youmd 0.10.2 → 0.12.0

package/dist/lib/handoff.d.ts

@@ -0,0 +1,170 @@
+/**
+ * Pure contract and planner for `you handoff`.
+ *
+ * The planner deliberately has no process, network, or filesystem access.  The
+ * CLI adapter inventories the fleet through the existing You orchestrator and
+ * remote-command boundary, then executes only the actions returned here.
+ */
+export declare const HANDOFF_CONTRACT: Readonly<{
+    schemaVersion: "you-md/handoff/v1";
+    never: readonly ["sigterm-active-work", "force-push", "reset", "auto-merge"];
+    dirtyRepos: "blocked-native-clean-repo-mvp";
+    cleanAheadPush: "exact-observed-head-no-force";
+    cleanCloneUpdate: "git-pull-ff-only";
+    arbitraryChatControl: false;
+    dreamCycle: "deferred-explicit-opt-in";
+}>;
+export type HandoffWorkerStatus = "running" | "exited" | "failed" | "stopped" | "unknown";
+export interface HandoffMachine {
+    machineKey: string;
+    host: string;
+    isLocal: boolean;
+    online: boolean;
+    managed: boolean;
+    lastSeenAt?: number;
+    note?: string;
+}
+export interface HandoffProject {
+    slug: string;
+    directoryName: string;
+    repoFullName?: string;
+    repoUrl?: string;
+    repoIdentity?: string | null;
+}
+export interface HandoffWorker {
+    id: string;
+    host: string;
+    project?: string;
+    status: HandoffWorkerStatus;
+    harness?: string;
+}
+export type HandoffRepoAvailability = "managed" | "unmanaged" | "offline" | "error";
+export interface HandoffRepoState {
+    machineKey: string;
+    host: string;
+    project: string;
+    availability: HandoffRepoAvailability;
+    dirty?: boolean;
+    branch?: string | null;
+    ahead?: number;
+    behind?: number;
+    headOid?: string | null;
+    upstream?: string | null;
+    upstreamOid?: string | null;
+    remoteUrl?: string | null;
+    remoteIdentity?: string | null;
+    note?: string;
+}
+export interface HandoffInventory {
+    machines: HandoffMachine[];
+    projects: HandoffProject[];
+    workers: HandoffWorker[];
+    repos: HandoffRepoState[];
+}
+/** Exact and short hostname aliases cannot safely address two stable machines on the current bus. */
+export declare function findAmbiguousMachineHosts(machines: Array<{
+    machineKey: string;
+    host: string;
+}>): Set<string>;
+/**
+ * Normalize one Git remote to a transport-independent repository identity.
+ * HTTPS, SSH URLs, and SCP-style Git URLs for the same host/path converge;
+ * local paths remain exact file identities. Invalid or ambiguous inputs fail
+ * closed instead of being guessed from a directory name.
+ */
+export declare function normalizeGitRemoteIdentity(value: string | null | undefined): string | null;
+export declare function projectRemoteIdentity(project: Pick<HandoffProject, "repoIdentity" | "repoUrl" | "repoFullName">): string | null;
+export type HandoffAction = {
+    kind: "worker_state_receipt";
+    machineKey: string;
+    host: string;
+    workerIds: string[];
+    verified: false;
+} | {
+    kind: "push_clean";
+    machineKey: string;
+    host: string;
+    project: string;
+    target: string;
+    expectedHead: string;
+    expectedBranch: string;
+    expectedUpstream: string;
+    expectedUpstreamOid: string;
+    expectedRemoteIdentity: string;
+    expectedFinalOid: string;
+    reason: string;
+} | {
+    kind: "pull_ff_only";
+    machineKey: string;
+    host: string;
+    project: string;
+    target: string;
+    expectedHead: string;
+    expectedBranch: string;
+    expectedUpstream: string;
+    expectedUpstreamOid: string;
+    expectedRemoteIdentity: string;
+    expectedFinalOid: string;
+} | {
+    kind: "machine_sync";
+    machineKey: string;
+    host: string;
+} | {
+    kind: "block";
+    project?: string;
+    hosts?: string[];
+    reason: string;
+} | {
+    kind: "report";
+    host?: string;
+    project?: string;
+    reason: string;
+};
+export interface HandoffPlan {
+    schemaVersion: "you-md/handoff-plan/v1";
+    safeToRun: boolean;
+    actions: HandoffAction[];
+    conflicts: Array<{
+        project: string;
+        dirtyHosts: string[];
+    }>;
+    offlineHosts: string[];
+    unmanaged: Array<{
+        host: string;
+        project: string;
+    }>;
+    errorRepos: Array<{
+        host: string;
+        project: string;
+        reason: string;
+    }>;
+    unverifiedWorkers: Array<{
+        host: string;
+        workerId: string;
+    }>;
+    blockingReasons: string[];
+}
+/**
+ * Execute an already-validated plan in safety order. No callback is invoked for
+ * an unsafe plan; every coordinator receipt must succeed before the first git
+ * or sync mutation; any later failure invalidates the remaining observations.
+ */
+export declare function executeGuardedHandoffPlan<T extends {
+    ok: boolean;
+}>(plan: HandoffPlan, execute: (action: Exclude<HandoffAction, {
+    kind: "block";
+} | {
+    kind: "report";
+}>) => Promise<T>): Promise<Array<{
+    action: Exclude<HandoffAction, {
+        kind: "block";
+    } | {
+        kind: "report";
+    }>;
+    result: T;
+}>>;
+/** Build the complete guarded handoff plan from an already-observed fleet. */
+export declare function buildHandoffPlan(inventory: HandoffInventory): HandoffPlan;
+/** Stable You Agent goal text used in receipts and activity logs. */
+export declare function buildHandoffGoal(mode: "plan" | "run"): string;
+//# sourceMappingURL=handoff.d.ts.map

