xaq-cli 0.1.0-nightly.90 → 0.1.0-nightly.92

package/dist/{admin-UKJE67mn.js → admin-5555baeh.js}

@@ -2,11 +2,11 @@
 import { t as NPX } from "./version-BxH7OuWD.js";
 import { i as saveProfile, n as loadProfile, v as ensurePrivateDir } from "./profile-QqEY5L3k.js";
 import { c as profilePath, i as deadPath, o as logPath, p as validProfileName } from "./paths-Bo6qtWNh.js";
-import { b as TransportError, f as isHermesRoute, x as checkTransport } from "./recipes-V8_-S1TM.js";
+import { b as TransportError, f as isHermesRoute, x as checkTransport } from "./recipes-BsCIHrrP.js";
 import { i as safeText, r as formatDuration } from "./ui-B8Sd4Y7Y.js";
-import { D as ApiError, N as getSelf, b as forwardEvent, g as resolveListen, h as forwardSecret, m as describeFilter, o as routeWarning, u as DEFAULT_LISTEN_TYPES } from "./hermes-Dic9rVz6.js";
-import { c as readDead, d as runCommand, f as Dispatcher, i as outputLine, l as readStatus, m as hasAccess, p as describeGrants, s as pidAlive, u as writeDead } from "./listen-C642JHIc.js";
-import { r as installedServiceLabel } from "./service-C-bf-vFa.js";
+import { D as ApiError, N as getSelf, b as forwardEvent, g as resolveListen, h as forwardSecret, m as describeFilter, o as routeWarning, u as DEFAULT_LISTEN_TYPES } from "./hermes-B_YoOADz.js";
+import { c as readDead, d as runCommand, f as Dispatcher, i as outputLine, l as readStatus, m as hasAccess, p as describeGrants, s as pidAlive, u as writeDead } from "./listen-DLZVpzxM.js";
+import { r as installedServiceLabel } from "./service-e8sBNMSS.js";
 import pc from "picocolors";
 //#region server/listen/admin.ts
 const out = (s = "") => process.stdout.write(`${s}\n`);
@@ -215,4 +215,4 @@ async function replayDead(flags, opts = {}) {
 //#endregion
 export { clearDead, printDead, printSecret, printStatus, replayDead };
 
-//# sourceMappingURL=admin-UKJE67mn.js.map
+//# sourceMappingURL=admin-5555baeh.js.map

