ysagc-agent 0.3.0 → 0.5.0

package/README.md

@@ -1,91 +1,163 @@
 # ysagc-agent
 
-代码工作台本机代理：替浏览器在本机执行**文件 / Git / 终端**操作。只处理工作台发来的指令，不偷传数据、不常驻收集信息。
+The **local execution agent** for ysagc. It runs on a user's own computer, opens a
+WebSocket to the platform backend, receives tool instructions, executes them
+**safely inside an authorization root**, and reports results back.
 
-- 仅监听 `127.0.0.1`（浏览器可信源），HTTPS 页面不拦截
-- 通信：JSON-RPC 2.0 over WebSocket（控制通道）+ 二进制帧（终端通道）
-- 路径沙箱：只能操作 allowlist（用户显式添加的项目根目录）内路径
-- 终端：node-pty（Windows: PowerShell / macOS·Linux: 默认 shell），输入输出**不经过网站后端**
-- **免配对码**（v0.2.0）：浏览器打开网站「工作台」自动识别并连接本机代理，无需输入配对码、无需安装 exe
-- **目录树浏览 + 技能链接安装**（v0.3.0）：新增 `fs.browse`（网页内逐级选文件夹）与 `skill.installFromUrl`（从链接下载安装技能）
+`ysagc-agent` is deliberately **state-agnostic**: it never stores balances, never
+makes billing decisions, and never holds platform secrets. It is a dumb, safe,
+well-scoped executor — all policy lives on the platform.
 
-## 安装（npm 方式，全球通用）
+## Highlights
 
-要求 Node.js ≥ 20（Windows / macOS / Linux 均可）。
+- **Authorization root** — every file operation is forced inside one directory tree.
+- **Danger-command guard** — destructive shell commands are detected and blocked.
+- **Sensitive-path guard** — credential/system paths are blocked regardless of mode.
+- **Secret masking** — secrets are redacted from logs and tool results.
+- **Idempotency** — repeated `tool_call`s with the same key return the cached result
+  and never double-execute or double-write.
+- **Heartbeat & auto-reconnect** — exponential backoff with a cap.
+- **Cancel support** — in-flight commands can be aborted by the platform.
+- **Strict TypeScript** — compiled with `tsc` to CommonJS, zero `any` leaks.
+- **Cross-platform** — bash, PowerShell and cmd command detection.
 
-```bash
-# 方式一：免安装，直接跑（推荐，首次会下载依赖包）
-npx ysagc-agent
+## Requirements
 
-# 方式二：全局安装后运行
-npm i -g ysagc-agent
-ysagc-agent
-```
+- Node.js **>= 18**
 
-启动后终端会显示 `ysagc-agent 运行中: ws://127.0.0.1:37890`，保持该终端窗口开启即可（最小化没问题，不要关闭）。
+## Quick start
 
-## 使用流程
+### Install globally and run
 
-1. 打开终端执行 `npx ysagc-agent`（保持运行）。
-2. 打开网站「工作台」，点击「新增工作区」→ 选择本机文件夹。
-3. 在聊天中把话题「绑定工作区」后，AI 就能在对应文件夹里读文件、改代码、跑命令了。
+```bash
+npm install -g ysagc-agent
 
-> 旧版（0.1.x）安装包渠道与配对码流程已不再需要；如需卸载：`npm rm -g ysagc-agent`。
+ysagc-agent --server ws://platform.example.com/agent \
+            --token <your-device-token> \
+            --root ~/my-projects
+```
 
-## 配置（agent.json）
+Once connected the agent sends a `hello` frame, waits for `welcome`, then answers
+`ping`/`tool_call`/`cancel` frames.
 
-位置：`~/.ysagc-agent/agent.json`（Windows 为 `C:\Users\<你>\.ysagc-agent`）。非法 JSON 会自动备份恢复。
+### Or run it from this checkout
 
