@agentdeck/bridge 1.0.15 → 1.0.17

package/dist/auth.d.ts

@@ -1,5 +1,30 @@
 /** Read existing token or generate a new one. */
 export declare function getOrCreateToken(): string;
+/** Tokens accepted for authentication but never handed out. */
+export declare function getAcceptedTokens(): string[];
+/**
+ * Adopt the pairing token of a daemon that is already serving this machine.
+ *
+ * A machine has ONE fleet of paired devices but can be served by either the
+ * Node CLI daemon or the macOS app's in-process Swift daemon, and the two keep
+ * their token in different files — the sandboxed app cannot read
+ * `~/.agentdeck/auth-token` and this process must not poke at the app's
+ * container. So the credential travels over the one channel both can always
+ * use: the incumbent's loopback `/health`, which carries `pairingToken` to
+ * same-machine callers only. Whoever starts second adopts what the incumbent
+ * is already serving, so a later handover in EITHER direction is
+ * credential-neutral and start order stops mattering.
+ *
+ * The token we were holding moves to the accepted list rather than being
+ * dropped: devices provisioned under it must keep working until they are
+ * re-armed.
+ *
+ * No new trust is granted — `probeDaemonHealth` dials 127.0.0.1, and
+ * same-machine peers are already fully trusted by this daemon's access model.
+ *
+ * Returns true when the served token actually changed.
+ */
+export declare function adoptPeerToken(peerToken: unknown): boolean;
 /** Check if a connection originates from this machine (localhost or own LAN IPs). */
 export declare function isLocalConnection(ip: string): boolean;
 /**
@@ -10,7 +35,11 @@ export declare function isLocalConnection(ip: string): boolean;
  * retired without hand-editing the file.
  */
 export declare function rotateToken(): string;
-/** Validate a token string against the stored token. */
+/**
+ * Validate a token against the one we serve, then against the ones we still
+ * accept (a token superseded by `adoptPeerToken`). Every candidate is compared
+ * — no early exit — so the answer costs the same whichever key matched.
+ */
 export declare function validateToken(token: string): boolean;
 /** Build a ws:// URL with auth token for QR code pairing. */
 export declare function getWsUrl(port: number): string;

package/dist/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAaA,iDAAiD;AACjD,wBAAgB,gBAAgB,IAAI,MAAM,CA4BzC;AAED,qFAAqF;AACrF,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAYrD;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAOpC;AAED,wDAAwD;AACxD,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CASpD;AAED,6DAA6D;AAC7D,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAI7C"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAiDA,iDAAiD;AACjD,wBAAgB,gBAAgB,IAAI,MAAM,CA8BzC;AAOD,+DAA+D;AAC/D,wBAAgB,iBAAiB,IAAI,MAAM,EAAE,CAiB5C;AAcD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,OAAO,GAAG,OAAO,CAmB1D;AAED,qFAAqF;AACrF,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAYrD;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAWpC;AAYD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAMpD;AAED,6DAA6D;AAC7D,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAI7C"}

package/dist/auth.js

@@ -4,38 +4,157 @@ import { join } from 'path';
 import { homedir, networkInterfaces } from 'os';
 import { getLanIp } from '@agentdeck/shared';
 import { debug } from './logger.js';
-const AGENTDECK_DIR = join(homedir(), '.agentdeck');
-const TOKEN_FILE = join(AGENTDECK_DIR, 'auth-token');
+const LEGACY_DIR = join(homedir(), '.agentdeck');
 const TOKEN_LENGTH = 32; // 32 hex chars = 16 bytes
+/** Bounded so a long-lived machine cannot accumulate an unbounded key ring. */
+const MAX_ACCEPTED_TOKENS = 4;
+/**
+ * Every other module resolves its state through
+ * `AGENTDECK_DATA_DIR || ~/.agentdeck`; this one used to hardcode the home
+ * path, so a daemon started with a custom data dir kept its pairing token
+ * somewhere else than the rest of its state.
