constructor(onMessage, onComment = () => {}) {
+		this.onMessage = onMessage;
+		this.onComment = onComment;
+	}
+	push(chunk) {
+		this.buf += chunk;
+		for (;;) {
+			const m = /\r\n|\r|\n/.exec(this.buf);
+			if (!m) break;
+			if (m[0] === "\r" && m.index === this.buf.length - 1) break;
+			const line = this.buf.slice(0, m.index);
+			this.buf = this.buf.slice(m.index + m[0].length);
+			this.line(line);
+		}
+	}
+	line(line) {
+		if (line === "") {
+			if (this.data.length) this.onMessage({
+				id: this.id,
+				event: this.event || "message",
+				data: this.data.join("\n")
+			});
+			this.data = [];
+			this.event = "";
+			return;
+		}
+		if (line.startsWith(":")) {
+			this.onComment(line.slice(1).trim());
+			return;
+		}
+		const colon = line.indexOf(":");
+		const field = colon < 0 ? line : line.slice(0, colon);
+		let value = colon < 0 ? "" : line.slice(colon + 1);
+		if (value.startsWith(" ")) value = value.slice(1);
+		if (field === "data") this.data.push(value);
+		else if (field === "event") this.event = value;
+		else if (field === "id" && !value.includes("\0")) this.id = value;
+	}
+};
+//#endregion
+//#region server/listen/stream.ts
+/**
+* Why the daemon refused or ended the stream. Permanent ones end the listener (exit 78); reversible
+* ones (an admin disabled the agent, or took away its last read grant) keep it waiting.
+*/
+const REFUSALS = {
+	agent_deleted: {
+		permanent: true,
+		text: "This agent was deleted in the xaq console."
+	},
+	key_rotated: {
+		permanent: true,
+		text: "This agent's API key was replaced (rotated) in the console."
+	},
+	unauthorized: {
+		permanent: true,
+		text: "The daemon doesn't recognize this API key (it was rotated, or the agent was deleted)."
+	},
+	agent_disabled: {
+		permanent: false,
+		text: "An admin disabled this agent. Waiting; it resumes on its own when the agent is re-enabled."
+	},
+	no_read_grant: {
+		permanent: false,
+		text: "This agent has no read access to any mailbox or calendar right now. Waiting; it resumes when an admin grants read or calendar.read."
+	},
+	forbidden: {
+		permanent: false,
+		text: "The daemon refused access for now. Waiting and retrying."
+	}
+};
+/** Classifies an HTTP refusal or a `revoked` reason code. 401 is permanent; 403 is reversible unless its code says otherwise. */
+function classifyRefusal(code, status) {
+	const known = code && REFUSALS[code] ? code : status === 401 ? "unauthorized" : status === 403 ? "forbidden" : code ? null : "unauthorized";
+	if (known) return {
+		code: known,
+		...REFUSALS[known]
+	};
+	return {
+		code,
+		permanent: true,
+		text: `Access revoked (${code}).`
+	};
+}
+const BLOCKED_RETRY_MS = 6e4;
+var Stalled = class extends Error {};
+var Paused = class extends Error {};
+var Reconnect = class extends Error {};
+const sleepJump = 2e4;
+/**
+* Holds the outbound event stream open forever: reconnects with jittered exponential backoff,
+* resumes with Last-Event-ID (the server also resumes from the consumer's acked cursor), treats
+* ~45 s of silence as a dead connection, and reconnects at once after the machine wakes from sleep.
+* Only permanent revocation (401, or `event: revoked` for a deleted agent or replaced key) and
+* unrecoverable request errors end it; a disabled agent or a missing read grant just waits.
+*/
+var EventStream = class {
+	o;
+	stopped = false;
+	current = null;
+	wake = null;
+	failures = 0;
+	constructor(o) {
+		this.o = o;
+	}
+	stop() {
+		this.stopped = true;
+		this.current?.abort();
+		this.wake?.();
+	}
+	/** Forces a reconnect now (network change, wake from sleep). */
+	reconnect() {
+		this.failures = 0;
+		this.current?.abort(new Reconnect("reconnect requested"));
+		this.wake?.();
+	}
+	sleep(ms) {
+		if (this.stopped) return Promise.resolve();
+		return new Promise((resolve) => {
+			const t = setTimeout(done, ms);
+			function done() {
+				clearTimeout(t);
+				resolve();
+			}
+			this.wake = done;
+		});
+	}
+	backoff() {
+		const min = this.o.minBackoffMs ?? 1e3;
+		const max = this.o.maxBackoffMs ?? 6e4;
+		const cap = Math.min(max, min * 2 ** Math.min(this.failures, 16));
+		return Math.round(min + Math.random() * (cap - min));
+	}
+	streamUrl() {
+		const u = new URL(`${this.o.url}/agent/v1/events/stream`);
+		u.searchParams.set("consumer", this.o.consumer);
+		if (this.o.types?.length) u.searchParams.set("types", this.o.types.join(","));
+		if (this.o.includeBody) u.searchParams.set("include_body", "1");
+		if (this.o.fromStart) u.searchParams.set("start", "beginning");
+		if (this.o.after) u.searchParams.set("after", String(this.o.after));
+		return u.toString();
+	}
+	async run() {
+		let lastTick = Date.now();
+		const sleepWatch = setInterval(() => {
+			const now = Date.now();
+			if (now - lastTick > sleepJump) this.reconnect();
+			lastTick = now;
+		}, 5e3);
+		sleepWatch.unref();
+		try {
+			while (!this.stopped) {
+				while (this.o.shouldPause?.() && !this.stopped) await this.sleep(250);
+				if (this.stopped) break;
+				const result = await this.connectOnce();
