@agentrific/server 0.1.2 → 0.1.4

package/cli.js

@@ -30,7 +30,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@agentrific/server",
-      version: "0.1.2",
+      version: "0.1.4",
       description: "Self-hosted control plane for long-running coding agents",
       keywords: [
         "agentrific",
@@ -204,6 +204,9 @@ var init_updates = __esm({
 
 // ../../packages/contracts/src/index.ts
 import { z as z2 } from "zod";
+function cronRange(base, min, max, stepped) {
+  return base === "*" ? [min, max] : base.includes("-") ? base.split("-").map(Number) : [Number(base), stepped ? max : Number(base)];
+}
 function cronFields(expression) {
   const fields = expression.trim().split(/\s+/);
   if (fields.length !== 5)
@@ -216,7 +219,7 @@ function cronFields(expression) {
       if (!match) throw new Error("Use numeric cron fields, *, ranges, lists and steps.");
       const base = match[1];
       const step = Number(match[2] ?? 1);
-      const [start, end] = base === "*" ? [min, max] : base.includes("-") ? base.split("-").map(Number) : [Number(base), match[2] ? max : Number(base)];
+      const [start, end] = cronRange(base, min, max, Boolean(match[2]));
       if (!Number.isInteger(step) || step < 1 || step > max - min + 1 || start < min || end > max || start > end)
         throw new Error("Cron field is outside its allowed range.");
       for (let value = start; value <= end; value += step) values.add(value);
@@ -237,6 +240,11 @@ function cronMatches(expression, date) {
   const day = fields[2].wildcard || fields[4].wildcard ? matches[2] && matches[4] : matches[2] || matches[4];
   return Boolean(matches[0] && matches[1] && matches[3] && day);
 }
+function createPairingLink(payload) {
+  const link = new URL("agentrific://pair");
+  link.searchParams.set("data", JSON.stringify(PairingPayloadSchema.parse(payload)));
+  return link.toString();
+}
 var cronBounds, AutomationConfigSchema, AutomationStateSchema, SessionStatusSchema, AgentKindSchema, ModelReferenceSchema, ModelIdentitySchema, ModelOptionSchema, ModelCatalogSchema, GitFlowSchema, GitDeliverySchema, DeliveryRequestSchema, RunPreparationSchema, SessionSchema, MAX_ATTACHMENTS, MAX_ATTACHMENT_BYTES, AttachmentSchema, AttachmentIdsSchema, CreateSessionSchema, SendMessageSchema, SessionEventSchema, RecordedEventSchema, EventHistorySchema, ServerEventSchema, ServerSettingsSchema, ConnectionsStatusSchema, UpdateSettingsSchema, ProjectSchema, TaskStatusSchema, TaskSchema, CreateTaskSchema, UpdateTaskSchema, PROTOCOL_VERSION, ServerUpdateStatusSchema, ServerHealthSchema, PairingPayloadSchema, PairingRequestSchema, DeviceSchema, PairingResultSchema, HandshakeSchema, HandshakeAckSchema;
 var init_src = __esm({
   "../../packages/contracts/src/index.ts"() {
@@ -468,6 +476,7 @@ var init_src = __esm({
       gitFlow: GitFlowSchema.optional(),
       status: TaskStatusSchema,
       sessionId: z2.string().nullable(),
+      pullRequestUrl: z2.string().url().optional(),
       createdAt: z2.string().datetime(),
       updatedAt: z2.string().datetime(),
       deletedAt: z2.string().datetime().optional()
@@ -485,7 +494,7 @@ var init_src = __esm({
       prompt: true,
       attachmentIds: true,
       gitFlow: true
-    }).strict();
+    }).extend({ gitFlow: GitFlowSchema.nullable().optional() }).strict();
     PROTOCOL_VERSION = 1;
     ServerUpdateStatusSchema = z2.object({
       currentVersion: z2.string(),
@@ -1235,6 +1244,9 @@ function taskStatusForSession(status, session) {
       return "needs_user_input";
   }
 }
+function pullRequestUrl(session) {
+  return session.gitDelivery?.status === "pr_opened" ? session.gitDelivery.url : void 0;
+}
 function sessionTask(session) {
   return TaskSchema.parse({
     id: `session-${session.id}`,
@@ -1245,6 +1257,7 @@ function sessionTask(session) {
     gitFlow: session.gitFlow,
     status: taskStatusForSession(session.status, session),
     sessionId: session.id,
+    pullRequestUrl: pullRequestUrl(session),
     createdAt: session.createdAt,
     updatedAt: session.updatedAt
   });
@@ -1256,12 +1269,13 @@ async function boardTasks(store2, projectId) {
     tasks.flatMap((task) => task.sessionId ? [task.sessionId] : [])