+ */
+function dataDir() {
+    return process.env.AGENTDECK_DATA_DIR || LEGACY_DIR;
+}
+function tokenFile(dir = dataDir()) {
+    return join(dir, 'auth-token');
+}
+/**
+ * Tokens this daemon still ACCEPTS but no longer hands out — the credential it
+ * held before adopting a peer daemon's one (see `adoptPeerToken`). Without it,
+ * convergence itself would lock out every device that was provisioned a moment
+ * earlier, which is the failure this whole path exists to prevent.
+ */
+function acceptedFile(dir = dataDir()) {
+    return join(dir, 'auth-token-accepted');
+}
+// Cached per resolved directory, so pointing AGENTDECK_DATA_DIR somewhere else
+// re-reads instead of serving the previous directory's credential.
 let cachedToken = null;
+let cachedAccepted = null;
+function readTokenFile(path) {
+    try {
+        if (!existsSync(path))
+            return null;
+        const token = readFileSync(path, 'utf-8').trim();
+        return token.length >= TOKEN_LENGTH ? token : null;
+    }
+    catch {
+        return null;
+    }
+}
 /** Read existing token or generate a new one. */
 export function getOrCreateToken() {
-    if (cachedToken)
-        return cachedToken;
+    const dir = dataDir();
+    if (cachedToken?.dir === dir)
+        return cachedToken.token;
+    let token = readTokenFile(tokenFile(dir));
+    // A custom data dir that has no token yet inherits the legacy one rather than
+    // minting a fresh one: generating here would silently un-pair every device
+    // the machine already has.
+    const inherited = token === null && dir !== LEGACY_DIR
+        ? readTokenFile(tokenFile(LEGACY_DIR))
+        : null;
+    if (inherited)
+        token = inherited;
+    const generated = token === null;
+    if (token === null)
+        token = randomBytes(TOKEN_LENGTH / 2).toString('hex');
+    if (generated || inherited) {
+        try {
+            mkdirSync(dir, { recursive: true });
+            writeFileSync(tokenFile(dir), token + '\n', { mode: 0o600 });
+            debug('auth', generated
+                ? `Generated new auth token → ${tokenFile(dir)}`
+                : `Carried the existing auth token into ${tokenFile(dir)}`);
+        }
+        catch (err) {
+            debug('auth', `Failed to write token file: ${err}`);
+        }
+    }
+    cachedToken = { dir, token };
+    return token;
+}
+/** Shape check for a token handed to us by someone else. */
+function isWellFormedToken(token) {
+    return typeof token === 'string' && token.trim().length >= TOKEN_LENGTH;
+}
+/** Tokens accepted for authentication but never handed out. */
+export function getAcceptedTokens() {
+    const dir = dataDir();
+    if (cachedAccepted?.dir === dir)
+        return cachedAccepted.tokens;
+    let tokens = [];
     try {
-        if (existsSync(TOKEN_FILE)) {
-            const token = readFileSync(TOKEN_FILE, 'utf-8').trim();
-            if (token.length >= TOKEN_LENGTH) {
-                cachedToken = token;
-                return token;
-            }
+        if (existsSync(acceptedFile(dir))) {
+            tokens = readFileSync(acceptedFile(dir), 'utf-8')
+                .split('\n')
+                .map(line => line.trim())
+                .filter(isWellFormedToken)
+                .slice(0, MAX_ACCEPTED_TOKENS);
         }
     }
     catch {
-        // Fall through to generate
+        tokens = [];
     }
-    // Generate new token
-    const token = randomBytes(TOKEN_LENGTH / 2).toString('hex');
+    cachedAccepted = { dir, tokens };
+    return tokens;
+}
+function writeAcceptedTokens(tokens) {
+    const dir = dataDir();
+    const bounded = tokens.slice(0, MAX_ACCEPTED_TOKENS);
+    cachedAccepted = { dir, tokens: bounded };
     try {
-        mkdirSync(AGENTDECK_DIR, { recursive: true });
-        writeFileSync(TOKEN_FILE, token + '\n', { mode: 0o600 });
-        debug('auth', `Generated new auth token → ${TOKEN_FILE}`);
+        mkdirSync(dir, { recursive: true });
+        writeFileSync(acceptedFile(dir), bounded.map(t => t + '\n').join(''), { mode: 0o600 });
     }
     catch (err) {
-        debug('auth', `Failed to write token file: ${err}`);
+        debug('auth', `Failed to write accepted-token file: ${err}`);
     }
-    cachedToken = token;
-    return token;
+}
+/**
+ * Adopt the pairing token of a daemon that is already serving this machine.