+				if (result) return result;
+			}
+			return { kind: "stopped" };
+		} finally {
+			clearInterval(sleepWatch);
+		}
+	}
+	/** One connection. Returns a terminal result, or null to reconnect (after waiting, unless paused). */
+	async connectOnce() {
+		const ac = new AbortController();
+		this.current = ac;
+		const stallMs = this.o.stallMs ?? 45e3;
+		let stallTimer;
+		const armStall = () => {
+			clearTimeout(stallTimer);
+			stallTimer = setTimeout(() => ac.abort(new Stalled(`no data or ping for ${Math.round(stallMs / 1e3)} s`)), stallMs);
+		};
+		const opened = Date.now();
+		let delivered = false;
+		let revoked = null;
+		try {
+			const refused = await this.o.beforeConnect?.();
+			if (refused) {
+				this.failures++;
+				const wait = Math.max(this.backoff(), 3e4);
+				this.disconnected(refused, wait, true);
+				await this.sleep(wait);
+				return null;
+			}
+			const headers = {
+				accept: "text/event-stream",
+				authorization: `Bearer ${this.o.apiKey}`,
+				"cache-control": "no-cache",
+				"user-agent": userAgent(),
+				"x-agentinbox-client": clientHeader()
+			};
+			const last = this.o.lastEventId();
+			if (last > 0) headers["last-event-id"] = String(last);
+			armStall();
+			const pending = (this.o.fetch ?? fetch)(this.streamUrl(), {
+				headers,
+				signal: ac.signal,
+				redirect: "error"
+			});
+			pending.then((r) => ac.signal.aborted ? r.body?.cancel().catch(() => {}) : void 0).catch(() => {});
+			const res = await abortable(pending, ac.signal);
+			if (!res.ok) {
+				const err = await abortable(apiError(res, "Opening the event stream"), ac.signal);
+				if (res.status === 401 || res.status === 403) {
+					const r = classifyRefusal(err.code, res.status);
+					if (r.permanent) return {
+						kind: "revoked",
+						code: r.code,
+						reason: r.text
+					};
+					clearTimeout(stallTimer);
+					this.o.onBlocked?.(r.code, r.text);
+					await this.sleep(this.o.blockedRetryMs ?? BLOCKED_RETRY_MS);
+					return null;
+				}
+				if (res.status === 400 || res.status === 422) return {
+					kind: "fatal",
+					reason: err.message
+				};
+				clearTimeout(stallTimer);
+				const longWait = res.status === 404 ? 3e5 : null;
+				if (res.status === 404) {
+					this.disconnected("This xaq server has no /agent/v1 event stream (upgrade the daemon). Retrying in 5 minutes", longWait, true);
+					await this.sleep(longWait);
+				} else {
+					this.failures++;
+					const wait = err.retryAfter ? err.retryAfter * 1e3 : this.backoff();
+					this.disconnected(err.message, wait, res.status >= 500 || res.status === 429 ? false : true);
+					await this.sleep(wait);
+				}
+				return null;
+			}
+			if (!(res.headers.get("content-type") ?? "").includes("text/event-stream") || !res.body) throw new Error(`expected text/event-stream, got ${res.headers.get("content-type") ?? "no content type"}`);
+			this.o.onOpen();
+			armStall();
+			const parser = new SseParser((m) => {
+				if (m.event === "revoked") {
+					let reason = "unauthorized";
+					try {
+						const r = JSON.parse(m.data).reason;
+						if (typeof r === "string" && r) reason = safeText(r, 60);
+					} catch {}
+					revoked = reason;
+					ac.abort();
+					return;
+				}
+				delivered = true;
+				this.o.onMessage(m);
+				if (this.o.shouldPause?.()) ac.abort(new Paused("backlog full"));
+			}, () => {});
+			const decoder = new TextDecoder();
+			const reader = res.body.getReader();
+			const cancel = () => void reader.cancel().catch(() => {});
+			ac.signal.addEventListener("abort", cancel, { once: true });
+			try {
+				for (;;) {
+					const { done, value } = await abortable(reader.read(), ac.signal);
+					if (done) break;
+					armStall();
+					parser.push(decoder.decode(value, { stream: true }));
+					if (revoked !== null) break;
+				}
+			} finally {
+				ac.signal.removeEventListener("abort", cancel);
+				cancel();
+			}
+			if (revoked !== null) return this.afterRevoked(revoked);
+			throw new Error("the server closed the stream");
+		} catch (err) {
+			if (revoked !== null) return this.afterRevoked(revoked);
+			if (this.stopped) return { kind: "stopped" };
+			const reason = ac.signal.aborted && ac.signal.reason instanceof Error ? ac.signal.reason : err;
+			if (reason instanceof Paused) return null;
+			if (delivered || Date.now() - opened > 6e4) this.failures = 0;
+			if (reason instanceof Reconnect) {
+				this.disconnected("reconnecting (network change or wake from sleep)", 0, false);
+				return null;
+			}
+			this.failures++;
+			const wait = this.backoff();
+			const text = reason instanceof Stalled ? `stream stalled (${reason.message})` : describeFetchError(reason);
+			this.disconnected(text, wait, this.failures > 3);
+			await this.sleep(wait);
+			return null;
+		} finally {
+			clearTimeout(stallTimer);
+			ac.abort();
+			this.current = null;
+		}
+	}
+	/** `event: revoked`: permanent reasons end the listener; reversible ones wait and retry. */
+	async afterRevoked(code) {
+		const r = classifyRefusal(code);
+		if (r.permanent) return {
+			kind: "revoked",
