@addai/node 0.27.1 → 0.28.0

package/dist/desktop/vault-seed.mjs

@@ -0,0 +1,112 @@
+// Plants the add.ai session cookie in a desktop's browser, from inside it.
+//
+// Runs in the container, not the daemon: the debugging port is bound to
+// loopback there on purpose (CDP is total control of a browser, and the host
+// must not be able to reach it), so the only place that can talk to it is the
+// container itself. Node 22 is in the image already — this is the same
+// arrangement +Ai Learn's recorder uses.
+//
+// Launched by the browser wrapper, in the background, immediately before Chrome
+// starts. It waits for the port rather than assuming, sets the cookie, and
+// exits. Nothing depends on its exit code: a browser that comes up without a
+// vault session is worse than one with, but it is still a working browser.
+import * as fs from 'node:fs';
+
+const PORT = Number(process.env.ADDAI_CDP_PORT || 9222);
+const SESSION_FILE = process.env.ADDAI_VAULT_SESSION || '/conf/vault/session.json';
+const DEADLINE_MS = 60_000;
+const POLL_MS = 250;
+
+const log = (m) => process.stdout.write(`[vault-seed] ${m}\n`);
+
+/** The cookie the extension reads: URI-encoded JSON with the two tokens. */
+export function cookieValue(session) {
+  return encodeURIComponent(JSON.stringify({
+    access_token: session.access_token,
+    refresh_token: session.refresh_token,
+  }));
+}
+
+/** Both add.ai itself and every *.add.ai app, which is what the session is
+ *  for — signing in at auth.add.ai signs you in across all of them. */
+export function cookieParams(session) {
+  return {
+    name: 'auth',
+    value: cookieValue(session),
+    domain: '.add.ai',
+    path: '/',
+    secure: true,
+    httpOnly: false,
+    sameSite: 'Lax',
+  };
+}
+
+async function waitForBrowser(deadline) {
+  while (Date.now() < deadline) {
+    try {
+      const res = await fetch(`http://127.0.0.1:${PORT}/json/version`);
+      if (res.ok) return await res.json();
+    } catch { /* not up yet */ }
+    await new Promise((r) => setTimeout(r, POLL_MS));
+  }
+  return null;
+}
+
+async function setCookie(wsUrl, params) {
+  const ws = new WebSocket(wsUrl);
+  await new Promise((resolve, reject) => {
+    ws.addEventListener('open', resolve, { once: true });
+    ws.addEventListener('error', () => reject(new Error('could not open the debugger')), { once: true });
+  });
+  const done = new Promise((resolve, reject) => {
+    const timer = setTimeout(() => reject(new Error('the browser did not answer')), 10_000);
+    ws.addEventListener('message', (ev) => {
+      let msg;
+      try { msg = JSON.parse(ev.data); } catch { return; }
+      if (msg.id !== 1) return;
+      clearTimeout(timer);
+      if (msg.error) reject(new Error(msg.error.message || 'setCookie failed'));
+      else resolve(msg.result);
+    });
+  });
+  ws.send(JSON.stringify({ id: 1, method: 'Network.setCookie', params }));
+  // finally, not after the await: an error reply rejects, and a socket left
+  // open holds the event loop forever. The failure mode is a hung node process
+  // per browser launch, which is worse than the failure it is reporting.
+  try {
+    return await done;
+  } finally {
+    ws.close();
+  }
+}
+
+async function main() {
+  let session;
+  try {
+    session = JSON.parse(fs.readFileSync(SESSION_FILE, 'utf8'));
+  } catch {
+    log('no session staged for this desktop — the vault will be empty until somebody signs in');
+    return;
+  }
+  if (!session?.access_token || !session?.refresh_token) {
+    log('the staged session is not usable');
+    return;
+  }
+
+  const version = await waitForBrowser(Date.now() + DEADLINE_MS);
+  if (!version?.webSocketDebuggerUrl) {
+    log('the browser never opened its debugging port');
+    return;
+  }
+  try {
+    const res = await setCookie(version.webSocketDebuggerUrl, cookieParams(session));
+    log(res?.success === false ? 'the browser refused the cookie' : 'signed in');
+  } catch (err) {
+    log(`could not sign in: ${err.message}`);
+  }
+}
+
+// Importable for tests; only runs when executed directly.
+if (process.argv[1] && process.argv[1].endsWith('vault-seed.mjs')) {
+  main().catch((err) => log(`unexpected: ${err.message}`));
+}