package/dist/{admin-UKJE67mn.js.map → admin-5555baeh.js.map}

@@ -1 +1 @@
-{"version":3,"file":"admin-UKJE67mn.js","names":[],"sources":["../server/listen/admin.ts"],"sourcesContent":["import pc from \"picocolors\";\nimport { ApiError, getSelf } from \"./api.ts\";\nimport { describeGrants, hasAccess } from \"./grants.ts\";\nimport { Dispatcher, type Job, type Target } from \"./dispatcher.ts\";\nimport { runCommand } from \"./exec.ts\";\nimport { ensurePrivateDir } from \"./fsutil.ts\";\nimport { forwardEvent } from \"./forward.ts\";\nimport { routeWarning } from \"./hermes.ts\";\nimport { describeFilter, type ListenFlags, MAX_BATCH, resolveListen } from \"./options.ts\";\nimport { outputLine } from \"./listen.ts\";\nimport { isHermesRoute } from \"./recipes.ts\";\nimport { DEFAULT_PROFILE, deadPath, logPath, profilePath, validProfileName } from \"./paths.ts\";\nimport { loadProfile, saveProfile } from \"./profile.ts\";\nimport { DEFAULT_LISTEN_TYPES, forwardSecret } from \"./options.ts\";\nimport { installedServiceLabel } from \"./service.ts\";\nimport { type DeadEntry, pidAlive, readDead, readStatus, writeDead } from \"./state.ts\";\nimport { checkTransport, TransportError } from \"./transport.ts\";\nimport { formatDuration, safeText } from \"./ui.ts\";\nimport { NPX } from \"./version.ts\";\n\nconst out = (s = \"\") => process.stdout.write(`${s}\\n`);\nconst flagFor = (profile: string) => (profile === DEFAULT_PROFILE ? \"\" : ` --profile ${profile}`);\nconst ago = (iso: string | null | undefined) => (iso ? `${formatDuration(Date.now() - Date.parse(iso))} ago` : \"never\");\n\n// ───────────── listen secret ─────────────\n\n/** Prints the forward-mode signing secret (generating and saving it on first use). */\nexport function printSecret(profileName: string, opts: { rotate?: boolean }): void {\n  const name = validProfileName(profileName);\n  const profile = loadProfile(name);\n  let { secret, created } = forwardSecret(profile);\n  if (opts.rotate) {\n    secret = forwardSecret({ ...profile, forward: undefined, forwardSecret: undefined }).secret;\n    created = true;\n  }\n  if (created) {\n    if (profile.forward) profile.forward = { ...profile.forward, secret };\n    else profile.forwardSecret = secret;\n    saveProfile(name, profile);\n    process.stderr.write(pc.gray(`${opts.rotate ? \"Rotated\" : \"Generated\"} the forward signing secret for profile \"${name}\"${opts.rotate ? \"; restart the listener\" : \"\"}.\\n`));\n  }\n  // The secret alone on stdout, so `export XAQ_WEBHOOK_SECRET=$(xaq listen secret)` works.\n  out(secret);\n}\n\n// ───────────── listen status ─────────────\n\nexport async function printStatus(profileName: string): Promise<void> {\n  const name = validProfileName(profileName);\n  const profile = loadProfile(name);\n  const st = readStatus(name);\n  const alive = st ? pidAlive(st.pid) && !st.stoppedAt : false;\n  const dead = readDead(name);\n\n  out(`${pc.bold(\"Profile\")}   ${name}  ${pc.gray(profilePath(name))}`);\n  out(`${pc.bold(\"Agent\")}     ${safeText(profile.agentName)} ${pc.gray(`(${profile.agentId})`)}`);\n  out(`${pc.bold(\"Daemon\")}    ${profile.url}`);\n  out(`${pc.bold(\"Consumer\")}  ${st?.consumer ?? profile.consumer}`);\n  // What the last run used (flags included), else what the profile has saved.\n  const exec = st && st.exec !== undefined ? st.exec : profile.exec;\n  const forward = st && st.forward !== undefined ? st.forward : profile.forward?.url;\n  const targets = [exec ? `exec ${safeText(exec, 120)}` : null, forward ? `forward ${forward}` : null].filter(Boolean);\n  out(`${pc.bold(\"Runs\")}      ${targets.length ? targets.join(\" · \") : pc.gray(\"nothing saved (pass --exec/--forward with --save)\")}`);\n  out(\n    `${pc.bold(\"Events\")}    ${\n      profile.types?.length\n        ? profile.types.join(\", \")\n        : `${DEFAULT_LISTEN_TYPES.join(\", \")} ${pc.gray(\"(default types; add --types all --save for every event)\")}`\n    }`,\n  );\n  // The running listener's filters (flags included), else the profile's.\n  let saved: ReturnType<typeof resolveListen>[\"config\"] | null = null;\n  try {\n    saved = resolveListen(name, profile, {}).config;\n  } catch {\n    // An invalid saved setting: `listen` itself reports it.\n  }\n  out(`${pc.bold(\"Filters\")}   ${(alive && st?.filters) || (saved ? describeFilter(saved) : \"?\")}`);\n  const batchSeconds = alive && st && st.batchSeconds !== undefined ? st.batchSeconds : (saved?.batchSeconds ?? 0);\n  if (batchSeconds) out(`${pc.bold(\"Batch\")}     ${formatDuration(batchSeconds * 1000)} window, up to ${MAX_BATCH} events per --exec run`);\n  const route = forward && isHermesRoute(forward) ? routeWarning(name, forward) : null;\n  if (route?.level === \"warn\") out(`${pc.bold(\"Route\")}     ${pc.yellow(route.message)}`);\n  out(`${pc.bold(\"Output\")}    ${outputLine(name, { exec: exec ?? null, forward: forward ? { url: forward } : null }, logPath(name))}`);\n\n  let svc = \"not installed\";\n  if (process.platform === \"linux\" || process.platform === \"darwin\") {\n    const installed = installedServiceLabel(name);\n    if (installed) svc = `installed (${installed}; details: ${NPX} listen service status${flagFor(name)})`;\n  }\n  out(`${pc.bold(\"Service\")}   ${svc}`);\n\n  try {\n    // Never send the key over a connection `listen` itself would refuse.\n    await checkTransport(profile.url, { insecure: profile.insecure });\n    const self = await getSelf(profile.url, profile.apiKey, 5000);\n    out(`${pc.bold(\"Key\")}       ${pc.green(\"valid\")}`);\n    // The access the console actually granted, in plain words (what the agent should report to its human).\n    const lines = describeGrants(self.grants, self.connections);\n    out(`${pc.bold(\"Access\")}    ${hasAccess(self) ? lines[0] : pc.yellow(lines[0]!)}`);\n    for (const l of lines.slice(1)) out(`          ${l}`);\n  } catch (err) {\n    const revoked = err instanceof ApiError && (err.status === 401 || err.status === 403);\n    const why = err instanceof ApiError && err.status === 0 ? (err.cause as string) : err instanceof Error ? err.message.split(\"\\n\")[0] : String(err);\n    if (err instanceof TransportError) out(`${pc.bold(\"Key\")}       ${pc.red(`not checked: ${why}`)}`);\n    else out(`${pc.bold(\"Key\")}       ${revoked ? pc.red(`rejected: ${(err as Error).message}`) : pc.yellow(`not checked (${why})`)}`);\n  }\n\n  if (!st) {\n    out(`${pc.bold(\"Listener\")}  ${pc.gray(\"has not run yet\")}`);\n  } else {\n    const state = !alive\n      ? pc.gray(`not running${st.stoppedAt ? ` (stopped ${ago(st.stoppedAt)}${st.exitReason ? `: ${safeText(st.exitReason, 160)}` : \"\"})` : \" (exited unexpectedly)\"}`)\n      : st.connected\n        ? pc.green(`running (pid ${st.pid}), connected ${ago(st.connectedSince)}`)\n        : pc.yellow(`running (pid ${st.pid}), disconnected${st.lastDisconnect ? ` ${ago(st.lastDisconnect.at)}: ${safeText(st.lastDisconnect.reason, 160)}` : \"\"}`);\n    out(`${pc.bold(\"Listener\")}  ${state}`);\n    out(\n      `${pc.bold(\"Cursor\")}    acked #${st.ackedSeq} · received #${st.receivedSeq}${alive && st.running ? ` · ${st.running} in progress` : \"\"}${st.skipped ? ` · ${st.skipped} skipped by filters` : \"\"} · last event ${ago(st.lastEventAt)}`,\n    );\n    if (st.recent.length) {\n      out(pc.bold(\"Recent\"));\n      for (const r of st.recent.slice(0, 8)) {\n        const icon = r.outcome === \"succeeded\" ? pc.green(\"✓\") : r.outcome === \"dead\" ? pc.red(\"✖\") : r.outcome === \"retrying\" ? pc.yellow(\"↻\") : pc.gray(\"·\");\n        out(`  ${icon} #${r.seq} ${r.type} ${pc.gray(`${ago(r.at)}${r.attempts > 1 ? `, ${r.attempts} attempts` : \"\"}${r.error && r.outcome !== \"succeeded\" ? `, ${safeText(r.error, 100)}` : \"\"}`)}`);\n      }\n    }\n  }\n  out(`${pc.bold(\"Dead\")}      ${dead.length ? pc.red(`${dead.length} event${dead.length > 1 ? \"s\" : \"\"}`) + pc.gray(` (inspect: ${NPX} listen dead${flagFor(name)})`) : \"0\"}`);\n  out(`${pc.bold(\"Log\")}       ${logPath(name)}`);\n}\n\n// ───────────── listen dead ─────────────\n\nexport function printDead(profileName: string, opts: { json?: boolean }): void {\n  const name = validProfileName(profileName);\n  const entries = readDead(name);\n  if (opts.json) {\n    for (const e of entries) out(JSON.stringify(e));\n    return;\n  }\n  if (!entries.length) {\n    out(`No dead events for profile \"${name}\".`);\n    return;\n  }\n  for (const e of entries) {\n    const m = e.payload.data.message;\n    out(`${pc.red(\"✖\")} #${e.seq} ${e.type} ${pc.gray(e.id)}  ${pc.gray(`died ${ago(e.deadAt)} after ${e.attempts} attempts`)}`);\n    if (m) out(`    from ${safeText(m.from?.email ?? \"?\", 80)}  \"${safeText(m.subject, 80)}\"`);\n    out(pc.gray(`    ${safeText(e.error, 300)}`));\n  }\n  out();\n  out(pc.gray(`${entries.length} dead event${entries.length > 1 ? \"s\" : \"\"} in ${deadPath(name)}.`));\n  out(pc.gray(`Replay with: ${NPX} listen dead --replay${flagFor(name)}   (one: --id <evt_…>; drop all: --clear)`));\n  out(pc.gray(`Replay uses the profile's saved --exec/--forward; if you ran them as flags only, pass them again, e.g. --replay --exec '<command>'.`));\n}\n\nexport function clearDead(profileName: string, id?: string): void {\n  const name = validProfileName(profileName);\n  const entries = readDead(name);\n  const keep = id ? entries.filter((e) => e.id !== id) : [];\n  writeDead(name, keep);\n  out(`Removed ${entries.length - keep.length} dead event${entries.length - keep.length === 1 ? \"\" : \"s\"}.`);\n}\n\n/**\n * Runs dead events again through the profile's targets (or the ones passed as flags). Successes are\n * removed from dead.jsonl; failures stay. Returns how many still failed.\n */\nexport async function replayDead(flags: ListenFlags & { id?: string }, opts: { retryDelayMs?: (n: number) => number } = {}): Promise<number> {\n  const name = validProfileName(flags.profile ?? DEFAULT_PROFILE);\n  const profile = loadProfile(name);\n  const { config } = resolveListen(name, profile, { ...flags, save: false });\n  const all = readDead(name);\n  const chosen = all.filter((e) => !flags.id || e.id === flags.id);\n  if (!chosen.length) {\n    out(flags.id ? `No dead event with id ${flags.id}.` : `No dead events for profile \"${name}\".`);\n    return 0;\n  }\n  const available: Target[] = [];\n  if (config.exec) available.push(\"exec\");\n  if (config.forward) available.push(\"forward\");\n  if (!available.length) throw new Error(`Nothing to replay to: pass --recipe <tool> (claude-code, codex, cursor, hermes), --exec '<command>' and/or --forward <url> (or save them in the profile with \\`${NPX} listen --save …\\`).`);\n  if (config.exec && process.platform === \"win32\") throw new Error(\"--exec isn't supported on Windows; replay with --forward instead.\");\n\n  const timeoutMs = config.timeoutSeconds * 1000;\n  if (config.cwdIsDefault) ensurePrivateDir(config.cwd);\n  const failed = new Map<string, DeadEntry>();\n  const bySeq = new Map(chosen.map((e) => [e.seq, e]));\n  const dispatcher = new Dispatcher({\n    targets: available,\n    concurrency: config.concurrency,\n    maxAttempts: config.maxAttempts,\n    retryDelayMs: opts.retryDelayMs,\n    run: async (job: Job, signal) => {\n      const errors: string[] = [];\n      if (job.remaining.has(\"exec\") && config.exec) {\n        const r = await runCommand(config.exec, job.payload, { timeoutMs, signal, cwd: config.cwd });\n        if (r.ok) job.remaining.delete(\"exec\");\n        else errors.push(`command: ${r.error}`);\n      }\n      if (job.remaining.has(\"forward\") && config.forward) {\n        const r = await forwardEvent(config.forward.url, config.forward.secret, job.payload, { timeoutMs: Math.min(timeoutMs, 30_000), signal, wrap: isHermesRoute(config.forward.url) });\n        if (r.ok) job.remaining.delete(\"forward\");\n        else errors.push(`forward: ${r.error}`);\n      }\n      return errors;\n    },\n    onAdvance: () => {},\n    onDead: (job) => {\n      const e = bySeq.get(job.seq)!;\n      failed.set(e.id, { ...e, deadAt: new Date().toISOString(), attempts: e.attempts + job.attempts, error: job.lastError ?? \"failed\" });\n      out(`${pc.red(\"✖\")} #${job.seq} still failing: ${safeText(job.lastError ?? \"failed\", 200)}`);\n    },\n    onFinished: (job) => {\n      if (job.outcome === \"succeeded\") out(`${pc.green(\"✓\")} #${job.seq} ${job.payload.type} replayed`);\n    },\n  });\n  out(`Replaying ${chosen.length} dead event${chosen.length > 1 ? \"s\" : \"\"} (up to ${config.maxAttempts} attempts each)…`);\n  // Only the targets that never succeeded (a forward that went through isn't POSTed again).\n  for (const e of [...chosen].sort((a, b) => a.seq - b.seq)) {\n    const targets = e.targets?.length ? e.targets.filter((t) => available.includes(t)) : available;\n    if (!targets.length) {\n      out(`${pc.yellow(\"!\")} #${e.seq} needs ${e.targets.join(\" and \")}, which isn't configured now; pass --${e.targets[0]} to replay it.`);\n      failed.set(e.id, e);\n      continue;\n    }\n    dispatcher.push(e.payload, { targets });\n  }\n  await dispatcher.idle();\n\n  const replayed = new Set(chosen.map((e) => e.id));\n  // Re-read so entries added by a running listener meanwhile are kept.\n  const current = readDead(name);\n  writeDead(name, [...current.filter((e) => !replayed.has(e.id)), ...failed.values()]);\n  out(`${chosen.length - failed.size} replayed, ${failed.size} still dead.`);\n  return failed.size;\n}\n"],"mappings":";;;;;;;;;;;AAoBA,MAAM,OAAO,IAAI,OAAO,QAAQ,OAAO,MAAM,GAAG,EAAE,GAAG;AACrD,MAAM,WAAW,YAAqB,YAAA,YAA8B,KAAK,cAAc;AACvF,MAAM,OAAO,QAAoC,MAAM,GAAG,eAAe,KAAK,IAAI,IAAI,KAAK,MAAM,GAAG,CAAC,EAAE,QAAQ;;AAK/G,SAAgB,YAAY,aAAqB,MAAkC;CACjF,MAAM,OAAO,iBAAiB,WAAW;CACzC,MAAM,UAAU,YAAY,IAAI;CAChC,IAAI,EAAE,QAAQ,YAAY,cAAc,OAAO;CAC/C,IAAI,KAAK,QAAQ;EACf,SAAS,cAAc;GAAE,GAAG;GAAS,SAAS,KAAA;GAAW,eAAe,KAAA;EAAU,CAAC,CAAC,CAAC;EACrF,UAAU;CACZ;CACA,IAAI,SAAS;EACX,IAAI,QAAQ,SAAS,QAAQ,UAAU;GAAE,GAAG,QAAQ;GAAS;EAAO;OAC/D,QAAQ,gBAAgB;EAC7B,YAAY,MAAM,OAAO;EACzB,QAAQ,OAAO,MAAM,GAAG,KAAK,GAAG,KAAK,SAAS,YAAY,YAAY,2CAA2C,KAAK,GAAG,KAAK,SAAS,2BAA2B,GAAG,IAAI,CAAC;CAC5K;CAEA,IAAI,MAAM;AACZ;AAIA,eAAsB,YAAY,aAAoC;CACpE,MAAM,OAAO,iBAAiB,WAAW;CACzC,MAAM,UAAU,YAAY,IAAI;CAChC,MAAM,KAAK,WAAW,IAAI;CAC1B,MAAM,QAAQ,KAAK,SAAS,GAAG,GAAG,KAAK,CAAC,GAAG,YAAY;CACvD,MAAM,OAAO,SAAS,IAAI;CAE1B,IAAI,GAAG,GAAG,KAAK,SAAS,EAAE,KAAK,KAAK,IAAI,GAAG,KAAK,YAAY,IAAI,CAAC,GAAG;CACpE,IAAI,GAAG,GAAG,KAAK,OAAO,EAAE,OAAO,SAAS,QAAQ,SAAS,EAAE,GAAG,GAAG,KAAK,IAAI,QAAQ,QAAQ,EAAE,GAAG;CAC/F,IAAI,GAAG,GAAG,KAAK,QAAQ,EAAE,MAAM,QAAQ,KAAK;CAC5C,IAAI,GAAG,GAAG,KAAK,UAAU,EAAE,IAAI,IAAI,YAAY,QAAQ,UAAU;CAEjE,MAAM,OAAO,MAAM,GAAG,SAAS,KAAA,IAAY,GAAG,OAAO,QAAQ;CAC7D,MAAM,UAAU,MAAM,GAAG,YAAY,KAAA,IAAY,GAAG,UAAU,QAAQ,SAAS;CAC/E,MAAM,UAAU,CAAC,OAAO,QAAQ,SAAS,MAAM,GAAG,MAAM,MAAM,UAAU,WAAW,YAAY,IAAI,CAAC,CAAC,OAAO,OAAO;CACnH,IAAI,GAAG,GAAG,KAAK,MAAM,EAAE,QAAQ,QAAQ,SAAS,QAAQ,KAAK,KAAK,IAAI,GAAG,KAAK,mDAAmD,GAAG;CACpI,IACE,GAAG,GAAG,KAAK,QAAQ,EAAE,MACnB,QAAQ,OAAO,SACX,QAAQ,MAAM,KAAK,IAAI,IACvB,GAAG,qBAAqB,KAAK,IAAI,EAAE,GAAG,GAAG,KAAK,yDAAyD,KAE/G;CAEA,IAAI,QAA2D;CAC/D,IAAI;EACF,QAAQ,cAAc,MAAM,SAAS,CAAC,CAAC,CAAC,CAAC;CAC3C,QAAQ,CAER;CACA,IAAI,GAAG,GAAG,KAAK,SAAS,EAAE,KAAM,SAAS,IAAI,YAAa,QAAQ,eAAe,KAAK,IAAI,MAAM;CAChG,MAAM,eAAe,SAAS,MAAM,GAAG,iBAAiB,KAAA,IAAY,GAAG,eAAgB,OAAO,gBAAgB;CAC9G,IAAI,cAAc,IAAI,GAAG,GAAG,KAAK,OAAO,EAAE,OAAO,eAAe,eAAe,GAAI,EAAE,wCAAkD;CACvI,MAAM,QAAQ,WAAW,cAAc,OAAO,IAAI,aAAa,MAAM,OAAO,IAAI;CAChF,IAAI,OAAO,UAAU,QAAQ,IAAI,GAAG,GAAG,KAAK,OAAO,EAAE,OAAO,GAAG,OAAO,MAAM,OAAO,GAAG;CACtF,IAAI,GAAG,GAAG,KAAK,QAAQ,EAAE,MAAM,WAAW,MAAM;EAAE,MAAM,QAAQ;EAAM,SAAS,UAAU,EAAE,KAAK,QAAQ,IAAI;CAAK,GAAG,QAAQ,IAAI,CAAC,GAAG;CAEpI,IAAI,MAAM;CACV,IAAI,QAAQ,aAAa,WAAW,QAAQ,aAAa,UAAU;EACjE,MAAM,YAAY,sBAAsB,IAAI;EAC5C,IAAI,WAAW,MAAM,cAAc,UAAU,aAAa,IAAI,wBAAwB,QAAQ,IAAI,EAAE;CACtG;CACA,IAAI,GAAG,GAAG,KAAK,SAAS,EAAE,KAAK,KAAK;CAEpC,IAAI;EAEF,MAAM,eAAe,QAAQ,KAAK,EAAE,UAAU,QAAQ,SAAS,CAAC;EAChE,MAAM,OAAO,MAAM,QAAQ,QAAQ,KAAK,QAAQ,QAAQ,GAAI;EAC5D,IAAI,GAAG,GAAG,KAAK,KAAK,EAAE,SAAS,GAAG,MAAM,OAAO,GAAG;EAElD,MAAM,QAAQ,eAAe,KAAK,QAAQ,KAAK,WAAW;EAC1D,IAAI,GAAG,GAAG,KAAK,QAAQ,EAAE,MAAM,UAAU,IAAI,IAAI,MAAM,KAAK,GAAG,OAAO,MAAM,EAAG,GAAG;EAClF,KAAK,MAAM,KAAK,MAAM,MAAM,CAAC,GAAG,IAAI,aAAa,GAAG;CACtD,SAAS,KAAK;EACZ,MAAM,UAAU,eAAe,aAAa,IAAI,WAAW,OAAO,IAAI,WAAW;EACjF,MAAM,MAAM,eAAe,YAAY,IAAI,WAAW,IAAK,IAAI,QAAmB,eAAe,QAAQ,IAAI,QAAQ,MAAM,IAAI,CAAC,CAAC,KAAK,OAAO,GAAG;EAChJ,IAAI,eAAe,gBAAgB,IAAI,GAAG,GAAG,KAAK,KAAK,EAAE,SAAS,GAAG,IAAI,gBAAgB,KAAK,GAAG;OAC5F,IAAI,GAAG,GAAG,KAAK,KAAK,EAAE,SAAS,UAAU,GAAG,IAAI,aAAc,IAAc,SAAS,IAAI,GAAG,OAAO,gBAAgB,IAAI,EAAE,GAAG;CACnI;CAEA,IAAI,CAAC,IACH,IAAI,GAAG,GAAG,KAAK,UAAU,EAAE,IAAI,GAAG,KAAK,iBAAiB,GAAG;MACtD;EACL,MAAM,QAAQ,CAAC,QACX,GAAG,KAAK,cAAc,GAAG,YAAY,aAAa,IAAI,GAAG,SAAS,IAAI,GAAG,aAAa,KAAK,SAAS,GAAG,YAAY,GAAG,MAAM,GAAG,KAAK,0BAA0B,IAC9J,GAAG,YACD,GAAG,MAAM,gBAAgB,GAAG,IAAI,eAAe,IAAI,GAAG,cAAc,GAAG,IACvE,GAAG,OAAO,gBAAgB,GAAG,IAAI,iBAAiB,GAAG,iBAAiB,IAAI,IAAI,GAAG,eAAe,EAAE,EAAE,IAAI,SAAS,GAAG,eAAe,QAAQ,GAAG,MAAM,IAAI;EAC9J,IAAI,GAAG,GAAG,KAAK,UAAU,EAAE,IAAI,OAAO;EACtC,IACE,GAAG,GAAG,KAAK,QAAQ,EAAE,aAAa,GAAG,SAAS,eAAe,GAAG,cAAc,SAAS,GAAG,UAAU,MAAM,GAAG,QAAQ,gBAAgB,KAAK,GAAG,UAAU,MAAM,GAAG,QAAQ,uBAAuB,GAAG,gBAAgB,IAAI,GAAG,WAAW,GACtO;EACA,IAAI,GAAG,OAAO,QAAQ;GACpB,IAAI,GAAG,KAAK,QAAQ,CAAC;GACrB,KAAK,MAAM,KAAK,GAAG,OAAO,MAAM,GAAG,CAAC,GAAG;IACrC,MAAM,OAAO,EAAE,YAAY,cAAc,GAAG,MAAM,GAAG,IAAI,EAAE,YAAY,SAAS,GAAG,IAAI,GAAG,IAAI,EAAE,YAAY,aAAa,GAAG,OAAO,GAAG,IAAI,GAAG,KAAK,GAAG;IACrJ,IAAI,KAAK,KAAK,IAAI,EAAE,IAAI,GAAG,EAAE,KAAK,GAAG,GAAG,KAAK,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,WAAW,IAAI,KAAK,EAAE,SAAS,aAAa,KAAK,EAAE,SAAS,EAAE,YAAY,cAAc,KAAK,SAAS,EAAE,OAAO,GAAG,MAAM,IAAI,GAAG;GAC/L;EACF;CACF;CACA,IAAI,GAAG,GAAG,KAAK,MAAM,EAAE,QAAQ,KAAK,SAAS,GAAG,IAAI,GAAG,KAAK,OAAO,QAAQ,KAAK,SAAS,IAAI,MAAM,IAAI,IAAI,GAAG,KAAK,cAAc,IAAI,cAAc,QAAQ,IAAI,EAAE,EAAE,IAAI,KAAK;CAC5K,IAAI,GAAG,GAAG,KAAK,KAAK,EAAE,SAAS,QAAQ,IAAI,GAAG;AAChD;AAIA,SAAgB,UAAU,aAAqB,MAAgC;CAC7E,MAAM,OAAO,iBAAiB,WAAW;CACzC,MAAM,UAAU,SAAS,IAAI;CAC7B,IAAI,KAAK,MAAM;EACb,KAAK,MAAM,KAAK,SAAS,IAAI,KAAK,UAAU,CAAC,CAAC;EAC9C;CACF;CACA,IAAI,CAAC,QAAQ,QAAQ;EACnB,IAAI,+BAA+B,KAAK,GAAG;EAC3C;CACF;CACA,KAAK,MAAM,KAAK,SAAS;EACvB,MAAM,IAAI,EAAE,QAAQ,KAAK;EACzB,IAAI,GAAG,GAAG,IAAI,GAAG,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,KAAK,GAAG,GAAG,KAAK,EAAE,EAAE,EAAE,IAAI,GAAG,KAAK,QAAQ,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,UAAU,GAAG;EAC3H,IAAI,GAAG,IAAI,YAAY,SAAS,EAAE,MAAM,SAAS,KAAK,EAAE,EAAE,KAAK,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE;EACzF,IAAI,GAAG,KAAK,OAAO,SAAS,EAAE,OAAO,GAAG,GAAG,CAAC;CAC9C;CACA,IAAI;CACJ,IAAI,GAAG,KAAK,GAAG,QAAQ,OAAO,aAAa,QAAQ,SAAS,IAAI,MAAM,GAAG,MAAM,SAAS,IAAI,EAAE,EAAE,CAAC;CACjG,IAAI,GAAG,KAAK,gBAAgB,IAAI,uBAAuB,QAAQ,IAAI,EAAE,0CAA0C,CAAC;CAChH,IAAI,GAAG,KAAK,qIAAqI,CAAC;AACpJ;AAEA,SAAgB,UAAU,aAAqB,IAAmB;CAChE,MAAM,OAAO,iBAAiB,WAAW;CACzC,MAAM,UAAU,SAAS,IAAI;CAC7B,MAAM,OAAO,KAAK,QAAQ,QAAQ,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;CACxD,UAAU,MAAM,IAAI;CACpB,IAAI,WAAW,QAAQ,SAAS,KAAK,OAAO,aAAa,QAAQ,SAAS,KAAK,WAAW,IAAI,KAAK,IAAI,EAAE;AAC3G;;;;;AAMA,eAAsB,WAAW,OAAsC,OAAiD,CAAC,GAAoB;CAC3I,MAAM,OAAO,iBAAiB,MAAM,WAAA,SAA0B;CAC9D,MAAM,UAAU,YAAY,IAAI;CAChC,MAAM,EAAE,WAAW,cAAc,MAAM,SAAS;EAAE,GAAG;EAAO,MAAM;CAAM,CAAC;CAEzE,MAAM,SADM,SAAS,IACJ,CAAC,CAAC,QAAQ,MAAM,CAAC,MAAM,MAAM,EAAE,OAAO,MAAM,EAAE;CAC/D,IAAI,CAAC,OAAO,QAAQ;EAClB,IAAI,MAAM,KAAK,yBAAyB,MAAM,GAAG,KAAK,+BAA+B,KAAK,GAAG;EAC7F,OAAO;CACT;CACA,MAAM,YAAsB,CAAC;CAC7B,IAAI,OAAO,MAAM,UAAU,KAAK,MAAM;CACtC,IAAI,OAAO,SAAS,UAAU,KAAK,SAAS;CAC5C,IAAI,CAAC,UAAU,QAAQ,MAAM,IAAI,MAAM,kKAAkK,IAAI,qBAAqB;CAClO,IAAI,OAAO,QAAQ,QAAQ,aAAa,SAAS,MAAM,IAAI,MAAM,mEAAmE;CAEpI,MAAM,YAAY,OAAO,iBAAiB;CAC1C,IAAI,OAAO,cAAc,iBAAiB,OAAO,GAAG;CACpD,MAAM,yBAAS,IAAI,IAAuB;CAC1C,MAAM,QAAQ,IAAI,IAAI,OAAO,KAAK,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;CACnD,MAAM,aAAa,IAAI,WAAW;EAChC,SAAS;EACT,aAAa,OAAO;EACpB,aAAa,OAAO;EACpB,cAAc,KAAK;EACnB,KAAK,OAAO,KAAU,WAAW;GAC/B,MAAM,SAAmB,CAAC;GAC1B,IAAI,IAAI,UAAU,IAAI,MAAM,KAAK,OAAO,MAAM;IAC5C,MAAM,IAAI,MAAM,WAAW,OAAO,MAAM,IAAI,SAAS;KAAE;KAAW;KAAQ,KAAK,OAAO;IAAI,CAAC;IAC3F,IAAI,EAAE,IAAI,IAAI,UAAU,OAAO,MAAM;SAChC,OAAO,KAAK,YAAY,EAAE,OAAO;GACxC;GACA,IAAI,IAAI,UAAU,IAAI,SAAS,KAAK,OAAO,SAAS;IAClD,MAAM,IAAI,MAAM,aAAa,OAAO,QAAQ,KAAK,OAAO,QAAQ,QAAQ,IAAI,SAAS;KAAE,WAAW,KAAK,IAAI,WAAW,GAAM;KAAG;KAAQ,MAAM,cAAc,OAAO,QAAQ,GAAG;IAAE,CAAC;IAChL,IAAI,EAAE,IAAI,IAAI,UAAU,OAAO,SAAS;SACnC,OAAO,KAAK,YAAY,EAAE,OAAO;GACxC;GACA,OAAO;EACT;EACA,iBAAiB,CAAC;EAClB,SAAS,QAAQ;GACf,MAAM,IAAI,MAAM,IAAI,IAAI,GAAG;GAC3B,OAAO,IAAI,EAAE,IAAI;IAAE,GAAG;IAAG,yBAAQ,IAAI,KAAK,EAAA,CAAE,YAAY;IAAG,UAAU,EAAE,WAAW,IAAI;IAAU,OAAO,IAAI,aAAa;GAAS,CAAC;GAClI,IAAI,GAAG,GAAG,IAAI,GAAG,EAAE,IAAI,IAAI,IAAI,kBAAkB,SAAS,IAAI,aAAa,UAAU,GAAG,GAAG;EAC7F;EACA,aAAa,QAAQ;GACnB,IAAI,IAAI,YAAY,aAAa,IAAI,GAAG,GAAG,MAAM,GAAG,EAAE,IAAI,IAAI,IAAI,GAAG,IAAI,QAAQ,KAAK,UAAU;EAClG;CACF,CAAC;CACD,IAAI,aAAa,OAAO,OAAO,aAAa,OAAO,SAAS,IAAI,MAAM,GAAG,UAAU,OAAO,YAAY,iBAAiB;CAEvH,KAAK,MAAM,KAAK,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,GAAG,MAAM,EAAE,MAAM,EAAE,GAAG,GAAG;EACzD,MAAM,UAAU,EAAE,SAAS,SAAS,EAAE,QAAQ,QAAQ,MAAM,UAAU,SAAS,CAAC,CAAC,IAAI;EACrF,IAAI,CAAC,QAAQ,QAAQ;GACnB,IAAI,GAAG,GAAG,OAAO,GAAG,EAAE,IAAI,EAAE,IAAI,SAAS,EAAE,QAAQ,KAAK,OAAO,EAAE,uCAAuC,EAAE,QAAQ,GAAG,eAAe;GACpI,OAAO,IAAI,EAAE,IAAI,CAAC;GAClB;EACF;EACA,WAAW,KAAK,EAAE,SAAS,EAAE,QAAQ,CAAC;CACxC;CACA,MAAM,WAAW,KAAK;CAEtB,MAAM,WAAW,IAAI,IAAI,OAAO,KAAK,MAAM,EAAE,EAAE,CAAC;CAEhD,MAAM,UAAU,SAAS,IAAI;CAC7B,UAAU,MAAM,CAAC,GAAG,QAAQ,QAAQ,MAAM,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC,GAAG,GAAG,OAAO,OAAO,CAAC,CAAC;CACnF,IAAI,GAAG,OAAO,SAAS,OAAO,KAAK,aAAa,OAAO,KAAK,aAAa;CACzE,OAAO,OAAO;AAChB"}