-```jsonc
-{
-  "port": 37890,               // 端口被占用自动 +1（最多 5 次）
-  "allowedRoots": [],          // 授权项目根目录（网站添加工作区时自动写入）
-  "deviceTokenWhitelist": [],  // 旧版配对令牌（sha256，兼容保留）
-  "originWhitelist": [],       // 允许直连的浏览器 Origin；留空=自动信任站点与 localhost
-  "trashEnabled": true,        // 删除进回收站
-  "trashRetentionDays": 7,
-  "enableTerminal": true,      // 终端开关
-  "terminalMaxSessions": 3,
-  "terminalIdleTimeoutMin": 30,
-  "terminalPermission": "ask", // ask=每次询问 / allow=始终允许 / deny=拒绝
-  "backendUrl": "https://chat.ysagc.top",
-  "logLevel": "info"
-}
+```bash
+npm install
+npm run build               # tsc -> dist/
+node dist/cli.js --selftest # run the smoke test
+node dist/cli.js --server ws://... --token ... --root ~/my-projects
 ```
 
-## 常见问题
+## Configuration
+
+Settings come from defaults, then environment variables, then CLI flags
+(CLI wins). `--token` is **never logged**.
+
+| CLI flag              | Environment        | Default           | Description                                          |
+| --------------------- | ------------------ | ----------------- | ---------------------------------------------------- |
+| `--server <url>`      | `WS_URL`           | _(required)_      | Platform WebSocket URL for the agent channel         |
+| `--token <token>`     | `YSAGC_TOKEN`      | _(required)_      | Device/agent auth token                              |
+| `--device-id <id>`    | `DEVICE_ID`        | host+pid          | Stable device identifier                             |
+| `--root <dir>`        | `WORKSPACE_ROOT`   | cwd               | Authorization root (all file ops stay inside it)     |
+| `--mode <mode>`       | `PERMISSION_MODE`  | `smart`           | Permission mode (see below)                          |
+| `--web`               | `YSAGC_WEB`        | off               | Enable the local web_search (stub) tool              |
+| `--timeout <ms>`      | `YSAGC_TIMEOUT`    | `120000`          | Command timeout in milliseconds                      |
+| `--max-bytes <n>`     | `YSAGC_MAX_BYTES`  | `64000`           | Per-stream output cap before truncation              |
+| `--log-level <level>` | `YSAGC_LOG_LEVEL`  | `info`            | `silent\|error\|warn\|info\|debug`                      |
+| `--selftest`          | —                  | —                 | Run the local smoke test and exit                    |
+| `-V, --version`       | —                  | —                 | Print version                                        |
+| `-h, --help`          | —                  | —                 | Print usage                                          |
+
+### Permission modes
+
+| Mode       | Shell behaviour                                                           |
+| ---------- | ------------------------------------------------------------------------- |
+| `supervise`| Every `run_command`/`git` is **denied** (requires human approval)         |
+| `smart`    | Safe commands are allowed; dangerous ones are blocked (default)           |
+| `auto`     | All non-dangerous commands are allowed                                    |
+
+Dangerous commands and sensitive paths are blocked **in every mode**.
+
+## Tools
+
+| Tool          | Args                                 | Returns                                 |
+| ------------- | ------------------------------------ | --------------------------------------- |
+| `list_dir`    | `path`, `depth`                      | entries (`name`, `type`, `size`, `mtime`) |
+| `read_file`   | `path`, `maxBytes`                   | text or hex, truncated, size info       |
+| `write_file`  | `path`, `content`, `mode?`           | `path`, `bytesWritten`                  |
+| `edit_file`   | `path`, `oldText`, `newText`         | `path`, `replacements`                  |
+| `run_command` | `cmd`, `timeout?`, `cwd?`            | `exitCode`, `stdout`, `stderr`, flags   |
+| `web_search`  | `query`                              | labelled **stub** result (real search is platform-side) |
+| `git`         | `args` (array) or `command` (string) | git output, `exitCode`, flags           |
+| `generate`    | `template`, `name`                   | file list it created                    |
+
+Every tool canonicalizes its path, asserts it is inside the authorization root,
+rejects outside/sensitive paths, and never leaks platform internals or keys.
+
+## Security model
+
+1. **Authorization root** — `canonicalize()` resolves `..`, symlinks, the
+   `\\?\` prefix, trailing dots/spaces and Windows reserved names, then
+   `isWithinRoot()` strictly checks the result is under the root. Writes equal
+   to the root are rejected; `..` and symlink escapes are rejected too.
+2. **Danger-command detection** — `isDangerCommand()` flags `rm -rf`, `sudo`,
+   `format`, `del /f`, `shutdown`, `reboot`, `git reset --hard`,
+   `git clean -fdx`, `find ... -delete`, `Remove-Item -Recurse -Force`,
+   `diskpart`, `reg delete`, `chmod -R 777 /`, `mkfs`, `dd of=/dev/...`,
+   redirects to block devices, fork bombs and more. Cross-platform
+   (bash / PowerShell / cmd).
+3. **Sensitive-path detection** — `isSensitivePath()` blocks system and
+   credential paths (`/etc/passwd`, `C:\Windows\System32`, `~/.ssh`, `.env`
+   with keys, `id_rsa`, `.npmrc` with `_authToken`, and so on) regardless of mode.
+4. **Secret masking** — `maskSecrets()` redacts provider keys, bearer tokens,
+   JWTs, private keys and `key=value` secrets from logs and tool output.
+5. **Idempotency** — results are cached by a hash of `(tool, args, idempotencyKey)`;
+   replayed jobs return the cached result without re-executing.
+6. **Environment sanitization** — child processes never inherit the agent's own
+   token or credential variables.
+
+## Self-test
 
-**Q：端口被占用怎么办？** 自动尝试 37891–37894；也可 `ysagc-agent --port <端口>` 指定。
+```bash
+node dist/cli.js --selftest
+```
 
-**Q：网页提示"未检测到本机代理"？** 确认 Agent 已在终端运行（能看到 `运行中: ws://127.0.0.1:37890`）；首次 `npx` 会先下载依赖，稍等片刻。
+Runs 27 checks over path safety, danger-command detection, sensitive-path
+detection, secret masking and the tool registry, printing `PASS`/`FAIL` lines
+and exiting `0`/`1`.
 
-**Q：macOS 提示"无法打开"？** npm 方式无需处理；仅安装包渠道需要右键 → 打开。
+## Protocol
 
-**Q：日志在哪？** `~/.ysagc-agent/logs/agent.log`。日志**永不记录**密钥文件内容与 Git 凭证。
+JSON text frames over a WebSocket.
 
-**Q：Agent 会读取我电脑上的所有文件吗？** 不会。Agent 只能访问你在网站显式添加的工作区目录（allowlist），越界操作一律拒绝并记录审计；终端除外（终端等同于你的命令行，可操作整台电脑——首次使用会在网页端弹安全确认）。
+**Client → server**
 
-**Q：其他网站能控制我的 Agent 吗？** 不能。Agent 只信任站点域名与 localhost 来源（Origin 白名单），其他网页发起的连接会被拒绝。
+```jsonc
+{ "type": "hello", "token": "...", "deviceId": "...", "version": "0.4.0", "platform": "node" }
+{ "type": "pong", "t": 42 }                       // reply to a server ping
+{ "type": "tool_result", "jobId": "j1", "ok": true, "result": { }, "durationMs": 12 }
+{ "type": "status", "state": "online" | "busy" | "error", "sessionId": "..." }
+```
 
-## 开发
+**Server → client**
 
-```bash
-npm ci
-npm start            # 启动
-npm run smoke        # 冒烟测试（WS 鉴权 / RPC / 终端全链路）
-node scripts/smoke.js <token> <port>   # 自定义参数
+```jsonc
+{ "type": "welcome", "sessionId": "..." }
+{ "type": "ping", "t": 42 }
+{ "type": "tool_call", "jobId": "j1", "idempotencyKey": "k1", "tool": "write_file", "args": { } }
+{ "type": "cancel", "jobId": "j1" }
 ```
 