package/dist/desktop/vault-session.d.ts

@@ -0,0 +1,41 @@
+/** A GoTrue session, reduced to the two fields the cookie carries. */
+export interface VaultSession {
+    access_token: string;
+    refresh_token: string;
+    /** Epoch ms. Used to decide whether to refresh before handing it over. */
+    expires_at: number;
+    email?: string;
+    entity_name?: string;
+}
+export declare function sessionPath(confDir: string): string;
+export declare function readSession(confDir: string): VaultSession | null;
+export declare function writeSession(confDir: string, s: VaultSession): void;
+export declare function isFresh(s: VaultSession | null, now: number): boolean;
+/** Exactly what the extension expects to find: the add.ai `auth` cookie is a
+ *  URI-encoded JSON object with the two tokens in it. */
+export declare function cookieValue(s: VaultSession): string;
+type Fetcher = typeof fetch;
+/** Trade a refresh token for a live one. Returns null when it has expired or
+ *  been revoked — which is the normal way a rotation elsewhere reaches us. */
+export declare function refreshSession(refreshToken: string, doFetch?: Fetcher): Promise<VaultSession | null>;
+/** Sign in with a freshly rotated password. */
+export declare function passwordSession(email: string, password: string, doFetch?: Fetcher): Promise<VaultSession | null>;
+export interface LoginRpc {
+    (desktopId: string, rotate: boolean): Promise<any>;
+}
+export interface EnsureResult {
+    session: VaultSession | null;
+    /** Why there is no session, when there is none. */
+    reason?: string;
+    /** True when a rotation was performed — worth logging, it is destructive. */
+    rotated: boolean;
+}
+/**
+ * Get a live session for this desktop, minting one only when necessary.
+ *
+ * Order matters: cached-and-fresh, then refresh, then rotate. Skipping to
+ * rotation because it is simpler would log the entity out of every other
+ * browser it is signed into, every time a desktop restarts.
+ */
+export declare function ensureVaultSession(confDir: string, login: LoginRpc, desktopId: string, doFetch?: Fetcher, now?: number): Promise<EnsureResult>;
+export {};