   );
   const linkedTasks = tasks.filter((task) => !task.deletedAt).map((task) => {
-    const session = sessions.find((item) => item.taskId === task.id) ?? sessions.find((item) => item.id === task.sessionId);
-    if (!session) return { ...task, status: "backlog" };
+    const session = sessions.find((item) => item.id === task.sessionId) ?? sessions.find((item) => item.taskId === task.id);
+    if (!session) return { ...task, status: "backlog", pullRequestUrl: void 0 };
     linkedSessionIds.add(session.id);
     return {
       ...task,
       sessionId: session.id,
+      pullRequestUrl: pullRequestUrl(session),
       status: taskStatusForSession(session.status, session)
     };
   });
@@ -1279,7 +1293,9 @@ async function findTask(store2, id) {
 function editTask(store2, id, input, resolveAttachments) {
   return withTaskLock(id, async () => {
     const task = await findTask(store2, id);
-    const { attachmentIds, ...updates2 } = input;
+    const { attachmentIds, gitFlow, ...updates2 } = input;
+    const configuration = { gitFlow: task.gitFlow };
+    if (gitFlow !== void 0) configuration.gitFlow = gitFlow ?? void 0;
     let files = task.attachments;
     if (attachmentIds) {
       if (!resolveAttachments)
@@ -1290,6 +1306,7 @@ function editTask(store2, id, input, resolveAttachments) {
       store2.saveTask({
         ...task,
         ...updates2,
+        ...configuration,
         attachments: files,
         updatedAt: (/* @__PURE__ */ new Date()).toISOString()
       })
@@ -1566,7 +1583,7 @@ var init_runtime = __esm({
           Effect7.gen({ self: this }, function* () {
             if (this.closed)
               return yield* Effect7.fail(new AgentError({ message: "Server is shutting down" }));
-            if (!session.branch)
+            if (!session.branch && (session.gitFlow || !session.workspacePath))
               return yield* Effect7.fail(new AgentError({ message: "Session checkout is not ready" }));
             if (this.hasMessage(session.id, messageId)) return;
             const entry = yield* this.open(session);
@@ -1894,45 +1911,7 @@ ${error ? workflowError(error instanceof Error ? error : String(error)) : messag
             if (await this.git(session, ["branch", "--show-current"], signal) !== session.branch)
               throw new Error("Restore the assigned run branch before requesting delivery.");
             if (dirty) {
-              await this.git(session, ["add", "--all"], signal);
-              await this.stage(job, "drafting");
-              const diff = await this.git(session, ["diff", "--cached", "HEAD", "--"], signal);
-              const files = await this.git(
-                session,
-                ["ls-files", "--others", "--exclude-standard"],
-                signal
-              );
-              if (this.options.draft) {
-                try {
-                  const draft = await this.options.draft(
-                    session,
-                    input,
-                    `${diff}
-New files:
-${files}`.slice(0, 4e4),
-                    signal
-                  );
-                  job.title = draft.title;
-                  job.body = draft.body;
-                } catch (error) {
-                  job.logs = workflowLog(
-                    `${job.logs}
-Message helper unavailable; using task summary. ${workflowError(error instanceof Error ? error : String(error))}`
-                  );
-                }
-              }
-              await this.stage(job, "committing");
-              if (await this.git(session, ["branch", "--show-current"], signal) !== session.branch)
-                throw new Error("The workspace changed branches while preparing delivery.");
-              const output = await this.git(
-                session,
-                ["commit", "-m", `${job.title}
-
-Agentrific run ${id}.`],
-                signal
-              );
-              job.logs = workflowLog(`${job.logs}
-${output}`);
+              await this.commitChanges(session, job, input, signal);
             } else {
               await this.git(session, ["hook", "run", "--ignore-missing", "pre-commit"], signal);
             }