+ *
+ * A machine has ONE fleet of paired devices but can be served by either the
+ * Node CLI daemon or the macOS app's in-process Swift daemon, and the two keep
+ * their token in different files — the sandboxed app cannot read
+ * `~/.agentdeck/auth-token` and this process must not poke at the app's
+ * container. So the credential travels over the one channel both can always
+ * use: the incumbent's loopback `/health`, which carries `pairingToken` to
+ * same-machine callers only. Whoever starts second adopts what the incumbent
+ * is already serving, so a later handover in EITHER direction is
+ * credential-neutral and start order stops mattering.
+ *
+ * The token we were holding moves to the accepted list rather than being
+ * dropped: devices provisioned under it must keep working until they are
+ * re-armed.
+ *
+ * No new trust is granted — `probeDaemonHealth` dials 127.0.0.1, and
+ * same-machine peers are already fully trusted by this daemon's access model.
+ *
+ * Returns true when the served token actually changed.
+ */
+export function adoptPeerToken(peerToken) {
+    if (!isWellFormedToken(peerToken))
+        return false;
+    const adopted = peerToken.trim();
+    const current = getOrCreateToken();
+    if (adopted === current)
+        return false;
+    const accepted = [current, ...getAcceptedTokens().filter(t => t !== current && t !== adopted)];
+    writeAcceptedTokens(accepted);
+    const dir = dataDir();
+    try {
+        mkdirSync(dir, { recursive: true });
+        writeFileSync(tokenFile(dir), adopted + '\n', { mode: 0o600 });
+    }
+    catch (err) {
+        debug('auth', `Failed to persist adopted token: ${err}`);
+    }
+    cachedToken = { dir, token: adopted };
+    debug('auth', 'Adopted the incumbent daemon\'s pairing token; previous one still accepted');
+    return true;
 }
 /** Check if a connection originates from this machine (localhost or own LAN IPs). */
 export function isLocalConnection(ip) {
@@ -62,24 +181,38 @@ export function isLocalConnection(ip) {
  */
 export function rotateToken() {
     const token = randomBytes(TOKEN_LENGTH / 2).toString('hex');
-    mkdirSync(AGENTDECK_DIR, { recursive: true });
-    writeFileSync(TOKEN_FILE, token + '\n', { mode: 0o600 });
-    cachedToken = token;
-    debug('auth', `Rotated auth token → ${TOKEN_FILE}`);
+    const dir = dataDir();
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(tokenFile(dir), token + '\n', { mode: 0o600 });
+    cachedToken = { dir, token };
+    // Retiring a leaked token has to retire the key ring with it, or the leaked
+    // one survives in the accepted list and rotation buys nothing.
+    writeAcceptedTokens([]);
+    debug('auth', `Rotated auth token → ${tokenFile(dir)}`);
     return token;
 }
-/** Validate a token string against the stored token. */
-export function validateToken(token) {
-    const stored = getOrCreateToken();
+function matchesToken(candidate, stored) {
     // Constant-time comparison to prevent timing attacks
-    if (token.length !== stored.length)
+    if (candidate.length !== stored.length)
         return false;
     let result = 0;
-    for (let i = 0; i < token.length; i++) {
-        result |= token.charCodeAt(i) ^ stored.charCodeAt(i);
+    for (let i = 0; i < candidate.length; i++) {
+        result |= candidate.charCodeAt(i) ^ stored.charCodeAt(i);
     }
     return result === 0;
 }
+/**
+ * Validate a token against the one we serve, then against the ones we still
+ * accept (a token superseded by `adoptPeerToken`). Every candidate is compared
+ * — no early exit — so the answer costs the same whichever key matched.