-打包（单文件，可选）：
+## Development
 
 ```bash
-npx @yao-pkg/pkg . --target node22-win-x64 --output dist/ysagc-agent.exe
-# 三平台（Linux 环境可交叉产出）：
-npx @yao-pkg/pkg . --target node22-win-x64,node22-macos-x64,node22-linux-x64 --output dist/ysagc-agent
+npm install
+npm run build          # tsc -> dist/
+npm run test           # node dist/cli.js --selftest
+npm start              # node dist/cli.js
 ```
 
-CI：`.gitlab-ci.yml`（build 产物 + tag 触发发布到 Package Registry / npm）。
-
-## 隐私
+## License
 
-Agent 与网站后端的交互仅限：设备自动注册、版本握手、审计元数据。**项目文件内容、终端输入输出、Git 凭证一律不经过网站后端**。
+MIT

package/dist/agent.d.ts

@@ -0,0 +1,17 @@
+import { type ClientState } from './protocol';
+import { type AgentConfig } from './config';
+/** Kept in sync with package.json. */
+export declare const AGENT_VERSION = "0.5.0";
+export interface AgentHandle {
+    stop(): void;
+}
+export interface AgentEvents {
+    /** Called when the agent transitions connectivity state. */
+    onState?: (state: ClientState) => void;
+}
+/** Start the local agent. Throws {@link ConfigError} for missing required
+ * config (no server/token/device-id) with a friendly message. */
+export declare function startAgent(config: AgentConfig, events?: AgentEvents): AgentHandle;
+/** Convenience wrapper that loads config from env/CLI and starts the agent. */
+export declare function startAgentFromEnv(overrides?: Partial<AgentConfig>): AgentHandle;
+//# sourceMappingURL=agent.d.ts.map