+{"version":3,"file":"admin-5555baeh.js","names":[],"sources":["../server/listen/admin.ts"],"sourcesContent":["import pc from \"picocolors\";\nimport { ApiError, getSelf } from \"./api.ts\";\nimport { describeGrants, hasAccess } from \"./grants.ts\";\nimport { Dispatcher, type Job, type Target } from \"./dispatcher.ts\";\nimport { runCommand } from \"./exec.ts\";\nimport { ensurePrivateDir } from \"./fsutil.ts\";\nimport { forwardEvent } from \"./forward.ts\";\nimport { routeWarning } from \"./hermes.ts\";\nimport { describeFilter, type ListenFlags, MAX_BATCH, resolveListen } from \"./options.ts\";\nimport { outputLine } from \"./listen.ts\";\nimport { isHermesRoute } from \"./recipes.ts\";\nimport { DEFAULT_PROFILE, deadPath, logPath, profilePath, validProfileName } from \"./paths.ts\";\nimport { loadProfile, saveProfile } from \"./profile.ts\";\nimport { DEFAULT_LISTEN_TYPES, forwardSecret } from \"./options.ts\";\nimport { installedServiceLabel } from \"./service.ts\";\nimport { type DeadEntry, pidAlive, readDead, readStatus, writeDead } from \"./state.ts\";\nimport { checkTransport, TransportError } from \"./transport.ts\";\nimport { formatDuration, safeText } from \"./ui.ts\";\nimport { NPX } from \"./version.ts\";\n\nconst out = (s = \"\") => process.stdout.write(`${s}\\n`);\nconst flagFor = (profile: string) => (profile === DEFAULT_PROFILE ? \"\" : ` --profile ${profile}`);\nconst ago = (iso: string | null | undefined) => (iso ? `${formatDuration(Date.now() - Date.parse(iso))} ago` : \"never\");\n\n// ───────────── listen secret ─────────────\n\n/** Prints the forward-mode signing secret (generating and saving it on first use). */\nexport function printSecret(profileName: string, opts: { rotate?: boolean }): void {\n  const name = validProfileName(profileName);\n  const profile = loadProfile(name);\n  let { secret, created } = forwardSecret(profile);\n  if (opts.rotate) {\n    secret = forwardSecret({ ...profile, forward: undefined, forwardSecret: undefined }).secret;\n    created = true;\n  }\n  if (created) {\n    if (profile.forward) profile.forward = { ...profile.forward, secret };\n    else profile.forwardSecret = secret;\n    saveProfile(name, profile);\n    process.stderr.write(pc.gray(`${opts.rotate ? \"Rotated\" : \"Generated\"} the forward signing secret for profile \"${name}\"${opts.rotate ? \"; restart the listener\" : \"\"}.\\n`));\n  }\n  // The secret alone on stdout, so `export XAQ_WEBHOOK_SECRET=$(xaq listen secret)` works.\n  out(secret);\n}\n\n// ───────────── listen status ─────────────\n\nexport async function printStatus(profileName: string): Promise<void> {\n  const name = validProfileName(profileName);\n  const profile = loadProfile(name);\n  const st = readStatus(name);\n  const alive = st ? pidAlive(st.pid) && !st.stoppedAt : false;\n  const dead = readDead(name);\n\n  out(`${pc.bold(\"Profile\")}   ${name}  ${pc.gray(profilePath(name))}`);\n  out(`${pc.bold(\"Agent\")}     ${safeText(profile.agentName)} ${pc.gray(`(${profile.agentId})`)}`);\n  out(`${pc.bold(\"Daemon\")}    ${profile.url}`);\n  out(`${pc.bold(\"Consumer\")}  ${st?.consumer ?? profile.consumer}`);\n  // What the last run used (flags included), else what the profile has saved.\n  const exec = st && st.exec !== undefined ? st.exec : profile.exec;\n  const forward = st && st.forward !== undefined ? st.forward : profile.forward?.url;\n  const targets = [exec ? `exec ${safeText(exec, 120)}` : null, forward ? `forward ${forward}` : null].filter(Boolean);\n  out(`${pc.bold(\"Runs\")}      ${targets.length ? targets.join(\" · \") : pc.gray(\"nothing saved (pass --exec/--forward with --save)\")}`);\n  out(\n    `${pc.bold(\"Events\")}    ${\n      profile.types?.length\n        ? profile.types.join(\", \")\n        : `${DEFAULT_LISTEN_TYPES.join(\", \")} ${pc.gray(\"(default types; add --types all --save for every event)\")}`\n    }`,\n  );\n  // The running listener's filters (flags included), else the profile's.\n  let saved: ReturnType<typeof resolveListen>[\"config\"] | null = null;\n  try {\n    saved = resolveListen(name, profile, {}).config;\n  } catch {\n    // An invalid saved setting: `listen` itself reports it.\n  }\n  out(`${pc.bold(\"Filters\")}   ${(alive && st?.filters) || (saved ? describeFilter(saved) : \"?\")}`);\n  const batchSeconds = alive && st && st.batchSeconds !== undefined ? st.batchSeconds : (saved?.batchSeconds ?? 0);\n  if (batchSeconds) out(`${pc.bold(\"Batch\")}     ${formatDuration(batchSeconds * 1000)} window, up to ${MAX_BATCH} events per --exec run`);\n  const route = forward && isHermesRoute(forward) ? routeWarning(name, forward) : null;\n  if (route?.level === \"warn\") out(`${pc.bold(\"Route\")}     ${pc.yellow(route.message)}`);\n  out(`${pc.bold(\"Output\")}    ${outputLine(name, { exec: exec ?? null, forward: forward ? { url: forward } : null }, logPath(name))}`);\n\n  let svc = \"not installed\";\n  if (process.platform === \"linux\" || process.platform === \"darwin\") {\n    const installed = installedServiceLabel(name);\n    if (installed) svc = `installed (${installed}; details: ${NPX} listen service status${flagFor(name)})`;\n  }\n  out(`${pc.bold(\"Service\")}   ${svc}`);\n\n  try {\n    // Never send the key over a connection `listen` itself would refuse.\n    await checkTransport(profile.url, { insecure: profile.insecure });\n    const self = await getSelf(profile.url, profile.apiKey, 5000);\n    out(`${pc.bold(\"Key\")}       ${pc.green(\"valid\")}`);\n    // The access the console actually granted, in plain words (what the agent should report to its human).\n    const lines = describeGrants(self.grants, self.connections);\n    out(`${pc.bold(\"Access\")}    ${hasAccess(self) ? lines[0] : pc.yellow(lines[0]!)}`);\n    for (const l of lines.slice(1)) out(`          ${l}`);\n  } catch (err) {\n    const revoked = err instanceof ApiError && (err.status === 401 || err.status === 403);\n    const why = err instanceof ApiError && err.status === 0 ? (err.cause as string) : err instanceof Error ? err.message.split(\"\\n\")[0] : String(err);\n    if (err instanceof TransportError) out(`${pc.bold(\"Key\")}       ${pc.red(`not checked: ${why}`)}`);\n    else out(`${pc.bold(\"Key\")}       ${revoked ? pc.red(`rejected: ${(err as Error).message}`) : pc.yellow(`not checked (${why})`)}`);\n  }\n\n  if (!st) {\n    out(`${pc.bold(\"Listener\")}  ${pc.gray(\"has not run yet\")}`);\n  } else {\n    const state = !alive\n      ? pc.gray(`not running${st.stoppedAt ? ` (stopped ${ago(st.stoppedAt)}${st.exitReason ? `: ${safeText(st.exitReason, 160)}` : \"\"})` : \" (exited unexpectedly)\"}`)\n      : st.connected\n        ? pc.green(`running (pid ${st.pid}), connected ${ago(st.connectedSince)}`)\n        : pc.yellow(`running (pid ${st.pid}), disconnected${st.lastDisconnect ? ` ${ago(st.lastDisconnect.at)}: ${safeText(st.lastDisconnect.reason, 160)}` : \"\"}`);\n    out(`${pc.bold(\"Listener\")}  ${state}`);\n    out(\n      `${pc.bold(\"Cursor\")}    acked #${st.ackedSeq} · received #${st.receivedSeq}${alive && st.running ? ` · ${st.running} in progress` : \"\"}${st.skipped ? ` · ${st.skipped} skipped by filters` : \"\"} · last event ${ago(st.lastEventAt)}`,\n    );\n    if (st.recent.length) {\n      out(pc.bold(\"Recent\"));\n      for (const r of st.recent.slice(0, 8)) {\n        const icon = r.outcome === \"succeeded\" ? pc.green(\"✓\") : r.outcome === \"dead\" ? pc.red(\"✖\") : r.outcome === \"retrying\" ? pc.yellow(\"↻\") : pc.gray(\"·\");\n        out(`  ${icon} #${r.seq} ${r.type} ${pc.gray(`${ago(r.at)}${r.attempts > 1 ? `, ${r.attempts} attempts` : \"\"}${r.error && r.outcome !== \"succeeded\" ? `, ${safeText(r.error, 100)}` : \"\"}`)}`);\n      }\n    }\n  }\n  out(`${pc.bold(\"Dead\")}      ${dead.length ? pc.red(`${dead.length} event${dead.length > 1 ? \"s\" : \"\"}`) + pc.gray(` (inspect: ${NPX} listen dead${flagFor(name)})`) : \"0\"}`);\n  out(`${pc.bold(\"Log\")}       ${logPath(name)}`);\n}\n\n// ───────────── listen dead ─────────────\n\nexport function printDead(profileName: string, opts: { json?: boolean }): void {\n  const name = validProfileName(profileName);\n  const entries = readDead(name);\n  if (opts.json) {\n    for (const e of entries) out(JSON.stringify(e));\n    return;\n  }\n  if (!entries.length) {\n    out(`No dead events for profile \"${name}\".`);\n    return;\n  }\n  for (const e of entries) {\n    const m = e.payload.data.message;\n    out(`${pc.red(\"✖\")} #${e.seq} ${e.type} ${pc.gray(e.id)}  ${pc.gray(`died ${ago(e.deadAt)} after ${e.attempts} attempts`)}`);\n    if (m) out(`    from ${safeText(m.from?.email ?? \"?\", 80)}  \"${safeText(m.subject, 80)}\"`);\n    out(pc.gray(`    ${safeText(e.error, 300)}`));\n  }\n  out();\n  out(pc.gray(`${entries.length} dead event${entries.length > 1 ? \"s\" : \"\"} in ${deadPath(name)}.`));\n  out(pc.gray(`Replay with: ${NPX} listen dead --replay${flagFor(name)}   (one: --id <evt_…>; drop all: --clear)`));\n  out(pc.gray(`Replay uses the profile's saved --exec/--forward; if you ran them as flags only, pass them again, e.g. --replay --exec '<command>'.`));\n}\n\nexport function clearDead(profileName: string, id?: string): void {\n  const name = validProfileName(profileName);\n  const entries = readDead(name);\n  const keep = id ? entries.filter((e) => e.id !== id) : [];\n  writeDead(name, keep);\n  out(`Removed ${entries.length - keep.length} dead event${entries.length - keep.length === 1 ? \"\" : \"s\"}.`);\n}\n\n/**\n * Runs dead events again through the profile's targets (or the ones passed as flags). Successes are\n * removed from dead.jsonl; failures stay. Returns how many still failed.\n */\nexport async function replayDead(flags: ListenFlags & { id?: string }, opts: { retryDelayMs?: (n: number) => number } = {}): Promise<number> {\n  const name = validProfileName(flags.profile ?? DEFAULT_PROFILE);\n  const profile = loadProfile(name);\n  const { config } = resolveListen(name, profile, { ...flags, save: false });\n  const all = readDead(name);\n  const chosen = all.filter((e) => !flags.id || e.id === flags.id);\n  if (!chosen.length) {\n    out(flags.id ? `No dead event with id ${flags.id}.` : `No dead events for profile \"${name}\".`);\n    return 0;\n  }\n  const available: Target[] = [];\n  if (config.exec) available.push(\"exec\");\n  if (config.forward) available.push(\"forward\");\n  if (!available.length) throw new Error(`Nothing to replay to: pass --recipe <tool> (claude-code, codex, cursor, hermes), --exec '<command>' and/or --forward <url> (or save them in the profile with \\`${NPX} listen --save …\\`).`);\n  if (config.exec && process.platform === \"win32\") throw new Error(\"--exec isn't supported on Windows; replay with --forward instead.\");\n\n  const timeoutMs = config.timeoutSeconds * 1000;\n  if (config.cwdIsDefault) ensurePrivateDir(config.cwd);\n  const failed = new Map<string, DeadEntry>();\n  const bySeq = new Map(chosen.map((e) => [e.seq, e]));\n  const dispatcher = new Dispatcher({\n    targets: available,\n    concurrency: config.concurrency,\n    maxAttempts: config.maxAttempts,\n    retryDelayMs: opts.retryDelayMs,\n    run: async (job: Job, signal) => {\n      const errors: string[] = [];\n      if (job.remaining.has(\"exec\") && config.exec) {\n        const r = await runCommand(config.exec, job.payload, { timeoutMs, signal, cwd: config.cwd });\n        if (r.ok) job.remaining.delete(\"exec\");\n        else errors.push(`command: ${r.error}`);\n      }\n      if (job.remaining.has(\"forward\") && config.forward) {\n        const r = await forwardEvent(config.forward.url, config.forward.secret, job.payload, { timeoutMs: Math.min(timeoutMs, 30_000), signal, wrap: isHermesRoute(config.forward.url) });\n        if (r.ok) job.remaining.delete(\"forward\");\n        else errors.push(`forward: ${r.error}`);\n      }\n      return errors;\n    },\n    onAdvance: () => {},\n    onDead: (job) => {\n      const e = bySeq.get(job.seq)!;\n      failed.set(e.id, { ...e, deadAt: new Date().toISOString(), attempts: e.attempts + job.attempts, error: job.lastError ?? \"failed\" });\n      out(`${pc.red(\"✖\")} #${job.seq} still failing: ${safeText(job.lastError ?? \"failed\", 200)}`);\n    },\n    onFinished: (job) => {\n      if (job.outcome === \"succeeded\") out(`${pc.green(\"✓\")} #${job.seq} ${job.payload.type} replayed`);\n    },\n  });\n  out(`Replaying ${chosen.length} dead event${chosen.length > 1 ? \"s\" : \"\"} (up to ${config.maxAttempts} attempts each)…`);\n  // Only the targets that never succeeded (a forward that went through isn't POSTed again).\n  for (const e of [...chosen].sort((a, b) => a.seq - b.seq)) {\n    const targets = e.targets?.length ? e.targets.filter((t) => available.includes(t)) : available;\n    if (!targets.length) {\n      out(`${pc.yellow(\"!\")} #${e.seq} needs ${e.targets.join(\" and \")}, which isn't configured now; pass --${e.targets[0]} to replay it.`);\n      failed.set(e.id, e);\n      continue;\n    }\n    dispatcher.push(e.payload, { targets });\n  }\n  await dispatcher.idle();\n\n  const replayed = new Set(chosen.map((e) => e.id));\n  // Re-read so entries added by a running listener meanwhile are kept.\n  const current = readDead(name);\n  writeDead(name, [...current.filter((e) => !replayed.has(e.id)), ...failed.values()]);\n  out(`${chosen.length - failed.size} replayed, ${failed.size} still dead.`);\n  return failed.size;\n}\n"],"mappings":";;;;;;;;;;;AAoBA,MAAM,OAAO,IAAI,OAAO,QAAQ,OAAO,MAAM,GAAG,EAAE,GAAG;AACrD,MAAM,WAAW,YAAqB,YAAA,YAA8B,KAAK,cAAc;AACvF,MAAM,OAAO,QAAoC,MAAM,GAAG,eAAe,KAAK,IAAI,IAAI,KAAK,MAAM,GAAG,CAAC,EAAE,QAAQ;;AAK/G,SAAgB,YAAY,aAAqB,MAAkC;CACjF,MAAM,OAAO,iBAAiB,WAAW;CACzC,MAAM,UAAU,YAAY,IAAI;CAChC,IAAI,EAAE,QAAQ,YAAY,cAAc,OAAO;CAC/C,IAAI,KAAK,QAAQ;EACf,SAAS,cAAc;GAAE,GAAG;GAAS,SAAS,KAAA;GAAW,eAAe,KAAA;EAAU,CAAC,CAAC,CAAC;EACrF,UAAU;CACZ;CACA,IAAI,SAAS;EACX,IAAI,QAAQ,SAAS,QAAQ,UAAU;GAAE,GAAG,QAAQ;GAAS;EAAO;OAC/D,QAAQ,gBAAgB;EAC7B,YAAY,MAAM,OAAO;EACzB,QAAQ,OAAO,MAAM,GAAG,KAAK,GAAG,KAAK,SAAS,YAAY,YAAY,2CAA2C,KAAK,GAAG,KAAK,SAAS,2BAA2B,GAAG,IAAI,CAAC;CAC5K;CAEA,IAAI,MAAM;AACZ;AAIA,eAAsB,YAAY,aAAoC;CACpE,MAAM,OAAO,iBAAiB,WAAW;CACzC,MAAM,UAAU,YAAY,IAAI;CAChC,MAAM,KAAK,WAAW,IAAI;CAC1B,MAAM,QAAQ,KAAK,SAAS,GAAG,GAAG,KAAK,CAAC,GAAG,YAAY;CACvD,MAAM,OAAO,SAAS,IAAI;CAE1B,IAAI,GAAG,GAAG,KAAK,SAAS,EAAE,KAAK,KAAK,IAAI,GAAG,KAAK,YAAY,IAAI,CAAC,GAAG;CACpE,IAAI,GAAG,GAAG,KAAK,OAAO,EAAE,OAAO,SAAS,QAAQ,SAAS,EAAE,GAAG,GAAG,KAAK,IAAI,QAAQ,QAAQ,EAAE,GAAG;CAC/F,IAAI,GAAG,GAAG,KAAK,QAAQ,EAAE,MAAM,QAAQ,KAAK;CAC5C,IAAI,GAAG,GAAG,KAAK,UAAU,EAAE,IAAI,IAAI,YAAY,QAAQ,UAAU;CAEjE,MAAM,OAAO,MAAM,GAAG,SAAS,KAAA,IAAY,GAAG,OAAO,QAAQ;CAC7D,MAAM,UAAU,MAAM,GAAG,YAAY,KAAA,IAAY,GAAG,UAAU,QAAQ,SAAS;CAC/E,MAAM,UAAU,CAAC,OAAO,QAAQ,SAAS,MAAM,GAAG,MAAM,MAAM,UAAU,WAAW,YAAY,IAAI,CAAC,CAAC,OAAO,OAAO;CACnH,IAAI,GAAG,GAAG,KAAK,MAAM,EAAE,QAAQ,QAAQ,SAAS,QAAQ,KAAK,KAAK,IAAI,GAAG,KAAK,mDAAmD,GAAG;CACpI,IACE,GAAG,GAAG,KAAK,QAAQ,EAAE,MACnB,QAAQ,OAAO,SACX,QAAQ,MAAM,KAAK,IAAI,IACvB,GAAG,qBAAqB,KAAK,IAAI,EAAE,GAAG,GAAG,KAAK,yDAAyD,KAE/G;CAEA,IAAI,QAA2D;CAC/D,IAAI;EACF,QAAQ,cAAc,MAAM,SAAS,CAAC,CAAC,CAAC,CAAC;CAC3C,QAAQ,CAER;CACA,IAAI,GAAG,GAAG,KAAK,SAAS,EAAE,KAAM,SAAS,IAAI,YAAa,QAAQ,eAAe,KAAK,IAAI,MAAM;CAChG,MAAM,eAAe,SAAS,MAAM,GAAG,iBAAiB,KAAA,IAAY,GAAG,eAAgB,OAAO,gBAAgB;CAC9G,IAAI,cAAc,IAAI,GAAG,GAAG,KAAK,OAAO,EAAE,OAAO,eAAe,eAAe,GAAI,EAAE,wCAAkD;CACvI,MAAM,QAAQ,WAAW,cAAc,OAAO,IAAI,aAAa,MAAM,OAAO,IAAI;CAChF,IAAI,OAAO,UAAU,QAAQ,IAAI,GAAG,GAAG,KAAK,OAAO,EAAE,OAAO,GAAG,OAAO,MAAM,OAAO,GAAG;CACtF,IAAI,GAAG,GAAG,KAAK,QAAQ,EAAE,MAAM,WAAW,MAAM;EAAE,MAAM,QAAQ;EAAM,SAAS,UAAU,EAAE,KAAK,QAAQ,IAAI;CAAK,GAAG,QAAQ,IAAI,CAAC,GAAG;CAEpI,IAAI,MAAM;CACV,IAAI,QAAQ,aAAa,WAAW,QAAQ,aAAa,UAAU;EACjE,MAAM,YAAY,sBAAsB,IAAI;EAC5C,IAAI,WAAW,MAAM,cAAc,UAAU,aAAa,IAAI,wBAAwB,QAAQ,IAAI,EAAE;CACtG;CACA,IAAI,GAAG,GAAG,KAAK,SAAS,EAAE,KAAK,KAAK;CAEpC,IAAI;EAEF,MAAM,eAAe,QAAQ,KAAK,EAAE,UAAU,QAAQ,SAAS,CAAC;EAChE,MAAM,OAAO,MAAM,QAAQ,QAAQ,KAAK,QAAQ,QAAQ,GAAI;EAC5D,IAAI,GAAG,GAAG,KAAK,KAAK,EAAE,SAAS,GAAG,MAAM,OAAO,GAAG;EAElD,MAAM,QAAQ,eAAe,KAAK,QAAQ,KAAK,WAAW;EAC1D,IAAI,GAAG,GAAG,KAAK,QAAQ,EAAE,MAAM,UAAU,IAAI,IAAI,MAAM,KAAK,GAAG,OAAO,MAAM,EAAG,GAAG;EAClF,KAAK,MAAM,KAAK,MAAM,MAAM,CAAC,GAAG,IAAI,aAAa,GAAG;CACtD,SAAS,KAAK;EACZ,MAAM,UAAU,eAAe,aAAa,IAAI,WAAW,OAAO,IAAI,WAAW;EACjF,MAAM,MAAM,eAAe,YAAY,IAAI,WAAW,IAAK,IAAI,QAAmB,eAAe,QAAQ,IAAI,QAAQ,MAAM,IAAI,CAAC,CAAC,KAAK,OAAO,GAAG;EAChJ,IAAI,eAAe,gBAAgB,IAAI,GAAG,GAAG,KAAK,KAAK,EAAE,SAAS,GAAG,IAAI,gBAAgB,KAAK,GAAG;OAC5F,IAAI,GAAG,GAAG,KAAK,KAAK,EAAE,SAAS,UAAU,GAAG,IAAI,aAAc,IAAc,SAAS,IAAI,GAAG,OAAO,gBAAgB,IAAI,EAAE,GAAG;CACnI;CAEA,IAAI,CAAC,IACH,IAAI,GAAG,GAAG,KAAK,UAAU,EAAE,IAAI,GAAG,KAAK,iBAAiB,GAAG;MACtD;EACL,MAAM,QAAQ,CAAC,QACX,GAAG,KAAK,cAAc,GAAG,YAAY,aAAa,IAAI,GAAG,SAAS,IAAI,GAAG,aAAa,KAAK,SAAS,GAAG,YAAY,GAAG,MAAM,GAAG,KAAK,0BAA0B,IAC9J,GAAG,YACD,GAAG,MAAM,gBAAgB,GAAG,IAAI,eAAe,IAAI,GAAG,cAAc,GAAG,IACvE,GAAG,OAAO,gBAAgB,GAAG,IAAI,iBAAiB,GAAG,iBAAiB,IAAI,IAAI,GAAG,eAAe,EAAE,EAAE,IAAI,SAAS,GAAG,eAAe,QAAQ,GAAG,MAAM,IAAI;EAC9J,IAAI,GAAG,GAAG,KAAK,UAAU,EAAE,IAAI,OAAO;EACtC,IACE,GAAG,GAAG,KAAK,QAAQ,EAAE,aAAa,GAAG,SAAS,eAAe,GAAG,cAAc,SAAS,GAAG,UAAU,MAAM,GAAG,QAAQ,gBAAgB,KAAK,GAAG,UAAU,MAAM,GAAG,QAAQ,uBAAuB,GAAG,gBAAgB,IAAI,GAAG,WAAW,GACtO;EACA,IAAI,GAAG,OAAO,QAAQ;GACpB,IAAI,GAAG,KAAK,QAAQ,CAAC;GACrB,KAAK,MAAM,KAAK,GAAG,OAAO,MAAM,GAAG,CAAC,GAAG;IACrC,MAAM,OAAO,EAAE,YAAY,cAAc,GAAG,MAAM,GAAG,IAAI,EAAE,YAAY,SAAS,GAAG,IAAI,GAAG,IAAI,EAAE,YAAY,aAAa,GAAG,OAAO,GAAG,IAAI,GAAG,KAAK,GAAG;IACrJ,IAAI,KAAK,KAAK,IAAI,EAAE,IAAI,GAAG,EAAE,KAAK,GAAG,GAAG,KAAK,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,WAAW,IAAI,KAAK,EAAE,SAAS,aAAa,KAAK,EAAE,SAAS,EAAE,YAAY,cAAc,KAAK,SAAS,EAAE,OAAO,GAAG,MAAM,IAAI,GAAG;GAC/L;EACF;CACF;CACA,IAAI,GAAG,GAAG,KAAK,MAAM,EAAE,QAAQ,KAAK,SAAS,GAAG,IAAI,GAAG,KAAK,OAAO,QAAQ,KAAK,SAAS,IAAI,MAAM,IAAI,IAAI,GAAG,KAAK,cAAc,IAAI,cAAc,QAAQ,IAAI,EAAE,EAAE,IAAI,KAAK;CAC5K,IAAI,GAAG,GAAG,KAAK,KAAK,EAAE,SAAS,QAAQ,IAAI,GAAG;AAChD;AAIA,SAAgB,UAAU,aAAqB,MAAgC;CAC7E,MAAM,OAAO,iBAAiB,WAAW;CACzC,MAAM,UAAU,SAAS,IAAI;CAC7B,IAAI,KAAK,MAAM;EACb,KAAK,MAAM,KAAK,SAAS,IAAI,KAAK,UAAU,CAAC,CAAC;EAC9C;CACF;CACA,IAAI,CAAC,QAAQ,QAAQ;EACnB,IAAI,+BAA+B,KAAK,GAAG;EAC3C;CACF;CACA,KAAK,MAAM,KAAK,SAAS;EACvB,MAAM,IAAI,EAAE,QAAQ,KAAK;EACzB,IAAI,GAAG,GAAG,IAAI,GAAG,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,KAAK,GAAG,GAAG,KAAK,EAAE,EAAE,EAAE,IAAI,GAAG,KAAK,QAAQ,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,UAAU,GAAG;EAC3H,IAAI,GAAG,IAAI,YAAY,SAAS,EAAE,MAAM,SAAS,KAAK,EAAE,EAAE,KAAK,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE;EACzF,IAAI,GAAG,KAAK,OAAO,SAAS,EAAE,OAAO,GAAG,GAAG,CAAC;CAC9C;CACA,IAAI;CACJ,IAAI,GAAG,KAAK,GAAG,QAAQ,OAAO,aAAa,QAAQ,SAAS,IAAI,MAAM,GAAG,MAAM,SAAS,IAAI,EAAE,EAAE,CAAC;CACjG,IAAI,GAAG,KAAK,gBAAgB,IAAI,uBAAuB,QAAQ,IAAI,EAAE,0CAA0C,CAAC;CAChH,IAAI,GAAG,KAAK,qIAAqI,CAAC;AACpJ;AAEA,SAAgB,UAAU,aAAqB,IAAmB;CAChE,MAAM,OAAO,iBAAiB,WAAW;CACzC,MAAM,UAAU,SAAS,IAAI;CAC7B,MAAM,OAAO,KAAK,QAAQ,QAAQ,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;CACxD,UAAU,MAAM,IAAI;CACpB,IAAI,WAAW,QAAQ,SAAS,KAAK,OAAO,aAAa,QAAQ,SAAS,KAAK,WAAW,IAAI,KAAK,IAAI,EAAE;AAC3G;;;;;AAMA,eAAsB,WAAW,OAAsC,OAAiD,CAAC,GAAoB;CAC3I,MAAM,OAAO,iBAAiB,MAAM,WAAA,SAA0B;CAC9D,MAAM,UAAU,YAAY,IAAI;CAChC,MAAM,EAAE,WAAW,cAAc,MAAM,SAAS;EAAE,GAAG;EAAO,MAAM;CAAM,CAAC;CAEzE,MAAM,SADM,SAAS,IACJ,CAAC,CAAC,QAAQ,MAAM,CAAC,MAAM,MAAM,EAAE,OAAO,MAAM,EAAE;CAC/D,IAAI,CAAC,OAAO,QAAQ;EAClB,IAAI,MAAM,KAAK,yBAAyB,MAAM,GAAG,KAAK,+BAA+B,KAAK,GAAG;EAC7F,OAAO;CACT;CACA,MAAM,YAAsB,CAAC;CAC7B,IAAI,OAAO,MAAM,UAAU,KAAK,MAAM;CACtC,IAAI,OAAO,SAAS,UAAU,KAAK,SAAS;CAC5C,IAAI,CAAC,UAAU,QAAQ,MAAM,IAAI,MAAM,kKAAkK,IAAI,qBAAqB;CAClO,IAAI,OAAO,QAAQ,QAAQ,aAAa,SAAS,MAAM,IAAI,MAAM,mEAAmE;CAEpI,MAAM,YAAY,OAAO,iBAAiB;CAC1C,IAAI,OAAO,cAAc,iBAAiB,OAAO,GAAG;CACpD,MAAM,yBAAS,IAAI,IAAuB;CAC1C,MAAM,QAAQ,IAAI,IAAI,OAAO,KAAK,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;CACnD,MAAM,aAAa,IAAI,WAAW;EAChC,SAAS;EACT,aAAa,OAAO;EACpB,aAAa,OAAO;EACpB,cAAc,KAAK;EACnB,KAAK,OAAO,KAAU,WAAW;GAC/B,MAAM,SAAmB,CAAC;GAC1B,IAAI,IAAI,UAAU,IAAI,MAAM,KAAK,OAAO,MAAM;IAC5C,MAAM,IAAI,MAAM,WAAW,OAAO,MAAM,IAAI,SAAS;KAAE;KAAW;KAAQ,KAAK,OAAO;IAAI,CAAC;IAC3F,IAAI,EAAE,IAAI,IAAI,UAAU,OAAO,MAAM;SAChC,OAAO,KAAK,YAAY,EAAE,OAAO;GACxC;GACA,IAAI,IAAI,UAAU,IAAI,SAAS,KAAK,OAAO,SAAS;IAClD,MAAM,IAAI,MAAM,aAAa,OAAO,QAAQ,KAAK,OAAO,QAAQ,QAAQ,IAAI,SAAS;KAAE,WAAW,KAAK,IAAI,WAAW,GAAM;KAAG;KAAQ,MAAM,cAAc,OAAO,QAAQ,GAAG;IAAE,CAAC;IAChL,IAAI,EAAE,IAAI,IAAI,UAAU,OAAO,SAAS;SACnC,OAAO,KAAK,YAAY,EAAE,OAAO;GACxC;GACA,OAAO;EACT;EACA,iBAAiB,CAAC;EAClB,SAAS,QAAQ;GACf,MAAM,IAAI,MAAM,IAAI,IAAI,GAAG;GAC3B,OAAO,IAAI,EAAE,IAAI;IAAE,GAAG;IAAG,yBAAQ,IAAI,KAAK,EAAA,CAAE,YAAY;IAAG,UAAU,EAAE,WAAW,IAAI;IAAU,OAAO,IAAI,aAAa;GAAS,CAAC;GAClI,IAAI,GAAG,GAAG,IAAI,GAAG,EAAE,IAAI,IAAI,IAAI,kBAAkB,SAAS,IAAI,aAAa,UAAU,GAAG,GAAG;EAC7F;EACA,aAAa,QAAQ;GACnB,IAAI,IAAI,YAAY,aAAa,IAAI,GAAG,GAAG,MAAM,GAAG,EAAE,IAAI,IAAI,IAAI,GAAG,IAAI,QAAQ,KAAK,UAAU;EAClG;CACF,CAAC;CACD,IAAI,aAAa,OAAO,OAAO,aAAa,OAAO,SAAS,IAAI,MAAM,GAAG,UAAU,OAAO,YAAY,iBAAiB;CAEvH,KAAK,MAAM,KAAK,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,GAAG,MAAM,EAAE,MAAM,EAAE,GAAG,GAAG;EACzD,MAAM,UAAU,EAAE,SAAS,SAAS,EAAE,QAAQ,QAAQ,MAAM,UAAU,SAAS,CAAC,CAAC,IAAI;EACrF,IAAI,CAAC,QAAQ,QAAQ;GACnB,IAAI,GAAG,GAAG,OAAO,GAAG,EAAE,IAAI,EAAE,IAAI,SAAS,EAAE,QAAQ,KAAK,OAAO,EAAE,uCAAuC,EAAE,QAAQ,GAAG,eAAe;GACpI,OAAO,IAAI,EAAE,IAAI,CAAC;GAClB;EACF;EACA,WAAW,KAAK,EAAE,SAAS,EAAE,QAAQ,CAAC;CACxC;CACA,MAAM,WAAW,KAAK;CAEtB,MAAM,WAAW,IAAI,IAAI,OAAO,KAAK,MAAM,EAAE,EAAE,CAAC;CAEhD,MAAM,UAAU,SAAS,IAAI;CAC7B,UAAU,MAAM,CAAC,GAAG,QAAQ,QAAQ,MAAM,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC,GAAG,GAAG,OAAO,OAAO,CAAC,CAAC;CACnF,IAAI,GAAG,OAAO,SAAS,OAAO,KAAK,aAAa,OAAO,KAAK,aAAa;CACzE,OAAO,OAAO;AAChB"}