package/dist/lib/handoff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handoff.d.ts","sourceRoot":"","sources":["../../src/lib/handoff.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,eAAO,MAAM,gBAAgB;;;;;;;;EAQ3B,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;AAE1F,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,mBAAmB,CAAC;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,uBAAuB,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,OAAO,CAAC;AAEpF,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,uBAAuB,CAAC;IACtC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC3B,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC3B,OAAO,EAAE,aAAa,EAAE,CAAC;IACzB,KAAK,EAAE,gBAAgB,EAAE,CAAC;CAC3B;AAED,qGAAqG;AACrG,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,KAAK,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAiB5G;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAwC1F;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,cAAc,GAAG,SAAS,GAAG,cAAc,CAAC,GAAG,MAAM,GAAG,IAAI,CAO/H;AAED,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,sBAAsB,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,KAAK,CAAA;CAAE,GACxG;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IAAC,mBAAmB,EAAE,MAAM,CAAC;IAAC,sBAAsB,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACxQ;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IAAC,mBAAmB,EAAE,MAAM,CAAC;IAAC,sBAAsB,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE,GAC1P;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC1D;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACrE;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAExE,MAAM,WAAW,WAAW;IAC1B,aAAa,EAAE,wBAAwB,CAAC;IACxC,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,aAAa,EAAE,CAAC;IACzB,SAAS,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IAC5D,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpD,UAAU,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACrE,iBAAiB,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7D,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED;;;;GAIG;AACH,wBAAsB,yBAAyB,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,OAAO,CAAA;CAAE,EACvE,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,aAAa,EAAE;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GAC9F,OAAO,CAAC,KAAK,CAAC;IAAE,MAAM,EAAE,OAAO,CAAC,aAAa,EAAE;QAAE,IAAI,EAAE,OAAO,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,QAAQ,CAAA;KAAE,CAAC,CAAC;IAAC,MAAM,EAAE,CAAC,CAAA;CAAE,CAAC,CAAC,CAiBvG;AAED,8EAA8E;AAC9E,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,gBAAgB,GAAG,WAAW,CA6LzE;AAED,qEAAqE;AACrE,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,GAAG,MAAM,CAU7D"}