+ */
+export function validateToken(token) {
+    let ok = matchesToken(token, getOrCreateToken());
+    for (const accepted of getAcceptedTokens()) {
+        ok = matchesToken(token, accepted) || ok;
+    }
+    return ok;
+}
 /** Build a ws:// URL with auth token for QR code pairing. */
 export function getWsUrl(port) {
     const ip = getLanIp();

package/dist/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AACxE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,IAAI,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEpC,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,YAAY,CAAC,CAAC;AACpD,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;AACrD,MAAM,YAAY,GAAG,EAAE,CAAC,CAAC,0BAA0B;AAEnD,IAAI,WAAW,GAAkB,IAAI,CAAC;AAEtC,iDAAiD;AACjD,MAAM,UAAU,gBAAgB;IAC9B,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;YACvD,IAAI,KAAK,CAAC,MAAM,IAAI,YAAY,EAAE,CAAC;gBACjC,WAAW,GAAG,KAAK,CAAC;gBACpB,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,2BAA2B;IAC7B,CAAC;IAED,qBAAqB;IACrB,MAAM,KAAK,GAAG,WAAW,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAE5D,IAAI,CAAC;QACH,SAAS,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,aAAa,CAAC,UAAU,EAAE,KAAK,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,KAAK,CAAC,MAAM,EAAE,8BAA8B,UAAU,EAAE,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,KAAK,CAAC,MAAM,EAAE,+BAA+B,GAAG,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,WAAW,GAAG,KAAK,CAAC;IACpB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,iBAAiB,CAAC,EAAU;IAC1C,IAAI,EAAE,KAAK,WAAW,IAAI,EAAE,KAAK,KAAK,IAAI,EAAE,KAAK,kBAAkB;QAAE,OAAO,IAAI,CAAC;IAEjF,+DAA+D;IAC/D,MAAM,IAAI,GAAG,iBAAiB,EAAE,CAAC;IACjC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,CAAC,CAAC,OAAO,KAAK,EAAE,IAAI,UAAU,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE;gBAAE,OAAO,IAAI,CAAC;QACpE,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW;IACzB,MAAM,KAAK,GAAG,WAAW,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC5D,SAAS,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,aAAa,CAAC,UAAU,EAAE,KAAK,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzD,WAAW,GAAG,KAAK,CAAC;IACpB,KAAK,CAAC,MAAM,EAAE,wBAAwB,UAAU,EAAE,CAAC,CAAC;IACpD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,qDAAqD;IACrD,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACjD,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,MAAM,KAAK,CAAC,CAAC;AACtB,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,MAAM,EAAE,GAAG,QAAQ,EAAE,CAAC;IACtB,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;IACjC,OAAO,QAAQ,EAAE,IAAI,IAAI,UAAU,KAAK,EAAE,CAAC;AAC7C,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AACxE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,IAAI,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEpC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,YAAY,CAAC,CAAC;AACjD,MAAM,YAAY,GAAG,EAAE,CAAC,CAAC,0BAA0B;AACnD,+EAA+E;AAC/E,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAE9B;;;;;GAKG;AACH,SAAS,OAAO;IACd,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,UAAU,CAAC;AACtD,CAAC;AACD,SAAS,SAAS,CAAC,GAAG,GAAG,OAAO,EAAE;IAChC,OAAO,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;AACjC,CAAC;AACD;;;;;GAKG;AACH,SAAS,YAAY,CAAC,GAAG,GAAG,OAAO,EAAE;IACnC,OAAO,IAAI,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;AAC1C,CAAC;AAED,+EAA+E;AAC/E,mEAAmE;AACnE,IAAI,WAAW,GAA0C,IAAI,CAAC;AAC9D,IAAI,cAAc,GAA6C,IAAI,CAAC;AAEpE,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QACjD,OAAO,KAAK,CAAC,MAAM,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,gBAAgB;IAC9B,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,IAAI,WAAW,EAAE,GAAG,KAAK,GAAG;QAAE,OAAO,WAAW,CAAC,KAAK,CAAC;IAEvD,IAAI,KAAK,GAAG,aAAa,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,8EAA8E;IAC9E,2EAA2E;IAC3E,2BAA2B;IAC3B,MAAM,SAAS,GAAG,KAAK,KAAK,IAAI,IAAI,GAAG,KAAK,UAAU;QACpD,CAAC,CAAC,aAAa,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACtC,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,SAAS;QAAE,KAAK,GAAG,SAAS,CAAC;IAEjC,MAAM,SAAS,GAAG,KAAK,KAAK,IAAI,CAAC;IACjC,IAAI,KAAK,KAAK,IAAI;QAAE,KAAK,GAAG,WAAW,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAE1E,IAAI,SAAS,IAAI,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACpC,aAAa,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC7D,KAAK,CAAC,MAAM,EAAE,SAAS;gBACrB,CAAC,CAAC,8BAA8B,SAAS,CAAC,GAAG,CAAC,EAAE;gBAChD,CAAC,CAAC,wCAAwC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,KAAK,CAAC,MAAM,EAAE,+BAA+B,GAAG,EAAE,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,WAAW,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;IAC7B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,4DAA4D;AAC5D,SAAS,iBAAiB,CAAC,KAAc;IACvC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,IAAI,YAAY,CAAC;AAC1E,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,iBAAiB;IAC/B,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,IAAI,cAAc,EAAE,GAAG,KAAK,GAAG;QAAE,OAAO,cAAc,CAAC,MAAM,CAAC;IAC9D,IAAI,MAAM,GAAa,EAAE,CAAC;IAC1B,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAClC,MAAM,GAAG,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;iBAC9C,KAAK,CAAC,IAAI,CAAC;iBACX,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;iBACxB,MAAM,CAAC,iBAAiB,CAAC;iBACzB,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,EAAE,CAAC;IACd,CAAC;IACD,cAAc,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IACjC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAgB;IAC3C,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC;IACrD,cAAc,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC1C,IAAI,CAAC;QACH,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,aAAa,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,KAAK,CAAC,MAAM,EAAE,wCAAwC,GAAG,EAAE,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,cAAc,CAAC,SAAkB;IAC/C,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IAChD,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IACjC,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC;IACnC,IAAI,OAAO,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IAEtC,MAAM,QAAQ,GAAG,CAAC,OAAO,EAAE,GAAG,iBAAiB,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC;IAC/F,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAE9B,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,aAAa,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,OAAO,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,KAAK,CAAC,MAAM,EAAE,oCAAoC,GAAG,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,WAAW,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IACtC,KAAK,CAAC,MAAM,EAAE,4EAA4E,CAAC,CAAC;IAC5F,OAAO,IAAI,CAAC;AACd,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,iBAAiB,CAAC,EAAU;IAC1C,IAAI,EAAE,KAAK,WAAW,IAAI,EAAE,KAAK,KAAK,IAAI,EAAE,KAAK,kBAAkB;QAAE,OAAO,IAAI,CAAC;IAEjF,+DAA+D;IAC/D,MAAM,IAAI,GAAG,iBAAiB,EAAE,CAAC;IACjC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,CAAC,CAAC,OAAO,KAAK,EAAE,IAAI,UAAU,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE;gBAAE,OAAO,IAAI,CAAC;QACpE,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW;IACzB,MAAM,KAAK,GAAG,WAAW,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,aAAa,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7D,WAAW,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;IAC7B,4EAA4E;IAC5E,+DAA+D;IAC/D,mBAAmB,CAAC,EAAE,CAAC,CAAC;IACxB,KAAK,CAAC,MAAM,EAAE,wBAAwB,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACxD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,SAAiB,EAAE,MAAc;IACrD,qDAAqD;IACrD,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACrD,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,IAAI,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,MAAM,KAAK,CAAC,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,IAAI,EAAE,GAAG,YAAY,CAAC,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACjD,KAAK,MAAM,QAAQ,IAAI,iBAAiB,EAAE,EAAE,CAAC;QAC3C,EAAE,GAAG,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC3C,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,MAAM,EAAE,GAAG,QAAQ,EAAE,CAAC;IACtB,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;IACjC,OAAO,QAAQ,EAAE,IAAI,IAAI,UAAU,KAAK,EAAE,CAAC;AAC7C,CAAC"}