package/dist/desktop/vault-session.js

@@ -0,0 +1,164 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sessionPath = sessionPath;
+exports.readSession = readSession;
+exports.writeSession = writeSession;
+exports.isFresh = isFresh;
+exports.cookieValue = cookieValue;
+exports.refreshSession = refreshSession;
+exports.passwordSession = passwordSession;
+exports.ensureVaultSession = ensureVaultSession;
+// Signing a desktop's browser in, so the vault has something in it.
+//
+// The +Ai Vault extension shows whatever the browser's add.ai session can see,
+// so an installed extension and no session is an empty vault. This mints the
+// session on the host and leaves it where the desktop can pick it up.
+//
+// Rotation is destructive — asking for a new password drops every other
+// session that identity holds, which would sign an entity out of every browser
+// it uses. So the order is always: use the cached refresh token, and only ask
+// the server for a password when there is nothing to refresh.
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const config_1 = require("../config");
+/** Refresh this long before expiry rather than at it: a browser that starts
+ *  with a token about to die shows an empty vault for its first minute. */
+const EARLY_REFRESH_MS = 5 * 60_000;
+function sessionPath(confDir) {
+    return path.join(confDir, 'vault', 'session.json');
+}
+function readSession(confDir) {
+    try {
+        const raw = fs.readFileSync(sessionPath(confDir), 'utf8');
+        const s = JSON.parse(raw);
+        if (!s?.access_token || !s?.refresh_token)
+            return null;
+        return s;
+    }
+    catch {
+        return null;
+    }
+}
+function writeSession(confDir, s) {
+    const p = sessionPath(confDir);
+    fs.mkdirSync(path.dirname(p), { recursive: true });
+    // 0600 on the host side. Inside the container the entity has root and can
+    // read it, which is fine: these are its OWN credentials, and it can already
+    // rotate them through its browser MCP. What matters is that the host does
+    // not leave them world-readable in a shared runtime directory.
+    fs.writeFileSync(p, JSON.stringify(s), { mode: 0o600 });
+}
+function isFresh(s, now) {
+    return !!s && s.expires_at - EARLY_REFRESH_MS > now;
+}
+/** Exactly what the extension expects to find: the add.ai `auth` cookie is a
+ *  URI-encoded JSON object with the two tokens in it. */
+function cookieValue(s) {
+    return encodeURIComponent(JSON.stringify({
+        access_token: s.access_token,
+        refresh_token: s.refresh_token,
+    }));
+}
+function toSession(body, extra = {}) {
+    if (!body?.access_token || !body?.refresh_token)
+        return null;
+    const ttl = Number(body.expires_in ?? 3600) * 1000;
+    return {
+        access_token: body.access_token,
+        refresh_token: body.refresh_token,
+        expires_at: Date.now() + ttl,
+        ...extra,
+    };
+}
+/** Trade a refresh token for a live one. Returns null when it has expired or
+ *  been revoked — which is the normal way a rotation elsewhere reaches us. */
+async function refreshSession(refreshToken, doFetch = fetch) {
+    const res = await doFetch(`${config_1.SUPABASE_URL}/auth/v1/token?grant_type=refresh_token`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', apikey: config_1.SUPABASE_ANON_KEY },
+        body: JSON.stringify({ refresh_token: refreshToken }),
+    });
+    if (!res.ok)
+        return null;
+    return toSession(await res.json());
+}
+/** Sign in with a freshly rotated password. */
+async function passwordSession(email, password, doFetch = fetch) {
+    const res = await doFetch(`${config_1.SUPABASE_URL}/auth/v1/token?grant_type=password`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', apikey: config_1.SUPABASE_ANON_KEY },
+        body: JSON.stringify({ email, password }),
+    });
+    if (!res.ok)
+        return null;
+    return toSession(await res.json(), { email });
+}
+/**
+ * Get a live session for this desktop, minting one only when necessary.
+ *
+ * Order matters: cached-and-fresh, then refresh, then rotate. Skipping to
+ * rotation because it is simpler would log the entity out of every other
+ * browser it is signed into, every time a desktop restarts.
+ */
+async function ensureVaultSession(confDir, login, desktopId, doFetch = fetch, now = Date.now()) {
+    const cached = readSession(confDir);
+    if (isFresh(cached, now))
+        return { session: cached, rotated: false };
+    if (cached?.refresh_token) {
+        const refreshed = await refreshSession(cached.refresh_token, doFetch);
+        if (refreshed) {
+            const merged = { ...refreshed, email: cached.email, entity_name: cached.entity_name };
+            writeSession(confDir, merged);
+            return { session: merged, rotated: false };
+        }
+    }
+    // Ask the server who this desktop belongs to AND for a password in one call.
+    // It refuses to guess on a shared desktop with no default entity, which is
+    // the case where planting one entity's session would hand its vault to
+    // another.
+    const info = await login(desktopId, true);
+    if (!info?.ok)
+        return { session: null, reason: info?.reason ?? 'login_refused', rotated: false };
+    if (!info.password || !info.email) {
+        return { session: null, reason: 'no_credentials_returned', rotated: false };
+    }
+    const fresh = await passwordSession(info.email, info.password, doFetch);
+    if (!fresh)
+        return { session: null, reason: 'sign_in_failed', rotated: true };
+    const out = { ...fresh, entity_name: info.entity_name };
+    writeSession(confDir, out);
+    return { session: out, rotated: true };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@addai/node",
-  "version": "0.27.1",
+  "version": "0.28.0",
   "description": "Daemon that pairs a machine with your +Ai account and runs Claude / Codex / Kimi / Gemini agents on its behalf. Reachable via Supabase from Vault, Entity Studio, or any other +Ai surface.",
   "license": "MIT",
   "keywords": [
@@ -34,10 +34,11 @@
   "files": [
     "dist",
     "scripts",
-    "README.md"
+    "README.md",
+    "assets"
   ],
   "scripts": {
-    "build": "tsc -p tsconfig.json",
+    "build": "tsc -p tsconfig.json && node scripts/copy-assets.js",
     "start": "node dist/cli.js",
     "dev": "tsc -p tsconfig.json && node dist/cli.js",
     "test": "npm run build && node --test test/*.test.mjs",

package/scripts/copy-assets.js

@@ -0,0 +1,18 @@
+// tsc compiles .ts and ignores everything else, but two files in this package
+// are deliberately plain .mjs: they run inside a desktop container (node 22,
+// no build step, no node_modules) rather than in the daemon. Ship them next to
+// the compiled output so dist/ is self-contained.
+const fs = require('fs');
+const path = require('path');
+
+const ASSETS = [
+  ['src/desktop/learn/recorder.mjs', 'dist/desktop/learn/recorder.mjs'],
+  ['src/desktop/learn/injected.mjs', 'dist/desktop/learn/injected.mjs'],
+  ['src/desktop/vault-seed.mjs', 'dist/desktop/vault-seed.mjs'],
+];
+
+for (const [from, to] of ASSETS) {
+  fs.mkdirSync(path.dirname(to), { recursive: true });
+  fs.copyFileSync(from, to);
+}
+console.log(`copied ${ASSETS.length} runtime assets into dist/`);