package/dist/{cli-C9lES1ug.js → cli-yN8ExqrA.js}

@@ -74,7 +74,7 @@ Example:
 		const { openAdminChannel } = await import("./admin-DbJXEo2d.js");
 		const { TerminalPrompter } = await import("./prompt-BEH311I7.js");
 		const { connectAgentMcp } = await import("./agent-B8a-Ivyd.js");
-		const { SmokeRun } = await import("./run-C0fpnYAb.js");
+		const { SmokeRun } = await import("./run-D3Qmg-MB.js");
 		const { renderReport } = await import("./report-D2D_6E5O.js");
 		if (!o.scratch) throw new Error("smoke google-workspace runs live on the connected Google account: it reads existing files and mail, and writes only into a new scratch folder and ONE draft to the account itself, which it removes again. Pass --scratch to run it.");
 		const out = safeWriter(o.json ? process.stderr : process.stdout);
@@ -123,4 +123,4 @@ Example:
 //#endregion
 export { registerSmokeCommands };
 
-//# sourceMappingURL=cli-C9lES1ug.js.map
+//# sourceMappingURL=cli-yN8ExqrA.js.map

package/dist/{cli-C9lES1ug.js.map → cli-yN8ExqrA.js.map}

@@ -1 +1 @@
-{"version":3,"file":"cli-C9lES1ug.js","names":[],"sources":["../server/smoke/cli.ts"],"sourcesContent":["// `xaq smoke google-workspace --scratch`: run on xaq's machine, through the daemon's admin API over the local admin\n// channel (server/connections-cli/admin.ts) and /mcp as a temporary agent. See run.ts for what it does.\n\nimport type { Command } from \"commander\";\nimport { LEGACY_PRODUCT } from \"../brand.ts\";\nimport { resolveDataDir } from \"../config.ts\";\nimport { NPX } from \"../listen/version.ts\";\nimport type { SmokeFlags } from \"./run.ts\";\n\nconst GROUP = \"MCP connections (on xaq's machine):\";\n\n/**\n * A line printer that can't kill the run: once the stream fails (EIO or EPIPE from a terminal that went away, e.g.\n * after SIGHUP), later lines are dropped instead of throwing or crashing on an unhandled 'error'.\n */\nexport function safeWriter(stream: NodeJS.WritableStream): { print: (line?: string) => void; dispose: () => void } {\n  let dead = false;\n  const onError = () => {\n    dead = true;\n  };\n  stream.on(\"error\", onError);\n  return {\n    print(line = \"\") {\n      if (dead) return;\n      try {\n        stream.write(`${line}\\n`, (err) => {\n          if (err) dead = true;\n        });\n      } catch {\n        dead = true;\n      }\n    },\n    dispose: () => stream.removeListener(\"error\", onError),\n  };\n}\n\nexport interface SmokeSignalOptions {\n  print: (line: string) => void;\n  exit: (code: number) => void;\n  /** The second Ctrl-C: the quick part of cleanup (agent, attachmentDirs), bounded. */\n  fastCleanup: () => Promise<void>;\n  /** What may still be there, in a sentence. */\n  leftovers: () => string;\n  /** Upper bound on the second Ctrl-C's cleanup before quitting anyway (default 8 s). */\n  quitWithinMs?: number;\n}\n\n/**\n * Signals during a run. SIGTERM and SIGHUP (a closed terminal, a stopped service) always act like the first Ctrl-C:\n * no new step starts and the run's full cleanup runs. The first Ctrl-C does the same; a second one runs the quick\n * cleanup (delete the agent, restore attachmentDirs) with a short timeout, says what may be left and quits.\n * Returns the remover.\n */\nexport function installSmokeSignals(controller: AbortController, opts: SmokeSignalOptions): () => void {\n  let interrupts = 0;\n  let quitting = false;\n  const stop = (why: string) => {\n    if (controller.signal.aborted) return;\n    opts.print(`\\n${why}: stopping after the current call, then cleaning up.${why === \"Ctrl-C\" ? \" Press Ctrl-C again to quit sooner (only the agent and attachmentDirs are cleaned up then).\" : \"\"}`);\n    controller.abort();\n  };\n  const onInt = () => {\n    interrupts++;\n    if (interrupts === 1) return stop(\"Ctrl-C\");\n    if (quitting) return;\n    quitting = true;\n    opts.print(\"\\nQuitting: deleting the temporary agent and restoring attachmentDirs first…\");\n    const deadline = new Promise<void>((r) => setTimeout(r, opts.quitWithinMs ?? 8000).unref?.());\n    void Promise.race([opts.fastCleanup().catch(() => {}), deadline]).then(() => {\n      opts.print(`Quit before the cleanup finished. ${opts.leftovers()}`);\n      opts.exit(130);\n    });\n  };\n  const onTerm = () => stop(\"SIGTERM\");\n  const onHup = () => stop(\"SIGHUP\");\n  process.on(\"SIGINT\", onInt);\n  process.on(\"SIGTERM\", onTerm);\n  process.on(\"SIGHUP\", onHup);\n  return () => {\n    process.removeListener(\"SIGINT\", onInt);\n    process.removeListener(\"SIGTERM\", onTerm);\n    process.removeListener(\"SIGHUP\", onHup);\n  };\n}\n\nexport function registerSmokeCommands(program: Command): void {\n  const smoke = program\n    .command(\"smoke\")\n    .description(\"live end-to-end checks against the connected accounts, safe by construction\")\n    .summary(\"live end-to-end check of a connection\")\n    .helpGroup(GROUP);\n\n  smoke\n    .command(\"google-workspace\")\n    .description(\"check Gmail attachments and the google-workspace extension end to end on the real account: reads anything, writes only into a new scratch folder and ONE draft to itself, cleans up\")\n    .option(\"--scratch\", \"required: confirms the run may create its scratch folder, its draft and its temporary agent (all removed again)\")\n    .option(\"--account <email>\", \"the Gmail account (default: the only one, or the one the Workspace connection is signed in as)\")\n    .option(\"--connection <slug>\", \"the google-workspace connection (default: the only one)\")\n    .option(\"--json\", \"print the result table as JSON on stdout (progress goes to stderr)\")\n    .option(\"-y, --yes\", \"don't ask before running\")\n    .option(\"-d, --data <dir>\", `xaq's data directory (default ~/.xaq, or an existing ~/.${LEGACY_PRODUCT}; env XAQ_DATA)`)\n    .addHelpText(\n      \"after\",\n      `\nPrints the plan first and asks (or --yes). Exit code 0 only when every step passes and nothing is left behind.\n\nExample:\n  ${NPX} smoke google-workspace --scratch`,\n    )\n    .action(async (o: SmokeFlags & { data?: string }) => {\n      const { openAdminChannel } = await import(\"../connections-cli/admin.ts\");\n      const { TerminalPrompter } = await import(\"../connections-cli/prompt.ts\");\n      const { connectAgentMcp } = await import(\"./agent.ts\");\n      const { SmokeRun } = await import(\"./run.ts\");\n      const { renderReport } = await import(\"./report.ts\");\n      if (!o.scratch) {\n        throw new Error(\n          \"smoke google-workspace runs live on the connected Google account: it reads existing files and mail, and writes only into a new scratch folder and ONE draft to the account itself, which it removes again. Pass --scratch to run it.\",\n        );\n      }\n      const out = safeWriter(o.json ? process.stderr : process.stdout);\n      const err = o.json ? out : safeWriter(process.stderr);\n      const json = o.json ? safeWriter(process.stdout) : null;\n      const channel = openAdminChannel({ dataDir: resolveDataDir(o.data, { quiet: true }) });\n      const prompter = new TerminalPrompter(!!o.yes, { input: process.stdin, output: o.json ? process.stderr : process.stdout });\n      const controller = new AbortController();\n      const run = new SmokeRun(o, {\n        admin: channel,\n        connectMcp: (key) => connectAgentMcp(channel.baseUrl, key),\n        print: out.print,\n        confirm: (q) => prompter.confirm(q, false),\n        signal: controller.signal,\n      });\n      const remove = installSmokeSignals(controller, {\n        print: (l) => err.print(l),\n        fastCleanup: () => run.fastCleanup(3000),\n        exit: (code) => {\n          channel.close();\n          process.exit(code);\n        },\n        leftovers: () => {\n          const left = run.pendingLeftovers();\n          return left.length ? `These may be left: ${left.join(\"; \")}. The next run removes the agent and the attachmentDirs entry and lists the rest.` : \"Nothing was left.\";\n        },\n      });\n      try {\n        const report = await run.run();\n        if (json) json.print(JSON.stringify(report, null, 2));\n        else for (const l of [\"\", ...renderReport(report)]) out.print(l);\n        process.exitCode = report.ok ? 0 : report.interrupted ? 130 : 1;\n      } finally {\n        remove();\n        prompter.close();\n        channel.close();\n        out.dispose();\n        if (err !== out) err.dispose();\n        json?.dispose();\n      }\n    });\n}\n"],"mappings":";;;;;AASA,MAAM,QAAQ;;;;;AAMd,SAAgB,WAAW,QAAwF;CACjH,IAAI,OAAO;CACX,MAAM,gBAAgB;EACpB,OAAO;CACT;CACA,OAAO,GAAG,SAAS,OAAO;CAC1B,OAAO;EACL,MAAM,OAAO,IAAI;GACf,IAAI,MAAM;GACV,IAAI;IACF,OAAO,MAAM,GAAG,KAAK,MAAM,QAAQ;KACjC,IAAI,KAAK,OAAO;IAClB,CAAC;GACH,QAAQ;IACN,OAAO;GACT;EACF;EACA,eAAe,OAAO,eAAe,SAAS,OAAO;CACvD;AACF;;;;;;;AAmBA,SAAgB,oBAAoB,YAA6B,MAAsC;CACrG,IAAI,aAAa;CACjB,IAAI,WAAW;CACf,MAAM,QAAQ,QAAgB;EAC5B,IAAI,WAAW,OAAO,SAAS;EAC/B,KAAK,MAAM,KAAK,IAAI,sDAAsD,QAAQ,WAAW,gGAAgG,IAAI;EACjM,WAAW,MAAM;CACnB;CACA,MAAM,cAAc;EAClB;EACA,IAAI,eAAe,GAAG,OAAO,KAAK,QAAQ;EAC1C,IAAI,UAAU;EACd,WAAW;EACX,KAAK,MAAM,8EAA8E;EACzF,MAAM,WAAW,IAAI,SAAe,MAAM,WAAW,GAAG,KAAK,gBAAgB,GAAI,CAAC,CAAC,QAAQ,CAAC;EAC5F,QAAa,KAAK,CAAC,KAAK,YAAY,CAAC,CAAC,YAAY,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,WAAW;GAC3E,KAAK,MAAM,qCAAqC,KAAK,UAAU,GAAG;GAClE,KAAK,KAAK,GAAG;EACf,CAAC;CACH;CACA,MAAM,eAAe,KAAK,SAAS;CACnC,MAAM,cAAc,KAAK,QAAQ;CACjC,QAAQ,GAAG,UAAU,KAAK;CAC1B,QAAQ,GAAG,WAAW,MAAM;CAC5B,QAAQ,GAAG,UAAU,KAAK;CAC1B,aAAa;EACX,QAAQ,eAAe,UAAU,KAAK;EACtC,QAAQ,eAAe,WAAW,MAAM;EACxC,QAAQ,eAAe,UAAU,KAAK;CACxC;AACF;AAEA,SAAgB,sBAAsB,SAAwB;CAO5D,QALG,QAAQ,OAAO,CAAC,CAChB,YAAY,6EAA6E,CAAC,CAC1F,QAAQ,uCAAuC,CAAC,CAChD,UAAU,KAET,CAAC,CACF,QAAQ,kBAAkB,CAAC,CAC3B,YAAY,qLAAqL,CAAC,CAClM,OAAO,aAAa,iHAAiH,CAAC,CACtI,OAAO,qBAAqB,gGAAgG,CAAC,CAC7H,OAAO,uBAAuB,yDAAyD,CAAC,CACxF,OAAO,UAAU,oEAAoE,CAAC,CACtF,OAAO,aAAa,0BAA0B,CAAC,CAC/C,OAAO,oBAAoB,2DAA2D,eAAe,gBAAgB,CAAC,CACtH,YACC,SACA;;;;IAIF,IAAI,kCACJ,CAAC,CACA,OAAO,OAAO,MAAsC;EACnD,MAAM,EAAE,qBAAqB,MAAM,OAAO;EAC1C,MAAM,EAAE,qBAAqB,MAAM,OAAO;EAC1C,MAAM,EAAE,oBAAoB,MAAM,OAAO;EACzC,MAAM,EAAE,aAAa,MAAM,OAAO;EAClC,MAAM,EAAE,iBAAiB,MAAM,OAAO;EACtC,IAAI,CAAC,EAAE,SACL,MAAM,IAAI,MACR,sOACF;EAEF,MAAM,MAAM,WAAW,EAAE,OAAO,QAAQ,SAAS,QAAQ,MAAM;EAC/D,MAAM,MAAM,EAAE,OAAO,MAAM,WAAW,QAAQ,MAAM;EACpD,MAAM,OAAO,EAAE,OAAO,WAAW,QAAQ,MAAM,IAAI;EACnD,MAAM,UAAU,iBAAiB,EAAE,SAAS,eAAe,EAAE,MAAM,EAAE,OAAO,KAAK,CAAC,EAAE,CAAC;EACrF,MAAM,WAAW,IAAI,iBAAiB,CAAC,CAAC,EAAE,KAAK;GAAE,OAAO,QAAQ;GAAO,QAAQ,EAAE,OAAO,QAAQ,SAAS,QAAQ;EAAO,CAAC;EACzH,MAAM,aAAa,IAAI,gBAAgB;EACvC,MAAM,MAAM,IAAI,SAAS,GAAG;GAC1B,OAAO;GACP,aAAa,QAAQ,gBAAgB,QAAQ,SAAS,GAAG;GACzD,OAAO,IAAI;GACX,UAAU,MAAM,SAAS,QAAQ,GAAG,KAAK;GACzC,QAAQ,WAAW;EACrB,CAAC;EACD,MAAM,SAAS,oBAAoB,YAAY;GAC7C,QAAQ,MAAM,IAAI,MAAM,CAAC;GACzB,mBAAmB,IAAI,YAAY,GAAI;GACvC,OAAO,SAAS;IACd,QAAQ,MAAM;IACd,QAAQ,KAAK,IAAI;GACnB;GACA,iBAAiB;IACf,MAAM,OAAO,IAAI,iBAAiB;IAClC,OAAO,KAAK,SAAS,sBAAsB,KAAK,KAAK,IAAI,EAAE,qFAAqF;GAClJ;EACF,CAAC;EACD,IAAI;GACF,MAAM,SAAS,MAAM,IAAI,IAAI;GAC7B,IAAI,MAAM,KAAK,MAAM,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;QAC/C,KAAK,MAAM,KAAK,CAAC,IAAI,GAAG,aAAa,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC;GAC/D,QAAQ,WAAW,OAAO,KAAK,IAAI,OAAO,cAAc,MAAM;EAChE,UAAU;GACR,OAAO;GACP,SAAS,MAAM;GACf,QAAQ,MAAM;GACd,IAAI,QAAQ;GACZ,IAAI,QAAQ,KAAK,IAAI,QAAQ;GAC7B,MAAM,QAAQ;EAChB;CACF,CAAC;AACL"}
+{"version":3,"file":"cli-yN8ExqrA.js","names":[],"sources":["../server/smoke/cli.ts"],"sourcesContent":["// `xaq smoke google-workspace --scratch`: run on xaq's machine, through the daemon's admin API over the local admin\n// channel (server/connections-cli/admin.ts) and /mcp as a temporary agent. See run.ts for what it does.\n\nimport type { Command } from \"commander\";\nimport { LEGACY_PRODUCT } from \"../brand.ts\";\nimport { resolveDataDir } from \"../config.ts\";\nimport { NPX } from \"../listen/version.ts\";\nimport type { SmokeFlags } from \"./run.ts\";\n\nconst GROUP = \"MCP connections (on xaq's machine):\";\n\n/**\n * A line printer that can't kill the run: once the stream fails (EIO or EPIPE from a terminal that went away, e.g.\n * after SIGHUP), later lines are dropped instead of throwing or crashing on an unhandled 'error'.\n */\nexport function safeWriter(stream: NodeJS.WritableStream): { print: (line?: string) => void; dispose: () => void } {\n  let dead = false;\n  const onError = () => {\n    dead = true;\n  };\n  stream.on(\"error\", onError);\n  return {\n    print(line = \"\") {\n      if (dead) return;\n      try {\n        stream.write(`${line}\\n`, (err) => {\n          if (err) dead = true;\n        });\n      } catch {\n        dead = true;\n      }\n    },\n    dispose: () => stream.removeListener(\"error\", onError),\n  };\n}\n\nexport interface SmokeSignalOptions {\n  print: (line: string) => void;\n  exit: (code: number) => void;\n  /** The second Ctrl-C: the quick part of cleanup (agent, attachmentDirs), bounded. */\n  fastCleanup: () => Promise<void>;\n  /** What may still be there, in a sentence. */\n  leftovers: () => string;\n  /** Upper bound on the second Ctrl-C's cleanup before quitting anyway (default 8 s). */\n  quitWithinMs?: number;\n}\n\n/**\n * Signals during a run. SIGTERM and SIGHUP (a closed terminal, a stopped service) always act like the first Ctrl-C:\n * no new step starts and the run's full cleanup runs. The first Ctrl-C does the same; a second one runs the quick\n * cleanup (delete the agent, restore attachmentDirs) with a short timeout, says what may be left and quits.\n * Returns the remover.\n */\nexport function installSmokeSignals(controller: AbortController, opts: SmokeSignalOptions): () => void {\n  let interrupts = 0;\n  let quitting = false;\n  const stop = (why: string) => {\n    if (controller.signal.aborted) return;\n    opts.print(`\\n${why}: stopping after the current call, then cleaning up.${why === \"Ctrl-C\" ? \" Press Ctrl-C again to quit sooner (only the agent and attachmentDirs are cleaned up then).\" : \"\"}`);\n    controller.abort();\n  };\n  const onInt = () => {\n    interrupts++;\n    if (interrupts === 1) return stop(\"Ctrl-C\");\n    if (quitting) return;\n    quitting = true;\n    opts.print(\"\\nQuitting: deleting the temporary agent and restoring attachmentDirs first…\");\n    const deadline = new Promise<void>((r) => setTimeout(r, opts.quitWithinMs ?? 8000).unref?.());\n    void Promise.race([opts.fastCleanup().catch(() => {}), deadline]).then(() => {\n      opts.print(`Quit before the cleanup finished. ${opts.leftovers()}`);\n      opts.exit(130);\n    });\n  };\n  const onTerm = () => stop(\"SIGTERM\");\n  const onHup = () => stop(\"SIGHUP\");\n  process.on(\"SIGINT\", onInt);\n  process.on(\"SIGTERM\", onTerm);\n  process.on(\"SIGHUP\", onHup);\n  return () => {\n    process.removeListener(\"SIGINT\", onInt);\n    process.removeListener(\"SIGTERM\", onTerm);\n    process.removeListener(\"SIGHUP\", onHup);\n  };\n}\n\nexport function registerSmokeCommands(program: Command): void {\n  const smoke = program\n    .command(\"smoke\")\n    .description(\"live end-to-end checks against the connected accounts, safe by construction\")\n    .summary(\"live end-to-end check of a connection\")\n    .helpGroup(GROUP);\n\n  smoke\n    .command(\"google-workspace\")\n    .description(\"check Gmail attachments and the google-workspace extension end to end on the real account: reads anything, writes only into a new scratch folder and ONE draft to itself, cleans up\")\n    .option(\"--scratch\", \"required: confirms the run may create its scratch folder, its draft and its temporary agent (all removed again)\")\n    .option(\"--account <email>\", \"the Gmail account (default: the only one, or the one the Workspace connection is signed in as)\")\n    .option(\"--connection <slug>\", \"the google-workspace connection (default: the only one)\")\n    .option(\"--json\", \"print the result table as JSON on stdout (progress goes to stderr)\")\n    .option(\"-y, --yes\", \"don't ask before running\")\n    .option(\"-d, --data <dir>\", `xaq's data directory (default ~/.xaq, or an existing ~/.${LEGACY_PRODUCT}; env XAQ_DATA)`)\n    .addHelpText(\n      \"after\",\n      `\nPrints the plan first and asks (or --yes). Exit code 0 only when every step passes and nothing is left behind.\n\nExample:\n  ${NPX} smoke google-workspace --scratch`,\n    )\n    .action(async (o: SmokeFlags & { data?: string }) => {\n      const { openAdminChannel } = await import(\"../connections-cli/admin.ts\");\n      const { TerminalPrompter } = await import(\"../connections-cli/prompt.ts\");\n      const { connectAgentMcp } = await import(\"./agent.ts\");\n      const { SmokeRun } = await import(\"./run.ts\");\n      const { renderReport } = await import(\"./report.ts\");\n      if (!o.scratch) {\n        throw new Error(\n          \"smoke google-workspace runs live on the connected Google account: it reads existing files and mail, and writes only into a new scratch folder and ONE draft to the account itself, which it removes again. Pass --scratch to run it.\",\n        );\n      }\n      const out = safeWriter(o.json ? process.stderr : process.stdout);\n      const err = o.json ? out : safeWriter(process.stderr);\n      const json = o.json ? safeWriter(process.stdout) : null;\n      const channel = openAdminChannel({ dataDir: resolveDataDir(o.data, { quiet: true }) });\n      const prompter = new TerminalPrompter(!!o.yes, { input: process.stdin, output: o.json ? process.stderr : process.stdout });\n      const controller = new AbortController();\n      const run = new SmokeRun(o, {\n        admin: channel,\n        connectMcp: (key) => connectAgentMcp(channel.baseUrl, key),\n        print: out.print,\n        confirm: (q) => prompter.confirm(q, false),\n        signal: controller.signal,\n      });\n      const remove = installSmokeSignals(controller, {\n        print: (l) => err.print(l),\n        fastCleanup: () => run.fastCleanup(3000),\n        exit: (code) => {\n          channel.close();\n          process.exit(code);\n        },\n        leftovers: () => {\n          const left = run.pendingLeftovers();\n          return left.length ? `These may be left: ${left.join(\"; \")}. The next run removes the agent and the attachmentDirs entry and lists the rest.` : \"Nothing was left.\";\n        },\n      });\n      try {\n        const report = await run.run();\n        if (json) json.print(JSON.stringify(report, null, 2));\n        else for (const l of [\"\", ...renderReport(report)]) out.print(l);\n        process.exitCode = report.ok ? 0 : report.interrupted ? 130 : 1;\n      } finally {\n        remove();\n        prompter.close();\n        channel.close();\n        out.dispose();\n        if (err !== out) err.dispose();\n        json?.dispose();\n      }\n    });\n}\n"],"mappings":";;;;;AASA,MAAM,QAAQ;;;;;AAMd,SAAgB,WAAW,QAAwF;CACjH,IAAI,OAAO;CACX,MAAM,gBAAgB;EACpB,OAAO;CACT;CACA,OAAO,GAAG,SAAS,OAAO;CAC1B,OAAO;EACL,MAAM,OAAO,IAAI;GACf,IAAI,MAAM;GACV,IAAI;IACF,OAAO,MAAM,GAAG,KAAK,MAAM,QAAQ;KACjC,IAAI,KAAK,OAAO;IAClB,CAAC;GACH,QAAQ;IACN,OAAO;GACT;EACF;EACA,eAAe,OAAO,eAAe,SAAS,OAAO;CACvD;AACF;;;;;;;AAmBA,SAAgB,oBAAoB,YAA6B,MAAsC;CACrG,IAAI,aAAa;CACjB,IAAI,WAAW;CACf,MAAM,QAAQ,QAAgB;EAC5B,IAAI,WAAW,OAAO,SAAS;EAC/B,KAAK,MAAM,KAAK,IAAI,sDAAsD,QAAQ,WAAW,gGAAgG,IAAI;EACjM,WAAW,MAAM;CACnB;CACA,MAAM,cAAc;EAClB;EACA,IAAI,eAAe,GAAG,OAAO,KAAK,QAAQ;EAC1C,IAAI,UAAU;EACd,WAAW;EACX,KAAK,MAAM,8EAA8E;EACzF,MAAM,WAAW,IAAI,SAAe,MAAM,WAAW,GAAG,KAAK,gBAAgB,GAAI,CAAC,CAAC,QAAQ,CAAC;EAC5F,QAAa,KAAK,CAAC,KAAK,YAAY,CAAC,CAAC,YAAY,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,WAAW;GAC3E,KAAK,MAAM,qCAAqC,KAAK,UAAU,GAAG;GAClE,KAAK,KAAK,GAAG;EACf,CAAC;CACH;CACA,MAAM,eAAe,KAAK,SAAS;CACnC,MAAM,cAAc,KAAK,QAAQ;CACjC,QAAQ,GAAG,UAAU,KAAK;CAC1B,QAAQ,GAAG,WAAW,MAAM;CAC5B,QAAQ,GAAG,UAAU,KAAK;CAC1B,aAAa;EACX,QAAQ,eAAe,UAAU,KAAK;EACtC,QAAQ,eAAe,WAAW,MAAM;EACxC,QAAQ,eAAe,UAAU,KAAK;CACxC;AACF;AAEA,SAAgB,sBAAsB,SAAwB;CAO5D,QALG,QAAQ,OAAO,CAAC,CAChB,YAAY,6EAA6E,CAAC,CAC1F,QAAQ,uCAAuC,CAAC,CAChD,UAAU,KAET,CAAC,CACF,QAAQ,kBAAkB,CAAC,CAC3B,YAAY,qLAAqL,CAAC,CAClM,OAAO,aAAa,iHAAiH,CAAC,CACtI,OAAO,qBAAqB,gGAAgG,CAAC,CAC7H,OAAO,uBAAuB,yDAAyD,CAAC,CACxF,OAAO,UAAU,oEAAoE,CAAC,CACtF,OAAO,aAAa,0BAA0B,CAAC,CAC/C,OAAO,oBAAoB,2DAA2D,eAAe,gBAAgB,CAAC,CACtH,YACC,SACA;;;;IAIF,IAAI,kCACJ,CAAC,CACA,OAAO,OAAO,MAAsC;EACnD,MAAM,EAAE,qBAAqB,MAAM,OAAO;EAC1C,MAAM,EAAE,qBAAqB,MAAM,OAAO;EAC1C,MAAM,EAAE,oBAAoB,MAAM,OAAO;EACzC,MAAM,EAAE,aAAa,MAAM,OAAO;EAClC,MAAM,EAAE,iBAAiB,MAAM,OAAO;EACtC,IAAI,CAAC,EAAE,SACL,MAAM,IAAI,MACR,sOACF;EAEF,MAAM,MAAM,WAAW,EAAE,OAAO,QAAQ,SAAS,QAAQ,MAAM;EAC/D,MAAM,MAAM,EAAE,OAAO,MAAM,WAAW,QAAQ,MAAM;EACpD,MAAM,OAAO,EAAE,OAAO,WAAW,QAAQ,MAAM,IAAI;EACnD,MAAM,UAAU,iBAAiB,EAAE,SAAS,eAAe,EAAE,MAAM,EAAE,OAAO,KAAK,CAAC,EAAE,CAAC;EACrF,MAAM,WAAW,IAAI,iBAAiB,CAAC,CAAC,EAAE,KAAK;GAAE,OAAO,QAAQ;GAAO,QAAQ,EAAE,OAAO,QAAQ,SAAS,QAAQ;EAAO,CAAC;EACzH,MAAM,aAAa,IAAI,gBAAgB;EACvC,MAAM,MAAM,IAAI,SAAS,GAAG;GAC1B,OAAO;GACP,aAAa,QAAQ,gBAAgB,QAAQ,SAAS,GAAG;GACzD,OAAO,IAAI;GACX,UAAU,MAAM,SAAS,QAAQ,GAAG,KAAK;GACzC,QAAQ,WAAW;EACrB,CAAC;EACD,MAAM,SAAS,oBAAoB,YAAY;GAC7C,QAAQ,MAAM,IAAI,MAAM,CAAC;GACzB,mBAAmB,IAAI,YAAY,GAAI;GACvC,OAAO,SAAS;IACd,QAAQ,MAAM;IACd,QAAQ,KAAK,IAAI;GACnB;GACA,iBAAiB;IACf,MAAM,OAAO,IAAI,iBAAiB;IAClC,OAAO,KAAK,SAAS,sBAAsB,KAAK,KAAK,IAAI,EAAE,qFAAqF;GAClJ;EACF,CAAC;EACD,IAAI;GACF,MAAM,SAAS,MAAM,IAAI,IAAI;GAC7B,IAAI,MAAM,KAAK,MAAM,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;QAC/C,KAAK,MAAM,KAAK,CAAC,IAAI,GAAG,aAAa,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC;GAC/D,QAAQ,WAAW,OAAO,KAAK,IAAI,OAAO,cAAc,MAAM;EAChE,UAAU;GACR,OAAO;GACP,SAAS,MAAM;GACf,QAAQ,MAAM;GACd,IAAI,QAAQ;GACZ,IAAI,QAAQ,KAAK,IAAI,QAAQ;GAC7B,MAAM,QAAQ;EAChB;CACF,CAAC;AACL"}

package/dist/cli.js

@@ -59,7 +59,7 @@ const SERVER_GROUP = "Run xaq:";
 const AGENT_GROUP = "On an agent's machine:";
 withServerOptions(program.command("start", { isDefault: true }).description("run xaq in this terminal and print the setup link (the default command)").summary("run it in this terminal (the default command)").helpGroup(SERVER_GROUP)).option("--no-open", "don't open a browser on first run").option("--dev", "development: API only, the console runs on Vite (:5173)").allowExcessArguments().action(async (o, cmd) => {
 	if (cmd.args.length) throw new Error(unknownCommand(cmd.args[0]));
-	const { runForeground } = await import("./server-DTxOHzZJ.js");
+	const { runForeground } = await import("./server-BmxoM9--.js");
 	await runForeground({
 		...configInput(o),
 		dev: !!o.dev,
@@ -70,16 +70,16 @@ withServerOptions(program.command("start", { isDefault: true }).description("run
 const service = program.command("service").description("run xaq in the background as a systemd / launchd service, started at boot").summary("run it in the background (systemd / launchd)").helpGroup(SERVER_GROUP);
 withServerOptions(service.command("install").description("install and start the service; re-run it to change the port or update (replaces an agentinbox service, keeping its data)")).option("--node <path>", "the Node.js binary the service runs (default: this one if new enough, else the previous service's, else the newest found)").action(async (o) => {
 	const { loadConfig } = await import("./config-CAqDP8xi.js");
-	const { installService, serviceInstallInput, systemOps } = await import("./service-C2nRdQnH.js");
+	const { installService, serviceInstallInput, systemOps } = await import("./service-Cp8j8469.js");
 	await installService(loadConfig(serviceInstallInput(configInput(o), systemOps()), version), void 0, { node: o.node });
 });
 service.command("uninstall").description("stop and remove the service (keeps your data)").option("-d, --data <dir>", "data directory, if the installed service doesn't say (default ~/.xaq, or an existing ~/.agentinbox; env XAQ_DATA)").action(async (o) => {
-	const { uninstallService } = await import("./service-C2nRdQnH.js");
+	const { uninstallService } = await import("./service-Cp8j8469.js");
 	const { resolveDataDir } = await import("./config-CAqDP8xi.js");
 	uninstallService({ dataDir: resolveDataDir(o.data, { quiet: true }) });
 });
 service.command("status").description("show service status, and check the Node.js it runs (code extensions need a recent one)").action(async () => {
-	const { serviceStatus } = await import("./service-C2nRdQnH.js");
+	const { serviceStatus } = await import("./service-Cp8j8469.js");
 	serviceStatus();
 });
 const skill = program.command("skill").description("the xaq agent skill (SKILL.md): teaches an agent how to use xaq's tools").summary("install the agent skill (SKILL.md)").helpGroup(AGENT_GROUP);
@@ -106,7 +106,7 @@ program.command("reset-password").description("forgot the console password? Remo
 	const { loadConfig } = await import("./config-CAqDP8xi.js");
 	const { Db } = await import("./db-Br2FHvQ-.js");
 	const { createBus } = await import("./bus-OKIGut72.js");
-	const { SettingsStore } = await import("./settings-DlwSOO5Y.js");
+	const { SettingsStore } = await import("./settings-fUNWD1cQ.js");
 	const { AuditLog } = await import("./audit-hQnqfGxA.js");
 	const { currentSetupToken, isClaimed, resetAdminPassword } = await import("./auth-CcvstbI5.js");
 	const { runningInstance } = await import("./instance-BsILpEQ7.js");
@@ -138,13 +138,13 @@ program.command("reset-password").description("forgot the console password? Remo
 		db.close();
 	}
 });
-const { registerListenCommands } = await import("./commands-Bo6-7SBs.js");
+const { registerListenCommands } = await import("./commands-DAd3ICss.js");
 registerListenCommands(program);
-const { registerConnectionsCommands } = await import("./commands-BKr8Ejx0.js");
+const { registerConnectionsCommands } = await import("./commands-CgmkYCYG.js");
 registerConnectionsCommands(program);
 const { registerExtensionCommands } = await import("./cli-B8cuKWiS.js");
 registerExtensionCommands(program);
-const { registerSmokeCommands } = await import("./cli-C9lES1ug.js");
+const { registerSmokeCommands } = await import("./cli-yN8ExqrA.js");
 registerSmokeCommands(program);
 const { registerSettingsCommands } = await import("./settings-cli-DfWc-yWJ.js");
 registerSettingsCommands(program);

package/dist/{commands-BKr8Ejx0.js → commands-CgmkYCYG.js}

@@ -87,7 +87,7 @@ with the single xaq entry, after a timestamped backup. The entry keeps the name
 Examples:
   ${NPX} import --from hermes --dry-run
   ${NPX} import --from hermes`).action(async (o) => {
-		const { runImport } = await import("./import-cL9vj0jq.js");
+		const { runImport } = await import("./import-y1bjWoGq.js");
 		const self = await selfOrigins(dataDirOf(o));
 		if (o.dryRun) {
 			const { TerminalPrompter } = await import("./prompt-BEH311I7.js");
@@ -115,4 +115,4 @@ Examples:
 //#endregion
 export { registerConnectionsCommands };
 
-//# sourceMappingURL=commands-BKr8Ejx0.js.map
+//# sourceMappingURL=commands-CgmkYCYG.js.map