+			code: r.code,
+			reason: r.text
+		};
+		this.o.onBlocked?.(r.code, r.text);
+		await this.sleep(this.o.blockedRetryMs ?? BLOCKED_RETRY_MS);
+		return null;
+	}
+	disconnected(reason, wait, serious) {
+		if (!this.stopped) this.o.onDisconnect(reason, wait, { serious });
+	}
+};
+//#endregion
+//#region server/listen/listen.ts
+/** Exit codes. 78 (EX_CONFIG) means "don't restart me": the service units are told not to. */
+const EXIT = {
+	ok: 0,
+	error: 1,
+	revoked: 78
+};
+/** Acknowledges the finished prefix, coalescing and retrying in the background. */
+var Acker = class {
+	post;
+	log;
+	wanted = 0;
+	acked = 0;
+	busy = null;
+	retry = null;
+	constructor(post, log) {
+		this.post = post;
+		this.log = log;
+	}
+	request(seq) {
+		this.wanted = Math.max(this.wanted, seq);
+		this.kick();
+	}
+	kick() {
+		if (this.busy || this.retry || this.wanted <= this.acked) return;
+		const seq = this.wanted;
+		this.busy = this.post(seq).then((acked) => {
+			this.acked = Math.max(this.acked, acked, seq);
+		}).catch((err) => {
+			this.log.debug(`ack failed, retrying: ${err instanceof Error ? err.message : String(err)}`, { seq });
+			this.retry = setTimeout(() => {
+				this.retry = null;
+				this.kick();
+			}, 5e3);
+			this.retry.unref();
+		}).finally(() => {
+			this.busy = null;
+			this.kick();
+		});
+	}
+	/** Best-effort final ack on shutdown. */
+	async flush(timeoutMs = 3e3) {
+		if (this.retry) clearTimeout(this.retry);
+		this.retry = null;
+		const deadline = Date.now() + timeoutMs;
+		while (Date.now() < deadline) if (this.busy) await Promise.race([this.busy, new Promise((r) => setTimeout(r, 100))]);
+		else if (this.wanted > this.acked) {
+			this.kick();
+			if (this.retry) break;
+		} else return;
+	}
+};
+const describeEvent = (p) => {
+	const m = p.data.message;
+	const e = p.data.calendarEvent;
+	const sender = m?.from?.email ?? (e && !e.organizerSelf ? e.organizer?.email : void 0);
+	const who = sender ? ` from ${safeText(sender, 80)}` : "";
+	const title = m?.subject ?? e?.summary;
+	const subject = title ? ` "${safeText(title, 70)}"` : "";
+	return `#${p.data.seq} ${p.type}${who}${subject}${e ? ` (${safeText(e.start, 30)})` : ""}`;
+};
+/** A finished job in the log: the event, or "batch of N (#a–#b)". */
+const describeJob = (job) => job.payloads.length === 1 ? describeEvent(job.payload) : `batch of ${job.payloads.length} events (#${job.seq}–#${job.lastSeq})`;
+/** The last few non-empty lines of a command's output, for the log (sanitized: it may echo email content). */
+const lastLines = (t, n = 3) => t.trim().split("\n").filter((l) => l.trim()).slice(-n).map((l) => `  │ ${safeText(l, 300)}`).join("\n");
+/** The agent's whole reply was the triage prompt's "nothing to do" (anything more is shown). */
+const isSilent = (stdout) => stdout.trim() === SILENT_MARKER;
+async function runListener(opts) {
+	const profileName = validProfileName(opts.flags.profile ?? "default");
+	let profile = loadProfile(profileName);
+	const { config, next, changed } = resolveListen(profileName, profile, opts.flags);
+	if (changed) {
+		saveProfile(profileName, next);
+		profile = next;
+	}
+	const quietConsole = underService() && process.platform === "darwin";
+	const backfill = !!opts.flags.backfill;
+	const oneOff = backfill || !!opts.flags.dryRun;
+	const log = opts.log ?? createListenLogger({
+		path: oneOff ? oneOffLogPath(profileName) : logPath(profileName),
+		debug: !!envVar("DEBUG"),
+		console: !quietConsole
+	});
+	if (opts.flags.save) log.info(`Saved these settings to profile "${profileName}".`);
+	const verdict = await checkTransport(profile.url, { insecure: config.insecure });
+	if (verdict.warning) {
+		process.stderr.write(`${insecureBanner(verdict.warning)}\n`);
+		log.warn(verdict.warning);
+	}
+	const targets = [];
+	if (config.exec) targets.push("exec");
+	if (config.forward) targets.push("forward");
+	const dryRun = !!opts.flags.dryRun;
+	if (!targets.length && !dryRun) throw new Error(`Nothing to run for events. Pass --exec "<command>" and/or --forward http://localhost:<port>/<path> (add --save to keep it in profile "${profileName}"),\n  or --dry-run to just print matching events. Recipes: ${NPX} listen --help`);
+	if (config.exec && process.platform === "win32" && !dryRun) throw new Error("--exec needs a POSIX shell (/bin/sh) and isn't supported on Windows. Use --forward to a local HTTP handler instead.");
+	const releaseLock = dryRun ? () => {} : backfill ? acquireBackfillLock(profileName) : acquireProfileLock(profileName);
+	try {
+		const fromStart = !!opts.flags.fromStart || backfill;
+		const known = knownConsumers(profileName).includes(config.consumer);
+		const streamConsumer = backfill ? throwawayConsumer(config.consumer, THROWAWAY_SUFFIXES.backfill) : dryRun ? throwawayConsumer(config.consumer, THROWAWAY_SUFFIXES.dryRun) : config.consumer;
+		let streamAfter = 0;
+		if (dryRun && !fromStart) streamAfter = await getSelf(profile.url, profile.apiKey, 8e3).then((s) => s.headSeq ?? 0, () => 0);