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,OAAO,EAAwB,MAAM,WAAW,CAAC;AAyP1D,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAM,CAAC;AAOtF;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAElE;AA+BD,gFAAgF;AAChF,QAAA,MAAM,cAAc,EAAE,MAAM,CAAC,aAAa,GAAG,WAAW,GAAG,UAAU,EAAE,MAAM,CAI5E,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE,CAsBjE;AAKD;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EAAE,EACd,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,EAAE,CAyBV;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,OAAO,cAAc,EACtC,OAAO,EAAE,MAAM,EACf,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,CAIR;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,MAAM,OAAO,cAAc,EACtC,OAAO,EAAE,MAAM,EACf,cAAc,EAAE,OAAO,EACvB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,CAER;AAID,QAAA,MAAM,OAAO,SAAgB,CAAC;AAqvE9B,wBAAsB,MAAM,CAAC,IAAI,GAAE,MAAM,EAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAMzE;AAED,OAAO,EAAE,OAAO,EAAE,CAAC"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,OAAO,EAAwB,MAAM,WAAW,CAAC;AAyP1D,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAM,CAAC;AAOtF;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAElE;AA+BD,gFAAgF;AAChF,QAAA,MAAM,cAAc,EAAE,MAAM,CAAC,aAAa,GAAG,WAAW,GAAG,UAAU,EAAE,MAAM,CAI5E,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE,CAsBjE;AAKD;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EAAE,EACd,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,EAAE,CAyBV;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,OAAO,cAAc,EACtC,OAAO,EAAE,MAAM,EACf,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,CAIR;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,MAAM,OAAO,cAAc,EACtC,OAAO,EAAE,MAAM,EACf,cAAc,EAAE,OAAO,EACvB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,CAER;AAID,QAAA,MAAM,OAAO,SAAgB,CAAC;AAs2E9B,wBAAsB,MAAM,CAAC,IAAI,GAAE,MAAM,EAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAMzE;AAED,OAAO,EAAE,OAAO,EAAE,CAAC"}

package/dist/cli.js

@@ -590,6 +590,7 @@ daemon
     .option('--wake-word', 'Enable wake word voice assistant ("오픈클로")')
     .action(async (opts) => {
     const { findExistingDaemon, probeDaemonHealth, readDaemonInfo, removeDaemonInfo, removeDaemonSession, requestDaemonStandDown, requestDaemonShutdown, waitForDaemonExit, waitForPortBindable } = await import('./session-registry.js');
+    const { adoptPeerToken } = await import('./auth.js');
     // Reverse two-tier upgrade path: the macOS app may already own the canonical
     // port with its in-process Swift daemon (Tier 1 — limited: no ADB devices,
     // no subscription usage, …). A plain "already running → exit" would strand
@@ -601,6 +602,14 @@ daemon
     const targetPort = opts.port ? parseInt(String(opts.port), 10) : BRIDGE_WS_PORT;
     const incumbent = await probeDaemonHealth(targetPort);
     if (incumbent?.mode === 'daemon') {
+        // Take over the fleet's credential along with the port. The app's daemon
+        // keeps its token inside its sandbox container, unreadable from here, so
+        // this loopback answer is the only place we can learn what every paired
+        // board is currently holding. Adopting it BEFORE the stand-down means the
+        // handover costs no device its pairing.
+        if (adoptPeerToken(incumbent.pairingToken)) {
+            log(`Adopted the incumbent daemon's pairing token so paired devices survive the handover.`);
+        }
         if (incumbent.isSwift) {
             log(`AgentDeck app's in-process daemon holds port ${targetPort} — requesting stand-down to take over with the full CLI feature set…`);
             // Prefer /stand-down (clean demote: the app stays running as a client).