package/dist/{commands-BKr8Ejx0.js.map → commands-CgmkYCYG.js.map}

@@ -1 +1 @@
-{"version":3,"file":"commands-BKr8Ejx0.js","names":[],"sources":["../server/connections-cli/commands.ts"],"sourcesContent":["import type { Command } from \"commander\";\nimport { NPX } from \"../listen/version.ts\";\nimport { LEGACY_PRODUCT } from \"../brand.ts\";\nimport { resolveDataDir } from \"../config.ts\";\n\n/**\n * `connections …` and `import --from …`: run on the daemon's machine, talking to its admin API through the\n * one-time local admin session (admin.ts). Listed in --help since the console (#65) shipped; while the daemon's\n * `brokerUpstreams` setting is off they say so (CONNECTIONS_VISIBLE).\n */\nexport const CONNECTIONS_VISIBLE = true;\nconst GROUP = \"MCP connections (on xaq's machine):\";\n\nconst collect = (value: string, previous: string[] | undefined) => [...(previous ?? []), value];\n// --data, else XAQ_DATA (AGENTINBOX_DATA), else ~/.xaq or an existing pre-rename ~/.agentinbox (config.ts; rename-xaq: keep).\nconst dataDirOf = (o: { data?: string }) => resolveDataDir(o.data, { quiet: true });\nconst dataOption = (cmd: Command) => cmd.option(\"-d, --data <dir>\", `xaq's data directory (default ~/.xaq, or an existing ~/.${LEGACY_PRODUCT}; env XAQ_DATA)`);\n\nasync function withApi<T>(o: { data?: string; yes?: boolean }, run: (deps: { api: import(\"./api.ts\").ConnectionsApi; prompter: import(\"./prompt.ts\").Prompter }) => Promise<T>): Promise<T> {\n  const { CLEANUP_SIGNALS, openAdminChannel } = await import(\"./admin.ts\");\n  const { ConnectionsApi } = await import(\"./api.ts\");\n  const { TerminalPrompter } = await import(\"./prompt.ts\");\n  const channel = openAdminChannel({ dataDir: dataDirOf(o) });\n  const handlers = CLEANUP_SIGNALS.map((sig) => {\n    const h = () => {\n      channel.close();\n      process.exit(sig === \"SIGINT\" ? 130 : 128 + (sig === \"SIGTERM\" ? 15 : 1));\n    };\n    process.once(sig, h);\n    return [sig, h] as const;\n  });\n  try {\n    return await run({ api: new ConnectionsApi(channel), prompter: new TerminalPrompter(!!o.yes) });\n  } finally {\n    for (const [sig, h] of handlers) process.removeListener(sig, h);\n    channel.close();\n  }\n}\n\n/** This xaq's own MCP origins, so `import` never imports its own entry. */\nasync function selfOrigins(dataDir: string): Promise<string[]> {\n  const { runningInstance } = await import(\"../instance.ts\");\n  const { daemonOrigin } = await import(\"./admin.ts\");\n  const running = runningInstance(dataDir);\n  if (!running) return [];\n  return [daemonOrigin(running), `http://localhost:${running.port}`, `http://127.0.0.1:${running.port}`, `http://[::1]:${running.port}`];\n}\n\nexport function registerConnectionsCommands(program: Command): void {\n  const connections = program\n    .command(\"connections\", { hidden: !CONNECTIONS_VISIBLE })\n    .description(\"the MCP servers xaq connects agents to (Notion, T3 Code, any MCP URL, installed extensions); run on xaq's machine\")\n    .summary(\"add, list, reconnect or remove connected MCP servers\")\n    .helpGroup(GROUP);\n\n  dataOption(\n    connections\n      .command(\"add\")\n      .description(\"connect an installed extension (install it first: `ext add notion`) or any MCP server URL, interactively\")\n      .argument(\"<integration-or-url>\", \"an installed extension (`ext add notion|t3code|whoop|brightspace` first), or an MCP server URL such as https://mcp.example.com/mcp\"),\n  )\n    .option(\"--url <address>\", \"t3code: your T3 Code server's address, e.g. http://100.101.102.103:3773 (asked when omitted)\")\n    .option(\"--slug <name>\", \"its short name: agents see its tools as <name>__<tool>\")\n    .option(\"--name <name>\", \"its display name (unique; default: the server's host, or the integration's name)\")\n    .option(\"--access <level>\", \"full, ask (ask before risky actions; the default) or read\")\n    .option(\"--agent <name>\", 'an agent that gets it (repeatable; default: all agents; \"all\")', collect)\n    .option(\"--header <name>\", \"header for a server that wants a static key (default Authorization)\")\n    .option(\"--account <email>\", \"a Google extension (google-workspace): the connected Google account it works as (asked when omitted)\")\n    .option(\"--paste\", \"paste the address the browser lands on after signing in, instead of waiting for the redirect (automatic over SSH)\")\n    .option(\"--allow-private <origin>\", \"allow this exact scheme://host:port on this machine or a private network without asking (--yes never does)\")\n    .option(\"-y, --yes\", \"answer yes to confirmations and take the defaults (never to a private-network allow)\")\n    .addHelpText(\n      \"after\",\n      `\nExamples:\n  ${NPX} connections add notion\n  ${NPX} connections add google-workspace --account you@example.com   # turn on its Google APIs, then allow access\n  ${NPX} connections add t3code --url http://100.101.102.103:3773   # one per T3 server; have a T3 pairing code ready\n  ${NPX} connections add https://mcp.example.com/mcp --access read\n  ${NPX} connections add http://127.0.0.1:8787/mcp      # asks before allowing a server on this machine`,\n    )\n    .action(async (target: string, o: import(\"./manage.ts\").AddFlags & { data?: string }) => {\n      const { addConnection } = await import(\"./manage.ts\");\n      process.exitCode = await withApi(o, (deps) => addConnection(target, o, deps));\n    });\n\n  dataOption(connections.command(\"list\").description(\"list connections with their status and access\")).action(async (o: { data?: string }) => {\n    const { listConnections } = await import(\"./manage.ts\");\n    process.exitCode = await withApi(o, (deps) => listConnections(deps));\n  });\n\n  dataOption(connections.command(\"reconnect\").description(\"sign in again (OAuth) or replace the key (header)\").argument(\"<name>\", \"the connection's name\"))\n    .option(\"--paste\", \"paste the address the browser lands on (automatic over SSH)\")\n    .option(\"--header <name>\", \"header connections: the header's name (default: asks, Authorization)\")\n    .action(async (slug: string, o: { data?: string; paste?: boolean; header?: string }) => {\n      const { reconnectConnection } = await import(\"./manage.ts\");\n      process.exitCode = await withApi(o, (deps) => reconnectConnection(slug, o, deps));\n    });\n\n  dataOption(connections.command(\"disable\").description(\"turn a connection off at once (the kill switch); turn it back on in the console\").argument(\"<name>\", \"the connection's name\"))\n    .option(\"-y, --yes\", \"don't ask\")\n    .action(async (slug: string, o: { data?: string; yes?: boolean }) => {\n      const { disableConnection } = await import(\"./manage.ts\");\n      process.exitCode = await withApi(o, (deps) => disableConnection(slug, deps));\n    });\n\n  dataOption(\n    connections\n      .command(\"rename\")\n      .description(\"change a connection's short name (agents see its tools as <name>__<tool>) or its display name\")\n      .argument(\"<name>\", \"the connection's current short name (or its id)\"),\n  )\n    .option(\"--slug <new>\", \"the new short name: 1-24 lowercase letters, digits and dashes (calls by the old tool names stop working)\")\n    .option(\"--name <display-name>\", \"a new display name\")\n    .option(\"-y, --yes\", \"don't ask\")\n    .action(async (target: string, o: { data?: string; yes?: boolean; slug?: string; name?: string }) => {\n      const { renameConnection } = await import(\"./manage.ts\");\n      process.exitCode = await withApi(o, (deps) => renameConnection(target, o, deps));\n    });\n\n  dataOption(connections.command(\"remove\").description(\"remove a connection and delete its credentials\").argument(\"<name>\", \"the connection's name\"))\n    .option(\"-y, --yes\", \"don't ask\")\n    .action(async (slug: string, o: { data?: string; yes?: boolean }) => {\n      const { removeConnection } = await import(\"./manage.ts\");\n      process.exitCode = await withApi(o, (deps) => removeConnection(slug, deps));\n    });\n\n  dataOption(\n    program\n      .command(\"import\", { hidden: !CONNECTIONS_VISIBLE })\n      .description(\"move an agent tool's MCP servers into xaq: one connection each, credentials moved into xaq\")\n      .summary(\"import MCP servers from Hermes, Claude Code, Cursor or Codex\")\n      .helpGroup(GROUP)\n      .requiredOption(\"--from <client>\", \"hermes, claude-code, cursor or codex\"),\n  )\n    .option(\"--dry-run\", \"print exactly what would be created and changed, and change nothing\")\n    .option(\"--access <level>\", \"for every imported connection: full, ask (the default) or read\")\n    .option(\"--agent <name>\", 'an agent that gets them (repeatable; default: all agents; \"all\")', collect)\n    .option(\"--profile <name>\", \"the agent profile setup-mcp uses for the single xaq entry (default \\\"default\\\")\")\n    .option(\"--allow-private <origin>\", \"allow this exact scheme://host:port on this machine or a private network without asking (repeatable; --yes never does)\", collect)\n    .option(\"-y, --yes\", \"answer yes to the confirmations (scripts); never to a private-network allow or a project's .mcp.json servers\")\n    .addHelpText(\n      \"after\",\n      `\nReads: hermes ~/.hermes/config.yaml mcp_servers (+ ~/.hermes/.env) · claude-code ~/.claude.json and ./.mcp.json ·\ncursor ~/.cursor/mcp.json · codex ~/.codex/config.toml. Static headers move into xaq (encrypted); OAuth\nservers are created needing Connect (their tokens stay in the client); local (stdio) servers aren't supported yet\nand stay where they are. Servers on this machine or a private network are created only after you confirm the exact\nhost:port. Then it offers setup-mcp --tool <client>, which replaces the entries that now work through xaq\nwith the single xaq entry, after a timestamped backup. The entry keeps the name the profile already uses (\"xaq\", or\n\"${LEGACY_PRODUCT}\" for a profile set up before the rename), so Hermes routes and cron jobs confined to it keep working.\n\nExamples:\n  ${NPX} import --from hermes --dry-run\n  ${NPX} import --from hermes`,\n    )\n    .action(async (o: import(\"./import.ts\").ImportFlags & { data?: string }) => {\n      const { runImport } = await import(\"./import.ts\");\n      const self = await selfOrigins(dataDirOf(o));\n      if (o.dryRun) {\n        // Read-only: the admin channel (when the daemon runs) only lists existing connections.\n        const { TerminalPrompter } = await import(\"./prompt.ts\");\n        const { openAdminChannel } = await import(\"./admin.ts\");\n        const { ConnectionsApi } = await import(\"./api.ts\");\n        let channel: import(\"./admin.ts\").AdminChannel | null = null;\n        try {\n          process.exitCode = await runImport(o, {\n            prompter: new TerminalPrompter(!!o.yes),\n            openApi: () => new ConnectionsApi((channel = openAdminChannel({ dataDir: dataDirOf(o) }))),\n            selfOrigins: self,\n          });\n        } finally {\n          (channel as import(\"./admin.ts\").AdminChannel | null)?.close();\n        }\n        return;\n      }\n      process.exitCode = await withApi(o, (deps) => runImport(o, { prompter: deps.prompter, openApi: () => deps.api, selfOrigins: self }));\n    });\n}\n"],"mappings":";;;;;AAWA,MAAM,QAAQ;AAEd,MAAM,WAAW,OAAe,aAAmC,CAAC,GAAI,YAAY,CAAC,GAAI,KAAK;AAE9F,MAAM,aAAa,MAAyB,eAAe,EAAE,MAAM,EAAE,OAAO,KAAK,CAAC;AAClF,MAAM,cAAc,QAAiB,IAAI,OAAO,oBAAoB,2DAA2D,eAAe,gBAAgB;AAE9J,eAAe,QAAW,GAAqC,KAA6H;CAC1L,MAAM,EAAE,iBAAiB,qBAAqB,MAAM,OAAO;CAC3D,MAAM,EAAE,mBAAmB,MAAM,OAAO;CACxC,MAAM,EAAE,qBAAqB,MAAM,OAAO;CAC1C,MAAM,UAAU,iBAAiB,EAAE,SAAS,UAAU,CAAC,EAAE,CAAC;CAC1D,MAAM,WAAW,gBAAgB,KAAK,QAAQ;EAC5C,MAAM,UAAU;GACd,QAAQ,MAAM;GACd,QAAQ,KAAK,QAAQ,WAAW,MAAM,OAAO,QAAQ,YAAY,KAAK,EAAE;EAC1E;EACA,QAAQ,KAAK,KAAK,CAAC;EACnB,OAAO,CAAC,KAAK,CAAC;CAChB,CAAC;CACD,IAAI;EACF,OAAO,MAAM,IAAI;GAAE,KAAK,IAAI,eAAe,OAAO;GAAG,UAAU,IAAI,iBAAiB,CAAC,CAAC,EAAE,GAAG;EAAE,CAAC;CAChG,UAAU;EACR,KAAK,MAAM,CAAC,KAAK,MAAM,UAAU,QAAQ,eAAe,KAAK,CAAC;EAC9D,QAAQ,MAAM;CAChB;AACF;;AAGA,eAAe,YAAY,SAAoC;CAC7D,MAAM,EAAE,oBAAoB,MAAM,OAAO;CACzC,MAAM,EAAE,iBAAiB,MAAM,OAAO;CACtC,MAAM,UAAU,gBAAgB,OAAO;CACvC,IAAI,CAAC,SAAS,OAAO,CAAC;CACtB,OAAO;EAAC,aAAa,OAAO;EAAG,oBAAoB,QAAQ;EAAQ,oBAAoB,QAAQ;EAAQ,gBAAgB,QAAQ;CAAM;AACvI;AAEA,SAAgB,4BAA4B,SAAwB;CAClE,MAAM,cAAc,QACjB,QAAQ,eAAe,EAAE,QAAQ,MAAqB,CAAC,CAAC,CACxD,YAAY,mHAAmH,CAAC,CAChI,QAAQ,sDAAsD,CAAC,CAC/D,UAAU,KAAK;CAElB,WACE,YACG,QAAQ,KAAK,CAAC,CACd,YAAY,0GAA0G,CAAC,CACvH,SAAS,wBAAwB,oIAAoI,CAC1K,CAAC,CACE,OAAO,mBAAmB,8FAA8F,CAAC,CACzH,OAAO,iBAAiB,wDAAwD,CAAC,CACjF,OAAO,iBAAiB,kFAAkF,CAAC,CAC3G,OAAO,oBAAoB,2DAA2D,CAAC,CACvF,OAAO,kBAAkB,oEAAkE,OAAO,CAAC,CACnG,OAAO,mBAAmB,qEAAqE,CAAC,CAChG,OAAO,qBAAqB,sGAAsG,CAAC,CACnI,OAAO,WAAW,mHAAmH,CAAC,CACtI,OAAO,4BAA4B,4GAA4G,CAAC,CAChJ,OAAO,aAAa,sFAAsF,CAAC,CAC3G,YACC,SACA;;IAEF,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI,gGACJ,CAAC,CACA,OAAO,OAAO,QAAgB,MAA0D;EACvF,MAAM,EAAE,kBAAkB,MAAM,OAAO;EACvC,QAAQ,WAAW,MAAM,QAAQ,IAAI,SAAS,cAAc,QAAQ,GAAG,IAAI,CAAC;CAC9E,CAAC;CAEH,WAAW,YAAY,QAAQ,MAAM,CAAC,CAAC,YAAY,+CAA+C,CAAC,CAAC,CAAC,OAAO,OAAO,MAAyB;EAC1I,MAAM,EAAE,oBAAoB,MAAM,OAAO;EACzC,QAAQ,WAAW,MAAM,QAAQ,IAAI,SAAS,gBAAgB,IAAI,CAAC;CACrE,CAAC;CAED,WAAW,YAAY,QAAQ,WAAW,CAAC,CAAC,YAAY,mDAAmD,CAAC,CAAC,SAAS,UAAU,uBAAuB,CAAC,CAAC,CACtJ,OAAO,WAAW,6DAA6D,CAAC,CAChF,OAAO,mBAAmB,sEAAsE,CAAC,CACjG,OAAO,OAAO,MAAc,MAA2D;EACtF,MAAM,EAAE,wBAAwB,MAAM,OAAO;EAC7C,QAAQ,WAAW,MAAM,QAAQ,IAAI,SAAS,oBAAoB,MAAM,GAAG,IAAI,CAAC;CAClF,CAAC;CAEH,WAAW,YAAY,QAAQ,SAAS,CAAC,CAAC,YAAY,iFAAiF,CAAC,CAAC,SAAS,UAAU,uBAAuB,CAAC,CAAC,CAClL,OAAO,aAAa,WAAW,CAAC,CAChC,OAAO,OAAO,MAAc,MAAwC;EACnE,MAAM,EAAE,sBAAsB,MAAM,OAAO;EAC3C,QAAQ,WAAW,MAAM,QAAQ,IAAI,SAAS,kBAAkB,MAAM,IAAI,CAAC;CAC7E,CAAC;CAEH,WACE,YACG,QAAQ,QAAQ,CAAC,CACjB,YAAY,+FAA+F,CAAC,CAC5G,SAAS,UAAU,iDAAiD,CACzE,CAAC,CACE,OAAO,gBAAgB,0GAA0G,CAAC,CAClI,OAAO,yBAAyB,oBAAoB,CAAC,CACrD,OAAO,aAAa,WAAW,CAAC,CAChC,OAAO,OAAO,QAAgB,MAAsE;EACnG,MAAM,EAAE,qBAAqB,MAAM,OAAO;EAC1C,QAAQ,WAAW,MAAM,QAAQ,IAAI,SAAS,iBAAiB,QAAQ,GAAG,IAAI,CAAC;CACjF,CAAC;CAEH,WAAW,YAAY,QAAQ,QAAQ,CAAC,CAAC,YAAY,gDAAgD,CAAC,CAAC,SAAS,UAAU,uBAAuB,CAAC,CAAC,CAChJ,OAAO,aAAa,WAAW,CAAC,CAChC,OAAO,OAAO,MAAc,MAAwC;EACnE,MAAM,EAAE,qBAAqB,MAAM,OAAO;EAC1C,QAAQ,WAAW,MAAM,QAAQ,IAAI,SAAS,iBAAiB,MAAM,IAAI,CAAC;CAC5E,CAAC;CAEH,WACE,QACG,QAAQ,UAAU,EAAE,QAAQ,MAAqB,CAAC,CAAC,CACnD,YAAY,4FAA4F,CAAC,CACzG,QAAQ,8DAA8D,CAAC,CACvE,UAAU,KAAK,CAAC,CAChB,eAAe,mBAAmB,sCAAsC,CAC7E,CAAC,CACE,OAAO,aAAa,qEAAqE,CAAC,CAC1F,OAAO,oBAAoB,gEAAgE,CAAC,CAC5F,OAAO,kBAAkB,sEAAoE,OAAO,CAAC,CACrG,OAAO,oBAAoB,iFAAiF,CAAC,CAC7G,OAAO,4BAA4B,0HAA0H,OAAO,CAAC,CACrK,OAAO,aAAa,8GAA8G,CAAC,CACnI,YACC,SACA;;;;;;;GAOH,eAAe;;;IAGd,IAAI;IACJ,IAAI,sBACJ,CAAC,CACA,OAAO,OAAO,MAA6D;EAC1E,MAAM,EAAE,cAAc,MAAM,OAAO;EACnC,MAAM,OAAO,MAAM,YAAY,UAAU,CAAC,CAAC;EAC3C,IAAI,EAAE,QAAQ;GAEZ,MAAM,EAAE,qBAAqB,MAAM,OAAO;GAC1C,MAAM,EAAE,qBAAqB,MAAM,OAAO;GAC1C,MAAM,EAAE,mBAAmB,MAAM,OAAO;GACxC,IAAI,UAAoD;GACxD,IAAI;IACF,QAAQ,WAAW,MAAM,UAAU,GAAG;KACpC,UAAU,IAAI,iBAAiB,CAAC,CAAC,EAAE,GAAG;KACtC,eAAe,IAAI,eAAgB,UAAU,iBAAiB,EAAE,SAAS,UAAU,CAAC,EAAE,CAAC,CAAE;KACzF,aAAa;IACf,CAAC;GACH,UAAU;IACR,SAAuD,MAAM;GAC/D;GACA;EACF;EACA,QAAQ,WAAW,MAAM,QAAQ,IAAI,SAAS,UAAU,GAAG;GAAE,UAAU,KAAK;GAAU,eAAe,KAAK;GAAK,aAAa;EAAK,CAAC,CAAC;CACrI,CAAC;AACL"}
+{"version":3,"file":"commands-CgmkYCYG.js","names":[],"sources":["../server/connections-cli/commands.ts"],"sourcesContent":["import type { Command } from \"commander\";\nimport { NPX } from \"../listen/version.ts\";\nimport { LEGACY_PRODUCT } from \"../brand.ts\";\nimport { resolveDataDir } from \"../config.ts\";\n\n/**\n * `connections …` and `import --from …`: run on the daemon's machine, talking to its admin API through the\n * one-time local admin session (admin.ts). Listed in --help since the console (#65) shipped; while the daemon's\n * `brokerUpstreams` setting is off they say so (CONNECTIONS_VISIBLE).\n */\nexport const CONNECTIONS_VISIBLE = true;\nconst GROUP = \"MCP connections (on xaq's machine):\";\n\nconst collect = (value: string, previous: string[] | undefined) => [...(previous ?? []), value];\n// --data, else XAQ_DATA (AGENTINBOX_DATA), else ~/.xaq or an existing pre-rename ~/.agentinbox (config.ts; rename-xaq: keep).\nconst dataDirOf = (o: { data?: string }) => resolveDataDir(o.data, { quiet: true });\nconst dataOption = (cmd: Command) => cmd.option(\"-d, --data <dir>\", `xaq's data directory (default ~/.xaq, or an existing ~/.${LEGACY_PRODUCT}; env XAQ_DATA)`);\n\nasync function withApi<T>(o: { data?: string; yes?: boolean }, run: (deps: { api: import(\"./api.ts\").ConnectionsApi; prompter: import(\"./prompt.ts\").Prompter }) => Promise<T>): Promise<T> {\n  const { CLEANUP_SIGNALS, openAdminChannel } = await import(\"./admin.ts\");\n  const { ConnectionsApi } = await import(\"./api.ts\");\n  const { TerminalPrompter } = await import(\"./prompt.ts\");\n  const channel = openAdminChannel({ dataDir: dataDirOf(o) });\n  const handlers = CLEANUP_SIGNALS.map((sig) => {\n    const h = () => {\n      channel.close();\n      process.exit(sig === \"SIGINT\" ? 130 : 128 + (sig === \"SIGTERM\" ? 15 : 1));\n    };\n    process.once(sig, h);\n    return [sig, h] as const;\n  });\n  try {\n    return await run({ api: new ConnectionsApi(channel), prompter: new TerminalPrompter(!!o.yes) });\n  } finally {\n    for (const [sig, h] of handlers) process.removeListener(sig, h);\n    channel.close();\n  }\n}\n\n/** This xaq's own MCP origins, so `import` never imports its own entry. */\nasync function selfOrigins(dataDir: string): Promise<string[]> {\n  const { runningInstance } = await import(\"../instance.ts\");\n  const { daemonOrigin } = await import(\"./admin.ts\");\n  const running = runningInstance(dataDir);\n  if (!running) return [];\n  return [daemonOrigin(running), `http://localhost:${running.port}`, `http://127.0.0.1:${running.port}`, `http://[::1]:${running.port}`];\n}\n\nexport function registerConnectionsCommands(program: Command): void {\n  const connections = program\n    .command(\"connections\", { hidden: !CONNECTIONS_VISIBLE })\n    .description(\"the MCP servers xaq connects agents to (Notion, T3 Code, any MCP URL, installed extensions); run on xaq's machine\")\n    .summary(\"add, list, reconnect or remove connected MCP servers\")\n    .helpGroup(GROUP);\n\n  dataOption(\n    connections\n      .command(\"add\")\n      .description(\"connect an installed extension (install it first: `ext add notion`) or any MCP server URL, interactively\")\n      .argument(\"<integration-or-url>\", \"an installed extension (`ext add notion|t3code|whoop|brightspace` first), or an MCP server URL such as https://mcp.example.com/mcp\"),\n  )\n    .option(\"--url <address>\", \"t3code: your T3 Code server's address, e.g. http://100.101.102.103:3773 (asked when omitted)\")\n    .option(\"--slug <name>\", \"its short name: agents see its tools as <name>__<tool>\")\n    .option(\"--name <name>\", \"its display name (unique; default: the server's host, or the integration's name)\")\n    .option(\"--access <level>\", \"full, ask (ask before risky actions; the default) or read\")\n    .option(\"--agent <name>\", 'an agent that gets it (repeatable; default: all agents; \"all\")', collect)\n    .option(\"--header <name>\", \"header for a server that wants a static key (default Authorization)\")\n    .option(\"--account <email>\", \"a Google extension (google-workspace): the connected Google account it works as (asked when omitted)\")\n    .option(\"--paste\", \"paste the address the browser lands on after signing in, instead of waiting for the redirect (automatic over SSH)\")\n    .option(\"--allow-private <origin>\", \"allow this exact scheme://host:port on this machine or a private network without asking (--yes never does)\")\n    .option(\"-y, --yes\", \"answer yes to confirmations and take the defaults (never to a private-network allow)\")\n    .addHelpText(\n      \"after\",\n      `\nExamples:\n  ${NPX} connections add notion\n  ${NPX} connections add google-workspace --account you@example.com   # turn on its Google APIs, then allow access\n  ${NPX} connections add t3code --url http://100.101.102.103:3773   # one per T3 server; have a T3 pairing code ready\n  ${NPX} connections add https://mcp.example.com/mcp --access read\n  ${NPX} connections add http://127.0.0.1:8787/mcp      # asks before allowing a server on this machine`,\n    )\n    .action(async (target: string, o: import(\"./manage.ts\").AddFlags & { data?: string }) => {\n      const { addConnection } = await import(\"./manage.ts\");\n      process.exitCode = await withApi(o, (deps) => addConnection(target, o, deps));\n    });\n\n  dataOption(connections.command(\"list\").description(\"list connections with their status and access\")).action(async (o: { data?: string }) => {\n    const { listConnections } = await import(\"./manage.ts\");\n    process.exitCode = await withApi(o, (deps) => listConnections(deps));\n  });\n\n  dataOption(connections.command(\"reconnect\").description(\"sign in again (OAuth) or replace the key (header)\").argument(\"<name>\", \"the connection's name\"))\n    .option(\"--paste\", \"paste the address the browser lands on (automatic over SSH)\")\n    .option(\"--header <name>\", \"header connections: the header's name (default: asks, Authorization)\")\n    .action(async (slug: string, o: { data?: string; paste?: boolean; header?: string }) => {\n      const { reconnectConnection } = await import(\"./manage.ts\");\n      process.exitCode = await withApi(o, (deps) => reconnectConnection(slug, o, deps));\n    });\n\n  dataOption(connections.command(\"disable\").description(\"turn a connection off at once (the kill switch); turn it back on in the console\").argument(\"<name>\", \"the connection's name\"))\n    .option(\"-y, --yes\", \"don't ask\")\n    .action(async (slug: string, o: { data?: string; yes?: boolean }) => {\n      const { disableConnection } = await import(\"./manage.ts\");\n      process.exitCode = await withApi(o, (deps) => disableConnection(slug, deps));\n    });\n\n  dataOption(\n    connections\n      .command(\"rename\")\n      .description(\"change a connection's short name (agents see its tools as <name>__<tool>) or its display name\")\n      .argument(\"<name>\", \"the connection's current short name (or its id)\"),\n  )\n    .option(\"--slug <new>\", \"the new short name: 1-24 lowercase letters, digits and dashes (calls by the old tool names stop working)\")\n    .option(\"--name <display-name>\", \"a new display name\")\n    .option(\"-y, --yes\", \"don't ask\")\n    .action(async (target: string, o: { data?: string; yes?: boolean; slug?: string; name?: string }) => {\n      const { renameConnection } = await import(\"./manage.ts\");\n      process.exitCode = await withApi(o, (deps) => renameConnection(target, o, deps));\n    });\n\n  dataOption(connections.command(\"remove\").description(\"remove a connection and delete its credentials\").argument(\"<name>\", \"the connection's name\"))\n    .option(\"-y, --yes\", \"don't ask\")\n    .action(async (slug: string, o: { data?: string; yes?: boolean }) => {\n      const { removeConnection } = await import(\"./manage.ts\");\n      process.exitCode = await withApi(o, (deps) => removeConnection(slug, deps));\n    });\n\n  dataOption(\n    program\n      .command(\"import\", { hidden: !CONNECTIONS_VISIBLE })\n      .description(\"move an agent tool's MCP servers into xaq: one connection each, credentials moved into xaq\")\n      .summary(\"import MCP servers from Hermes, Claude Code, Cursor or Codex\")\n      .helpGroup(GROUP)\n      .requiredOption(\"--from <client>\", \"hermes, claude-code, cursor or codex\"),\n  )\n    .option(\"--dry-run\", \"print exactly what would be created and changed, and change nothing\")\n    .option(\"--access <level>\", \"for every imported connection: full, ask (the default) or read\")\n    .option(\"--agent <name>\", 'an agent that gets them (repeatable; default: all agents; \"all\")', collect)\n    .option(\"--profile <name>\", \"the agent profile setup-mcp uses for the single xaq entry (default \\\"default\\\")\")\n    .option(\"--allow-private <origin>\", \"allow this exact scheme://host:port on this machine or a private network without asking (repeatable; --yes never does)\", collect)\n    .option(\"-y, --yes\", \"answer yes to the confirmations (scripts); never to a private-network allow or a project's .mcp.json servers\")\n    .addHelpText(\n      \"after\",\n      `\nReads: hermes ~/.hermes/config.yaml mcp_servers (+ ~/.hermes/.env) · claude-code ~/.claude.json and ./.mcp.json ·\ncursor ~/.cursor/mcp.json · codex ~/.codex/config.toml. Static headers move into xaq (encrypted); OAuth\nservers are created needing Connect (their tokens stay in the client); local (stdio) servers aren't supported yet\nand stay where they are. Servers on this machine or a private network are created only after you confirm the exact\nhost:port. Then it offers setup-mcp --tool <client>, which replaces the entries that now work through xaq\nwith the single xaq entry, after a timestamped backup. The entry keeps the name the profile already uses (\"xaq\", or\n\"${LEGACY_PRODUCT}\" for a profile set up before the rename), so Hermes routes and cron jobs confined to it keep working.\n\nExamples:\n  ${NPX} import --from hermes --dry-run\n  ${NPX} import --from hermes`,\n    )\n    .action(async (o: import(\"./import.ts\").ImportFlags & { data?: string }) => {\n      const { runImport } = await import(\"./import.ts\");\n      const self = await selfOrigins(dataDirOf(o));\n      if (o.dryRun) {\n        // Read-only: the admin channel (when the daemon runs) only lists existing connections.\n        const { TerminalPrompter } = await import(\"./prompt.ts\");\n        const { openAdminChannel } = await import(\"./admin.ts\");\n        const { ConnectionsApi } = await import(\"./api.ts\");\n        let channel: import(\"./admin.ts\").AdminChannel | null = null;\n        try {\n          process.exitCode = await runImport(o, {\n            prompter: new TerminalPrompter(!!o.yes),\n            openApi: () => new ConnectionsApi((channel = openAdminChannel({ dataDir: dataDirOf(o) }))),\n            selfOrigins: self,\n          });\n        } finally {\n          (channel as import(\"./admin.ts\").AdminChannel | null)?.close();\n        }\n        return;\n      }\n      process.exitCode = await withApi(o, (deps) => runImport(o, { prompter: deps.prompter, openApi: () => deps.api, selfOrigins: self }));\n    });\n}\n"],"mappings":";;;;;AAWA,MAAM,QAAQ;AAEd,MAAM,WAAW,OAAe,aAAmC,CAAC,GAAI,YAAY,CAAC,GAAI,KAAK;AAE9F,MAAM,aAAa,MAAyB,eAAe,EAAE,MAAM,EAAE,OAAO,KAAK,CAAC;AAClF,MAAM,cAAc,QAAiB,IAAI,OAAO,oBAAoB,2DAA2D,eAAe,gBAAgB;AAE9J,eAAe,QAAW,GAAqC,KAA6H;CAC1L,MAAM,EAAE,iBAAiB,qBAAqB,MAAM,OAAO;CAC3D,MAAM,EAAE,mBAAmB,MAAM,OAAO;CACxC,MAAM,EAAE,qBAAqB,MAAM,OAAO;CAC1C,MAAM,UAAU,iBAAiB,EAAE,SAAS,UAAU,CAAC,EAAE,CAAC;CAC1D,MAAM,WAAW,gBAAgB,KAAK,QAAQ;EAC5C,MAAM,UAAU;GACd,QAAQ,MAAM;GACd,QAAQ,KAAK,QAAQ,WAAW,MAAM,OAAO,QAAQ,YAAY,KAAK,EAAE;EAC1E;EACA,QAAQ,KAAK,KAAK,CAAC;EACnB,OAAO,CAAC,KAAK,CAAC;CAChB,CAAC;CACD,IAAI;EACF,OAAO,MAAM,IAAI;GAAE,KAAK,IAAI,eAAe,OAAO;GAAG,UAAU,IAAI,iBAAiB,CAAC,CAAC,EAAE,GAAG;EAAE,CAAC;CAChG,UAAU;EACR,KAAK,MAAM,CAAC,KAAK,MAAM,UAAU,QAAQ,eAAe,KAAK,CAAC;EAC9D,QAAQ,MAAM;CAChB;AACF;;AAGA,eAAe,YAAY,SAAoC;CAC7D,MAAM,EAAE,oBAAoB,MAAM,OAAO;CACzC,MAAM,EAAE,iBAAiB,MAAM,OAAO;CACtC,MAAM,UAAU,gBAAgB,OAAO;CACvC,IAAI,CAAC,SAAS,OAAO,CAAC;CACtB,OAAO;EAAC,aAAa,OAAO;EAAG,oBAAoB,QAAQ;EAAQ,oBAAoB,QAAQ;EAAQ,gBAAgB,QAAQ;CAAM;AACvI;AAEA,SAAgB,4BAA4B,SAAwB;CAClE,MAAM,cAAc,QACjB,QAAQ,eAAe,EAAE,QAAQ,MAAqB,CAAC,CAAC,CACxD,YAAY,mHAAmH,CAAC,CAChI,QAAQ,sDAAsD,CAAC,CAC/D,UAAU,KAAK;CAElB,WACE,YACG,QAAQ,KAAK,CAAC,CACd,YAAY,0GAA0G,CAAC,CACvH,SAAS,wBAAwB,oIAAoI,CAC1K,CAAC,CACE,OAAO,mBAAmB,8FAA8F,CAAC,CACzH,OAAO,iBAAiB,wDAAwD,CAAC,CACjF,OAAO,iBAAiB,kFAAkF,CAAC,CAC3G,OAAO,oBAAoB,2DAA2D,CAAC,CACvF,OAAO,kBAAkB,oEAAkE,OAAO,CAAC,CACnG,OAAO,mBAAmB,qEAAqE,CAAC,CAChG,OAAO,qBAAqB,sGAAsG,CAAC,CACnI,OAAO,WAAW,mHAAmH,CAAC,CACtI,OAAO,4BAA4B,4GAA4G,CAAC,CAChJ,OAAO,aAAa,sFAAsF,CAAC,CAC3G,YACC,SACA;;IAEF,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI,gGACJ,CAAC,CACA,OAAO,OAAO,QAAgB,MAA0D;EACvF,MAAM,EAAE,kBAAkB,MAAM,OAAO;EACvC,QAAQ,WAAW,MAAM,QAAQ,IAAI,SAAS,cAAc,QAAQ,GAAG,IAAI,CAAC;CAC9E,CAAC;CAEH,WAAW,YAAY,QAAQ,MAAM,CAAC,CAAC,YAAY,+CAA+C,CAAC,CAAC,CAAC,OAAO,OAAO,MAAyB;EAC1I,MAAM,EAAE,oBAAoB,MAAM,OAAO;EACzC,QAAQ,WAAW,MAAM,QAAQ,IAAI,SAAS,gBAAgB,IAAI,CAAC;CACrE,CAAC;CAED,WAAW,YAAY,QAAQ,WAAW,CAAC,CAAC,YAAY,mDAAmD,CAAC,CAAC,SAAS,UAAU,uBAAuB,CAAC,CAAC,CACtJ,OAAO,WAAW,6DAA6D,CAAC,CAChF,OAAO,mBAAmB,sEAAsE,CAAC,CACjG,OAAO,OAAO,MAAc,MAA2D;EACtF,MAAM,EAAE,wBAAwB,MAAM,OAAO;EAC7C,QAAQ,WAAW,MAAM,QAAQ,IAAI,SAAS,oBAAoB,MAAM,GAAG,IAAI,CAAC;CAClF,CAAC;CAEH,WAAW,YAAY,QAAQ,SAAS,CAAC,CAAC,YAAY,iFAAiF,CAAC,CAAC,SAAS,UAAU,uBAAuB,CAAC,CAAC,CAClL,OAAO,aAAa,WAAW,CAAC,CAChC,OAAO,OAAO,MAAc,MAAwC;EACnE,MAAM,EAAE,sBAAsB,MAAM,OAAO;EAC3C,QAAQ,WAAW,MAAM,QAAQ,IAAI,SAAS,kBAAkB,MAAM,IAAI,CAAC;CAC7E,CAAC;CAEH,WACE,YACG,QAAQ,QAAQ,CAAC,CACjB,YAAY,+FAA+F,CAAC,CAC5G,SAAS,UAAU,iDAAiD,CACzE,CAAC,CACE,OAAO,gBAAgB,0GAA0G,CAAC,CAClI,OAAO,yBAAyB,oBAAoB,CAAC,CACrD,OAAO,aAAa,WAAW,CAAC,CAChC,OAAO,OAAO,QAAgB,MAAsE;EACnG,MAAM,EAAE,qBAAqB,MAAM,OAAO;EAC1C,QAAQ,WAAW,MAAM,QAAQ,IAAI,SAAS,iBAAiB,QAAQ,GAAG,IAAI,CAAC;CACjF,CAAC;CAEH,WAAW,YAAY,QAAQ,QAAQ,CAAC,CAAC,YAAY,gDAAgD,CAAC,CAAC,SAAS,UAAU,uBAAuB,CAAC,CAAC,CAChJ,OAAO,aAAa,WAAW,CAAC,CAChC,OAAO,OAAO,MAAc,MAAwC;EACnE,MAAM,EAAE,qBAAqB,MAAM,OAAO;EAC1C,QAAQ,WAAW,MAAM,QAAQ,IAAI,SAAS,iBAAiB,MAAM,IAAI,CAAC;CAC5E,CAAC;CAEH,WACE,QACG,QAAQ,UAAU,EAAE,QAAQ,MAAqB,CAAC,CAAC,CACnD,YAAY,4FAA4F,CAAC,CACzG,QAAQ,8DAA8D,CAAC,CACvE,UAAU,KAAK,CAAC,CAChB,eAAe,mBAAmB,sCAAsC,CAC7E,CAAC,CACE,OAAO,aAAa,qEAAqE,CAAC,CAC1F,OAAO,oBAAoB,gEAAgE,CAAC,CAC5F,OAAO,kBAAkB,sEAAoE,OAAO,CAAC,CACrG,OAAO,oBAAoB,iFAAiF,CAAC,CAC7G,OAAO,4BAA4B,0HAA0H,OAAO,CAAC,CACrK,OAAO,aAAa,8GAA8G,CAAC,CACnI,YACC,SACA;;;;;;;GAOH,eAAe;;;IAGd,IAAI;IACJ,IAAI,sBACJ,CAAC,CACA,OAAO,OAAO,MAA6D;EAC1E,MAAM,EAAE,cAAc,MAAM,OAAO;EACnC,MAAM,OAAO,MAAM,YAAY,UAAU,CAAC,CAAC;EAC3C,IAAI,EAAE,QAAQ;GAEZ,MAAM,EAAE,qBAAqB,MAAM,OAAO;GAC1C,MAAM,EAAE,qBAAqB,MAAM,OAAO;GAC1C,MAAM,EAAE,mBAAmB,MAAM,OAAO;GACxC,IAAI,UAAoD;GACxD,IAAI;IACF,QAAQ,WAAW,MAAM,UAAU,GAAG;KACpC,UAAU,IAAI,iBAAiB,CAAC,CAAC,EAAE,GAAG;KACtC,eAAe,IAAI,eAAgB,UAAU,iBAAiB,EAAE,SAAS,UAAU,CAAC,EAAE,CAAC,CAAE;KACzF,aAAa;IACf,CAAC;GACH,UAAU;IACR,SAAuD,MAAM;GAC/D;GACA;EACF;EACA,QAAQ,WAAW,MAAM,QAAQ,IAAI,SAAS,UAAU,GAAG;GAAE,UAAU,KAAK;GAAU,eAAe,KAAK;GAAK,aAAa;EAAK,CAAC,CAAC;CACrI,CAAC;AACL"}