+		const backfillHead = backfill ? await backfillEnd(profileName, profile, config.consumer, streamConsumer, opts.flags.until, log) : 0;
+		const backfillHint = backfillCommand(profileName, profile, config);
+		if (config.cwdIsDefault) ensurePrivateDir(config.cwd);
+		if (!existsSync(claudeMcpConfigPath(profileName))) writeClaudeMcpConfig(profileName, `${profile.url}/mcp`);
+		if (!quietConsole) printBanner(log, profileName, profile, config, dryRun, backfill);
+		const notes = typesNotes(config);
+		for (const m of notes.info) log.info(m);
+		for (const m of notes.warn) log.warn(m);
+		const categories = categoryNote(profileName, profile, opts.flags, config);
+		if (categories) log.info(categories);
+		const change = hermesChangeNote(opts.flags.recipe, config.exec);
+		if (change) log.info(change);
+		if (config.forward && isHermesRoute(config.forward.url) && !dryRun) {
+			gatewayWarning(config.forward.url).then((w) => w && log.warn(w));
+			const route = routeWarning(profileName, config.forward.url);
+			if (route) log[route.level](route.message);
+		}
+		if (backfill && backfillHead === 0) {
+			log.info(`Nothing to backfill: the listener (consumer "${config.consumer}") started with the oldest stored mail, so it handles all of it.`);
+			return EXIT.ok;
+		}
+		if (backfill) log.info(`Backfill: handling the mail from before the listener started (events up to #${backfillHead}), oldest first, then exiting${dryRun ? " (dry run: nothing executed)" : ""}. Everything newer is the listener's.`);
+		else if (dryRun) log.info(fromStart ? "Dry run from the oldest stored event." : "Dry run: showing new events from now on.");
+		else if (fromStart && known) log.warn(`This listener (consumer "${config.consumer}") already has a position on the daemon, so --from-start does nothing.\n--from-start only applies to a new consumer. To run the mail from before this listener started through it once (fine while it runs): ${backfillHint}`);
+		else if (fromStart) log.info("Processing every stored event this agent can see, from the oldest (--from-start).");
+		else if (!known) log.info(`Listening for new events from now on. To also run the mail from before this listener started, once (in another terminal, while this keeps running): ${backfillHint}`);
+		const status = new StatusWriter(profileName, {
+			pid: process.pid,
+			profile: profileName,
+			url: profile.url,
+			consumer: streamConsumer,
+			version,
+			startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+			connected: false,
+			connectedSince: null,
+			lastDisconnect: null,
+			lastEventAt: null,
+			receivedSeq: 0,
+			ackedSeq: 0,
+			running: 0,
+			recent: [],
+			stoppedAt: null,
+			exitReason: null,
+			exec: config.exec,
+			forward: config.forward?.url ?? null,
+			filters: describeFilter(config),
+			batchSeconds: config.batchSeconds,
+			skipped: 0
+		}, !oneOff);
+		status.flush();
+		const transportOk = () => checkTransport(profile.url, { insecure: config.insecure }).then(() => null, (err) => err instanceof Error ? err.message.split("\n")[0] : String(err));
+		let grantsSeen = null;
+		let grantsBusy = false;
+		const checkGrants = async () => {
+			if (grantsBusy || await transportOk()) return;
+			grantsBusy = true;
+			try {
+				const self = await getSelf(profile.url, profile.apiKey, 8e3);
+				const key = grantsKey(self.grants, self.connections);
+				if (key === grantsSeen) return;
+				const first = grantsSeen === null;
+				grantsSeen = key;
+				const lines = describeGrants(self.grants, self.connections).map((l) => `  ${hasAccess(self) ? l : pc.yellow(l)}`);
+				log.info(`${first ? `Signed in as agent "${safeText(self.name)}". Access` : "Access changed in the console. Now"}:\n${lines.join("\n")}`);
+			} catch (err) {
+				if (err instanceof ApiError && (err.status === 401 || err.status === 403)) return;
+				log.debug(`identity check failed: ${err instanceof Error ? err.message : String(err)}`);
+			} finally {
+				grantsBusy = false;
+			}
+		};
+		checkGrants();
+		const grantsTimer = setInterval(() => void checkGrants(), opts.grantsRefreshMs ?? 3e5);
+		grantsTimer.unref();
+		const acker = new Acker(async (seq) => {
+			const refused = await transportOk();
+			if (refused) throw new Error(refused);
+			const acked = (await ackEvents(profile.url, profile.apiKey, config.consumer, seq)).ackedSeq;
+			status.update({ ackedSeq: acked });
+			return acked;
+		}, log);
+		const timeoutMs = config.timeoutSeconds * 1e3;
+		const batched = config.batchSeconds > 0 && !!config.exec;
+		const wrapForward = !!config.forward && isHermesRoute(config.forward.url);
+		const runTargets = async (job, signal) => {
+			const errors = [];
+			const tag = job.payloads.length === 1 ? `#${job.seq}` : `batch #${job.seq}–#${job.lastSeq} (${job.payloads.length} events)`;
+			const ids = job.payloads.map((p) => p.data.id);
+			if (job.remaining.has("exec") && config.exec) {
+				const r = await runCommand(config.exec, batched ? job.payloads : job.payload, {
+					timeoutMs,
+					signal,
+					cwd: config.cwd
+				});
+				const meta = {
+					seq: job.seq,
+					lastSeq: job.lastSeq,