package/dist/agent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent.d.ts","sourceRoot":"","sources":["../src/agent.ts"],"names":[],"mappings":"AACA,OAAO,EAYL,KAAK,WAAW,EACjB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAgE,KAAK,WAAW,EAAE,MAAM,UAAU,CAAC;AAI1G,sCAAsC;AACtC,eAAO,MAAM,aAAa,UAAU,CAAC;AAQrC,MAAM,WAAW,WAAW;IAC1B,IAAI,IAAI,IAAI,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,4DAA4D;IAC5D,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;CACxC;AA8TD;iEACiE;AACjE,wBAAgB,UAAU,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,WAAW,CAGjF;AAED,+EAA+E;AAC/E,wBAAgB,iBAAiB,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,GAAG,WAAW,CAG/E"}

package/dist/agent.js

@@ -0,0 +1,331 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AGENT_VERSION = void 0;
+exports.startAgent = startAgent;
+exports.startAgentFromEnv = startAgentFromEnv;
+const ws_1 = __importDefault(require("ws"));
+const protocol_1 = require("./protocol");
+const tools_1 = require("./tools");
+const config_1 = require("./config");
+const tokens_1 = require("./tokens");
+/** Kept in sync with package.json. */
+exports.AGENT_VERSION = '0.5.0';
+const MAX_IDEMPOTENCY_ENTRIES = 512;
+const RECONNECT_BASE_MS = 1000;
+const RECONNECT_CAP_MS = 60000;
+const HEARTBEAT_MS = 30000;
+const READY_OPEN = 1; // ws.WebSocket.OPEN
+class Agent {
+    constructor(config, events) {
+        this.ws = null;
+        this.sessionId = '';
+        this.state = 'error';
+        this.stopped = false;
+        this.intentionalClose = false;
+        this.reconnectAttempt = 0;
+        this.jobs = new Map();
+        this.idempotencyCache = new Map();
+        this.config = config;
+        this.events = events;
+        this.log = (0, config_1.loggerFromConfig)(config);
+        this.registry = (0, tools_1.createToolRegistry)({
+            root: config.root,
+            mode: config.mode,
+            permissionPreset: config.permissionPreset,
+            webEnabled: config.web,
+            timeoutMs: config.timeoutMs,
+            maxBytes: config.maxBytes,
+            logger: this.log.child('tools'),
+        });
+    }
+    start() {
+        (0, config_1.validateConfig)(this.config);
+        this.log.info('starting agent', (0, config_1.describeConfig)(this.config));
+        this.connect();
+        this.startHeartbeat();
+        return { stop: () => this.stop() };
+    }
+    connect() {
+        if (this.stopped)
+            return;
+        if (this.ws) {
+            this.log.debug('already connected, ignoring connect()');
+            return;
+        }
+        this.log.info('connecting', { url: this.config.server });
+        const ws = new ws_1.default(this.config.server, { handshakeTimeout: 15000, perMessageDeflate: false });
+        this.ws = ws;
+        ws.on('open', () => {
+            this.log.info('socket open; sending hello');
+            this.sendHello();
+        });
+        ws.on('message', (data) => {
+            this.handleMessage(data);
+        });
+        ws.on('pong', () => {
+            this.log.debug('pong received');
+        });
+        ws.on('unexpected-response', (_req, res) => {
+            this.log.warn('unexpected ws response', { status: res.statusCode });
+        });
+        ws.on('error', (err) => {
+            this.log.error('ws error', { error: err.message });
+        });
+        ws.on('close', (code, reason) => {
+            this.ws = null;
+            this.setStatus('error');
+            const reasonText = reason.toString();
+            this.log.warn('socket closed', { code, reason: reasonText });
+            // A disconnect/close should stop any in-flight jobs so a stalled command
+            // does not keep running against a backend that is no longer listening.
+            this.abortAllJobs();
+            if (this.intentionalClose || this.stopped)
+                return;
+            this.scheduleReconnect();
+        });
+    }
+    sendHello() {
+        const { token, deviceId, platform } = this.config;
+        this.send({
+            type: 'hello',
+            token,
+            deviceId,
+            version: exports.AGENT_VERSION,
+            platform,
+        });
+    }
+    send(msg) {
+        if (this.ws && this.ws.readyState === READY_OPEN) {
+            this.ws.send((0, protocol_1.encodeMessage)(msg));
+        }