package/dist/tui.d.ts

@@ -1 +0,0 @@
-export declare function runHarnessesTui(): Promise<void>;

package/dist/tui.js

@@ -1,314 +0,0 @@
-"use strict";
-// `entities-runtime harnesses` — interactive harness manager in the
-// Claude Code terminal idiom: alt-screen, rounded panels, dim chrome,
-// ❯ selection, braille spinner, ⏺ status dots. Hand-rolled ANSI — the
-// daemon deliberately has no TUI framework dependency.
-//
-// Local actions hand the real terminal to the harness CLI itself (there
-// is nothing to bridge when you're already at the machine): install
-// streams npm output into a panel; login leaves the alt screen, runs the
-// CLI's own login flow attached to your TTY, then re-probes on return.
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.runHarnessesTui = runHarnessesTui;
-const child_process_1 = require("child_process");
-const readline = __importStar(require("readline"));
-const capabilities_1 = require("./capabilities");
-const win_1 = require("./win");
-const fs = __importStar(require("fs"));
-const os = __importStar(require("os"));
-const path = __importStar(require("path"));
-const harness_registry_1 = require("./harness-registry");
-/* ── ansi helpers ────────────────────────────────────────────────────── */
-const ESC = '\x1b[';
-const dim = (s) => `${ESC}2m${s}${ESC}22m`;
-const bold = (s) => `${ESC}1m${s}${ESC}22m`;
-const fg = (n, s) => `${ESC}38;5;${n}m${s}${ESC}39m`;
-const green = (s) => fg(114, s);
-const yellow = (s) => fg(179, s);
-const grey = (s) => fg(244, s);
-const cyan = (s) => fg(80, s);
-const altOn = () => process.stdout.write(`${ESC}?1049h${ESC}?25l`);
-const altOff = () => process.stdout.write(`${ESC}?1049l${ESC}?25h`);
-const home = () => process.stdout.write(`${ESC}H${ESC}2J`);
-const SPIN = ['⠋', '⠙', '⠹', '⠸', '⠼', '⠴', '⠦', '⠧', '⠇', '⠏'];
-const width = () => Math.min(process.stdout.columns || 100, 110);
-function panel(title, lines) {
-    const w = width() - 2;
-    const strip = (s) => s.replace(/\x1b\[[0-9;]*m/g, '');
-    const top = `${dim('╭─')} ${bold(title)} ${dim('─'.repeat(Math.max(1, w - strip(title).length - 4)) + '╮')}`;
-    const body = lines.map(l => {
-        const pad = Math.max(0, w - 2 - strip(l).length);
-        return `${dim('│')} ${l}${' '.repeat(pad)} ${dim('│')}`;
-    });
-    const bottom = dim(`╰${'─'.repeat(w)}╯`);
-    return [top, ...body, bottom].join('\n');
-}
-function dot(p) {
-    if (!p?.available)
-        return grey('⏺');
-    return p.authed ? green('⏺') : yellow('⏺');
-}
-function actionFor(id, p) {
-    if (!p?.available)
-        return (0, harness_registry_1.isInstallable)(id) ? 'install' : 'how to install';
-    if (!p.authed)
-        return 'log in';
-    return harness_registry_1.HARNESSES[id].logout ? 'log out' : 'ok';
-}
-function row(id, p, selected) {
-    const spec = harness_registry_1.HARNESSES[id];
-    const name = spec.label.padEnd(13);
-    const ver = (p?.version ? `v${p.version}` : '—').padEnd(12).slice(0, 12);
-    const who = (p?.authed
-        ? `${p.account ?? p.accountKind ?? 'logged in'}${p.plan ? ` · ${p.plan}` : ''}`
-        : p?.available ? 'not logged in' : 'not installed').padEnd(28).slice(0, 28);
-    const models = `${p?.models?.length ?? 0} models`.padEnd(10);
-    const efforts = spec.efforts.length ? spec.efforts.join('/') : '—';
-    const act = actionFor(id, p);
-    const actTxt = act === 'ok' ? green('✓') : act === 'log out' ? dim('↵ log out') : cyan(`↵ ${act}`);
-    const line = `${dot(p)}  ${name} ${dim(ver)} ${who} ${dim(models)} ${dim(efforts.padEnd(26).slice(0, 26))} ${actTxt}`;
-    return selected ? `${cyan('❯')} ${bold(line)}` : `  ${line}`;
-}
-function render(st) {
-    home();
-    const lines = [];
-    if (!st.caps) {
-        lines.push(`${cyan(SPIN[st.spin % SPIN.length])} probing installed harnesses…`);
-    }
-    else {
-        lines.push(dim('   harness       version      account                      models     efforts'));
-        harness_registry_1.HARNESS_IDS.forEach((id, i) => lines.push(row(id, st.caps[id], i === st.sel)));
-    }
-    if (st.busy)
-        lines.push('', `${cyan(SPIN[st.spin % SPIN.length])} ${st.busy}`);