+					ids,
+					attempt: job.attempts,
+					exitCode: r.exitCode,
+					signal: r.signal,
+					durationMs: r.durationMs,
+					stdoutTail: r.stdoutTail,
+					stderrTail: r.stderrTail
+				};
+				if (signal.aborted) {
+					errors.push("stopped");
+					log.debug(`${tag} command stopped by shutdown`, meta);
+				} else if (r.ok) {
+					job.remaining.delete("exec");
+					log.debug(`${tag} command finished in ${formatDuration(r.durationMs)}`, meta);
+					if (isSilent(r.stdoutTail)) log.info(pc.gray(`  ${tag}: nothing to do`));
+					else if (!r.stdoutTail.trim()) log.info(pc.gray(`  ${tag}: no output`));
+					else log.info(`  ${tag} output:\n${lastLines(r.stdoutTail, 6)}`);
+				} else {
+					errors.push(`command: ${r.error}`);
+					const tail = lastLines(r.stderrTail) || lastLines(r.stdoutTail);
+					log.warn(`${tag} command failed (attempt ${job.attempts}/${config.maxAttempts}): ${r.error}${tail ? `\n${tail}` : ""}`, meta);
+				}
+			}
+			if (job.remaining.has("forward") && config.forward) {
+				let failed = false;
+				for (const p of job.payloads) {
+					if (job.forwarded.has(p.data.seq)) continue;
+					const r = await forwardEvent(config.forward.url, config.forward.secret, p, {
+						timeoutMs: Math.min(timeoutMs, 3e4),
+						signal,
+						wrap: wrapForward
+					});
+					const meta = {
+						seq: p.data.seq,
+						id: p.data.id,
+						attempt: job.attempts,
+						statusCode: r.statusCode,
+						durationMs: r.durationMs,
+						response: r.response
+					};
+					if (signal.aborted) {
+						errors.push("stopped");
+						failed = true;
+						break;
+					} else if (r.ok) {
+						job.forwarded.add(p.data.seq);
+						log.debug(`#${p.data.seq} forwarded (${r.statusCode}) in ${formatDuration(r.durationMs)}`, meta);
+					} else {
+						errors.push(`forward: ${r.error}`);
+						failed = true;
+						if (r.retryAfterMs !== void 0) {
+							job.retryAfterMs = r.retryAfterMs;
+							log.info(`#${p.data.seq} forward: the receiver is rate-limiting (429); trying again in ${formatDuration(r.retryAfterMs)} (doesn't count as a failed attempt)`, meta);
+						} else log.warn(`#${p.data.seq} forward failed (attempt ${job.attempts}/${config.maxAttempts}): ${r.error}`, meta);
+						break;
+					}
+				}
+				if (!failed) job.remaining.delete("forward");
+			}
+			return errors;
+		};
+		const dispatcher = new Dispatcher({
+			targets: dryRun ? [] : targets,
+			concurrency: config.concurrency,
+			maxAttempts: config.maxAttempts,
+			retryDelayMs: opts.retryDelayMs,
+			batch: batched && !dryRun ? {
+				windowMs: config.batchSeconds * 1e3,
+				max: 20
+			} : void 0,
+			run: runTargets,
+			onAdvance: (seq) => {
+				if (dryRun || backfill) return;
+				acker.request(seq);
+			},
+			onRetry: (job, delay) => {
+				log.info(`${describeJob(job)}: retrying in ${formatDuration(delay)}`);
+				for (const p of job.payloads) status.addRecent({
+					seq: p.data.seq,
+					id: p.data.id,
+					type: p.type,
+					outcome: "retrying",
+					attempts: job.attempts,
+					at: (/* @__PURE__ */ new Date()).toISOString(),
+					error: job.lastError
+				});
+			},
+			onDead: (job) => {
+				failed += job.payloads.length;
+				for (const p of job.payloads) {
+					const targets = [...job.remaining].filter((t) => t !== "forward" || !job.forwarded.has(p.data.seq));
+					appendDead(profileName, {
+						deadAt: (/* @__PURE__ */ new Date()).toISOString(),
+						seq: p.data.seq,
+						id: p.data.id,
+						type: p.type,
+						attempts: job.attempts,
+						error: job.lastError ?? "failed",
+						targets,
+						payload: p
+					});
+				}
+				log.error(`${describeJob(job)}: gave up after ${job.attempts} attempts (${job.lastError}). Saved to dead letters: ${NPX} listen dead${profileName === "default" ? "" : ` --profile ${profileName}`}`, {
+					seq: job.seq,
+					ids: job.payloads.map((p) => p.data.id)
+				});
+			},
+			onFinished: (job) => {
+				if (job.outcome === "succeeded") handled += job.payloads.length;
+				if (job.outcome === "succeeded") log.info(`${pc.green("✓")} ${describeJob(job)} ${pc.gray(`(${formatDuration(Date.now() - job.firstSeenAt)})`)}`, {
+					seq: job.seq,
+					ids: job.payloads.map((p) => p.data.id),
+					attempts: job.attempts
+				});
+				for (const p of job.payloads) status.addRecent({
+					seq: p.data.seq,
+					id: p.data.id,
+					type: p.type,
+					outcome: job.outcome === "dead" ? "dead" : "succeeded",
+					attempts: job.attempts,
+					at: (/* @__PURE__ */ new Date()).toISOString(),
+					error: job.lastError
+				});
+				status.update({ running: dispatcher.inFlight });
+			}
+		});
+		let downSince = null;
+		let connectedNow = false;
+		/** --backfill: last time something arrived or ran; and whether an event past the end was seen. */
+		let lastActivity = Date.now();
+		let pastHead = false;
+		/** Reversible refusal currently in effect (logged once per change). */
+		let blocked = null;
+		const stream = new EventStream({
+			url: profile.url,
+			apiKey: profile.apiKey,
+			consumer: streamConsumer,
+			after: streamAfter,