package/dist/lib/handoff.js

@@ -0,0 +1,316 @@
+"use strict";
+/**
+ * Pure contract and planner for `you handoff`.
+ *
+ * The planner deliberately has no process, network, or filesystem access.  The
+ * CLI adapter inventories the fleet through the existing You orchestrator and
+ * remote-command boundary, then executes only the actions returned here.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HANDOFF_CONTRACT = void 0;
+exports.findAmbiguousMachineHosts = findAmbiguousMachineHosts;
+exports.normalizeGitRemoteIdentity = normalizeGitRemoteIdentity;
+exports.projectRemoteIdentity = projectRemoteIdentity;
+exports.executeGuardedHandoffPlan = executeGuardedHandoffPlan;
+exports.buildHandoffPlan = buildHandoffPlan;
+exports.buildHandoffGoal = buildHandoffGoal;
+exports.HANDOFF_CONTRACT = Object.freeze({
+    schemaVersion: "you-md/handoff/v1",
+    never: ["sigterm-active-work", "force-push", "reset", "auto-merge"],
+    dirtyRepos: "blocked-native-clean-repo-mvp",
+    cleanAheadPush: "exact-observed-head-no-force",
+    cleanCloneUpdate: "git-pull-ff-only",
+    arbitraryChatControl: false,
+    dreamCycle: "deferred-explicit-opt-in",
+});
+/** Exact and short hostname aliases cannot safely address two stable machines on the current bus. */
+function findAmbiguousMachineHosts(machines) {
+    const keysByAlias = new Map();
+    for (const machine of machines) {
+        const host = machine.host.trim().toLowerCase();
+        if (!host)
+            continue;
+        for (const alias of new Set([host, host.split(".")[0]])) {
+            const keys = keysByAlias.get(alias) || new Set();
+            keys.add(machine.machineKey);
+            keysByAlias.set(alias, keys);
+        }
+    }
+    const collidedAliases = new Set([...keysByAlias.entries()].filter(([, keys]) => keys.size > 1).map(([alias]) => alias));
+    return new Set(machines
+        .map((machine) => machine.host.trim().toLowerCase())
+        .filter((host) => collidedAliases.has(host) || collidedAliases.has(host.split(".")[0])));
+}
+/**
+ * Normalize one Git remote to a transport-independent repository identity.
+ * HTTPS, SSH URLs, and SCP-style Git URLs for the same host/path converge;
+ * local paths remain exact file identities. Invalid or ambiguous inputs fail
+ * closed instead of being guessed from a directory name.
+ */
+function normalizeGitRemoteIdentity(value) {
+    const raw = value?.trim();
+    if (!raw || /[\r\n\0]/.test(raw))
+        return null;
+    if (raw.startsWith("file:/")) {
+        const normalized = raw.slice("file:".length).replace(/\\/g, "/").replace(/\/+$/, "").replace(/\.git$/i, "");
+        return normalized.startsWith("/") ? `file:${normalized}` : null;
+    }
+    if (raw.startsWith("/")) {
+        const normalized = raw.replace(/\\/g, "/").replace(/\/+$/, "").replace(/\.git$/i, "");
+        return normalized ? `file:${normalized}` : null;
+    }
+    if (/^(?:[A-Za-z0-9-]+\.)+[A-Za-z0-9-]+(?::\d+)?\/.+/.test(raw)) {
+        return normalizeGitRemoteIdentity(`https://${raw}`);
+    }
+    if (raw.startsWith("./") || raw.startsWith("../"))
+        return null;
+    const scp = raw.match(/^(?:[^@/:]+@)?([^/:]+):(.+)$/);
+    const candidate = scp && !raw.includes("://") ? `ssh://${scp[1]}/${scp[2]}` : raw;
+    try {
+        const parsed = new URL(candidate);
+        if (parsed.username && parsed.protocol !== "ssh:")
+            return null;
+        if (parsed.password || parsed.search || parsed.hash)
+            return null;
+        if (parsed.protocol === "file:") {
+            const pathname = parsed.pathname.replace(/\/+$/, "").replace(/\.git$/i, "");
+            return pathname ? `file:${pathname}` : null;
+        }
+        if (!["https:", "http:", "ssh:", "git:"].includes(parsed.protocol))
+            return null;
+        const host = parsed.hostname.toLowerCase();
+        let pathname = parsed.pathname.replace(/^\/+|\/+$/g, "").replace(/\.git$/i, "");
+        if (!host || !pathname || pathname.split("/").some((part) => !part || part === "." || part === ".."))
+            return null;
+        if (host === "github.com" || host.endsWith(".github.com")) {
+            if (pathname.split("/").length !== 2)
+                return null;
+            pathname = pathname.toLowerCase();
+        }
+        const port = parsed.port ? `:${parsed.port}` : "";
+        return `${host}${port}/${pathname}`;
+    }
+    catch {
+        return null;
+    }
+}
+function projectRemoteIdentity(project) {
+    const declared = normalizeGitRemoteIdentity(project.repoIdentity) || normalizeGitRemoteIdentity(project.repoUrl);
+    if (declared)
+        return declared;
+    const fullName = project.repoFullName?.trim().replace(/^\/+|\/+$/g, "").replace(/\.git$/i, "");
+    return fullName && /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(fullName)
+        ? normalizeGitRemoteIdentity(`https://github.com/${fullName}`)
+        : null;
+}
+/**
+ * Execute an already-validated plan in safety order. No callback is invoked for
+ * an unsafe plan; every coordinator receipt must succeed before the first git
+ * or sync mutation; any later failure invalidates the remaining observations.
+ */
+async function executeGuardedHandoffPlan(plan, execute) {
+    if (!plan.safeToRun)
+        return [];
+    const executable = plan.actions.filter((action) => action.kind !== "block" && action.kind !== "report");
+    const ordered = [
+        ...executable.filter((action) => action.kind === "worker_state_receipt"),
+        ...executable.filter((action) => action.kind !== "worker_state_receipt"),
+    ];
+    const receipts = [];
+    for (const action of ordered) {
+        const result = await execute(action);
+        receipts.push({ action, result });
+        if (!result.ok)
+            break;
+    }
+    return receipts;
+}
+/** Build the complete guarded handoff plan from an already-observed fleet. */
+function buildHandoffPlan(inventory) {
+    const actions = [];
+    const conflicts = [];
+    const offlineHosts = inventory.machines.filter((machine) => !machine.online).map((machine) => machine.host);
+    const unmanaged = inventory.repos
+        .filter((repo) => repo.availability === "unmanaged")
+        .map((repo) => ({ host: repo.host, project: repo.project }));
+    const errorRepos = inventory.repos
+        .filter((repo) => repo.availability === "error")
+        .map((repo) => ({ host: repo.host, project: repo.project, reason: repo.note || "repository state could not be verified" }));
+    const unverifiedWorkers = inventory.workers
+        .filter((worker) => worker.status === "running")
+        .map((worker) => ({ host: worker.host, workerId: worker.id }));
+    for (const machine of inventory.machines) {
+        if (!machine.online) {
+            actions.push({ kind: "report", host: machine.host, reason: machine.note || "offline or daemon unavailable" });
+            continue;
+        }
+        const workers = inventory.workers.filter((worker) => worker.host === machine.host);
+        actions.push({ kind: "worker_state_receipt", machineKey: machine.machineKey, host: machine.host, workerIds: workers.map((worker) => worker.id), verified: false });
+    }
+    for (const project of inventory.projects) {
+        const states = inventory.repos.filter((repo) => repo.project === project.slug && repo.availability === "managed");
+        const dirty = states.filter((repo) => repo.dirty);
+        if (dirty.length > 1) {
+            const dirtyHosts = dirty.map((repo) => repo.host);
+            conflicts.push({ project: project.slug, dirtyHosts });
+            actions.push({
+                kind: "block",
+                project: project.slug,
+                hosts: dirtyHosts,