package/dist/{commands-Bo6-7SBs.js → commands-DAd3ICss.js}

@@ -3,7 +3,7 @@ import { t as LEGACY_PRODUCT } from "./brand-Bg9VPAym.js";
 import { s as EVENT_TYPES } from "./types-BhJDbSzE.js";
 import { t as NPX } from "./version-BxH7OuWD.js";
 import { t as DEFAULT_PROFILE } from "./paths-Bo6qtWNh.js";
-import { _ as recipesHelp, i as TOOLS, n as RECIPE_NAMES } from "./recipes-V8_-S1TM.js";
+import { _ as recipesHelp, i as TOOLS, n as RECIPE_NAMES } from "./recipes-BsCIHrrP.js";
 import { InvalidArgumentError } from "commander";
 //#region server/listen/commands.ts
 /** `xaq connect`, `xaq setup-mcp` and `xaq listen …`, all lazily loaded. */
@@ -83,19 +83,19 @@ Exit codes: 0 approved, 2 denied, 3 expired, 4 already consumed, 130 cancelled,
 
 Example:
   ${NPX} connect https://mail.example.com --tool claude-code --setup-mcp`).action(async (url, flags) => {
-		const { runConnect } = await import("./connect-xUMBNHSZ.js");
+		const { runConnect } = await import("./connect-CNECpz7N.js");
 		process.exit(await runConnect(url, flags, { handleSignals: true }));
 	});
 	profileOption(program.command("setup-mcp").description("register the xaq MCP server in your agent's tool, without showing the key")).option("--tool <tool>", `${TOOLS.filter((t) => t !== "other").join(", ")} (default: the tool given to connect)`).option("--dry-run", "print the exact commands and file changes, and change nothing").addHelpText("after", mcpSetupHelp()).action(async (flags) => {
-		const { parseTool, printMcpResult } = await import("./connect-xUMBNHSZ.js");
+		const { parseTool, printMcpResult } = await import("./connect-CNECpz7N.js");
 		const { loadProfile } = await import("./profile-BWK08YwL.js");
-		const { setupMcp, mcpTarget } = await import("./mcpsetup-C9mGhinf.js");
+		const { setupMcp, mcpTarget } = await import("./mcpsetup-sfobhJnl.js");
 		const { profilePath } = await import("./paths-Bk9CoSYL.js");
 		const name = flags.profile ?? "default";
 		const profile = loadProfile(name);
 		const tool = flags.tool ? parseTool(flags.tool) : profile.tool ?? "other";
 		if (tool === "other") throw new Error(`Which tool? Pass --tool ${TOOLS.filter((t) => t !== "other").join("|")}.`);
-		const { claudeMcpConfigPath, writeClaudeMcpConfig } = await import("./mcpheader-CK2dhg-I.js");
+		const { claudeMcpConfigPath, writeClaudeMcpConfig } = await import("./mcpheader-DOwvJTUJ.js");
 		const r = setupMcp(tool, mcpTarget(name, profile), profilePath(name), { dryRun: flags.dryRun });
 		if (flags.dryRun) r.changes = [...r.changes ?? [], `refresh ${claudeMcpConfigPath(name)} (keyless MCP config the Claude Code listen recipe loads)`];
 		else writeClaudeMcpConfig(name, `${profile.url}/mcp`);
@@ -103,18 +103,18 @@ Example:
 		if (!r.ok) process.exitCode = 1;
 	});
 	profileOption(program.command("mcp-header").description("print the agent's Authorization header as JSON for an MCP client's header helper (refuses to print to a terminal)")).action(async (flags) => {
-		const { printMcpHeader } = await import("./mcpheader-CK2dhg-I.js");
+		const { printMcpHeader } = await import("./mcpheader-DOwvJTUJ.js");
 		process.exitCode = printMcpHeader(flags.profile ?? "default");
 	});
 	const listen = listenFlags(program.command("listen").description("wake a local agent on new mail: hold an outbound stream to the daemon and run a command or POST to localhost per event")).option("--dry-run", "print matching events without running anything (uses a throwaway <consumer>-dry-run cursor)").option("--from-start", "a NEW consumer starts at the oldest stored event (no effect once it exists: use --backfill)").option("--backfill", "run the mail from before this listener started through --exec/--forward once, oldest first, then exit; safe while the listener runs (own cursor)").option("--until <seq>", "with --backfill: replay up to this event number instead of where the listener started", int("--until")).option("--print-recipe <name>", `print what --recipe <name> runs (hermes: its URL), for ${RECIPE_NAMES.join(", ")} (with this machine's paths), and exit`).addHelpText("after", recipesHelp()).action(async (flags) => {
 		if (flags.printRecipe !== void 0) {
-			const { parseRecipeTool, recipe } = await import("./recipes-CwyZRyXM.js");
+			const { parseRecipeTool, recipe } = await import("./recipes-BOhG7jcd.js");
 			const name = flags.printRecipe.trim().toLowerCase();
 			const r = recipe(name === "other" ? "other" : parseRecipeTool(name), flags.profile ?? "default");
 			process.stdout.write(`${r.exec ?? r.forward}\n`);
 			return;
 		}
-		const { runListener } = await import("./listen-CcZUPf3p.js");
+		const { runListener } = await import("./listen-B6TV_qUM.js");
 		process.exit(await runListener({
 			flags,
 			handleSignals: true
@@ -122,22 +122,22 @@ Example:
 	});
 	profileOption(listen.command("status").description("show the listener's connection, cursor, recent events and dead letters")).action(async (_o, cmd) => {
 		const flags = all(cmd);
-		const { printStatus } = await import("./admin-UKJE67mn.js");
+		const { printStatus } = await import("./admin-5555baeh.js");
 		await printStatus(flags.profile ?? "default");
 	});
 	profileOption(listen.command("secret").description("print the forward-mode signing secret (whsec_…) for your local receiver")).option("--rotate", "generate a new secret (restart the listener afterwards)").action(async (_o, cmd) => {
 		const flags = all(cmd);
-		const { printSecret } = await import("./admin-UKJE67mn.js");
+		const { printSecret } = await import("./admin-5555baeh.js");
 		printSecret(flags.profile ?? "default", flags);
 	});
 	profileOption(listen.command("hermes").description("create the Hermes gateway webhook route that --recipe hermes forwards to, limited to the xaq tools")).option("--deliver <target>", "where Hermes sends its triage: telegram, discord, slack… (a platform connected to your gateway), or log").option("--deliver-chat-id <id>", "with --deliver: a specific chat instead of the platform's home channel").option("--cron-job <job>", "instead of --deliver: fire this existing Hermes cron job (id or name; `hermes cron list`); its prompt, tools and delivery apply, so its enabled_toolsets must be exactly [\"xaq\"]").option("--script <file>", "a Hermes filter script under ~/.hermes/scripts (runs before the agent; can drop events at no LLM cost)").option("--run", "set the route up now: run hermes, then set the real secret and limit the route to the xaq tools (recommended)").addHelpText("after", hermesHelp()).action(async (_o, cmd) => {
 		const flags = all(cmd);
-		const { hermesSubscribe } = await import("./hermes-DcrI-TtP.js");
+		const { hermesSubscribe } = await import("./hermes-BwsRDFyI.js");
 		process.exitCode = await hermesSubscribe(flags.profile ?? "default", flags);
 	});
 	listenFlags(listen.command("dead").description("list events that failed every attempt; --replay runs them again")).option("--replay", "run dead events again (successes are removed)").option("--id <eventId>", "only this event (with --replay or --clear)").option("--clear", "delete dead events without running them").option("--json", "print raw JSON lines").action(async (_o, cmd) => {
 		const flags = all(cmd);
-		const admin = await import("./admin-UKJE67mn.js");
+		const admin = await import("./admin-5555baeh.js");
 		const profile = flags.profile ?? "default";
 		if (flags.clear) admin.clearDead(profile, flags.id);
 		else if (flags.replay) {
@@ -147,21 +147,21 @@ Example:
 	const service = listen.command("service").description("run the listener in the background (systemd user service / launchd agent, one per profile)");
 	listenFlags(service.command("install").description("install and start the listener service; flags are saved to the profile. Re-run to update")).action(async (_o, cmd) => {
 		const flags = all(cmd);
-		const { installListenService } = await import("./service-CaLi0ECi.js");
+		const { installListenService } = await import("./service-B-VzLRzc.js");
 		await installListenService(flags);
 	});
 	profileOption(service.command("uninstall").description("stop and remove the listener service (keeps the profile)")).action(async (_o, cmd) => {
 		const flags = all(cmd);
-		const { uninstallListenService } = await import("./service-CaLi0ECi.js");
+		const { uninstallListenService } = await import("./service-B-VzLRzc.js");
 		uninstallListenService(flags.profile ?? "default");
 	});
 	profileOption(service.command("status").description("show the service manager's status for the listener")).action(async (_o, cmd) => {
 		const flags = all(cmd);
-		const { listenServiceStatus } = await import("./service-CaLi0ECi.js");
+		const { listenServiceStatus } = await import("./service-B-VzLRzc.js");
 		listenServiceStatus(flags.profile ?? "default");
 	});
 }
 //#endregion
 export { registerListenCommands };
 
-//# sourceMappingURL=commands-Bo6-7SBs.js.map
+//# sourceMappingURL=commands-DAd3ICss.js.map