+        else {
+            this.log.debug('dropping outbound message (socket not open)', { type: msg.type });
+        }
+    }
+    handleMessage(data) {
+        const text = rawToString(data);
+        const msg = (0, protocol_1.decodeMessage)(text);
+        if (!msg) {
+            this.log.warn('ignoring malformed frame');
+            return;
+        }
+        switch (msg.type) {
+            case 'welcome':
+                this.onWelcome(msg);
+                break;
+            case 'ping':
+                this.onPing(msg);
+                break;
+            case 'tool_call':
+                this.onToolCall(msg);
+                break;
+            case 'cancel':
+                this.onCancel(msg);
+                break;
+            default:
+                this.log.warn('unhandled message type', { type: msg.type });
+        }
+    }
+    onWelcome(msg) {
+        if (!(0, protocol_1.isWelcome)(msg))
+            return;
+        this.sessionId = msg.sessionId;
+        // A successful handshake resets the backoff ramp.
+        this.reconnectAttempt = 0;
+        this.setStatus('online');
+        this.log.info('welcomed', { sessionId: this.sessionId });
+    }
+    onPing(msg) {
+        if (!(0, protocol_1.isPing)(msg))
+            return;
+        this.send({ type: 'pong', t: msg.t });
+        this.log.debug('replied to ping');
+    }
+    async onToolCall(msg) {
+        if (!(0, protocol_1.isToolCall)(msg))
+            return;
+        const { jobId, tool, args, idempotencyKey } = msg;
+        const key = (0, protocol_1.computeIdempotencyKey)(tool, args ?? {}, idempotencyKey);
+        if (this.idempotencyCache.has(key)) {
+            const cached = this.idempotencyCache.get(key);
+            this.log.info('serving cached result', { jobId, tool });
+            this.sendResult({ ...cached, cached: true, durationMs: cached.durationMs }, jobId);
+            return;
+        }
+        this.setStatus('busy');
+        const controller = new AbortController();
+        this.jobs.set(jobId, controller);
+        this.log.info('running tool', { jobId, tool });
+        try {
+            const result = await this.registry.dispatch(tool, args ?? {}, controller.signal);
+            if (controller.signal.aborted) {
+                // The platform sent a cancel for this job; report it explicitly.
+                this.sendResult({ ok: false, error: 'Job cancelled by platform', durationMs: result.durationMs }, jobId);
+                return;
+            }
+            this.cacheResult(key, result);
+            this.sendResult(result, jobId);
+            // Token meter: report an approximate request/response count per turn.
+            this.sendUsage(jobId, args ?? {}, result.result ?? result.error);
+        }
+        finally {
+            this.jobs.delete(jobId);
+            if (this.jobs.size === 0)
+                this.setStatus('online');
+        }
+    }
+    /** Emit a usage message estimating request/response tokens for this turn.
+     * When the platform supplies exact usage it wins; otherwise we estimate. */
+    sendUsage(jobId, input, output) {
+        const usage = (0, tokens_1.computeUsage)(input, output);
+        // No LLM usage available locally; estimate tokens from the payload.
+        const message = {
+            type: 'usage',
+            jobId,
+            ...(this.sessionId ? { sessionId: this.sessionId } : {}),
+            inputTokens: usage.inputTokens,
+            outputTokens: usage.outputTokens,
+            totalTokens: usage.totalTokens,
+            source: 'estimate',
+            ts: Date.now(),
+        };
+        this.send(message);
+        this.log.debug('usage reported', {
+            jobId,
+            inputTokens: usage.inputTokens,
+            outputTokens: usage.outputTokens,
+        });
+    }
+    onCancel(msg) {
+        if (!(0, protocol_1.isCancel)(msg))
+            return;
+        const controller = this.jobs.get(msg.jobId);
+        if (controller) {
+            controller.abort();
+            this.log.info('cancelled job', { jobId: msg.jobId });
+        }
+        else {
+            this.log.warn('cancel for unknown/job already finished', { jobId: msg.jobId });
+        }
+    }
+    /** Stop every in-flight job (used on disconnect / shutdown). */
+    abortAllJobs() {