+                reason: "same repository is dirty on multiple hosts; no copy is chosen or changed",
+            });
+            continue;
+        }
+        if (dirty.length === 1) {
+            const authority = dirty[0];
+            actions.push({
+                kind: "block",
+                project: project.slug,
+                hosts: [authority.host],
+                reason: "native handoff currently supports clean repositories only; dirty work remains untouched and partial",
+            });
+            continue;
+        }
+        const declaredRemoteIdentity = projectRemoteIdentity(project);
+        const stateRemoteIdentities = states.map((state) => normalizeGitRemoteIdentity(state.remoteIdentity) || normalizeGitRemoteIdentity(state.remoteUrl));
+        const remoteIdentities = new Set(stateRemoteIdentities.filter((identity) => Boolean(identity)));
+        if (states.some((_, index) => !stateRemoteIdentities[index]) ||
+            remoteIdentities.size !== 1 ||
+            (declaredRemoteIdentity !== null && !remoteIdentities.has(declaredRemoteIdentity))) {
+            actions.push({
+                kind: "block",
+                project: project.slug,
+                hosts: states.map((state) => state.host),
+                reason: "project clones do not share one canonical remote repository identity",
+            });
+            continue;
+        }
+        const expectedRemoteIdentity = [...remoteIdentities][0];
+        const branches = new Set(states.map((state) => state.branch).filter((branch) => Boolean(branch)));
+        if (states.some((state) => !state.branch || !state.headOid || !state.upstream || !state.upstreamOid) || branches.size > 1) {
+            actions.push({
+                kind: "block",
+                project: project.slug,
+                hosts: states.map((state) => state.host),
+                reason: "clean clones do not share one fully observed branch/upstream/OID state",
+            });
+            continue;
+        }
+        const ahead = states.filter((state) => (state.ahead || 0) > 0);
+        if (ahead.length > 1 || ahead.some((state) => (state.behind || 0) > 0)) {
+            actions.push({
+                kind: "block",
+                project: project.slug,
+                hosts: ahead.map((state) => state.host),
+                reason: "clean clones have divergent or multiple ahead branches; handoff never chooses or merges",
+            });
+            continue;
+        }
+        if (ahead.length === 1) {
+            const authority = ahead[0];
+            const expectedFinalOid = authority.headOid;
+            actions.push({
+                kind: "push_clean",
+                machineKey: authority.machineKey,
+                host: authority.host,
+                project: project.slug,
+                target: project.directoryName,
+                expectedHead: authority.headOid,
+                expectedBranch: authority.branch,
+                expectedUpstream: authority.upstream,
+                expectedUpstreamOid: authority.upstreamOid,
+                expectedRemoteIdentity,
+                expectedFinalOid,
+                reason: "one clean, non-divergent clone is ahead; push its exact observed HEAD without force",
+            });
+            for (const state of states) {
+                if (state.machineKey !== authority.machineKey) {
+                    actions.push({
+                        kind: "pull_ff_only",
+                        machineKey: state.machineKey,
+                        host: state.host,
+                        project: project.slug,
+                        target: project.directoryName,
+                        expectedHead: state.headOid,
+                        expectedBranch: state.branch,
+                        expectedUpstream: state.upstream,
+                        expectedUpstreamOid: state.upstreamOid,
+                        expectedRemoteIdentity,
+                        expectedFinalOid,
+                    });
+                }
+            }
+            continue;
+        }
+        const finalOids = new Set(states.map((state) => state.upstreamOid));
+        if (finalOids.size !== 1) {
+            actions.push({
+                kind: "block",
+                project: project.slug,
+                hosts: states.map((state) => state.host),
+                reason: "project clones do not resolve to one observed final remote OID",
+            });
+            continue;
+        }
+        const expectedFinalOid = [...finalOids][0];
+        for (const state of states) {
+            actions.push({
+                kind: "pull_ff_only",
+                machineKey: state.machineKey,
+                host: state.host,
+                project: project.slug,
+                target: project.directoryName,
+                expectedHead: state.headOid,
+                expectedBranch: state.branch,
+                expectedUpstream: state.upstream,
+                expectedUpstreamOid: state.upstreamOid,
+                expectedRemoteIdentity,
+                expectedFinalOid,
+            });
+        }
+    }
+    for (const machine of inventory.machines) {
+        if (machine.online)
+            actions.push({ kind: "machine_sync", machineKey: machine.machineKey, host: machine.host });
+    }
+    for (const row of unmanaged) {
+        actions.push({ kind: "report", ...row, reason: "project is not managed on this host" });
+    }
+    return {
+        schemaVersion: "you-md/handoff-plan/v1",
+        safeToRun: conflicts.length === 0 &&
+            offlineHosts.length === 0 &&
+            unmanaged.length === 0 &&
+            errorRepos.length === 0 &&
+            unverifiedWorkers.length === 0 &&
+            inventory.machines.every((machine) => machine.managed) &&
+            !actions.some((action) => action.kind === "block"),
+        actions,
+        conflicts,
+        offlineHosts,
+        unmanaged,
+        errorRepos,
+        unverifiedWorkers,
+        blockingReasons: [
+            ...(offlineHosts.length ? [`${offlineHosts.length} machine(s) offline`] : []),
+            ...(unmanaged.length ? [`${unmanaged.length} unmanaged project clone(s)`] : []),
+            ...(errorRepos.length ? [`${errorRepos.length} repository state probe(s) failed`] : []),
+            ...(unverifiedWorkers.length ? [`${unverifiedWorkers.length} running worker(s) have state receipts only, not agent-authored checkpoints`] : []),
+            ...(inventory.machines.some((machine) => !machine.managed) ? ["one or more coordinator registries are unavailable"] : []),
+            ...actions.filter((action) => action.kind === "block").map((action) => action.reason),
+        ],
+    };
+}
+/** Stable You Agent goal text used in receipts and activity logs. */
+function buildHandoffGoal(mode) {
+    return [
+        `${mode === "plan" ? "Plan" : "Run"} the end-of-day fleet handoff through the You Agent orchestrator.`,
+        "Inventory every synced machine, portfolio project, and registered orchestrator worker.",
+        "Request checkpoints only from registered coordinators that expose a receipt protocol; otherwise record state as unverified without signaling or terminating work.",
+        "Block repositories dirty on more than one host.",
+        "Leave dirty repositories untouched; for clean repositories, push only one non-divergent exact observed HEAD and update other clean clones with git pull --ff-only.",
+        "Sync You.md identity, shared skills, and project context, then report offline, unmanaged, and conflicted state honestly.",
+        "Never claim control of arbitrary Codex, Claude, or Cursor chats.",
+    ].join(" ");
+}
+//# sourceMappingURL=handoff.js.map