@@ -1349,6 +1358,96 @@ program
         // qrcode not available
     }
 });
+program
+    .command('pair')
+    .description('Pair a device with a one-time code (no camera or USB needed)')
+    .option('-p, --port <port>', 'Daemon port (auto-detected)')
+    .option('-t, --ttl <seconds>', 'How long the window stays open')
+    .option('-n, --devices <count>', 'How many devices this window may pair', '1')
+    .option('--adopt <ip...>', 'Re-arm ESP32 board(s) at these IPs over WiFi — no cable. Read the address off the daemon\'s "Rejected <ip> (esp32)" line')
+    .action(async (opts) => {
+    const { readDaemonInfo, findDaemonPort } = await import('./session-registry.js');
+    const { formatPairingCode, getLanIp, PAIRING_WINDOW_MS, PAIRING_MAX_FAILED_ATTEMPTS } = await import('@agentdeck/shared');
+    const info = readDaemonInfo();
+    const port = opts.port != null
+        ? parseInt(opts.port, 10)
+        : (info?.httpPort ?? info?.port ?? findDaemonPort() ?? BRIDGE_WS_PORT);
+    const ttlMs = opts.ttl != null ? Math.round(parseFloat(opts.ttl) * 1000) : PAIRING_WINDOW_MS;
+    const redemptions = parseInt(opts.devices, 10) || 1;
+    const adoptEsp32Ips = Array.isArray(opts.adopt)
+        ? opts.adopt
+        : (typeof opts.adopt === 'string' ? [opts.adopt] : []);
+    const daemon = `http://127.0.0.1:${port}`;
+    let opened;
+    try {
+        const res = await fetch(`${daemon}/pair/open`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ ttlMs, redemptions, adoptEsp32Ips }),
+            signal: AbortSignal.timeout(3000),
+        });
+        if (!res.ok)
+            throw new Error(`daemon answered ${res.status}`);
+        opened = await res.json();
+    }
+    catch (err) {
+        console.error(`Could not reach the daemon on port ${port}: ${err instanceof Error ? err.message : String(err)}`);
+        console.error('Start it with "agentdeck daemon start", then try again.');
+        process.exitCode = 1;
+        return;
+    }
+    const lanIp = getLanIp();
+    log('');
+    log(`  Pairing code:  ${formatPairingCode(opened.code)}`);
+    log('');
+    log(`  On the device: Settings → Connection → "Pair with code", enter it there.`);
+    log(`  The device finds this Mac itself (${lanIp}:${port}) — no cable, no QR scan.`);
+    log('');
+    log(`  Valid for ${Math.round((opened.expiresAt - Date.now()) / 1000)}s, `
+        + `${opened.redemptions} device(s), ${PAIRING_MAX_FAILED_ATTEMPTS} wrong tries.`);
+    if (opened.adoptEsp32Ips?.length) {
+        log('');
+        log(`  Also re-arming ESP32 board(s) at ${opened.adoptEsp32Ips.join(', ')} —`);
+        log('  they need no code; the credential is pushed on their next connect.');
+    }
+    log('');
+    // Watch the window until it closes, so the operator sees who paired — and
+    // sees a wrong code as it happens, which is the point of a short window
+    // somebody is standing in front of.
+    const seenRedemptions = new Set();
+    let seenFailures = 0;
+    for (;;) {
+        await new Promise((r) => setTimeout(r, 1000));
+        let status;
+        try {
+            const res = await fetch(`${daemon}/pair/status`, { signal: AbortSignal.timeout(2000) });
+            status = await res.json();
+        }
+        catch {
+            console.error('Lost contact with the daemon — the pairing window is no longer being watched.');
+            process.exitCode = 1;
+            return;
+        }
+        for (const r of status.redemptions) {
+            const key = `${r.at}:${r.ip}`;
+            if (seenRedemptions.has(key))
+                continue;
+            seenRedemptions.add(key);
+            log(`  ✓ Paired  ${r.name} (${r.kind}) at ${r.ip}`);
+        }
+        for (const f of status.failures.slice(seenFailures)) {
+            log(`  ✗ Wrong code from ${f.ip} — ${status.attemptsRemaining} attempt(s) left`);
+        }
+        seenFailures = status.failures.length;
+        if (!status.open) {
+            log('');
+            log(seenRedemptions.size > 0
+                ? `Pairing window closed. ${seenRedemptions.size} device(s) paired.`
+                : 'Pairing window closed with nothing paired. Run "agentdeck pair" again to retry.');
+            return;
+        }
+    }
+});
 program
     .command('token')
     .description('Show or rotate the pairing token (~/.agentdeck/auth-token)')