-    if (st.log.length) {
-        lines.push('');
-        st.log.slice(-8).forEach(l => lines.push(dim(l.slice(0, width() - 8))));
-    }
-    if (st.note)
-        lines.push('', st.note);
-    process.stdout.write(panel('Harnesses', lines) + '\n');
-    process.stdout.write(dim('  ↑/↓ move · ↵ install / log in · r refresh · q quit\n'));
-}
-/* ── actions ─────────────────────────────────────────────────────────── */
-async function installSelected(st, id, redraw) {
-    const spec = harness_registry_1.HARNESSES[id];
-    if (!(0, harness_registry_1.isInstallable)(id)) {
-        st.note = yellow(`${spec.label}: ${spec.login.instructions}`);
-        return;
-    }
-    st.busy = `installing ${spec.label} (npm i -g ${spec.npmPackage})`;
-    st.log = [];
-    redraw();
-    const inv = (0, win_1.resolveCliInvocation)('npm', ['install', '-g', spec.npmPackage]);
-    await new Promise(resolve => {
-        const child = (0, child_process_1.spawn)(inv.file, inv.args, { env: process.env });
-        const onChunk = (b) => {
-            st.log.push(...b.toString('utf8').split('\n').filter(Boolean));
-            redraw();
-        };
-        child.stdout?.on('data', onChunk);
-        child.stderr?.on('data', onChunk);
-        child.on('exit', code => {
-            st.busy = null;
-            st.note = code === 0 ? green(`✓ ${spec.label} installed`) : fg(203, `✗ npm exited ${code}`);
-            resolve();
-        });
-        child.on('error', err => { st.busy = null; st.note = fg(203, `✗ ${err.message}`); resolve(); });
-    });
-}
-function logoutSelected(id) {
-    const spec = harness_registry_1.HARNESSES[id];
-    if (!spec.logout)
-        return `${spec.label} can only be logged out on the device`;
-    if (spec.logout.cmd) {
-        const bin = spec.findBinary();
-        if (!bin)
-            return `${spec.label} is not installed`;
-        const inv = (0, win_1.resolveCliInvocation)(bin, spec.logout.cmd);
-        const res = (0, child_process_1.spawnSync)(inv.file, inv.args, { stdio: 'ignore', env: process.env, timeout: 60_000 });
-        if (res.status !== 0)
-            return `logout exited with code ${res.status ?? '?'}`;
-    }
-    for (const rel of spec.logout.files ?? []) {
-        try {
-            fs.rmSync(path.join(os.homedir(), rel), { force: true });
-        }
-        catch { /* best effort */ }
-    }
-    for (const [rel, varName] of spec.logout.envStrip ?? []) {
-        const envPath = path.join(os.homedir(), rel);
-        try {
-            const body = fs.readFileSync(envPath, 'utf8');
-            fs.writeFileSync(envPath, body.split('\n').filter(l => !l.startsWith(`${varName}=`)).join('\n'), { mode: 0o600 });
-        }
-        catch { /* nothing to strip */ }
-    }
-    return null;
-}
-function loginSelected(id) {
-    const spec = harness_registry_1.HARNESSES[id];
-    const bin = spec.findBinary();
-    if (!bin)
-        return `${spec.label} is not installed`;
-    // Hand the real terminal to the CLI — leave the alt screen first.
-    altOff();
-    console.log(cyan(`\n— ${spec.label} login —`));
-    console.log(dim(spec.login.instructions) + '\n');
-    const args = spec.login.strategy === 'pty-url-code' ? (spec.login.loginArgs ?? []) : [];
-    const inv = (0, win_1.resolveCliInvocation)(bin, args);
-    const res = (0, child_process_1.spawnSync)(inv.file, inv.args, { stdio: 'inherit', env: process.env });
-    altOn();
-    return res.status === 0 ? null : `login exited with code ${res.status ?? '?'}`;
-}
-/* ── entry ───────────────────────────────────────────────────────────── */
-async function plainStatus() {
-    const caps = await (0, capabilities_1.probeCapabilities)();
-    for (const id of harness_registry_1.HARNESS_IDS) {
-        const p = caps[id];
-        const state = !p?.available ? 'not installed' : p.authed ? `authed (${p.account ?? p.accountKind ?? '?'})` : 'not logged in';
-        console.log(`${id.padEnd(8)} ${(p?.version ?? '—').padEnd(12)} ${state}`);
-    }
-}
-async function runHarnessesTui() {
-    if (!process.stdout.isTTY || !process.stdin.isTTY) {