package/dist/lib/handoff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handoff.js","sourceRoot":"","sources":["../../src/lib/handoff.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;AAmEH,8DAiBC;AAQD,gEAwCC;AAED,sDAOC;AA2BD,8DAoBC;AAGD,4CA6LC;AAGD,4CAUC;AAvYY,QAAA,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC5C,aAAa,EAAE,mBAA4B;IAC3C,KAAK,EAAE,CAAC,qBAAqB,EAAE,YAAY,EAAE,OAAO,EAAE,YAAY,CAAU;IAC5E,UAAU,EAAE,+BAAwC;IACpD,cAAc,EAAE,8BAAuC;IACvD,gBAAgB,EAAE,kBAA2B;IAC7C,oBAAoB,EAAE,KAAc;IACpC,UAAU,EAAE,0BAAmC;CAChD,CAAC,CAAC;AAwDH,qGAAqG;AACrG,SAAgB,yBAAyB,CAAC,QAAqD;IAC7F,MAAM,WAAW,GAAG,IAAI,GAAG,EAAuB,CAAC;IACnD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC/C,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,KAAK,MAAM,KAAK,IAAI,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;YACzD,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YAC7B,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IACxH,OAAO,IAAI,GAAG,CACZ,QAAQ;SACL,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SACnD,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAC1F,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,0BAA0B,CAAC,KAAgC;IACzE,MAAM,GAAG,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAI,CAAC,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAE9C,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC5G,OAAO,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAClE,CAAC;IACD,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACtF,OAAO,UAAU,CAAC,CAAC,CAAC,QAAQ,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAClD,CAAC;IACD,IAAI,iDAAiD,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAChE,OAAO,0BAA0B,CAAC,WAAW,GAAG,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE/D,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;IAClF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;QAClC,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;QAC/D,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACjE,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAChC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YAC5E,OAAO,QAAQ,CAAC,CAAC,CAAC,QAAQ,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9C,CAAC;QACD,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAChF,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC3C,IAAI,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAChF,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAClH,IAAI,IAAI,KAAK,YAAY,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YAC1D,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAClD,QAAQ,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;QACpC,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,OAAO,GAAG,IAAI,GAAG,IAAI,IAAI,QAAQ,EAAE,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAgB,qBAAqB,CAAC,OAA0E;IAC9G,MAAM,QAAQ,GAAG,0BAA0B,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,0BAA0B,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACjH,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAC/F,OAAO,QAAQ,IAAI,oCAAoC,CAAC,IAAI,CAAC,QAAQ,CAAC;QACpE,CAAC,CAAC,0BAA0B,CAAC,sBAAsB,QAAQ,EAAE,CAAC;QAC9D,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAsBD;;;;GAIG;AACI,KAAK,UAAU,yBAAyB,CAC7C,IAAiB,EACjB,OAA+F;IAE/F,IAAI,CAAC,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,CAAC;IAC/B,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CACpC,CAAC,MAAM,EAA4E,EAAE,CACnF,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,CACtD,CAAC;IACF,MAAM,OAAO,GAAG;QACd,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,sBAAsB,CAAC;QACxE,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,sBAAsB,CAAC;KACzE,CAAC;IACF,MAAM,QAAQ,GAA2D,EAAE,CAAC;IAC5E,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;QACrC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAClC,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,MAAM;IACxB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,8EAA8E;AAC9E,SAAgB,gBAAgB,CAAC,SAA2B;IAC1D,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,MAAM,SAAS,GAA6B,EAAE,CAAC;IAC/C,MAAM,YAAY,GAAG,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5G,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK;SAC9B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,KAAK,WAAW,CAAC;SACnD,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAC/D,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK;SAC/B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,KAAK,OAAO,CAAC;SAC/C,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,IAAI,wCAAwC,EAAE,CAAC,CAAC,CAAC;IAC9H,MAAM,iBAAiB,GAAG,SAAS,CAAC,OAAO;SACxC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC;SAC/C,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAEjE,KAAK,MAAM,OAAO,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;QACzC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,IAAI,+BAA+B,EAAE,CAAC,CAAC;YAC9G,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QACnF,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;IACrK,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,CACnC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,KAAK,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,CAC3E,CAAC;QACF,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAElD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClD,SAAS,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;YACtD,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,OAAO;gBACb,OAAO,EAAE,OAAO,CAAC,IAAI;gBACrB,KAAK,EAAE,UAAU;gBACjB,MAAM,EAAE,0EAA0E;aACnF,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAC3B,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,OAAO;gBACb,OAAO,EAAE,OAAO,CAAC,IAAI;gBACrB,KAAK,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC;gBACvB,MAAM,EAAE,qGAAqG;aAC9G,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,MAAM,sBAAsB,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAC9D,MAAM,qBAAqB,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACjD,0BAA0B,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,0BAA0B,CAAC,KAAK,CAAC,SAAS,CAAC,CAChG,CAAC;QACF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAsB,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QACpH,IACE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;YACxD,gBAAgB,CAAC,IAAI,KAAK,CAAC;YAC3B,CAAC,sBAAsB,KAAK,IAAI,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,EAClF,CAAC;YACD,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,OAAO;gBACb,OAAO,EAAE,OAAO,CAAC,IAAI;gBACrB,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;gBACxC,MAAM,EAAE,sEAAsE;aAC/E,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,MAAM,sBAAsB,GAAG,CAAC,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;QAExD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAoB,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACpH,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,QAAQ,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC1H,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,OAAO;gBACb,OAAO,EAAE,OAAO,CAAC,IAAI;gBACrB,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;gBACxC,MAAM,EAAE,wEAAwE;aACjF,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/D,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACvE,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,OAAO;gBACb,OAAO,EAAE,OAAO,CAAC,IAAI;gBACrB,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;gBACvC,MAAM,EAAE,yFAAyF;aAClG,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAC3B,MAAM,gBAAgB,GAAG,SAAS,CAAC,OAAiB,CAAC;YACrD,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,YAAY;gBAClB,UAAU,EAAE,SAAS,CAAC,UAAU;gBAChC,IAAI,EAAE,SAAS,CAAC,IAAI;gBACpB,OAAO,EAAE,OAAO,CAAC,IAAI;gBACrB,MAAM,EAAE,OAAO,CAAC,aAAa;gBAC7B,YAAY,EAAE,SAAS,CAAC,OAAiB;gBACzC,cAAc,EAAE,SAAS,CAAC,MAAgB;gBAC1C,gBAAgB,EAAE,SAAS,CAAC,QAAkB;gBAC9C,mBAAmB,EAAE,SAAS,CAAC,WAAqB;gBACpD,sBAAsB;gBACtB,gBAAgB;gBAChB,MAAM,EAAE,qFAAqF;aAC9F,CAAC,CAAC;YACH,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,UAAU,EAAE,CAAC;oBAC9C,OAAO,CAAC,IAAI,CAAC;wBACX,IAAI,EAAE,cAAc;wBACpB,UAAU,EAAE,KAAK,CAAC,UAAU;wBAC5B,IAAI,EAAE,KAAK,CAAC,IAAI;wBAChB,OAAO,EAAE,OAAO,CAAC,IAAI;wBACrB,MAAM,EAAE,OAAO,CAAC,aAAa;wBAC7B,YAAY,EAAE,KAAK,CAAC,OAAiB;wBACrC,cAAc,EAAE,KAAK,CAAC,MAAgB;wBACtC,gBAAgB,EAAE,KAAK,CAAC,QAAkB;wBAC1C,mBAAmB,EAAE,KAAK,CAAC,WAAqB;wBAChD,sBAAsB;wBACtB,gBAAgB;qBACjB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,SAAS;QACX,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAqB,CAAC,CAAC,CAAC;QAC9E,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,OAAO;gBACb,OAAO,EAAE,OAAO,CAAC,IAAI;gBACrB,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;gBACxC,MAAM,EAAE,gEAAgE;aACzE,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,MAAM,gBAAgB,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,cAAc;gBACpB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,OAAO,EAAE,OAAO,CAAC,IAAI;gBACrB,MAAM,EAAE,OAAO,CAAC,aAAa;gBAC7B,YAAY,EAAE,KAAK,CAAC,OAAiB;gBACrC,cAAc,EAAE,KAAK,CAAC,MAAgB;gBACtC,gBAAgB,EAAE,KAAK,CAAC,QAAkB;gBAC1C,mBAAmB,EAAE,KAAK,CAAC,WAAqB;gBAChD,sBAAsB;gBACtB,gBAAgB;aACjB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;QACzC,IAAI,OAAO,CAAC,MAAM;YAAE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACjH,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC,CAAC;IAC1F,CAAC;IAED,OAAO;QACL,aAAa,EAAE,wBAAwB;QACvC,SAAS,EACP,SAAS,CAAC,MAAM,KAAK,CAAC;YACtB,YAAY,CAAC,MAAM,KAAK,CAAC;YACzB,SAAS,CAAC,MAAM,KAAK,CAAC;YACtB,UAAU,CAAC,MAAM,KAAK,CAAC;YACvB,iBAAiB,CAAC,MAAM,KAAK,CAAC;YAC9B,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;YACtD,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC;QACpD,OAAO;QACP,SAAS;QACT,YAAY;QACZ,SAAS;QACT,UAAU;QACV,iBAAiB;QACjB,eAAe,EAAE;YACf,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,MAAM,qBAAqB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7E,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,MAAM,6BAA6B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/E,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,MAAM,mCAAmC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACvF,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,iBAAiB,CAAC,MAAM,6EAA6E,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/I,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,oDAAoD,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACzH,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAuD,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;SAC3I;KACF,CAAC;AACJ,CAAC;AAED,qEAAqE;AACrE,SAAgB,gBAAgB,CAAC,IAAoB;IACnD,OAAO;QACL,GAAG,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,mEAAmE;QACtG,wFAAwF;QACxF,mKAAmK;QACnK,iDAAiD;QACjD,oKAAoK;QACpK,0HAA0H;QAC1H,kEAAkE;KACnE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC"}

