@4pm/cli 1.2.3 → 1.2.4

package/LICENSE

@@ -0,0 +1,30 @@
+4PM CLI — Source-Available License (All Rights Reserved)
+
+Copyright (c) 2026 4PM. All rights reserved.
+
+This source code is made publicly viewable for transparency and security auditing
+only. It is NOT open source and NOT free software.
+
+You ARE permitted to:
+  - View and read this source code.
+  - Audit it for security and correctness.
+
+You are NOT permitted, without a separate prior written agreement from the
+copyright holder, to:
+  - Use, run, or execute this source (other than the official distributions —
+    the `@4pm/cli` npm package and the official container images — under their
+    own terms);
+  - Copy, modify, adapt, translate, or create derivative works;
+  - Redistribute, sublicense, sell, or otherwise make the source available; or
+  - Remove or alter this notice.
+
+Contributions are accepted only under a separate Contributor License Agreement.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+Licensing inquiries: hiroshi.kaze1994@gmail.com

package/README.md

@@ -1,32 +1,52 @@
-# @4pm/cli
+# 4PM CLI (`@4pm/cli`)
 
-**An agent running on the worker machine** — receives commands from `@4pm/server` over WebSocket and orchestrates
-the AI CLIs (`claude` / `codex`) plus other tools (`git`, `gh`, `glab`, `shell`).
-Node ESM + TypeScript.
+**The agent that runs on a 4PM worker machine.** It pairs with the 4PM server, opens an
+encrypted WebSocket, and orchestrates the AI CLIs (`claude` / `codex`) plus `git` / `gh` /
+`glab` / shell on your machine — streaming their output back to the 4PM dashboard.
 
-Lifecycle: **pairing** with the server via a hashcode (the `.cre` file) → request a `ws_token` → open a
-TLS WebSocket → receive commands → **spawn child processes**, gather the output (backpressure) back to the
-server. Multiple instances on one machine use separate profiles, and the server groups them into one **worker**.
+> **This repository is the public, source-available mirror of the 4PM CLI.** It is published
+> for transparency and security auditing — you run an agent that spawns processes and uses
+> your git credentials locally, so you can read exactly what it does. It is **not** open
+> source: see [`LICENSE`](./LICENSE) (source-available, all rights reserved).
+
+## Install (users)
 
 ```bash
-pnpm --filter @4pm/cli dev
+npm i -g @4pm/cli      # official distribution (npm)
+4pm link               # pair with your 4PM server, then:
+4pm start              # run the worker
 ```
 
-## Run as a container (ADR-0192)
+Container images are published to `ghcr.io/4azuo/4pm-cli`. Configuration is via `4pm link`
++ the profile's `config.json`; environment variables are documented in
+[`.env.example`](./.env.example).
+
+> **Security note:** use an `https://` server URL in production. The WebSocket session
+> encryption (ephemeral ECDH) protects confidentiality but does **not** authenticate the
+> server — TLS does. Connecting over plaintext to a non-local host emits a warning.
+
+## Build from source
 
-Package the cli as a Docker image — the **container is the OS sandbox** (one cli per container).
-Build + run + pair (full runbook: [`11-docs/41-guides/0015-cli-container.md`](../../11-docs/41-guides/0015-cli-container.md)):
+The repository is standalone — it needs no other 4PM code. The `@4pm/*` shared packages are
+provided as a trimmed, vendored subset under [`vendor/`](./vendor) (only the code the CLI
+actually uses; server-internal types are excluded).
 
 ```bash
-docker build -f 31-docker/cli.Dockerfile --target full -t 4pm-cli:full .          # base = cli only
-FOURPM_SERVER=https://app.example docker compose -f 31-docker/docker-compose.cli.yml run --rm cli link  # pair once
-FOURPM_SERVER=https://app.example docker compose -f 31-docker/docker-compose.cli.yml up -d              # run headless
-docker compose -f 31-docker/docker-compose.cli.yml exec cli 4pm attach                                  # TUI (optional)
+pnpm install
+pnpm build       # → dist/index.js (self-contained bundle)
+pnpm typecheck
 ```
 
-Headless (ECS/pool): boot with `FOURPM_PAIR_TOKEN` (a provisioning token) ⇒ the cli self-pairs, no
-interactive step (ADR-0192 §6). In a container the in-process auto-update is moot — redeploy a new
-image tag instead.
+## How this repo relates to 4PM
+
+The 4PM CLI is developed inside the private 4PM monorepo and embedded there as a git
+submodule. The `vendor/` subset is generated from the monorepo's shared packages by
+`scripts/vendor-shared.mjs`; do not hand-edit it. Releases are built and signed from the
+monorepo and published here (npm + GitHub Release tarball + GHCR image).
+
+## Layout
 
-> Code organization, conventions & what's missing: [`CLAUDE.md`](./CLAUDE.md).
-> The cli behavior spec: [`11-docs/61-cli/`](../../11-docs/61-cli/README.md).
+- `src/core/` — orchestration; `src/commands/` — subcommands (`link`/`start`/`attach`/…).
+- `src/services/` — server REST calls; `src/ui/` — the Ink TUI (`4pm start` on a TTY).
+- `src/common/`, `src/utils/`, `src/config/` — shared helpers, pure functions, config.
+- `vendor/@4pm/*` — generated trimmed shared subset (see above).