+			types: config.types,
+			includeBody: config.includeBody,
+			lastEventId: () => dispatcher.lastSeq,
+			stallMs: opts.stallMs,
+			beforeConnect: transportOk,
+			fromStart,
+			blockedRetryMs: opts.blockedRetryMs,
+			onBlocked: (code, text) => {
+				downSince ??= Date.now();
+				if (blocked !== code) log.warn(`${pc.yellow("⏸")} ${text}`, { code });
+				blocked = code;
+				status.update({
+					connected: false,
+					lastDisconnect: {
+						at: (/* @__PURE__ */ new Date()).toISOString(),
+						reason: text
+					}
+				});
+			},
+			minBackoffMs: opts.minBackoffMs,
+			maxBackoffMs: opts.maxBackoffMs,
+			shouldPause: () => dispatcher.backlog >= 200,
+			onOpen: () => {
+				const after = downSince ? ` after ${formatDuration(Date.now() - downSince)}` : "";
+				if (blocked) log.info("Access restored.");
+				if (blocked || downSince) checkGrants();
+				blocked = null;
+				connectedNow = true;
+				lastActivity = Date.now();
+				log.info(`${pc.green("●")} Connected${after}. ${backfill ? "Receiving stored events…" : "Waiting for events…"}`);
+				if (!dryRun && !backfill) rememberConsumer(profileName, config.consumer);
+				downSince = null;
+				status.update({
+					connected: true,
+					connectedSince: (/* @__PURE__ */ new Date()).toISOString()
+				});
+			},
+			onDisconnect: (reason, retryInMs, { serious }) => {
+				downSince ??= Date.now();
+				connectedNow = false;
+				const msg = `${pc.yellow("○")} Disconnected: ${reason}. Reconnecting${retryInMs ? ` in ${formatDuration(retryInMs)}` : ""}…`;
+				if (serious) log.warn(msg);
+				else log.info(msg);
+				status.update({
+					connected: false,
+					lastDisconnect: {
+						at: (/* @__PURE__ */ new Date()).toISOString(),
+						reason
+					}
+				});
+			},
+			onMessage: (m) => {
+				if (m.event !== "mail") {
+					log.debug(`ignoring unknown stream event "${m.event}"`);
+					return;
+				}
+				let payload;
+				try {
+					payload = parsePayload(m.data);
+				} catch (err) {
+					log.warn(`Ignoring a malformed event from the stream: ${err.message}`, { id: m.id });
+					return;
+				}
+				if (backfill && payload.data.seq > backfillHead) {
+					pastHead = true;
+					return;
+				}
+				lastActivity = Date.now();
+				const skip = skipReason(payload, config);
+				const match = skip === null;
+				if (dryRun && match) log.info(`${pc.cyan("→")} ${describeEvent(payload)} ${pc.gray("(dry run: nothing executed, cursor not advanced)")}`);
+				else if (match) {
+					const waits = batched && dispatcher.lastSeq < payload.data.seq ? pc.gray(` (batching for up to ${formatDuration(config.batchSeconds * 1e3)})`) : "";
+					log.info(`${pc.cyan("→")} ${describeEvent(payload)}${waits}`, {
+						seq: payload.data.seq,
+						id: payload.data.id,
+						type: payload.type
+					});
+				} else {
+					const line = `skip ${describeEvent(payload)} (${safeText(skip, 120)})`;
+					if (dryRun) log.info(pc.gray(`  ${line}`));
+					else log.debug(line, {
+						seq: payload.data.seq,
+						id: payload.data.id
+					});
+					if (dispatcher.lastSeq < payload.data.seq) status.update({ skipped: (status.status.skipped ?? 0) + 1 });
+				}
+				if (!dispatcher.push(payload, { skip: !match })) log.debug(`duplicate #${payload.data.seq} ignored`);
+				status.update({
+					receivedSeq: dispatcher.lastSeq,
+					lastEventAt: (/* @__PURE__ */ new Date()).toISOString(),
+					running: dispatcher.inFlight
+				});
+			}
+		});
+		let stopReason = null;
+		const stop = (why) => {
+			if (stopReason) return;
+			stopReason = why;
+			stream.stop();
+		};
+		if (opts.signal?.aborted) stop("stopped");
+		else opts.signal?.addEventListener("abort", () => stop("stopped"), { once: true });
+		const onSignal = (sig) => {
+			if (stopReason) {
+				log.warn("Exiting now.");
+				killAllRuns();
+				process.exit(130);
+			}
+			log.info(`${sig === "SIGINT" ? "\n" : ""}Stopping (${sig}). Unfinished events will be delivered again next time. Press Ctrl-C again to force.`);
+			stop(sig);
+		};
+		if (opts.handleSignals) {
+			process.on("SIGINT", onSignal);
+			process.on("SIGTERM", onSignal);
+		}
+		let handled = 0;
+		let failed = 0;
+		let backfillTimer = null;
+		if (backfill) {
+			const idleMs = opts.backfillIdleMs ?? 6e4;
+			const unreachableMs = opts.backfillUnreachableMs ?? 6e5;
+			backfillTimer = setInterval(() => {
+				const now = Date.now();
+				if (!connectedNow) {
+					if (downSince !== null && now - downSince >= unreachableMs) stop("backfill unreachable");
+					return;
+				}
+				if (dispatcher.inFlight > 0) {
+					lastActivity = now;
+					return;
+				}
+				if (pastHead || dispatcher.lastSeq >= backfillHead) stop("backfill complete");
+				else if (now - lastActivity >= idleMs) {
+					log.info(`No more stored events arrived for ${formatDuration(idleMs)}; the rest up to #${backfillHead} aren't visible to this listener (event types, label scope, or removed by retention).`);
+					stop("backfill complete");
+				}
+			}, 100);
+		}
+		const end = await stream.run();
+		if (backfillTimer) clearInterval(backfillTimer);