package/dist/lib/machine-identity.d.ts

@@ -12,5 +12,7 @@ type MachineIdentityOptions = {
  * workspace location participates in the identity.
  */
 export declare function getPhysicalMachineKey(options?: MachineIdentityOptions): string;
+/** Read the durable key without provisioning it. Safe for read-only plan/status commands. */
+export declare function readPhysicalMachineKey(options?: Pick<MachineIdentityOptions, "bundleDir">): string | null;
 export {};
 //# sourceMappingURL=machine-identity.d.ts.map

package/dist/lib/machine-identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"machine-identity.d.ts","sourceRoot":"","sources":["../../src/lib/machine-identity.ts"],"names":[],"mappings":"AAcA,KAAK,sBAAsB,GAAG;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,MAAM,CAAC;IAC1B,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB,CAAC;AAeF;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,GAAE,sBAA2B,GAAG,MAAM,CA2ClF"}
+{"version":3,"file":"machine-identity.d.ts","sourceRoot":"","sources":["../../src/lib/machine-identity.ts"],"names":[],"mappings":"AAcA,KAAK,sBAAsB,GAAG;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,MAAM,CAAC;IAC1B,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB,CAAC;AAeF;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,GAAE,sBAA2B,GAAG,MAAM,CAwClF;AAED,6FAA6F;AAC7F,wBAAgB,sBAAsB,CAAC,OAAO,GAAE,IAAI,CAAC,sBAAsB,EAAE,WAAW,CAAM,GAAG,MAAM,GAAG,IAAI,CAO7G"}

package/dist/lib/machine-identity.js

@@ -34,6 +34,7 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getPhysicalMachineKey = getPhysicalMachineKey;
+exports.readPhysicalMachineKey = readPhysicalMachineKey;
 const crypto = __importStar(require("crypto"));
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
@@ -61,14 +62,11 @@ function nonEmptyString(value) {
  */
 function getPhysicalMachineKey(options = {}) {
     const bundleDir = options.bundleDir || (0, config_1.getWritableHomeBundleDir)();
-    const machineDir = path.join(bundleDir, "machine");
-    const identityPath = path.join(machineDir, "physical-machine.json");
-    const existing = readJson(identityPath);
-    const existingKey = existing?.schemaVersion === IDENTITY_SCHEMA
-        ? nonEmptyString(existing.machineKey)
-        : null;
+    const existingKey = readPhysicalMachineKey({ bundleDir });
     if (existingKey)
         return existingKey;
+    const machineDir = path.join(bundleDir, "machine");
+    const identityPath = path.join(machineDir, "physical-machine.json");
     const secretVaultKeyPath = path.join(bundleDir, "secret-vault", "devices", "current-device-key.json");
     const secretVaultDeviceId = nonEmptyString(readJson(secretVaultKeyPath)?.deviceId);
     const record = {
@@ -98,4 +96,13 @@ function getPhysicalMachineKey(options = {}) {
         throw error;
     }
 }
+/** Read the durable key without provisioning it. Safe for read-only plan/status commands. */
+function readPhysicalMachineKey(options = {}) {
+    const bundleDir = options.bundleDir || (0, config_1.getWritableHomeBundleDir)();
+    const identityPath = path.join(bundleDir, "machine", "physical-machine.json");
+    const existing = readJson(identityPath);
+    return existing?.schemaVersion === IDENTITY_SCHEMA
+        ? nonEmptyString(existing.machineKey)
+        : null;
+}
 //# sourceMappingURL=machine-identity.js.map