@@ -1959,6 +1938,44 @@ ${workflowError(error instanceof Error ? error : String(error))}`
           }
         });
       }
+      async commitChanges(session, job, input, signal) {
+        const id = session.id;
+        await this.git(session, ["add", "--all"], signal);
+        await this.stage(job, "drafting");
+        const diff = await this.git(session, ["diff", "--cached", "HEAD", "--"], signal);
+        const files = await this.git(session, ["ls-files", "--others", "--exclude-standard"], signal);
+        if (this.options.draft) {
+          try {
+            const draft = await this.options.draft(
+              session,
+              input,
+              `${diff}
+New files:
+${files}`.slice(0, 4e4),
+              signal
+            );
+            job.title = draft.title;
+            job.body = draft.body;
+          } catch (error) {
+            job.logs = workflowLog(
+              `${job.logs}
+Message helper unavailable; using task summary. ${workflowError(error instanceof Error ? error : String(error))}`
+            );
+          }
+        }
+        await this.stage(job, "committing");
+        if (await this.git(session, ["branch", "--show-current"], signal) !== session.branch)
+          throw new Error("The workspace changed branches while preparing delivery.");
+        const output = await this.git(
+          session,
+          ["commit", "-m", `${job.title}
+
+Agentrific run ${id}.`],
+          signal
+        );
+        job.logs = workflowLog(`${job.logs}
+${output}`);
+      }
       fallbackBody(id, input) {
         return `${input.summary}
 
@@ -2031,6 +2048,31 @@ Agentrific run ${id}.`;
             );
         }
       }
+      async mergeChanges(session, job, projectPath, commit) {
+        await this.stage(job, "integrating");
+        if (session.gitFlow.workspace === "checkout" && await this.command(projectPath, "git", ["branch", "--show-current"]) === session.branch)
+          await this.command(projectPath, "git", ["switch", "main"]);
+        if (await this.command(projectPath, "git", ["branch", "--show-current"]) !== "main")
+          throw new Error("Switch the project checkout to main, then retry delivery.");
+        if (await this.command(projectPath, "git", ["status", "--porcelain"]))
+          throw new Error(
+            "Waiting for local changes in the main checkout. Commit or move them, then retry delivery."
+          );
+        const included = await this.command(projectPath, "git", ["merge-base", "main", commit]) === commit;
+        if (!included) {
+          try {
+            await this.command(projectPath, "git", ["merge", "--no-edit", commit]);
+          } catch (error) {
+            await this.command(projectPath, "git", ["merge", "--abort"]).catch(() => void 0);
+            throw new Error(
+              `Integration failed. Resolve conflicts against main in the run workspace, then call deliver_changes again.
+${workflowError(error instanceof Error ? error : String(error))}`
+            );
+          }
+        }
+        job.result = "merged";
+        job.message = "Committed changes are on main.";
+      }
       async integrate(id) {
         const job = await this.job(id);
         if (!job?.commitSha) return;
@@ -2044,29 +2086,7 @@ Agentrific run ${id}.`;
                 "The workspace changed after requesting delivery. Call deliver_changes again for the new changes."
               );
             if (session.gitFlow.delivery === "merge") {
-              await this.stage(job, "integrating");
-              if (session.gitFlow.workspace === "checkout" && await this.command(projectPath, "git", ["branch", "--show-current"]) === session.branch)
-                await this.command(projectPath, "git", ["switch", "main"]);
-              if (await this.command(projectPath, "git", ["branch", "--show-current"]) !== "main")
-                throw new Error("Switch the project checkout to main, then retry delivery.");
-              if (await this.command(projectPath, "git", ["status", "--porcelain"]))
-                throw new Error(
-                  "Waiting for local changes in the main checkout. Commit or move them, then retry delivery."