+        if (this.jobs.size === 0)
+            return;
+        this.log.debug('aborting in-flight jobs', { count: this.jobs.size });
+        for (const controller of this.jobs.values())
+            controller.abort();
+    }
+    sendResult(result, jobId) {
+        const message = {
+            type: 'tool_result',
+            jobId,
+            ok: result.ok,
+            durationMs: result.durationMs,
+            ...(result.result !== undefined ? { result: result.result } : {}),
+            ...(result.error !== undefined ? { error: result.error } : {}),
+            ...(result.cached ? { cached: true } : {}),
+            ...(result.needsApproval ? { needsApproval: true } : {}),
+        };
+        this.send(message);
+        if (result.ok) {
+            this.log.info('sent result', { jobId, ok: true, durationMs: result.durationMs, cached: !!result.cached });
+        }
+        else {
+            this.log.info('sent result', { jobId, ok: false, error: result.error, durationMs: result.durationMs });
+        }
+    }
+    cacheResult(key, result) {
+        if (this.idempotencyCache.size >= MAX_IDEMPOTENCY_ENTRIES) {
+            const oldest = this.idempotencyCache.keys().next().value;
+            if (oldest !== undefined)
+                this.idempotencyCache.delete(oldest);
+        }
+        this.idempotencyCache.set(key, result);
+    }
+    setStatus(state) {
+        if (this.state === state)
+            return;
+        this.state = state;
+        this.send({ type: 'status', state, ...(this.sessionId ? { sessionId: this.sessionId } : {}), ts: Date.now() });
+        this.events?.onState?.(state);
+        this.log.info('status', { state });
+    }
+    startHeartbeat() {
+        if (this.heartbeatTimer)
+            return;
+        this.heartbeatTimer = setInterval(() => {
+            if (!this.stopped && this.state !== 'error' && this.ws) {
+                this.send({ type: 'status', state: this.state, ...(this.sessionId ? { sessionId: this.sessionId } : {}), ts: Date.now() });
+            }
+        }, HEARTBEAT_MS);
+        this.heartbeatTimer.unref?.();
+    }
+    scheduleReconnect() {
+        if (this.stopped)
+            return;
+        if (this.reconnectTimer)
+            return;
+        const delay = Math.min(RECONNECT_CAP_MS, RECONNECT_BASE_MS * Math.pow(2, this.reconnectAttempt));
+        this.reconnectAttempt += 1;
+        this.log.info('reconnecting', { delayMs: delay, attempt: this.reconnectAttempt });
+        this.reconnectTimer = setTimeout(() => {
+            this.reconnectTimer = undefined;
+            this.connect();
+        }, delay);
+        this.reconnectTimer.unref?.();
+    }
+    stop() {
+        this.log.info('stopping agent');
+        this.stopped = true;
+        this.intentionalClose = true;
+        if (this.reconnectTimer) {
+            clearTimeout(this.reconnectTimer);
+            this.reconnectTimer = undefined;
+        }
+        if (this.heartbeatTimer) {
+            clearInterval(this.heartbeatTimer);
+            this.heartbeatTimer = undefined;
+        }
+        for (const controller of this.jobs.values())
+            controller.abort();
+        this.jobs.clear();
+        if (this.ws) {
+            try {
+                this.ws.close(1000, 'agent stopping');
+            }
+            catch {
+                /* ignore */
+            }
+            this.ws = null;
+        }
+    }
+}
+/** Convert a ws RawData frame into a UTF-8 string. */
+function rawToString(data) {
+    if (typeof data === 'string')
+        return data;
+    if (Array.isArray(data)) {
+        return Buffer.concat(data).toString('utf8');
+    }
+    if (data instanceof ArrayBuffer) {
+        return Buffer.from(data).toString('utf8');
+    }
+    // Buffer (or other Uint8Array)
+    return Buffer.from(data).toString('utf8');
+}
+/** Start the local agent. Throws {@link ConfigError} for missing required
+ * config (no server/token/device-id) with a friendly message. */
+function startAgent(config, events) {
+    const agent = new Agent(config, events);
+    return agent.start();
+}
+/** Convenience wrapper that loads config from env/CLI and starts the agent. */
+function startAgentFromEnv(overrides) {
+    const config = (0, config_1.loadConfig)(overrides);
+    return startAgent(config);
+}
+//# sourceMappingURL=agent.js.map