package/dist/lib/machine-identity.js.map

@@ -1 +1 @@
-{"version":3,"file":"machine-identity.js","sourceRoot":"","sources":["../../src/lib/machine-identity.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyCA,sDA2CC;AApFD,+CAAiC;AACjC,uCAAyB;AACzB,2CAA6B;AAC7B,qCAAoD;AAEpD,MAAM,eAAe,GAAG,qCAA8C,CAAC;AAevE,SAAS,QAAQ,CAAC,QAAgB;IAChC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QAC5D,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAgC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACzE,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,qBAAqB,CAAC,UAAkC,EAAE;IACxE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAA,iCAAwB,GAAE,CAAC;IAClE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACnD,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,uBAAuB,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC;IACxC,MAAM,WAAW,GAAG,QAAQ,EAAE,aAAa,KAAK,eAAe;QAC7D,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC;QACrC,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAClC,SAAS,EACT,cAAc,EACd,SAAS,EACT,yBAAyB,CAC1B,CAAC;IACF,MAAM,mBAAmB,GAAG,cAAc,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,QAAQ,CAAC,CAAC;IAEnF,MAAM,MAAM,GAA4B;QACtC,aAAa,EAAE,eAAe;QAC9B,UAAU,EAAE,mBAAmB,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC,EAAE;QAC9E,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,WAAW;QAC1D,SAAS,EAAE,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE;KAC/D,CAAC;IACF,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAE3D,0EAA0E;IAC1E,4EAA4E;IAC5E,IAAI,CAAC;QACH,EAAE,CAAC,aAAa,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE;YACrE,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,KAAK;YACX,IAAI,EAAE,IAAI;SACX,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,UAAU,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,KAAK,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,KAAK,EAAE,aAAa,KAAK,eAAe;YACvD,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC;YAClC,CAAC,CAAC,IAAI,CAAC;QACT,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"machine-identity.js","sourceRoot":"","sources":["../../src/lib/machine-identity.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyCA,sDAwCC;AAGD,wDAOC;AA3FD,+CAAiC;AACjC,uCAAyB;AACzB,2CAA6B;AAC7B,qCAAoD;AAEpD,MAAM,eAAe,GAAG,qCAA8C,CAAC;AAevE,SAAS,QAAQ,CAAC,QAAgB;IAChC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QAC5D,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAgC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACzE,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,qBAAqB,CAAC,UAAkC,EAAE;IACxE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAA,iCAAwB,GAAE,CAAC;IAClE,MAAM,WAAW,GAAG,sBAAsB,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;IAC1D,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IACpC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACnD,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,uBAAuB,CAAC,CAAC;IAEpE,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAClC,SAAS,EACT,cAAc,EACd,SAAS,EACT,yBAAyB,CAC1B,CAAC;IACF,MAAM,mBAAmB,GAAG,cAAc,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,QAAQ,CAAC,CAAC;IAEnF,MAAM,MAAM,GAA4B;QACtC,aAAa,EAAE,eAAe;QAC9B,UAAU,EAAE,mBAAmB,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC,EAAE;QAC9E,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,WAAW;QAC1D,SAAS,EAAE,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE;KAC/D,CAAC;IACF,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAE3D,0EAA0E;IAC1E,4EAA4E;IAC5E,IAAI,CAAC;QACH,EAAE,CAAC,aAAa,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE;YACrE,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,KAAK;YACX,IAAI,EAAE,IAAI;SACX,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,UAAU,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,KAAK,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,KAAK,EAAE,aAAa,KAAK,eAAe;YACvD,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC;YAClC,CAAC,CAAC,IAAI,CAAC;QACT,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,6FAA6F;AAC7F,SAAgB,sBAAsB,CAAC,UAAqD,EAAE;IAC5F,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAA,iCAAwB,GAAE,CAAC;IAClE,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,uBAAuB,CAAC,CAAC;IAC9E,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC;IACxC,OAAO,QAAQ,EAAE,aAAa,KAAK,eAAe;QAChD,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC;QACrC,CAAC,CAAC,IAAI,CAAC;AACX,CAAC"}

package/dist/lib/onboarding.d.ts

@@ -63,7 +63,10 @@ interface ChatMessage {
     role: "system" | "user" | "assistant";
     content: string;
 }
-declare function callLLM(apiKey: string | null, messages: ChatMessage[]): Promise<string>;
+declare function callLLM(apiKey: string | null, messages: ChatMessage[], options?: {
+    authorizationToken?: string;
+    model?: "opus-5" | "gpt-5.6-sol";
+}): Promise<string>;
 interface SectionUpdate {
     section: string;
     content: string;