-                );
-              const included = await this.command(projectPath, "git", ["merge-base", "main", commit]) === commit;
-              if (!included) {
-                try {
-                  await this.command(projectPath, "git", ["merge", "--no-edit", commit]);
-                } catch (error) {
-                  await this.command(projectPath, "git", ["merge", "--abort"]).catch(() => void 0);
-                  throw new Error(
-                    `Integration failed. Resolve conflicts against main in the run workspace, then call deliver_changes again.
-${workflowError(error instanceof Error ? error : String(error))}`
-                  );
-                }
-              }
-              job.result = "merged";
-              job.message = "Committed changes are on main.";
+              await this.mergeChanges(session, job, projectPath, commit);
             } else {
               await this.stage(job, "pushing");
               await this.git(session, ["push", "origin", `${commit}:refs/heads/${session.branch}`]);
@@ -2153,6 +2173,7 @@ var init_preparation = __esm({
         return [...this.preparing.values()].map((id) => `preparation:${id}`);
       }
       async prepare(session, projectPath, input) {
+        if (!session.gitFlow) return { ...session, branch: null, workspacePath: projectPath };
         const preparation2 = Symbol(session.id);
         this.preparing.set(preparation2, session.id);
         return withTaskLock(`prepare:${session.id}`, async () => {
@@ -2185,56 +2206,7 @@ ${logs}` : ""}`);
           try {
             await record("creating", "Creating the run workspace\u2026");
             const workspace = session.workspacePath;
-            const checkout = session.gitFlow?.workspace === "checkout";
-            const branchAtWorkspace = await command(workspace, "git", [
-              "branch",
-              "--show-current"
-            ]).catch(() => void 0);
-            if (branchAtWorkspace !== session.branch) {
-              if (checkout) {
-                if (branchAtWorkspace !== "main" || await command(projectPath, "git", ["status", "--porcelain"]))
-                  throw new Error(
-                    "The project checkout must be clean and on main before starting a checkout run."
-                  );
-                await command(
-                  projectPath,
-                  "git",
-                  ["switch", "-c", session.branch, "main"],
-                  void 0,
-                  true
-                );
-              } else {
-                if (branchAtWorkspace !== void 0)
-                  throw new Error("The run workspace already exists on a different branch.");
-                await mkdir4(path6.dirname(workspace), { recursive: true });
-                try {
-                  await command(
-                    projectPath,
-                    "git",
-                    [
-                      "worktree",
-                      "add",
-                      "-b",
-                      session.branch,
-                      workspace,
-                      session.gitFlow ? "main" : "HEAD"
-                    ],
-                    void 0,
-                    true
-                  );
-                } catch (error) {
-                  if (await command(workspace, "git", ["branch", "--show-current"]).catch(
-                    () => void 0
-                  ) !== session.branch)
-                    throw error;
-                  await record(
-                    "creating",
-                    "Workspace created; a checkout hook failed. Preparing dependencies\u2026",
-                    workflowError(error instanceof Error ? error : String(error))
-                  );
-                }
-              }
-            }
+            await this.createWorkspace(session, projectPath, command, record);
             await record("installing", "Installing run dependencies\u2026");
             await this.install(workspace, command);
             await record("ready", "Workspace ready.");
@@ -2250,6 +2222,57 @@ ${logs}` : ""}`);
           }
         }).finally(() => this.preparing.delete(preparation2));
       }
+      async createWorkspace(session, projectPath, command, record) {
+        const workspace = session.workspacePath;
+        const checkout = session.gitFlow?.workspace === "checkout";
+        if (!await command(projectPath, "git", ["rev-parse", "--verify", "HEAD"]).catch(() => void 0))
+          throw new Error(
+            "Git Flow needs an initial commit. Create one in the project, or turn off Git Flow for a plain chat."