package/dist/{commands-Bo6-7SBs.js.map → commands-DAd3ICss.js.map}

@@ -1 +1 @@
-{"version":3,"file":"commands-Bo6-7SBs.js","names":[],"sources":["../server/listen/commands.ts"],"sourcesContent":["import { type Command, InvalidArgumentError } from \"commander\";\nimport { LEGACY_PRODUCT } from \"../brand.ts\";\nimport { EVENT_TYPES } from \"../../shared/types.ts\";\nimport type { ConnectFlags } from \"./connect.ts\";\nimport type { HermesFlags } from \"./hermes.ts\";\nimport type { ListenFlags } from \"./options.ts\";\nimport { DEFAULT_PROFILE } from \"./paths.ts\";\nimport { RECIPE_NAMES, recipesHelp, TOOLS } from \"./recipes.ts\";\nimport { NPX } from \"./version.ts\";\n\n/** `xaq connect`, `xaq setup-mcp` and `xaq listen …`, all lazily loaded. */\n\n/**\n * Options of a `listen` subcommand plus any its ancestors parsed: `listen` declares the same flags\n * (--profile, --exec…), and commander lets the parent claim them wherever they appear.\n */\nconst all = <T>(cmd: Command): T => cmd.optsWithGlobals() as T;\n\nconst collect = (value: string, previous: string[] | undefined) => [...(previous ?? []), value];\n\nconst int = (name: string) => (value: string) => {\n  if (!/^\\d+$/.test(value)) throw new InvalidArgumentError(`${name} must be a whole number.`);\n  return Number(value);\n};\n\nconst profileOption = (cmd: Command) => cmd.option(\"--profile <name>\", `profile to use (default \"${DEFAULT_PROFILE}\")`);\n\nfunction listenFlags(cmd: Command): Command {\n  return profileOption(cmd)\n    .option(\"--exec <command>\", \"run this command for each event (via /bin/sh; the event arrives on stdin as JSON, never in the command)\")\n    .option(\"--recipe <name>\", `use a built-in target: ${RECIPE_NAMES.join(\", \")} (hermes forwards to your Hermes gateway; see it with --print-recipe)`)\n    .option(\"--forward <url>\", \"POST each event to this localhost URL, signed per Standard Webhooks\")\n    .option(\"--types <list>\", `comma-separated event types, or \"all\" (default: message.received, new mail only; also ${EVENT_TYPES.filter((t) => t !== \"message.received\").join(\", \")}; calendar.* need calendar.read)`)\n    .option(\"--from <glob>\", 'only senders (calendar: organizers) matching this glob, e.g. \"*@stripe.com\" (repeatable)', collect)\n    .option(\"--to <glob>\", \"only when a to/cc address (calendar: an attendee) matches (repeatable)\", collect)\n    .option(\"--label <id>\", \"only messages with this Gmail label id, e.g. INBOX or Label_123 (repeatable)\", collect)\n    .option(\"--subject <regex>\", \"only subjects (calendar: event titles) matching this case-insensitive regular expression\")\n    .option(\"--not-from <glob>\", 'skip senders matching this glob, e.g. \"*@github.com\" (repeatable; --not-from \"\" --save clears saved exclusions)', collect)\n    .option(\"--not-label <id>\", \"skip messages with this Gmail label id, e.g. CATEGORY_UPDATES (repeatable)\", collect)\n    .option(\"--all-categories\", \"don't skip Gmail's Promotions, Social and Forums tabs (skipped by default)\")\n    .option(\"--include-category <name>\", \"take one category back from the default skip: promotions, social or forums (repeatable)\", collect)\n    .option(\"--default-categories\", \"back to the default: skip Promotions, Social and Forums (undoes a saved --all-categories / --include-category)\")\n    .option(\"--batch <duration>\", `collect events this long (e.g. 60s, 2m) and run --exec once for all of them (up to 20); 0 turns it off`)\n    .option(\"--include-body\", \"include the cleaned message body (calendar: the event description) in each event\")\n    .option(\"--no-include-body\", \"don't include bodies (overrides a saved setting)\")\n    .option(\"--concurrency <n>\", \"events handled at once (default 2)\", int(\"--concurrency\"))\n    .option(\"--timeout <seconds>\", \"per-event time limit; the whole process group is killed after it (default 300)\", int(\"--timeout\"))\n    .option(\"--max-attempts <n>\", \"attempts before an event goes to dead letters (default 5)\", int(\"--max-attempts\"))\n    .option(\"--consumer <name>\", \"server-side cursor name (default <hostname>-<profile>)\")\n    .option(\"--cwd <dir>\", \"directory --exec commands run in (default: a private dir in the state dir; must be yours and not group/world-writable)\")\n    .option(\"--insecure\", \"allow plain http to a non-loopback, non-Tailscale daemon (loud warning)\")\n    .option(\"--save\", \"save these settings to the profile\");\n}\n\n/** `listen hermes --help`. */\nfunction hermesHelp(): string {\n  return `\n--recipe hermes forwards each event to your running Hermes gateway (http://127.0.0.1:8644/webhooks/xaq; for\nanother profile the route is xaq-<profile>; a profile set up before the rename keeps its ${LEGACY_PRODUCT}[-<profile>] route,\ntoolset and server name). Hermes verifies the Standard Webhooks signature with the\nlistener's secret, runs the triage, and delivers the result where this route says. Mail that isn't important gets\na [SILENT] reply, which Hermes doesn't deliver.\n\nA Hermes webhook run normally gets web tools (web_search, web_extract, vision_analyze, clarify) and every MCP\nserver enabled in Hermes: with email as the trigger, an attacker could make it read your mail and send it out.\n--run therefore also limits the route to the xaq MCP server (\"toolsets\": [\"mcp-xaq\"] in\nwebhook_subscriptions.json, which \\`hermes webhook subscribe\\` can't set). That limit only holds when xaq is an\nenabled MCP server in Hermes' config.yaml (else Hermes adds every MCP server), so this refuses until\n\\`${NPX} setup-mcp --tool hermes\\` has added it. --run creates the route disabled with the real secret under Hermes'\nlock (python3), runs \\`hermes webhook subscribe\\` without --secret (hermes keeps the secret and the disabled state),\nthen sets the toolsets and enables it. The secret is never in a command line, the route never runs unconfined, and\nany failure removes it again. Re-run it after any \\`hermes webhook subscribe\\` for this route (that resets the\ntoolsets). The Hermes home follows HERMES_HOME or Hermes' sticky active_profile.\n\nWithout --run it prints both steps for you to do by hand; the toolsets edit is required.\n\n--cron-job hands the email to that job's own tools, so it is accepted only when the job's enabled_toolsets is\nexactly [\"xaq\"] (the bare server name; \"mcp-xaq\" doesn't narrow MCP servers for cron jobs).\n\nNeeds python3, the gateway's webhook platform (hermes gateway setup, or WEBHOOK_ENABLED=true in ~/.hermes/.env) and\na running gateway. Check it: curl http://127.0.0.1:8644/health\n\nExamples:\n  ${NPX} listen hermes --deliver telegram --run\n  ${NPX} listen hermes --cron-job email-watch --run    # only for a job limited to [\"xaq\"]\n  ${NPX} listen service install --recipe hermes`;\n}\n\n/** `setup-mcp --help`: exactly what it changes, per tool. */\nfunction mcpSetupHelp(): string {\n  return `\nWhat it changes (the server is named \"xaq\", or \"xaq-<profile>\" for --profile; a profile set up before the\nrename keeps the \"${LEGACY_PRODUCT}[-<profile>]\" name it already has in your tools):\n  claude-code  runs \\`claude mcp remove xaq --scope user\\` then\n               \\`claude mcp add-json --scope user xaq '{\"type\":\"http\",\"url\":\"<daemon>/mcp\",\"headersHelper\":\"…\"}'\\`.\n               The header helper (~/.config/xaq/bin/mcp-header.mjs) reads the key from your profile, so\n               the key is in neither the command line nor ~/.claude.json. Backs up ~/.claude.json first\n               ($CLAUDE_CONFIG_DIR/.claude.json if set).\n  codex        adds or replaces [mcp_servers.xaq] in ~/.codex/config.toml ($CODEX_HOME), with the key in\n               http_headers; the file becomes 0600.\n  cursor       adds or replaces mcpServers.xaq in ~/.cursor/mcp.json, with the key in headers; 0600.\n  hermes       adds or replaces mcp_servers.xaq in ~/.hermes/config.yaml ($HERMES_HOME) and puts the key in\n               ~/.hermes/.env as XAQ_API_KEY; both 0600.\nEvery file is backed up first as <file>.xaq-backup-<timestamp> (0600; backups of files holding the key hold it\ntoo). It also refreshes ~/.config/xaq/mcp/<profile>.claude.json (no key), which the listen recipe uses.\n\nCheck it afterwards: claude mcp list · codex mcp list · agent mcp list (Cursor) · hermes mcp test xaq\n\nExample:\n  ${NPX} setup-mcp --tool claude-code --dry-run`;\n}\n\nexport function registerListenCommands(program: Command): void {\n  program\n    .command(\"connect\")\n    .description(\"pair this machine's agent with a xaq daemon (approve the code in the console)\")\n    .argument(\"<daemon-url>\", \"the xaq daemon, e.g. https://mail.example.com or http://100.101.102.103:8425\")\n    .option(\"--name <name>\", 'how the agent appears in the console (default \"<Tool> on <hostname>\")')\n    .option(\"--tool <tool>\", `the agent's tool: ${TOOLS.join(\", \")}; tailors the next steps`)\n    .option(\"--account <email>\", \"mailbox to request access to (repeatable; the approver decides)\", collect)\n    .option(\"--capabilities <list>\", \"capabilities to request, e.g. read,draft or read,calendar.read (the approver decides)\")\n    .option(\"--reason <text>\", \"why the agent needs access (shown to the approver)\")\n    .option(\"--setup-mcp\", \"also register the MCP server in the chosen tool (the key is never shown; `setup-mcp --help` lists exactly what changes)\")\n    .option(\"--profile <name>\", `profile to save the key in (default \"${DEFAULT_PROFILE}\")`)\n    .option(\"--consumer <name>\", \"listener cursor name (default <hostname>-<profile>)\")\n    .option(\"--log <file>\", \"also write the output to this file (created 0600; for running connect in the background)\")\n    .option(\"--insecure\", \"allow plain http to a non-loopback, non-Tailscale daemon (loud warning)\")\n    .option(\"--force\", \"re-pair an existing profile (keeps its listener settings)\")\n    .addHelpText(\n      \"after\",\n      `\nExit codes: 0 approved, 2 denied, 3 expired, 4 already consumed, 130 cancelled, 1 error.\n\nExample:\n  ${NPX} connect https://mail.example.com --tool claude-code --setup-mcp`,\n    )\n    .action(async (url: string, flags: ConnectFlags) => {\n      const { runConnect } = await import(\"./connect.ts\");\n      process.exit(await runConnect(url, flags, { handleSignals: true }));\n    });\n\n  profileOption(program.command(\"setup-mcp\").description(\"register the xaq MCP server in your agent's tool, without showing the key\"))\n    .option(\"--tool <tool>\", `${TOOLS.filter((t) => t !== \"other\").join(\", \")} (default: the tool given to connect)`)\n    .option(\"--dry-run\", \"print the exact commands and file changes, and change nothing\")\n    .addHelpText(\"after\", mcpSetupHelp())\n    .action(async (flags: { tool?: string; profile?: string; dryRun?: boolean }) => {\n      const { parseTool, printMcpResult } = await import(\"./connect.ts\");\n      const { loadProfile } = await import(\"./profile.ts\");\n      const { setupMcp, mcpTarget } = await import(\"./mcpsetup.ts\");\n      const { profilePath } = await import(\"./paths.ts\");\n      const name = flags.profile ?? DEFAULT_PROFILE;\n      const profile = loadProfile(name);\n      const tool = flags.tool ? parseTool(flags.tool) : (profile.tool ?? \"other\");\n      if (tool === \"other\") throw new Error(`Which tool? Pass --tool ${TOOLS.filter((t) => t !== \"other\").join(\"|\")}.`);\n      const { claudeMcpConfigPath, writeClaudeMcpConfig } = await import(\"./mcpheader.ts\");\n      const r = setupMcp(tool, mcpTarget(name, profile), profilePath(name), { dryRun: flags.dryRun });\n      if (flags.dryRun) r.changes = [...(r.changes ?? []), `refresh ${claudeMcpConfigPath(name)} (keyless MCP config the Claude Code listen recipe loads)`];\n      else writeClaudeMcpConfig(name, `${profile.url}/mcp`);\n      printMcpResult(r);\n      if (!r.ok) process.exitCode = 1;\n    });\n\n  profileOption(\n    program.command(\"mcp-header\").description(\"print the agent's Authorization header as JSON for an MCP client's header helper (refuses to print to a terminal)\"),\n  ).action(async (flags: { profile?: string }) => {\n    const { printMcpHeader } = await import(\"./mcpheader.ts\");\n    process.exitCode = printMcpHeader(flags.profile ?? DEFAULT_PROFILE);\n  });\n\n  const listen = listenFlags(\n    program\n      .command(\"listen\")\n      .description(\"wake a local agent on new mail: hold an outbound stream to the daemon and run a command or POST to localhost per event\"),\n  )\n    .option(\"--dry-run\", \"print matching events without running anything (uses a throwaway <consumer>-dry-run cursor)\")\n    .option(\"--from-start\", \"a NEW consumer starts at the oldest stored event (no effect once it exists: use --backfill)\")\n    .option(\"--backfill\", \"run the mail from before this listener started through --exec/--forward once, oldest first, then exit; safe while the listener runs (own cursor)\")\n    .option(\"--until <seq>\", \"with --backfill: replay up to this event number instead of where the listener started\", int(\"--until\"))\n    .option(\"--print-recipe <name>\", `print what --recipe <name> runs (hermes: its URL), for ${RECIPE_NAMES.join(\", \")} (with this machine's paths), and exit`)\n    .addHelpText(\"after\", recipesHelp())\n    .action(async (flags: ListenFlags & { printRecipe?: string }) => {\n      if (flags.printRecipe !== undefined) {\n        const { parseRecipeTool, recipe } = await import(\"./recipes.ts\");\n        const name = flags.printRecipe.trim().toLowerCase();\n        const r = recipe(name === \"other\" ? \"other\" : parseRecipeTool(name), flags.profile ?? DEFAULT_PROFILE);\n        // Exec recipes print the bare command (to edit and pass back with --exec); hermes its forward URL.\n        process.stdout.write(`${r.exec ?? r.forward}\\n`);\n        return;\n      }\n      const { runListener } = await import(\"./listen.ts\");\n      process.exit(await runListener({ flags, handleSignals: true }));\n    });\n\n  profileOption(listen.command(\"status\").description(\"show the listener's connection, cursor, recent events and dead letters\")).action(async (_o: unknown, cmd: Command) => {\n    const flags = all<{ profile?: string }>(cmd);\n    const { printStatus } = await import(\"./admin.ts\");\n    await printStatus(flags.profile ?? DEFAULT_PROFILE);\n  });\n\n  profileOption(listen.command(\"secret\").description(\"print the forward-mode signing secret (whsec_…) for your local receiver\"))\n    .option(\"--rotate\", \"generate a new secret (restart the listener afterwards)\")\n    .action(async (_o: unknown, cmd: Command) => {\n      const flags = all<{ profile?: string; rotate?: boolean }>(cmd);\n      const { printSecret } = await import(\"./admin.ts\");\n      printSecret(flags.profile ?? DEFAULT_PROFILE, flags);\n    });\n\n  profileOption(\n    listen\n      .command(\"hermes\")\n      .description(\"create the Hermes gateway webhook route that --recipe hermes forwards to, limited to the xaq tools\"),\n  )\n    .option(\"--deliver <target>\", \"where Hermes sends its triage: telegram, discord, slack… (a platform connected to your gateway), or log\")\n    .option(\"--deliver-chat-id <id>\", \"with --deliver: a specific chat instead of the platform's home channel\")\n    .option(\"--cron-job <job>\", \"instead of --deliver: fire this existing Hermes cron job (id or name; `hermes cron list`); its prompt, tools and delivery apply, so its enabled_toolsets must be exactly [\\\"xaq\\\"]\")\n    .option(\"--script <file>\", \"a Hermes filter script under ~/.hermes/scripts (runs before the agent; can drop events at no LLM cost)\")\n    .option(\"--run\", \"set the route up now: run hermes, then set the real secret and limit the route to the xaq tools (recommended)\")\n    .addHelpText(\"after\", hermesHelp())\n    .action(async (_o: unknown, cmd: Command) => {\n      const flags = all<HermesFlags>(cmd);\n      const { hermesSubscribe } = await import(\"./hermes.ts\");\n      process.exitCode = await hermesSubscribe(flags.profile ?? DEFAULT_PROFILE, flags);\n    });\n\n  listenFlags(listen.command(\"dead\").description(\"list events that failed every attempt; --replay runs them again\"))\n    .option(\"--replay\", \"run dead events again (successes are removed)\")\n    .option(\"--id <eventId>\", \"only this event (with --replay or --clear)\")\n    .option(\"--clear\", \"delete dead events without running them\")\n    .option(\"--json\", \"print raw JSON lines\")\n    .action(async (_o: unknown, cmd: Command) => {\n      const flags = all<ListenFlags & { replay?: boolean; id?: string; clear?: boolean; json?: boolean }>(cmd);\n      const admin = await import(\"./admin.ts\");\n      const profile = flags.profile ?? DEFAULT_PROFILE;\n      if (flags.clear) admin.clearDead(profile, flags.id);\n      else if (flags.replay) {\n        if ((await admin.replayDead(flags)) > 0) process.exitCode = 1;\n      } else admin.printDead(profile, flags);\n    });\n\n  const service = listen.command(\"service\").description(\"run the listener in the background (systemd user service / launchd agent, one per profile)\");\n  listenFlags(service.command(\"install\").description(\"install and start the listener service; flags are saved to the profile. Re-run to update\")).action(\n    async (_o: unknown, cmd: Command) => {\n      const flags = all<ListenFlags>(cmd);\n      const { installListenService } = await import(\"./service.ts\");\n      await installListenService(flags);\n    },\n  );\n  profileOption(service.command(\"uninstall\").description(\"stop and remove the listener service (keeps the profile)\")).action(async (_o: unknown, cmd: Command) => {\n    const flags = all<{ profile?: string }>(cmd);\n    const { uninstallListenService } = await import(\"./service.ts\");\n    uninstallListenService(flags.profile ?? DEFAULT_PROFILE);\n  });\n  profileOption(service.command(\"status\").description(\"show the service manager's status for the listener\")).action(async (_o: unknown, cmd: Command) => {\n    const flags = all<{ profile?: string }>(cmd);\n    const { listenServiceStatus } = await import(\"./service.ts\");\n    listenServiceStatus(flags.profile ?? DEFAULT_PROFILE);\n  });\n}\n"],"mappings":";;;;;;;;;;;;;AAgBA,MAAM,OAAU,QAAoB,IAAI,gBAAgB;AAExD,MAAM,WAAW,OAAe,aAAmC,CAAC,GAAI,YAAY,CAAC,GAAI,KAAK;AAE9F,MAAM,OAAO,UAAkB,UAAkB;CAC/C,IAAI,CAAC,QAAQ,KAAK,KAAK,GAAG,MAAM,IAAI,qBAAqB,GAAG,KAAK,yBAAyB;CAC1F,OAAO,OAAO,KAAK;AACrB;AAEA,MAAM,iBAAiB,QAAiB,IAAI,OAAO,oBAAoB,4BAA4B,gBAAgB,GAAG;AAEtH,SAAS,YAAY,KAAuB;CAC1C,OAAO,cAAc,GAAG,CAAC,CACtB,OAAO,oBAAoB,yGAAyG,CAAC,CACrI,OAAO,mBAAmB,0BAA0B,aAAa,KAAK,IAAI,EAAE,sEAAsE,CAAC,CACnJ,OAAO,mBAAmB,qEAAqE,CAAC,CAChG,OAAO,kBAAkB,yFAAyF,YAAY,QAAQ,MAAM,MAAM,kBAAkB,CAAC,CAAC,KAAK,IAAI,EAAE,iCAAiC,CAAC,CACnN,OAAO,iBAAiB,8FAA4F,OAAO,CAAC,CAC5H,OAAO,eAAe,0EAA0E,OAAO,CAAC,CACxG,OAAO,gBAAgB,gFAAgF,OAAO,CAAC,CAC/G,OAAO,qBAAqB,0FAA0F,CAAC,CACvH,OAAO,qBAAqB,uHAAmH,OAAO,CAAC,CACvJ,OAAO,oBAAoB,8EAA8E,OAAO,CAAC,CACjH,OAAO,oBAAoB,4EAA4E,CAAC,CACxG,OAAO,6BAA6B,2FAA2F,OAAO,CAAC,CACvI,OAAO,wBAAwB,gHAAgH,CAAC,CAChJ,OAAO,sBAAsB,wGAAwG,CAAC,CACtI,OAAO,kBAAkB,kFAAkF,CAAC,CAC5G,OAAO,qBAAqB,kDAAkD,CAAC,CAC/E,OAAO,qBAAqB,sCAAsC,IAAI,eAAe,CAAC,CAAC,CACvF,OAAO,uBAAuB,kFAAkF,IAAI,WAAW,CAAC,CAAC,CACjI,OAAO,sBAAsB,6DAA6D,IAAI,gBAAgB,CAAC,CAAC,CAChH,OAAO,qBAAqB,wDAAwD,CAAC,CACrF,OAAO,eAAe,wHAAwH,CAAC,CAC/I,OAAO,cAAc,yEAAyE,CAAC,CAC/F,OAAO,UAAU,oCAAoC;AAC1D;;AAGA,SAAS,aAAqB;CAC5B,OAAO;;2FAEkF,eAAe;;;;;;;;;;IAUtG,IAAI;;;;;;;;;;;;;;;IAeJ,IAAI;IACJ,IAAI;IACJ,IAAI;AACR;;AAGA,SAAS,eAAuB;CAC9B,OAAO;;oBAEW,eAAe;;;;;;;;;;;;;;;;;IAiB/B,IAAI;AACR;AAEA,SAAgB,uBAAuB,SAAwB;CAC7D,QACG,QAAQ,SAAS,CAAC,CAClB,YAAY,+EAA+E,CAAC,CAC5F,SAAS,gBAAgB,8EAA8E,CAAC,CACxG,OAAO,iBAAiB,yEAAuE,CAAC,CAChG,OAAO,iBAAiB,qBAAqB,MAAM,KAAK,IAAI,EAAE,yBAAyB,CAAC,CACxF,OAAO,qBAAqB,mEAAmE,OAAO,CAAC,CACvG,OAAO,yBAAyB,uFAAuF,CAAC,CACxH,OAAO,mBAAmB,oDAAoD,CAAC,CAC/E,OAAO,eAAe,yHAAyH,CAAC,CAChJ,OAAO,oBAAoB,wCAAwC,gBAAgB,GAAG,CAAC,CACvF,OAAO,qBAAqB,qDAAqD,CAAC,CAClF,OAAO,gBAAgB,0FAA0F,CAAC,CAClH,OAAO,cAAc,yEAAyE,CAAC,CAC/F,OAAO,WAAW,2DAA2D,CAAC,CAC9E,YACC,SACA;;;;IAIF,IAAI,iEACJ,CAAC,CACA,OAAO,OAAO,KAAa,UAAwB;EAClD,MAAM,EAAE,eAAe,MAAM,OAAO;EACpC,QAAQ,KAAK,MAAM,WAAW,KAAK,OAAO,EAAE,eAAe,KAAK,CAAC,CAAC;CACpE,CAAC;CAEH,cAAc,QAAQ,QAAQ,WAAW,CAAC,CAAC,YAAY,2EAA2E,CAAC,CAAC,CACjI,OAAO,iBAAiB,GAAG,MAAM,QAAQ,MAAM,MAAM,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,sCAAsC,CAAC,CAChH,OAAO,aAAa,+DAA+D,CAAC,CACpF,YAAY,SAAS,aAAa,CAAC,CAAC,CACpC,OAAO,OAAO,UAAiE;EAC9E,MAAM,EAAE,WAAW,mBAAmB,MAAM,OAAO;EACnD,MAAM,EAAE,gBAAgB,MAAM,OAAO;EACrC,MAAM,EAAE,UAAU,cAAc,MAAM,OAAO;EAC7C,MAAM,EAAE,gBAAgB,MAAM,OAAO;EACrC,MAAM,OAAO,MAAM,WAAA;EACnB,MAAM,UAAU,YAAY,IAAI;EAChC,MAAM,OAAO,MAAM,OAAO,UAAU,MAAM,IAAI,IAAK,QAAQ,QAAQ;EACnE,IAAI,SAAS,SAAS,MAAM,IAAI,MAAM,2BAA2B,MAAM,QAAQ,MAAM,MAAM,OAAO,CAAC,CAAC,KAAK,GAAG,EAAE,EAAE;EAChH,MAAM,EAAE,qBAAqB,yBAAyB,MAAM,OAAO;EACnE,MAAM,IAAI,SAAS,MAAM,UAAU,MAAM,OAAO,GAAG,YAAY,IAAI,GAAG,EAAE,QAAQ,MAAM,OAAO,CAAC;EAC9F,IAAI,MAAM,QAAQ,EAAE,UAAU,CAAC,GAAI,EAAE,WAAW,CAAC,GAAI,WAAW,oBAAoB,IAAI,EAAE,0DAA0D;OAC/I,qBAAqB,MAAM,GAAG,QAAQ,IAAI,KAAK;EACpD,eAAe,CAAC;EAChB,IAAI,CAAC,EAAE,IAAI,QAAQ,WAAW;CAChC,CAAC;CAEH,cACE,QAAQ,QAAQ,YAAY,CAAC,CAAC,YAAY,mHAAmH,CAC/J,CAAC,CAAC,OAAO,OAAO,UAAgC;EAC9C,MAAM,EAAE,mBAAmB,MAAM,OAAO;EACxC,QAAQ,WAAW,eAAe,MAAM,WAAA,SAA0B;CACpE,CAAC;CAED,MAAM,SAAS,YACb,QACG,QAAQ,QAAQ,CAAC,CACjB,YAAY,wHAAwH,CACzI,CAAC,CACE,OAAO,aAAa,6FAA6F,CAAC,CAClH,OAAO,gBAAgB,6FAA6F,CAAC,CACrH,OAAO,cAAc,kJAAkJ,CAAC,CACxK,OAAO,iBAAiB,yFAAyF,IAAI,SAAS,CAAC,CAAC,CAChI,OAAO,yBAAyB,0DAA0D,aAAa,KAAK,IAAI,EAAE,uCAAuC,CAAC,CAC1J,YAAY,SAAS,YAAY,CAAC,CAAC,CACnC,OAAO,OAAO,UAAkD;EAC/D,IAAI,MAAM,gBAAgB,KAAA,GAAW;GACnC,MAAM,EAAE,iBAAiB,WAAW,MAAM,OAAO;GACjD,MAAM,OAAO,MAAM,YAAY,KAAK,CAAC,CAAC,YAAY;GAClD,MAAM,IAAI,OAAO,SAAS,UAAU,UAAU,gBAAgB,IAAI,GAAG,MAAM,WAAA,SAA0B;GAErG,QAAQ,OAAO,MAAM,GAAG,EAAE,QAAQ,EAAE,QAAQ,GAAG;GAC/C;EACF;EACA,MAAM,EAAE,gBAAgB,MAAM,OAAO;EACrC,QAAQ,KAAK,MAAM,YAAY;GAAE;GAAO,eAAe;EAAK,CAAC,CAAC;CAChE,CAAC;CAEH,cAAc,OAAO,QAAQ,QAAQ,CAAC,CAAC,YAAY,wEAAwE,CAAC,CAAC,CAAC,OAAO,OAAO,IAAa,QAAiB;EACxK,MAAM,QAAQ,IAA0B,GAAG;EAC3C,MAAM,EAAE,gBAAgB,MAAM,OAAO;EACrC,MAAM,YAAY,MAAM,WAAA,SAA0B;CACpD,CAAC;CAED,cAAc,OAAO,QAAQ,QAAQ,CAAC,CAAC,YAAY,yEAAyE,CAAC,CAAC,CAC3H,OAAO,YAAY,yDAAyD,CAAC,CAC7E,OAAO,OAAO,IAAa,QAAiB;EAC3C,MAAM,QAAQ,IAA4C,GAAG;EAC7D,MAAM,EAAE,gBAAgB,MAAM,OAAO;EACrC,YAAY,MAAM,WAAA,WAA4B,KAAK;CACrD,CAAC;CAEH,cACE,OACG,QAAQ,QAAQ,CAAC,CACjB,YAAY,oGAAoG,CACrH,CAAC,CACE,OAAO,sBAAsB,yGAAyG,CAAC,CACvI,OAAO,0BAA0B,wEAAwE,CAAC,CAC1G,OAAO,oBAAoB,oLAAoL,CAAC,CAChN,OAAO,mBAAmB,wGAAwG,CAAC,CACnI,OAAO,SAAS,+GAA+G,CAAC,CAChI,YAAY,SAAS,WAAW,CAAC,CAAC,CAClC,OAAO,OAAO,IAAa,QAAiB;EAC3C,MAAM,QAAQ,IAAiB,GAAG;EAClC,MAAM,EAAE,oBAAoB,MAAM,OAAO;EACzC,QAAQ,WAAW,MAAM,gBAAgB,MAAM,WAAA,WAA4B,KAAK;CAClF,CAAC;CAEH,YAAY,OAAO,QAAQ,MAAM,CAAC,CAAC,YAAY,iEAAiE,CAAC,CAAC,CAC/G,OAAO,YAAY,+CAA+C,CAAC,CACnE,OAAO,kBAAkB,4CAA4C,CAAC,CACtE,OAAO,WAAW,yCAAyC,CAAC,CAC5D,OAAO,UAAU,sBAAsB,CAAC,CACxC,OAAO,OAAO,IAAa,QAAiB;EAC3C,MAAM,QAAQ,IAAsF,GAAG;EACvG,MAAM,QAAQ,MAAM,OAAO;EAC3B,MAAM,UAAU,MAAM,WAAA;EACtB,IAAI,MAAM,OAAO,MAAM,UAAU,SAAS,MAAM,EAAE;OAC7C,IAAI,MAAM,QACR;OAAA,MAAM,MAAM,WAAW,KAAK,IAAK,GAAG,QAAQ,WAAW;EAAA,OACvD,MAAM,UAAU,SAAS,KAAK;CACvC,CAAC;CAEH,MAAM,UAAU,OAAO,QAAQ,SAAS,CAAC,CAAC,YAAY,4FAA4F;CAClJ,YAAY,QAAQ,QAAQ,SAAS,CAAC,CAAC,YAAY,0FAA0F,CAAC,CAAC,CAAC,OAC9I,OAAO,IAAa,QAAiB;EACnC,MAAM,QAAQ,IAAiB,GAAG;EAClC,MAAM,EAAE,yBAAyB,MAAM,OAAO;EAC9C,MAAM,qBAAqB,KAAK;CAClC,CACF;CACA,cAAc,QAAQ,QAAQ,WAAW,CAAC,CAAC,YAAY,0DAA0D,CAAC,CAAC,CAAC,OAAO,OAAO,IAAa,QAAiB;EAC9J,MAAM,QAAQ,IAA0B,GAAG;EAC3C,MAAM,EAAE,2BAA2B,MAAM,OAAO;EAChD,uBAAuB,MAAM,WAAA,SAA0B;CACzD,CAAC;CACD,cAAc,QAAQ,QAAQ,QAAQ,CAAC,CAAC,YAAY,oDAAoD,CAAC,CAAC,CAAC,OAAO,OAAO,IAAa,QAAiB;EACrJ,MAAM,QAAQ,IAA0B,GAAG;EAC3C,MAAM,EAAE,wBAAwB,MAAM,OAAO;EAC7C,oBAAoB,MAAM,WAAA,SAA0B;CACtD,CAAC;AACH"}