-        await plainStatus();
-        return;
-    }
-    const st = { caps: null, sel: 0, spin: 0, busy: null, log: [], note: null, confirmLogout: null };
-    const redraw = () => render(st);
-    altOn();
-    readline.emitKeypressEvents(process.stdin);
-    process.stdin.setRawMode(true);
-    process.stdin.resume();
-    const spinTimer = setInterval(() => { st.spin++; if (st.busy || !st.caps)
-        redraw(); }, 90);
-    const quit = () => {
-        clearInterval(spinTimer);
-        process.stdin.setRawMode(false);
-        process.stdin.pause();
-        altOff();
-        process.exit(0);
-    };
-    const reprobe = async () => {
-        st.caps = null;
-        redraw();
-        st.caps = await (0, capabilities_1.probeCapabilities)();
-        redraw();
-    };
-    let acting = false;
-    process.stdin.on('keypress', (_str, key) => {
-        void (async () => {
-            if (!key || acting)
-                return;
-            if (key.name === 'q' || (key.ctrl && key.name === 'c')) {
-                quit();
-                return;
-            }
-            if (!st.caps)
-                return;
-            if (st.confirmLogout) {
-                const target = st.confirmLogout;
-                st.confirmLogout = null;
-                if (key.name === 'y') {
-                    acting = true;
-                    try {
-                        const err = logoutSelected(target);
-                        st.note = err ? fg(203, `✗ ${err}`) : green(`✓ ${harness_registry_1.HARNESSES[target].label} logged out`);
-                        await reprobe();
-                    }
-                    finally {
-                        acting = false;
-                    }
-                }
-                else {
-                    st.note = dim('logout cancelled');
-                    redraw();
-                }
-                return;
-            }
-            if (key.name === 'up' || key.name === 'k') {
-                st.sel = (st.sel + harness_registry_1.HARNESS_IDS.length - 1) % harness_registry_1.HARNESS_IDS.length;
-                redraw();
-                return;
-            }
-            if (key.name === 'down' || key.name === 'j') {
-                st.sel = (st.sel + 1) % harness_registry_1.HARNESS_IDS.length;
-                redraw();
-                return;
-            }
-            if (key.name === 'r') {
-                await reprobe();
-                return;
-            }
-            if (key.name !== 'return')
-                return;
-            const id = harness_registry_1.HARNESS_IDS[st.sel];
-            const p = st.caps[id];
-            acting = true;
-            try {
-                if (!p?.available) {
-                    await installSelected(st, id, redraw);
-                    await reprobe();
-                }
-                else if (!p.authed) {
-                    const err = loginSelected(id);
-                    st.note = err ? fg(203, `✗ ${err}`) : green('✓ login flow finished — verifying…');
-                    await reprobe();
-                    const now = st.caps?.[id];
-                    if (now?.authed)
-                        st.note = green(`✓ ${harness_registry_1.HARNESSES[id].label} logged in as ${now.account ?? now.accountKind ?? '?'}`);
-                    else if (!err)
-                        st.note = yellow(`${harness_registry_1.HARNESSES[id].label} still reports unauthenticated`);
-                    redraw();
-                }
-                else if (harness_registry_1.HARNESSES[id].logout) {
-                    st.confirmLogout = id;
-                    st.note = yellow(`log out of ${harness_registry_1.HARNESSES[id].label}? press y to confirm`);
-                    redraw();
-                }
-                else {
-                    st.note = green(`${harness_registry_1.HARNESSES[id].label} is installed and logged in.`);
-                    redraw();
-                }
-            }
-            finally {
-                acting = false;
-            }
-        })();
-    });
-    await reprobe();
-}