package/dist/agent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent.js","sourceRoot":"","sources":["../src/agent.ts"],"names":[],"mappings":";;;;;;AAoWA,gCAGC;AAGD,8CAGC;AA7WD,4CAA6C;AAC7C,yCAaoB;AACpB,mCAA8D;AAC9D,qCAA0G;AAC1G,qCAAwC;AAGxC,sCAAsC;AACzB,QAAA,aAAa,GAAG,OAAO,CAAC;AAErC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AACpC,MAAM,iBAAiB,GAAG,IAAK,CAAC;AAChC,MAAM,gBAAgB,GAAG,KAAM,CAAC;AAChC,MAAM,YAAY,GAAG,KAAM,CAAC;AAC5B,MAAM,UAAU,GAAG,CAAC,CAAC,CAAC,oBAAoB;AAW1C,MAAM,KAAK;IAgBT,YAAY,MAAmB,EAAE,MAAoB;QAb7C,OAAE,GAAqB,IAAI,CAAC;QAC5B,cAAS,GAAG,EAAE,CAAC;QACf,UAAK,GAAgB,OAAO,CAAC;QAC7B,YAAO,GAAG,KAAK,CAAC;QAChB,qBAAgB,GAAG,KAAK,CAAC;QACzB,qBAAgB,GAAG,CAAC,CAAC;QAGZ,SAAI,GAAG,IAAI,GAAG,EAA2B,CAAC;QAC1C,qBAAgB,GAAG,IAAI,GAAG,EAAsB,CAAC;QAKhE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,GAAG,GAAG,IAAA,yBAAgB,EAAC,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC,QAAQ,GAAG,IAAA,0BAAkB,EAAC;YACjC,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,UAAU,EAAE,MAAM,CAAC,GAAG;YACtB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;SAChC,CAAC,CAAC;IACL,CAAC;IAED,KAAK;QACH,IAAA,uBAAc,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAA,uBAAc,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7D,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,IAAI,CAAC,cAAc,EAAE,CAAC;QACtB,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;IACrC,CAAC;IAEO,OAAO;QACb,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;YACZ,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;YACxD,OAAO;QACT,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACzD,MAAM,EAAE,GAAG,IAAI,YAAS,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,gBAAgB,EAAE,KAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,CAAC;QACrG,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QAEb,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;YACjB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;YAC5C,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE;YACxB,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;YACjB,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,EAAE,CAAC,qBAAqB,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YACzC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;QACtE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACrB,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YAC9B,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC;YACf,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YACxB,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;YACrC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YAC7D,yEAAyE;YACzE,uEAAuE;YACvE,IAAI,CAAC,YAAY,EAAE,CAAC;YACpB,IAAI,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC,OAAO;gBAAE,OAAO;YAClD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC3B,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,SAAS;QACf,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC;QAClD,IAAI,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,OAAO;YACb,KAAK;YACL,QAAQ;YACR,OAAO,EAAE,qBAAa;YACtB,QAAQ;SACT,CAAC,CAAC;IACL,CAAC;IAEO,IAAI,CAAC,GAAkB;QAC7B,IAAI,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;YACjD,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAA,wBAAa,EAAC,GAAG,CAAC,CAAC,CAAC;QACnC,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,6CAA6C,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IAEO,aAAa,CAAC,IAAa;QACjC,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,GAAG,GAAG,IAAA,wBAAa,EAAC,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;YAC1C,OAAO;QACT,CAAC;QACD,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;YACjB,KAAK,SAAS;gBACZ,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACpB,MAAM;YACR,KAAK,MAAM;gBACT,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACjB,MAAM;YACR,KAAK,WAAW;gBACd,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;gBACrB,MAAM;YACR,KAAK,QAAQ;gBACX,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;gBACnB,MAAM;YACR;gBACE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,IAAI,EAAG,GAAqB,CAAC,IAAI,EAAE,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IAEO,SAAS,CAAC,GAAwC;QACxD,IAAI,CAAC,IAAA,oBAAS,EAAC,GAAG,CAAC;YAAE,OAAO;QAC5B,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC;QAC/B,kDAAkD;QAClD,IAAI,CAAC,gBAAgB,GAAG,CAAC,CAAC;QAC1B,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACzB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAC3D,CAAC;IAEO,MAAM,CAAC,GAAqC;QAClD,IAAI,CAAC,IAAA,iBAAM,EAAC,GAAG,CAAC;YAAE,OAAO;QACzB,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACpC,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,GAA0C;QACjE,IAAI,CAAC,IAAA,qBAAU,EAAC,GAAG,CAAC;YAAE,OAAO;QAC7B,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,GAAG,CAAC;QAElD,MAAM,GAAG,GAAG,IAAA,gCAAqB,EAAC,IAAI,EAAE,IAAI,IAAI,EAAE,EAAE,cAAc,CAAC,CAAC;QACpE,IAAI,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;YAC/C,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACxD,IAAI,CAAC,UAAU,CAAC,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE,KAAK,CAAC,CAAC;YACnF,OAAO;QACT,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACvB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QACjC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAE/C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;YACjF,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC9B,iEAAiE;gBACjE,IAAI,CAAC,UAAU,CACb,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,EAChF,KAAK,CACN,CAAC;gBACF,OAAO;