+		clearInterval(grantsTimer);
+		await dispatcher.stop();
+		if (!dryRun) await acker.flush();
+		if (opts.handleSignals) {
+			process.off("SIGINT", onSignal);
+			process.off("SIGTERM", onSignal);
+		}
+		if (end.kind === "revoked") return revokedExit(log, status, profileName, profile, end.reason, opts);
+		if (end.kind === "fatal") {
+			log.error(`The daemon rejected the stream request: ${end.reason}`);
+			status.update({
+				connected: false,
+				stoppedAt: (/* @__PURE__ */ new Date()).toISOString(),
+				exitReason: end.reason
+			});
+			status.flush();
+			return EXIT.revoked;
+		}
+		status.update({
+			connected: false,
+			stoppedAt: (/* @__PURE__ */ new Date()).toISOString(),
+			exitReason: stopReason ?? "stopped"
+		});
+		status.flush();
+		if (backfill && stopReason === "backfill unreachable") {
+			log.error(`Gave up: the daemon was unreachable for ${formatDuration(opts.backfillUnreachableMs ?? 6e5)}. ${handled} event${handled === 1 ? "" : "s"} handled so far; run the backfill again later (it starts over from the oldest event, so handlers should dedupe on the event id).`);
+			return EXIT.error;
+		}
+		if (backfill && stopReason === "backfill complete") {
+			const p = profileName === "default" ? "" : ` --profile ${profileName}`;
+			log.info(`${failed ? pc.yellow("Backfill done") : `${pc.green("✔")} Backfill done`}: ${handled} event${handled === 1 ? "" : "s"} handled${failed ? `, ${failed} failed (see ${NPX} listen dead${p})` : ""}.`);
+			return failed ? EXIT.error : EXIT.ok;
+		}
+		log.info("Stopped.");
+		return EXIT.ok;
+	} finally {
+		releaseLock();
+	}
+}
+async function revokedExit(log, status, profileName, profile, reason, opts) {
+	const p = profileName === "default" ? "" : ` --profile ${profileName}`;
+	log.error(`Access revoked: ${safeText(reason, 300)}\nThis key won't work again. Pair again with: ${NPX} connect ${profile.url}${p} --force\n(your listener settings in the profile are kept; restart the listener or its service afterwards)`);
+	status.update({
+		connected: false,
+		stoppedAt: (/* @__PURE__ */ new Date()).toISOString(),
+		exitReason: `revoked: ${safeText(reason, 300)}`
+	});
+	status.flush();
+	if (underService() && process.platform === "darwin") await new Promise((r) => setTimeout(r, opts.revokedExitDelayMs ?? 9e5));
+	return EXIT.revoked;
+}
+/**
+* Where `--backfill` ends: the seq the listener's consumer started at on the daemon (recorded when the
+* consumer was created), or --until. Refuses when that can't be known, rather than replaying mail the
+* listener already handled.
+*/
+async function backfillEnd(profileName, profile, consumer, replay, until, log) {
+	if (until !== void 0 && (!Number.isSafeInteger(until) || until < 0)) throw new Error("--until must be an event number (0 or more).");
+	const p = profileName === "default" ? "" : ` --profile ${profileName}`;
+	let self;
+	try {
+		self = await getSelf(profile.url, profile.apiKey, 8e3);
+	} catch (err) {
+		throw new Error(`Couldn't ask the daemon where the listener started: ${err instanceof Error ? err.message.split("\n")[0] : String(err)}`);
+	}
+	const replayCursor = self.consumers?.find((c) => c.consumer === replay);
+	if (replayCursor && replayCursor.ackedSeq > 0) throw new Error(`The backfill cursor "${replay}" on the daemon has been moved to #${replayCursor.ackedSeq} (something acknowledged it), so a backfill would skip the oldest mail.\n  Use another consumer name for this listener (--consumer <name> --save), or remove that consumer in the console.`);
+	const mine = self.consumers?.find((c) => c.consumer === consumer);
+	if (until !== void 0) {
+		if (mine?.startSeq != null && until > mine.startSeq) log.warn(`--until #${until} is past where the listener started (#${mine.startSeq}): ${until === mine.startSeq + 1 ? `event #${until} was` : `events #${mine.startSeq + 1}–#${until} were`} (or will be) handled by the listener too, so ${until === mine.startSeq + 1 ? "it runs" : "they run"} twice.`);
+		return until;
+	}
+	if (!self.consumers) throw new Error("This xaq daemon doesn't report where listeners started (it's older than this CLI), so a backfill could re-run mail the listener already handled.\n  Update xaq, or pass --until <event number>: the newest event to replay (events after it are the listener's).");
+	if (!mine) throw new Error(`The listener (consumer "${consumer}") hasn't connected yet, so no mail predates it.\n  Start it with --from-start instead: a new listener then begins with the oldest stored mail. E.g. ${NPX} listen${p} --from-start`);
+	if (mine.startSeq === null) throw new Error(`The daemon doesn't know where consumer "${consumer}" started (it was created by an older xaq).\n  Pass --until <event number>: the newest event to replay. The listener's first handled events are in ${NPX} listen status${p} and its log.`);
+	return mine.startSeq;
+}
+/**
+* The one-off backfill command for this listener: `listen --backfill`, plus the targets when they came
+* from flags rather than the profile (the backfill must run the same thing).