+{"version":3,"file":"commands-DAd3ICss.js","names":[],"sources":["../server/listen/commands.ts"],"sourcesContent":["import { type Command, InvalidArgumentError } from \"commander\";\nimport { LEGACY_PRODUCT } from \"../brand.ts\";\nimport { EVENT_TYPES } from \"../../shared/types.ts\";\nimport type { ConnectFlags } from \"./connect.ts\";\nimport type { HermesFlags } from \"./hermes.ts\";\nimport type { ListenFlags } from \"./options.ts\";\nimport { DEFAULT_PROFILE } from \"./paths.ts\";\nimport { RECIPE_NAMES, recipesHelp, TOOLS } from \"./recipes.ts\";\nimport { NPX } from \"./version.ts\";\n\n/** `xaq connect`, `xaq setup-mcp` and `xaq listen …`, all lazily loaded. */\n\n/**\n * Options of a `listen` subcommand plus any its ancestors parsed: `listen` declares the same flags\n * (--profile, --exec…), and commander lets the parent claim them wherever they appear.\n */\nconst all = <T>(cmd: Command): T => cmd.optsWithGlobals() as T;\n\nconst collect = (value: string, previous: string[] | undefined) => [...(previous ?? []), value];\n\nconst int = (name: string) => (value: string) => {\n  if (!/^\\d+$/.test(value)) throw new InvalidArgumentError(`${name} must be a whole number.`);\n  return Number(value);\n};\n\nconst profileOption = (cmd: Command) => cmd.option(\"--profile <name>\", `profile to use (default \"${DEFAULT_PROFILE}\")`);\n\nfunction listenFlags(cmd: Command): Command {\n  return profileOption(cmd)\n    .option(\"--exec <command>\", \"run this command for each event (via /bin/sh; the event arrives on stdin as JSON, never in the command)\")\n    .option(\"--recipe <name>\", `use a built-in target: ${RECIPE_NAMES.join(\", \")} (hermes forwards to your Hermes gateway; see it with --print-recipe)`)\n    .option(\"--forward <url>\", \"POST each event to this localhost URL, signed per Standard Webhooks\")\n    .option(\"--types <list>\", `comma-separated event types, or \"all\" (default: message.received, new mail only; also ${EVENT_TYPES.filter((t) => t !== \"message.received\").join(\", \")}; calendar.* need calendar.read)`)\n    .option(\"--from <glob>\", 'only senders (calendar: organizers) matching this glob, e.g. \"*@stripe.com\" (repeatable)', collect)\n    .option(\"--to <glob>\", \"only when a to/cc address (calendar: an attendee) matches (repeatable)\", collect)\n    .option(\"--label <id>\", \"only messages with this Gmail label id, e.g. INBOX or Label_123 (repeatable)\", collect)\n    .option(\"--subject <regex>\", \"only subjects (calendar: event titles) matching this case-insensitive regular expression\")\n    .option(\"--not-from <glob>\", 'skip senders matching this glob, e.g. \"*@github.com\" (repeatable; --not-from \"\" --save clears saved exclusions)', collect)\n    .option(\"--not-label <id>\", \"skip messages with this Gmail label id, e.g. CATEGORY_UPDATES (repeatable)\", collect)\n    .option(\"--all-categories\", \"don't skip Gmail's Promotions, Social and Forums tabs (skipped by default)\")\n    .option(\"--include-category <name>\", \"take one category back from the default skip: promotions, social or forums (repeatable)\", collect)\n    .option(\"--default-categories\", \"back to the default: skip Promotions, Social and Forums (undoes a saved --all-categories / --include-category)\")\n    .option(\"--batch <duration>\", `collect events this long (e.g. 60s, 2m) and run --exec once for all of them (up to 20); 0 turns it off`)\n    .option(\"--include-body\", \"include the cleaned message body (calendar: the event description) in each event\")\n    .option(\"--no-include-body\", \"don't include bodies (overrides a saved setting)\")\n    .option(\"--concurrency <n>\", \"events handled at once (default 2)\", int(\"--concurrency\"))\n    .option(\"--timeout <seconds>\", \"per-event time limit; the whole process group is killed after it (default 300)\", int(\"--timeout\"))\n    .option(\"--max-attempts <n>\", \"attempts before an event goes to dead letters (default 5)\", int(\"--max-attempts\"))\n    .option(\"--consumer <name>\", \"server-side cursor name (default <hostname>-<profile>)\")\n    .option(\"--cwd <dir>\", \"directory --exec commands run in (default: a private dir in the state dir; must be yours and not group/world-writable)\")\n    .option(\"--insecure\", \"allow plain http to a non-loopback, non-Tailscale daemon (loud warning)\")\n    .option(\"--save\", \"save these settings to the profile\");\n}\n\n/** `listen hermes --help`. */\nfunction hermesHelp(): string {\n  return `\n--recipe hermes forwards each event to your running Hermes gateway (http://127.0.0.1:8644/webhooks/xaq; for\nanother profile the route is xaq-<profile>; a profile set up before the rename keeps its ${LEGACY_PRODUCT}[-<profile>] route,\ntoolset and server name). Hermes verifies the Standard Webhooks signature with the\nlistener's secret, runs the triage, and delivers the result where this route says. Mail that isn't important gets\na [SILENT] reply, which Hermes doesn't deliver.\n\nA Hermes webhook run normally gets web tools (web_search, web_extract, vision_analyze, clarify) and every MCP\nserver enabled in Hermes: with email as the trigger, an attacker could make it read your mail and send it out.\n--run therefore also limits the route to the xaq MCP server (\"toolsets\": [\"mcp-xaq\"] in\nwebhook_subscriptions.json, which \\`hermes webhook subscribe\\` can't set). That limit only holds when xaq is an\nenabled MCP server in Hermes' config.yaml (else Hermes adds every MCP server), so this refuses until\n\\`${NPX} setup-mcp --tool hermes\\` has added it. --run creates the route disabled with the real secret under Hermes'\nlock (python3), runs \\`hermes webhook subscribe\\` without --secret (hermes keeps the secret and the disabled state),\nthen sets the toolsets and enables it. The secret is never in a command line, the route never runs unconfined, and\nany failure removes it again. Re-run it after any \\`hermes webhook subscribe\\` for this route (that resets the\ntoolsets). The Hermes home follows HERMES_HOME or Hermes' sticky active_profile.\n\nWithout --run it prints both steps for you to do by hand; the toolsets edit is required.\n\n--cron-job hands the email to that job's own tools, so it is accepted only when the job's enabled_toolsets is\nexactly [\"xaq\"] (the bare server name; \"mcp-xaq\" doesn't narrow MCP servers for cron jobs).\n\nNeeds python3, the gateway's webhook platform (hermes gateway setup, or WEBHOOK_ENABLED=true in ~/.hermes/.env) and\na running gateway. Check it: curl http://127.0.0.1:8644/health\n\nExamples:\n  ${NPX} listen hermes --deliver telegram --run\n  ${NPX} listen hermes --cron-job email-watch --run    # only for a job limited to [\"xaq\"]\n  ${NPX} listen service install --recipe hermes`;\n}\n\n/** `setup-mcp --help`: exactly what it changes, per tool. */\nfunction mcpSetupHelp(): string {\n  return `\nWhat it changes (the server is named \"xaq\", or \"xaq-<profile>\" for --profile; a profile set up before the\nrename keeps the \"${LEGACY_PRODUCT}[-<profile>]\" name it already has in your tools):\n  claude-code  runs \\`claude mcp remove xaq --scope user\\` then\n               \\`claude mcp add-json --scope user xaq '{\"type\":\"http\",\"url\":\"<daemon>/mcp\",\"headersHelper\":\"…\"}'\\`.\n               The header helper (~/.config/xaq/bin/mcp-header.mjs) reads the key from your profile, so\n               the key is in neither the command line nor ~/.claude.json. Backs up ~/.claude.json first\n               ($CLAUDE_CONFIG_DIR/.claude.json if set).\n  codex        adds or replaces [mcp_servers.xaq] in ~/.codex/config.toml ($CODEX_HOME), with the key in\n               http_headers; the file becomes 0600.\n  cursor       adds or replaces mcpServers.xaq in ~/.cursor/mcp.json, with the key in headers; 0600.\n  hermes       adds or replaces mcp_servers.xaq in ~/.hermes/config.yaml ($HERMES_HOME) and puts the key in\n               ~/.hermes/.env as XAQ_API_KEY; both 0600.\nEvery file is backed up first as <file>.xaq-backup-<timestamp> (0600; backups of files holding the key hold it\ntoo). It also refreshes ~/.config/xaq/mcp/<profile>.claude.json (no key), which the listen recipe uses.\n\nCheck it afterwards: claude mcp list · codex mcp list · agent mcp list (Cursor) · hermes mcp test xaq\n\nExample:\n  ${NPX} setup-mcp --tool claude-code --dry-run`;\n}\n\nexport function registerListenCommands(program: Command): void {\n  program\n    .command(\"connect\")\n    .description(\"pair this machine's agent with a xaq daemon (approve the code in the console)\")\n    .argument(\"<daemon-url>\", \"the xaq daemon, e.g. https://mail.example.com or http://100.101.102.103:8425\")\n    .option(\"--name <name>\", 'how the agent appears in the console (default \"<Tool> on <hostname>\")')\n    .option(\"--tool <tool>\", `the agent's tool: ${TOOLS.join(\", \")}; tailors the next steps`)\n    .option(\"--account <email>\", \"mailbox to request access to (repeatable; the approver decides)\", collect)\n    .option(\"--capabilities <list>\", \"capabilities to request, e.g. read,draft or read,calendar.read (the approver decides)\")\n    .option(\"--reason <text>\", \"why the agent needs access (shown to the approver)\")\n    .option(\"--setup-mcp\", \"also register the MCP server in the chosen tool (the key is never shown; `setup-mcp --help` lists exactly what changes)\")\n    .option(\"--profile <name>\", `profile to save the key in (default \"${DEFAULT_PROFILE}\")`)\n    .option(\"--consumer <name>\", \"listener cursor name (default <hostname>-<profile>)\")\n    .option(\"--log <file>\", \"also write the output to this file (created 0600; for running connect in the background)\")\n    .option(\"--insecure\", \"allow plain http to a non-loopback, non-Tailscale daemon (loud warning)\")\n    .option(\"--force\", \"re-pair an existing profile (keeps its listener settings)\")\n    .addHelpText(\n      \"after\",\n      `\nExit codes: 0 approved, 2 denied, 3 expired, 4 already consumed, 130 cancelled, 1 error.\n\nExample:\n  ${NPX} connect https://mail.example.com --tool claude-code --setup-mcp`,\n    )\n    .action(async (url: string, flags: ConnectFlags) => {\n      const { runConnect } = await import(\"./connect.ts\");\n      process.exit(await runConnect(url, flags, { handleSignals: true }));\n    });\n\n  profileOption(program.command(\"setup-mcp\").description(\"register the xaq MCP server in your agent's tool, without showing the key\"))\n    .option(\"--tool <tool>\", `${TOOLS.filter((t) => t !== \"other\").join(\", \")} (default: the tool given to connect)`)\n    .option(\"--dry-run\", \"print the exact commands and file changes, and change nothing\")\n    .addHelpText(\"after\", mcpSetupHelp())\n    .action(async (flags: { tool?: string; profile?: string; dryRun?: boolean }) => {\n      const { parseTool, printMcpResult } = await import(\"./connect.ts\");\n      const { loadProfile } = await import(\"./profile.ts\");\n      const { setupMcp, mcpTarget } = await import(\"./mcpsetup.ts\");\n      const { profilePath } = await import(\"./paths.ts\");\n      const name = flags.profile ?? DEFAULT_PROFILE;\n      const profile = loadProfile(name);\n      const tool = flags.tool ? parseTool(flags.tool) : (profile.tool ?? \"other\");\n      if (tool === \"other\") throw new Error(`Which tool? Pass --tool ${TOOLS.filter((t) => t !== \"other\").join(\"|\")}.`);\n      const { claudeMcpConfigPath, writeClaudeMcpConfig } = await import(\"./mcpheader.ts\");\n      const r = setupMcp(tool, mcpTarget(name, profile), profilePath(name), { dryRun: flags.dryRun });\n      if (flags.dryRun) r.changes = [...(r.changes ?? []), `refresh ${claudeMcpConfigPath(name)} (keyless MCP config the Claude Code listen recipe loads)`];\n      else writeClaudeMcpConfig(name, `${profile.url}/mcp`);\n      printMcpResult(r);\n      if (!r.ok) process.exitCode = 1;\n    });\n\n  profileOption(\n    program.command(\"mcp-header\").description(\"print the agent's Authorization header as JSON for an MCP client's header helper (refuses to print to a terminal)\"),\n  ).action(async (flags: { profile?: string }) => {\n    const { printMcpHeader } = await import(\"./mcpheader.ts\");\n    process.exitCode = printMcpHeader(flags.profile ?? DEFAULT_PROFILE);\n  });\n\n  const listen = listenFlags(\n    program\n      .command(\"listen\")\n      .description(\"wake a local agent on new mail: hold an outbound stream to the daemon and run a command or POST to localhost per event\"),\n  )\n    .option(\"--dry-run\", \"print matching events without running anything (uses a throwaway <consumer>-dry-run cursor)\")\n    .option(\"--from-start\", \"a NEW consumer starts at the oldest stored event (no effect once it exists: use --backfill)\")\n    .option(\"--backfill\", \"run the mail from before this listener started through --exec/--forward once, oldest first, then exit; safe while the listener runs (own cursor)\")\n    .option(\"--until <seq>\", \"with --backfill: replay up to this event number instead of where the listener started\", int(\"--until\"))\n    .option(\"--print-recipe <name>\", `print what --recipe <name> runs (hermes: its URL), for ${RECIPE_NAMES.join(\", \")} (with this machine's paths), and exit`)\n    .addHelpText(\"after\", recipesHelp())\n    .action(async (flags: ListenFlags & { printRecipe?: string }) => {\n      if (flags.printRecipe !== undefined) {\n        const { parseRecipeTool, recipe } = await import(\"./recipes.ts\");\n        const name = flags.printRecipe.trim().toLowerCase();\n        const r = recipe(name === \"other\" ? \"other\" : parseRecipeTool(name), flags.profile ?? DEFAULT_PROFILE);\n        // Exec recipes print the bare command (to edit and pass back with --exec); hermes its forward URL.\n        process.stdout.write(`${r.exec ?? r.forward}\\n`);\n        return;\n      }\n      const { runListener } = await import(\"./listen.ts\");\n      process.exit(await runListener({ flags, handleSignals: true }));\n    });\n\n  profileOption(listen.command(\"status\").description(\"show the listener's connection, cursor, recent events and dead letters\")).action(async (_o: unknown, cmd: Command) => {\n    const flags = all<{ profile?: string }>(cmd);\n    const { printStatus } = await import(\"./admin.ts\");\n    await printStatus(flags.profile ?? DEFAULT_PROFILE);\n  });\n\n  profileOption(listen.command(\"secret\").description(\"print the forward-mode signing secret (whsec_…) for your local receiver\"))\n    .option(\"--rotate\", \"generate a new secret (restart the listener afterwards)\")\n    .action(async (_o: unknown, cmd: Command) => {\n      const flags = all<{ profile?: string; rotate?: boolean }>(cmd);\n      const { printSecret } = await import(\"./admin.ts\");\n      printSecret(flags.profile ?? DEFAULT_PROFILE, flags);\n    });\n\n  profileOption(\n    listen\n      .command(\"hermes\")\n      .description(\"create the Hermes gateway webhook route that --recipe hermes forwards to, limited to the xaq tools\"),\n  )\n    .option(\"--deliver <target>\", \"where Hermes sends its triage: telegram, discord, slack… (a platform connected to your gateway), or log\")\n    .option(\"--deliver-chat-id <id>\", \"with --deliver: a specific chat instead of the platform's home channel\")\n    .option(\"--cron-job <job>\", \"instead of --deliver: fire this existing Hermes cron job (id or name; `hermes cron list`); its prompt, tools and delivery apply, so its enabled_toolsets must be exactly [\\\"xaq\\\"]\")\n    .option(\"--script <file>\", \"a Hermes filter script under ~/.hermes/scripts (runs before the agent; can drop events at no LLM cost)\")\n    .option(\"--run\", \"set the route up now: run hermes, then set the real secret and limit the route to the xaq tools (recommended)\")\n    .addHelpText(\"after\", hermesHelp())\n    .action(async (_o: unknown, cmd: Command) => {\n      const flags = all<HermesFlags>(cmd);\n      const { hermesSubscribe } = await import(\"./hermes.ts\");\n      process.exitCode = await hermesSubscribe(flags.profile ?? DEFAULT_PROFILE, flags);\n    });\n\n  listenFlags(listen.command(\"dead\").description(\"list events that failed every attempt; --replay runs them again\"))\n    .option(\"--replay\", \"run dead events again (successes are removed)\")\n    .option(\"--id <eventId>\", \"only this event (with --replay or --clear)\")\n    .option(\"--clear\", \"delete dead events without running them\")\n    .option(\"--json\", \"print raw JSON lines\")\n    .action(async (_o: unknown, cmd: Command) => {\n      const flags = all<ListenFlags & { replay?: boolean; id?: string; clear?: boolean; json?: boolean }>(cmd);\n      const admin = await import(\"./admin.ts\");\n      const profile = flags.profile ?? DEFAULT_PROFILE;\n      if (flags.clear) admin.clearDead(profile, flags.id);\n      else if (flags.replay) {\n        if ((await admin.replayDead(flags)) > 0) process.exitCode = 1;\n      } else admin.printDead(profile, flags);\n    });\n\n  const service = listen.command(\"service\").description(\"run the listener in the background (systemd user service / launchd agent, one per profile)\");\n  listenFlags(service.command(\"install\").description(\"install and start the listener service; flags are saved to the profile. Re-run to update\")).action(\n    async (_o: unknown, cmd: Command) => {\n      const flags = all<ListenFlags>(cmd);\n      const { installListenService } = await import(\"./service.ts\");\n      await installListenService(flags);\n    },\n  );\n  profileOption(service.command(\"uninstall\").description(\"stop and remove the listener service (keeps the profile)\")).action(async (_o: unknown, cmd: Command) => {\n    const flags = all<{ profile?: string }>(cmd);\n    const { uninstallListenService } = await import(\"./service.ts\");\n    uninstallListenService(flags.profile ?? DEFAULT_PROFILE);\n  });\n  profileOption(service.command(\"status\").description(\"show the service manager's status for the listener\")).action(async (_o: unknown, cmd: Command) => {\n    const flags = all<{ profile?: string }>(cmd);\n    const { listenServiceStatus } = await import(\"./service.ts\");\n    listenServiceStatus(flags.profile ?? DEFAULT_PROFILE);\n  });\n}\n"],"mappings":";;;;;;;;;;;;;AAgBA,MAAM,OAAU,QAAoB,IAAI,gBAAgB;AAExD,MAAM,WAAW,OAAe,aAAmC,CAAC,GAAI,YAAY,CAAC,GAAI,KAAK;AAE9F,MAAM,OAAO,UAAkB,UAAkB;CAC/C,IAAI,CAAC,QAAQ,KAAK,KAAK,GAAG,MAAM,IAAI,qBAAqB,GAAG,KAAK,yBAAyB;CAC1F,OAAO,OAAO,KAAK;AACrB;AAEA,MAAM,iBAAiB,QAAiB,IAAI,OAAO,oBAAoB,4BAA4B,gBAAgB,GAAG;AAEtH,SAAS,YAAY,KAAuB;CAC1C,OAAO,cAAc,GAAG,CAAC,CACtB,OAAO,oBAAoB,yGAAyG,CAAC,CACrI,OAAO,mBAAmB,0BAA0B,aAAa,KAAK,IAAI,EAAE,sEAAsE,CAAC,CACnJ,OAAO,mBAAmB,qEAAqE,CAAC,CAChG,OAAO,kBAAkB,yFAAyF,YAAY,QAAQ,MAAM,MAAM,kBAAkB,CAAC,CAAC,KAAK,IAAI,EAAE,iCAAiC,CAAC,CACnN,OAAO,iBAAiB,8FAA4F,OAAO,CAAC,CAC5H,OAAO,eAAe,0EAA0E,OAAO,CAAC,CACxG,OAAO,gBAAgB,gFAAgF,OAAO,CAAC,CAC/G,OAAO,qBAAqB,0FAA0F,CAAC,CACvH,OAAO,qBAAqB,uHAAmH,OAAO,CAAC,CACvJ,OAAO,oBAAoB,8EAA8E,OAAO,CAAC,CACjH,OAAO,oBAAoB,4EAA4E,CAAC,CACxG,OAAO,6BAA6B,2FAA2F,OAAO,CAAC,CACvI,OAAO,wBAAwB,gHAAgH,CAAC,CAChJ,OAAO,sBAAsB,wGAAwG,CAAC,CACtI,OAAO,kBAAkB,kFAAkF,CAAC,CAC5G,OAAO,qBAAqB,kDAAkD,CAAC,CAC/E,OAAO,qBAAqB,sCAAsC,IAAI,eAAe,CAAC,CAAC,CACvF,OAAO,uBAAuB,kFAAkF,IAAI,WAAW,CAAC,CAAC,CACjI,OAAO,sBAAsB,6DAA6D,IAAI,gBAAgB,CAAC,CAAC,CAChH,OAAO,qBAAqB,wDAAwD,CAAC,CACrF,OAAO,eAAe,wHAAwH,CAAC,CAC/I,OAAO,cAAc,yEAAyE,CAAC,CAC/F,OAAO,UAAU,oCAAoC;AAC1D;;AAGA,SAAS,aAAqB;CAC5B,OAAO;;2FAEkF,eAAe;;;;;;;;;;IAUtG,IAAI;;;;;;;;;;;;;;;IAeJ,IAAI;IACJ,IAAI;IACJ,IAAI;AACR;;AAGA,SAAS,eAAuB;CAC9B,OAAO;;oBAEW,eAAe;;;;;;;;;;;;;;;;;IAiB/B,IAAI;AACR;AAEA,SAAgB,uBAAuB,SAAwB;CAC7D,QACG,QAAQ,SAAS,CAAC,CAClB,YAAY,+EAA+E,CAAC,CAC5F,SAAS,gBAAgB,8EAA8E,CAAC,CACxG,OAAO,iBAAiB,yEAAuE,CAAC,CAChG,OAAO,iBAAiB,qBAAqB,MAAM,KAAK,IAAI,EAAE,yBAAyB,CAAC,CACxF,OAAO,qBAAqB,mEAAmE,OAAO,CAAC,CACvG,OAAO,yBAAyB,uFAAuF,CAAC,CACxH,OAAO,mBAAmB,oDAAoD,CAAC,CAC/E,OAAO,eAAe,yHAAyH,CAAC,CAChJ,OAAO,oBAAoB,wCAAwC,gBAAgB,GAAG,CAAC,CACvF,OAAO,qBAAqB,qDAAqD,CAAC,CAClF,OAAO,gBAAgB,0FAA0F,CAAC,CAClH,OAAO,cAAc,yEAAyE,CAAC,CAC/F,OAAO,WAAW,2DAA2D,CAAC,CAC9E,YACC,SACA;;;;IAIF,IAAI,iEACJ,CAAC,CACA,OAAO,OAAO,KAAa,UAAwB;EAClD,MAAM,EAAE,eAAe,MAAM,OAAO;EACpC,QAAQ,KAAK,MAAM,WAAW,KAAK,OAAO,EAAE,eAAe,KAAK,CAAC,CAAC;CACpE,CAAC;CAEH,cAAc,QAAQ,QAAQ,WAAW,CAAC,CAAC,YAAY,2EAA2E,CAAC,CAAC,CACjI,OAAO,iBAAiB,GAAG,MAAM,QAAQ,MAAM,MAAM,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,sCAAsC,CAAC,CAChH,OAAO,aAAa,+DAA+D,CAAC,CACpF,YAAY,SAAS,aAAa,CAAC,CAAC,CACpC,OAAO,OAAO,UAAiE;EAC9E,MAAM,EAAE,WAAW,mBAAmB,MAAM,OAAO;EACnD,MAAM,EAAE,gBAAgB,MAAM,OAAO;EACrC,MAAM,EAAE,UAAU,cAAc,MAAM,OAAO;EAC7C,MAAM,EAAE,gBAAgB,MAAM,OAAO;EACrC,MAAM,OAAO,MAAM,WAAA;EACnB,MAAM,UAAU,YAAY,IAAI;EAChC,MAAM,OAAO,MAAM,OAAO,UAAU,MAAM,IAAI,IAAK,QAAQ,QAAQ;EACnE,IAAI,SAAS,SAAS,MAAM,IAAI,MAAM,2BAA2B,MAAM,QAAQ,MAAM,MAAM,OAAO,CAAC,CAAC,KAAK,GAAG,EAAE,EAAE;EAChH,MAAM,EAAE,qBAAqB,yBAAyB,MAAM,OAAO;EACnE,MAAM,IAAI,SAAS,MAAM,UAAU,MAAM,OAAO,GAAG,YAAY,IAAI,GAAG,EAAE,QAAQ,MAAM,OAAO,CAAC;EAC9F,IAAI,MAAM,QAAQ,EAAE,UAAU,CAAC,GAAI,EAAE,WAAW,CAAC,GAAI,WAAW,oBAAoB,IAAI,EAAE,0DAA0D;OAC/I,qBAAqB,MAAM,GAAG,QAAQ,IAAI,KAAK;EACpD,eAAe,CAAC;EAChB,IAAI,CAAC,EAAE,IAAI,QAAQ,WAAW;CAChC,CAAC;CAEH,cACE,QAAQ,QAAQ,YAAY,CAAC,CAAC,YAAY,mHAAmH,CAC/J,CAAC,CAAC,OAAO,OAAO,UAAgC;EAC9C,MAAM,EAAE,mBAAmB,MAAM,OAAO;EACxC,QAAQ,WAAW,eAAe,MAAM,WAAA,SAA0B;CACpE,CAAC;CAED,MAAM,SAAS,YACb,QACG,QAAQ,QAAQ,CAAC,CACjB,YAAY,wHAAwH,CACzI,CAAC,CACE,OAAO,aAAa,6FAA6F,CAAC,CAClH,OAAO,gBAAgB,6FAA6F,CAAC,CACrH,OAAO,cAAc,kJAAkJ,CAAC,CACxK,OAAO,iBAAiB,yFAAyF,IAAI,SAAS,CAAC,CAAC,CAChI,OAAO,yBAAyB,0DAA0D,aAAa,KAAK,IAAI,EAAE,uCAAuC,CAAC,CAC1J,YAAY,SAAS,YAAY,CAAC,CAAC,CACnC,OAAO,OAAO,UAAkD;EAC/D,IAAI,MAAM,gBAAgB,KAAA,GAAW;GACnC,MAAM,EAAE,iBAAiB,WAAW,MAAM,OAAO;GACjD,MAAM,OAAO,MAAM,YAAY,KAAK,CAAC,CAAC,YAAY;GAClD,MAAM,IAAI,OAAO,SAAS,UAAU,UAAU,gBAAgB,IAAI,GAAG,MAAM,WAAA,SAA0B;GAErG,QAAQ,OAAO,MAAM,GAAG,EAAE,QAAQ,EAAE,QAAQ,GAAG;GAC/C;EACF;EACA,MAAM,EAAE,gBAAgB,MAAM,OAAO;EACrC,QAAQ,KAAK,MAAM,YAAY;GAAE;GAAO,eAAe;EAAK,CAAC,CAAC;CAChE,CAAC;CAEH,cAAc,OAAO,QAAQ,QAAQ,CAAC,CAAC,YAAY,wEAAwE,CAAC,CAAC,CAAC,OAAO,OAAO,IAAa,QAAiB;EACxK,MAAM,QAAQ,IAA0B,GAAG;EAC3C,MAAM,EAAE,gBAAgB,MAAM,OAAO;EACrC,MAAM,YAAY,MAAM,WAAA,SAA0B;CACpD,CAAC;CAED,cAAc,OAAO,QAAQ,QAAQ,CAAC,CAAC,YAAY,yEAAyE,CAAC,CAAC,CAC3H,OAAO,YAAY,yDAAyD,CAAC,CAC7E,OAAO,OAAO,IAAa,QAAiB;EAC3C,MAAM,QAAQ,IAA4C,GAAG;EAC7D,MAAM,EAAE,gBAAgB,MAAM,OAAO;EACrC,YAAY,MAAM,WAAA,WAA4B,KAAK;CACrD,CAAC;CAEH,cACE,OACG,QAAQ,QAAQ,CAAC,CACjB,YAAY,oGAAoG,CACrH,CAAC,CACE,OAAO,sBAAsB,yGAAyG,CAAC,CACvI,OAAO,0BAA0B,wEAAwE,CAAC,CAC1G,OAAO,oBAAoB,oLAAoL,CAAC,CAChN,OAAO,mBAAmB,wGAAwG,CAAC,CACnI,OAAO,SAAS,+GAA+G,CAAC,CAChI,YAAY,SAAS,WAAW,CAAC,CAAC,CAClC,OAAO,OAAO,IAAa,QAAiB;EAC3C,MAAM,QAAQ,IAAiB,GAAG;EAClC,MAAM,EAAE,oBAAoB,MAAM,OAAO;EACzC,QAAQ,WAAW,MAAM,gBAAgB,MAAM,WAAA,WAA4B,KAAK;CAClF,CAAC;CAEH,YAAY,OAAO,QAAQ,MAAM,CAAC,CAAC,YAAY,iEAAiE,CAAC,CAAC,CAC/G,OAAO,YAAY,+CAA+C,CAAC,CACnE,OAAO,kBAAkB,4CAA4C,CAAC,CACtE,OAAO,WAAW,yCAAyC,CAAC,CAC5D,OAAO,UAAU,sBAAsB,CAAC,CACxC,OAAO,OAAO,IAAa,QAAiB;EAC3C,MAAM,QAAQ,IAAsF,GAAG;EACvG,MAAM,QAAQ,MAAM,OAAO;EAC3B,MAAM,UAAU,MAAM,WAAA;EACtB,IAAI,MAAM,OAAO,MAAM,UAAU,SAAS,MAAM,EAAE;OAC7C,IAAI,MAAM,QACR;OAAA,MAAM,MAAM,WAAW,KAAK,IAAK,GAAG,QAAQ,WAAW;EAAA,OACvD,MAAM,UAAU,SAAS,KAAK;CACvC,CAAC;CAEH,MAAM,UAAU,OAAO,QAAQ,SAAS,CAAC,CAAC,YAAY,4FAA4F;CAClJ,YAAY,QAAQ,QAAQ,SAAS,CAAC,CAAC,YAAY,0FAA0F,CAAC,CAAC,CAAC,OAC9I,OAAO,IAAa,QAAiB;EACnC,MAAM,QAAQ,IAAiB,GAAG;EAClC,MAAM,EAAE,yBAAyB,MAAM,OAAO;EAC9C,MAAM,qBAAqB,KAAK;CAClC,CACF;CACA,cAAc,QAAQ,QAAQ,WAAW,CAAC,CAAC,YAAY,0DAA0D,CAAC,CAAC,CAAC,OAAO,OAAO,IAAa,QAAiB;EAC9J,MAAM,QAAQ,IAA0B,GAAG;EAC3C,MAAM,EAAE,2BAA2B,MAAM,OAAO;EAChD,uBAAuB,MAAM,WAAA,SAA0B;CACzD,CAAC;CACD,cAAc,QAAQ,QAAQ,QAAQ,CAAC,CAAC,YAAY,oDAAoD,CAAC,CAAC,CAAC,OAAO,OAAO,IAAa,QAAiB;EACrJ,MAAM,QAAQ,IAA0B,GAAG;EAC3C,MAAM,EAAE,wBAAwB,MAAM,OAAO;EAC7C,oBAAoB,MAAM,WAAA,SAA0B;CACtD,CAAC;AACH"}