+          );
+        const branchAtWorkspace = await command(workspace, "git", ["branch", "--show-current"]).catch(
+          () => void 0
+        );
+        if (branchAtWorkspace !== session.branch) {
+          if (checkout) {
+            if (branchAtWorkspace !== "main" || await command(projectPath, "git", ["status", "--porcelain"]))
+              throw new Error(
+                "The project checkout must be clean and on main before starting a checkout run."
+              );
+            await command(
+              projectPath,
+              "git",
+              ["switch", "-c", session.branch, "main"],
+              void 0,
+              true
+            );
+          } else {
+            await this.createWorktree(session, projectPath, command, record, branchAtWorkspace);
+          }
+        }
+      }
+      async createWorktree(session, projectPath, command, record, branchAtWorkspace) {
+        const workspace = session.workspacePath;
+        if (branchAtWorkspace !== void 0)
+          throw new Error("The run workspace already exists on a different branch.");
+        await mkdir4(path6.dirname(workspace), { recursive: true });
+        try {
+          await command(
+            projectPath,
+            "git",
+            ["worktree", "add", "-b", session.branch, workspace, "main"],
+            void 0,
+            true
+          );
+        } catch (error) {
+          if (await command(workspace, "git", ["branch", "--show-current"]).catch(() => void 0) !== session.branch)
+            throw error;
+          await record(
+            "creating",
+            "Workspace created; a checkout hook failed. Preparing dependencies\u2026",
+            workflowError(error instanceof Error ? error : String(error))
+          );
+        }
+      }
       async install(workspace, command) {
         const packageFile = await readFile3(path6.join(workspace, "package.json"), "utf8").catch(
           () => void 0
@@ -3010,31 +3033,7 @@ var init_store = __esm({
               this.db.prepare("DELETE FROM projects WHERE id = ?").run(replacedId);
             }
             if (previousPath && previousPath !== project.path) {
-              this.db.prepare(
-                "UPDATE workflows SET payload = json_set(payload, '$.projectPath', ?) WHERE json_extract(payload, '$.kind') = 'preparation' AND json_extract(payload, '$.projectPath') = ?"
-              ).run(project.path, previousPath);
-              const relocate = (workspace) => workspace === previousPath || workspace.startsWith(`${previousPath}${path8.sep}`) ? project.path + workspace.slice(previousPath.length) : workspace;
-              for (const row of this.db.prepare(
-                "SELECT id, payload FROM sessions WHERE json_extract(payload, '$.projectId') = ?"
-              ).all(project.id)) {
-                const session = SessionSchema.parse(JSON.parse(PayloadRow.parse(row).payload));
-                if (session.workspacePath) {
-                  session.workspacePath = String(relocate(session.workspacePath));
-                  this.db.prepare("UPDATE sessions SET payload = ? WHERE id = ?").run(JSON.stringify(session), session.id);
-                }
-              }
-              for (const row of this.db.prepare(
-                "SELECT sequence, payload FROM events WHERE json_extract(payload, '$.session.projectId') = ?"
-              ).all(project.id)) {
-                const event = SessionSchema.parse(JSON.parse(PayloadRow.parse(row).payload).session);
-                if (event.workspacePath) {
-                  event.workspacePath = String(relocate(event.workspacePath));
-                  this.db.prepare("UPDATE events SET payload = ? WHERE sequence = ?").run(
-                    JSON.stringify({ type: "session.updated", session: event }),
-                    Number(row.sequence)
-                  );
-                }
-              }
+              this.relocateProjectHistory(project, previousPath);
             }
             this.db.prepare(
               "INSERT INTO projects(id, payload) VALUES (?, ?) ON CONFLICT(id) DO UPDATE SET payload = excluded.payload"
@@ -3047,6 +3046,28 @@ var init_store = __esm({
           }
         });
       }
+      relocateProjectHistory(project, previousPath) {
+        this.db.prepare(
+          "UPDATE workflows SET payload = json_set(payload, '$.projectPath', ?) WHERE json_extract(payload, '$.kind') = 'preparation' AND json_extract(payload, '$.projectPath') = ?"