+*/
+function backfillCommand(profileName, profile, c) {
+	const parts = [`${NPX} listen`];
+	if (profileName !== "default") parts.push(`--profile ${profileName}`);
+	parts.push("--backfill");
+	const savedExec = profile.exec ?? null;
+	const savedForward = profile.forward?.url ?? null;
+	if (c.exec !== savedExec || (c.forward?.url ?? null) !== savedForward) {
+		const tool = recipeToolFor(c.exec, profileName);
+		const fwdTool = c.exec ? null : recipeToolFor(null, profileName, c.forward?.url ?? null);
+		if (tool) parts.push(`--recipe ${tool}`);
+		else if (c.exec) parts.push(`--exec ${shellQuote(c.exec)}`);
+		if (fwdTool) parts.push(`--recipe ${fwdTool}`);
+		else if (c.forward) parts.push(`--forward ${shellQuote(c.forward.url)}`);
+	}
+	return parts.join(" ");
+}
+/** Where the agent's output ends up, said plainly at start (and in `listen status`). */
+function outputLine(profileName, c, log) {
+	const r = recipeOf(c, profileName);
+	const parts = [];
+	if (c.exec) parts.push(r?.exec ? `${TOOL_LABELS[r.tool]}'s reply only goes to the listener's log (${log}, and the console when run in the foreground); it can't notify you by itself (--recipe hermes can, see docs)` : `your command's last output lines go to the listener's log (${log}, and the console when run in the foreground)`);
+	if (c.forward) parts.push(r?.forward ? "Hermes delivers its triage where its route says (listen hermes); this listener only sees the HTTP status" : "the receiver at --forward handles it; this listener only sees the HTTP status");
+	return parts.join(" · ");
+}
+function printBanner(log, name, profile, c, dryRun, backfill = false) {
+	const lines = [`${pc.bold("xaq listen")} ${pc.gray(`v${version}`)} · profile ${pc.cyan(name)} · agent ${pc.cyan(safeText(profile.agentName))}`, `  daemon    ${profile.url}  ${pc.gray(`(consumer ${c.consumer} on ${hostname()})`)}`];
+	if (dryRun) lines.push(`  mode      ${pc.yellow("dry run")}: matching events are printed; nothing runs and the cursor is not advanced`);
+	if (backfill) lines.push(`  mode      ${pc.yellow("backfill")}: mail from before the listener started, then exit (own cursor; the listener is not affected)`);
+	if (c.exec) lines.push(`  exec      ${safeText(c.exec, 300)}`, `  cwd       ${c.cwd}${c.cwdIsDefault ? pc.gray(" (private; --cwd to change)") : ""}`);
+	if (c.forward) lines.push(`  forward   ${c.forward.url} ${pc.gray(`(signed, see \`${NPX} listen secret\`)`)}`);
+	lines.push(`  events    ${describeFilter(c)}${c.includeBody ? " · with bodies" : ""}`);
+	if (c.batchSeconds) lines.push(c.exec ? `  batch     up to 20 events per run, collected for ${formatDuration(c.batchSeconds * 1e3)} after the first${c.forward ? pc.gray(" (forward stays one POST per event)") : ""}` : pc.gray(`  batch     ${formatDuration(c.batchSeconds * 1e3)} ignored: --batch applies to --exec; forward is one POST per event`));
+	lines.push(`  limits    concurrency ${c.concurrency} · timeout ${c.timeoutSeconds}s · ${c.maxAttempts} attempts`);
+	lines.push(`  output    ${outputLine(name, c, backfill || dryRun ? oneOffLogPath(name) : logPath(name))}`);
+	lines.push(pc.gray(`  log       ${backfill || dryRun ? oneOffLogPath(name) : logPath(name)}`));
+	for (const l of lines) process.stdout.write(`${l}\n`);
+	log.debug("listener starting", {
+		profile: name,
+		url: profile.url,
+		consumer: c.consumer,
+		exec: c.exec,
+		forward: c.forward?.url,
+		types: c.types,
+		filter: c.filter
+	});
+}
+//#endregion
+export { runListener as a, readDead as c, runCommand as d, Dispatcher as f, outputLine as i, readStatus as l, hasAccess as m, backfillCommand as n, acquireFileLock as o, describeGrants as p, isSilent as r, pidAlive as s, EXIT as t, writeDead as u };
+
+//# sourceMappingURL=listen-B9iO7HgQ.js.map