YACT,CAAC;YACD,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAC9B,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC/B,sEAAsE;YACtE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,IAAI,EAAE,EAAE,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;QACnE,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACxB,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC;gBAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED;gFAC4E;IACpE,SAAS,CAAC,KAAa,EAAE,KAAc,EAAE,MAAe;QAC9D,MAAM,KAAK,GAAG,IAAA,qBAAY,EAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC1C,oEAAoE;QACpE,MAAM,OAAO,GAAiB;YAC5B,IAAI,EAAE,OAAO;YACb,KAAK;YACL,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,UAAU;YAClB,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;SACf,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnB,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,gBAAgB,EAAE;YAC/B,KAAK;YACL,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC;IACL,CAAC;IAEO,QAAQ,CAAC,GAAuC;QACtD,IAAI,CAAC,IAAA,mBAAQ,EAAC,GAAG,CAAC;YAAE,OAAO;QAC3B,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,UAAU,EAAE,CAAC;YACf,UAAU,CAAC,KAAK,EAAE,CAAC;YACnB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;QACvD,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,yCAAyC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IAED,gEAAgE;IACxD,YAAY;QAClB,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO;QACjC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACrE,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YAAE,UAAU,CAAC,KAAK,EAAE,CAAC;IAClE,CAAC;IAEO,UAAU,CAAC,MAAkB,EAAE,KAAa;QAClD,MAAM,OAAO,GAAsB;YACjC,IAAI,EAAE,aAAa;YACnB,KAAK;YACL,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1C,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzD,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnB,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACd,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5G,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;QACzG,CAAC;IACH,CAAC;IAEO,WAAW,CAAC,GAAW,EAAE,MAAkB;QACjD,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,IAAI,uBAAuB,EAAE,CAAC;YAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YACzD,IAAI,MAAM,KAAK,SAAS;gBAAE,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;IAEO,SAAS,CAAC,KAAkB;QAClC,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK;YAAE,OAAO;QACjC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC/G,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACrC,CAAC;IAEO,cAAc;QACpB,IAAI,IAAI,CAAC,cAAc;YAAE,OAAO;QAChC,IAAI,CAAC,cAAc,GAAG,WAAW,CAAC,GAAG,EAAE;YACrC,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,KAAK,OAAO,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;gBACvD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAC7H,CAAC;QACH,CAAC,EAAE,YAAY,CAAC,CAAC;QACjB,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,EAAE,CAAC;IAChC,CAAC;IAEO,iBAAiB;QACvB,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,IAAI,CAAC,cAAc;YAAE,OAAO;QAChC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC;QACjG,IAAI,CAAC,gBAAgB,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAClF,IAAI,CAAC,cAAc,GAAG,UAAU,CAAC,GAAG,EAAE;YACpC,IAAI,CAAC,cAAc,GAAG,SAAS,CAAC;YAChC,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,CAAC,EAAE,KAAK,CAAC,CAAC;QACV,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,EAAE,CAAC;IAChC,CAAC;IAEO,IAAI;QACV,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAChC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;QAC7B,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAClC,IAAI,CAAC,cAAc,GAAG,SAAS,CAAC;QAClC,CAAC;QACD,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,aAAa,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACnC,IAAI,CAAC,cAAc,GAAG,SAAS,CAAC;QAClC,CAAC;QACD,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YAAE,UAAU,CAAC,KAAK,EAAE,CAAC;QAChE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAClB,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;YACZ,IAAI,CAAC;gBACH,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;YACxC,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;YACD,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC;QACjB,CAAC;IACH,CAAC;CACF;AAED,sDAAsD;AACtD,SAAS,WAAW,CAAC,IAAa;IAChC,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,IAAI,YAAY,WAAW,EAAE,CAAC;QAChC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5C,CAAC;IACD,+BAA+B;IAC/B,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC5C,CAAC;AAED;iEACiE;AACjE,SAAgB,UAAU,CAAC,MAAmB,EAAE,MAAoB;IAClE,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,OAAO,KAAK,CAAC,KAAK,EAAE,CAAC;AACvB,CAAC;AAED,+EAA+E;AAC/E,SAAgB,iBAAiB,CAAC,SAAgC;IAChE,MAAM,MAAM,GAAG,IAAA,mBAAU,EAAC,SAAS,CAAC,CAAC;IACrC,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;AAC5B,CAAC"}

package/dist/cli.d.ts

@@ -0,0 +1,14 @@
+#!/usr/bin/env node
+export interface SelfTest {
+    name: string;
+    ok: boolean;
+    details?: string;
+    error?: string;
+}
+/**
+ * Run a local smoke test of path safety, danger-command detection, sensitive
+ * path detection, secret masking and the tool registry. Returns structured
+ * PASS/FAIL results; the CLI prints them and picks the exit code.
+ */
+export declare function runSelfTest(): Promise<SelfTest[]>;
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAaA,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAgGD;;;;GAIG;AACH,wBAAsB,WAAW,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC,CAkMvD"}