package/dist/lib/onboarding.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"onboarding.d.ts","sourceRoot":"","sources":["../../src/lib/onboarding.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,cAAc,EAA6C,MAAM,UAAU,CAAC;AAYrF,QAAA,MAAM,cAAc,QAAyB,CAAC;AAC9C,QAAA,MAAM,UAAU,QAA2B,CAAC;AAC5C,QAAA,MAAM,YAAY,QAA6B,CAAC;AAQhD,QAAA,MAAM,cAAc;;;;;CAqCnB,CAAC;AAEF,iBAAS,WAAW,CAAC,QAAQ,EAAE,MAAM,OAAO,cAAc,GAAG,MAAM,CAGlE;AAsOD,QAAA,MAAM,eAAe,mKAQX,CAAC;AAEX,KAAK,aAAa,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC;AAEtD,QAAA,MAAM,aAAa,44LA6GV,CAAC;AAoBV,iBAAS,cAAc,IAAI,MAAM,CAIhC;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAG/D;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,GAAG,OAAO,CAkB3E;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAGpD;AAyBD,iBAAS,gBAAgB,IAAI,MAAM,GAAG,IAAI,CAWzC;AAID,iBAAe,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA0B/D;AAID,UAAU,YAAY;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,iBAAe,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CActE;AAED,UAAU,cAAc;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,iBAAe,YAAY,CAAC,MAAM,EAAE;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAcjC;AA0BD,UAAU,WAAW;IACnB,IAAI,EAAE,QAAQ,GAAG,MAAM,GAAG,WAAW,CAAC;IACtC,OAAO,EAAE,MAAM,CAAC;CACjB;AASD,iBAAe,OAAO,CACpB,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,QAAQ,EAAE,WAAW,EAAE,GACtB,OAAO,CAAC,MAAM,CAAC,CAqDjB;AAID,UAAU,aAAa;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,iBAAS,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,aAAa,EAAE,CAAC;CAC1B,CA+BA;AAED,iBAAS,gBAAgB,CACvB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,GACd,IAAI,CAmBN;AAED,iBAAS,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAI7C;AA6BD,iBAAS,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAsDxF;AAID,UAAU,SAAS;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAuiBD;;;GAGG;AACH,eAAO,MAAM,gBAAgB,wEAC0C,CAAC;AAExE;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAW7D;AAgJD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CA+WnD;AAGD,wBAAsB,YAAY,CAChC,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,IAAI,CAAC,CAiEf;AAID,OAAO,EACL,OAAO,EACP,wBAAwB,EACxB,gBAAgB,EAChB,YAAY,EACZ,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,YAAY,EACZ,gBAAgB,EAChB,cAAc,IAAI,OAAO,EACzB,cAAc,EACd,WAAW,EACX,aAAa,EACb,eAAe,EACf,cAAc,EACd,UAAU,EACV,YAAY,GACb,CAAC;AACF,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa,EAAE,SAAS,EAAE,YAAY,EAAE,cAAc,EAAE,CAAC"}
+{"version":3,"file":"onboarding.d.ts","sourceRoot":"","sources":["../../src/lib/onboarding.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,cAAc,EAA6C,MAAM,UAAU,CAAC;AAYrF,QAAA,MAAM,cAAc,QAAyB,CAAC;AAC9C,QAAA,MAAM,UAAU,QAA2B,CAAC;AAC5C,QAAA,MAAM,YAAY,QAA6B,CAAC;AAQhD,QAAA,MAAM,cAAc;;;;;CAqCnB,CAAC;AAEF,iBAAS,WAAW,CAAC,QAAQ,EAAE,MAAM,OAAO,cAAc,GAAG,MAAM,CAGlE;AAsOD,QAAA,MAAM,eAAe,mKAQX,CAAC;AAEX,KAAK,aAAa,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC;AAEtD,QAAA,MAAM,aAAa,44LA6GV,CAAC;AAoBV,iBAAS,cAAc,IAAI,MAAM,CAIhC;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAG/D;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,GAAG,OAAO,CAkB3E;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAGpD;AAyBD,iBAAS,gBAAgB,IAAI,MAAM,GAAG,IAAI,CAWzC;AAID,iBAAe,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA0B/D;AAID,UAAU,YAAY;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,iBAAe,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CActE;AAED,UAAU,cAAc;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,iBAAe,YAAY,CAAC,MAAM,EAAE;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAcjC;AA0BD,UAAU,WAAW;IACnB,IAAI,EAAE,QAAQ,GAAG,MAAM,GAAG,WAAW,CAAC;IACtC,OAAO,EAAE,MAAM,CAAC;CACjB;AASD,iBAAe,OAAO,CACpB,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,QAAQ,EAAE,WAAW,EAAE,EACvB,OAAO,CAAC,EAAE;IACR,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,KAAK,CAAC,EAAE,QAAQ,GAAG,aAAa,CAAC;CAClC,GACA,OAAO,CAAC,MAAM,CAAC,CA6DjB;AAID,UAAU,aAAa;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,iBAAS,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,aAAa,EAAE,CAAC;CAC1B,CA+BA;AAED,iBAAS,gBAAgB,CACvB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,GACd,IAAI,CAmBN;AAED,iBAAS,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAI7C;AA6BD,iBAAS,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAsDxF;AAID,UAAU,SAAS;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAuiBD;;;GAGG;AACH,eAAO,MAAM,gBAAgB,wEAC0C,CAAC;AAExE;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAW7D;AAgJD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CA+WnD;AAGD,wBAAsB,YAAY,CAChC,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,IAAI,CAAC,CAiEf;AAID,OAAO,EACL,OAAO,EACP,wBAAwB,EACxB,gBAAgB,EAChB,YAAY,EACZ,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,YAAY,EACZ,gBAAgB,EAChB,cAAc,IAAI,OAAO,EACzB,cAAc,EACd,WAAW,EACX,aAAa,EACb,eAAe,EACf,cAAc,EACd,UAAU,EACV,YAAY,GACb,CAAC;AACF,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa,EAAE,SAAS,EAAE,YAAY,EAAE,cAAc,EAAE,CAAC"}

package/dist/lib/onboarding.js

@@ -626,13 +626,21 @@ function displayScrapeResult(label, data) {
  * directive blocks out of the live display. URL for the SSE proxy:
  */
 const STREAM_CHAT_URL = `${_SITE}/api/v1/chat/stream`;
-async function callLLM(apiKey, messages) {
+async function callLLM(apiKey, messages, options) {
     // Try the you.md proxy first (no API key needed)
     try {
         const proxyRes = await fetch(CHAT_PROXY_URL, {
             method: "POST",
-            headers: { "Content-Type": "application/json" },
-            body: JSON.stringify({ messages }),
+            headers: {
+                "Content-Type": "application/json",
+                ...(options?.authorizationToken
+                    ? { Authorization: `Bearer ${options.authorizationToken}` }
+                    : {}),
+            },
+            body: JSON.stringify({
+                messages,
+                ...(options?.model ? { model: options.model } : {}),
+            }),
             signal: AbortSignal.timeout(60000),
         });
         if (proxyRes.ok) {