+        ).run(project.path, previousPath);
+        const relocate = (workspace) => workspace === previousPath || workspace.startsWith(`${previousPath}${path8.sep}`) ? project.path + workspace.slice(previousPath.length) : workspace;
+        for (const row of this.db.prepare("SELECT id, payload FROM sessions WHERE json_extract(payload, '$.projectId') = ?").all(project.id)) {
+          const session = SessionSchema.parse(JSON.parse(PayloadRow.parse(row).payload));
+          if (session.workspacePath) {
+            session.workspacePath = String(relocate(session.workspacePath));
+            this.db.prepare("UPDATE sessions SET payload = ? WHERE id = ?").run(JSON.stringify(session), session.id);
+          }
+        }
+        for (const row of this.db.prepare(
+          "SELECT sequence, payload FROM events WHERE json_extract(payload, '$.session.projectId') = ?"
+        ).all(project.id)) {
+          const event = SessionSchema.parse(JSON.parse(PayloadRow.parse(row).payload).session);
+          if (event.workspacePath) {
+            event.workspacePath = String(relocate(event.workspacePath));
+            this.db.prepare("UPDATE events SET payload = ? WHERE sequence = ?").run(JSON.stringify({ type: "session.updated", session: event }), Number(row.sequence));
+          }
+        }
+      }
       defaultModel() {
         return this.query(() => {
           const row = this.db.prepare("SELECT payload FROM settings WHERE id = 'default-model'").get();
@@ -3298,16 +3319,27 @@ async function githubCliStatus() {
     return { githubCli: { installed: true, authenticated: false } };
   }
 }
-async function createAndStartSession(input) {
-  maintenance.assertReady();
-  if (input.gitFlow?.delivery === "pull_request") {
-    const github = await githubCliStatus();
-    if (!github.githubCli.authenticated)
-      return { error: "GitHub CLI must be authenticated on the server to open a PR.", status: 400 };
+async function selectSessionModel(input, hasImages) {
+  try {
+    const reference = input.model ?? await models.defaultReference();
+    const selected = await models.resolve(reference);
+    if (hasImages && !selected.input.includes("image"))
+      return {
+        error: "This model cannot read images. Choose a vision model in Settings.",
+        status: 400
+      };
+    return { model: models.identity(selected.provider, selected.id) };
+  } catch {
+    return {
+      error: "The default model is unavailable. Choose an available model in Settings.",
+      status: 400
+    };
   }
+}
+async function resolveSessionProject(projectId) {
   const projectsRoot = await Effect14.runPromise(store.projectsRoot(defaultProjectsRoot));
   const project = (await Effect14.runPromise(discoverProjects(projectsRoot, store))).find(
-    (item) => item.id === input.projectId && item.available
+    (item) => item.id === projectId && item.available
   );
   if (!project)
     return { error: "Project folder is missing. Reconnect it before starting a run.", status: 404 };
@@ -3315,6 +3347,37 @@ async function createAndStartSession(input) {
   const resolvedRoot = await realpath2(projectsRoot);
   if (path9.dirname(projectPath) !== resolvedRoot)
     return { error: "Project path is outside projects root.", status: 400 };
+  return { projectPath };
+}
+async function resolveSessionWorkspace(id, gitFlow, projectPath) {
+  const worktreePath = path9.join(worktreesRoot, id);
+  const branch = gitFlow ? `agentrific/${id.slice(0, 8)}` : null;
+  const useProjectCheckout = gitFlow?.workspace === "checkout";
+  const workspacePath = !gitFlow || useProjectCheckout ? projectPath : worktreePath;
+  if (useProjectCheckout) {
+    const serverPath = await realpath2(process.cwd());
+    if (serverPath === projectPath || serverPath.startsWith(`${projectPath}${path9.sep}`))
+      return {
+        error: "The server runs from this project. Choose a worktree for this task.",
+        status: 409
+      };
+  }
+  return { branch, workspacePath };
+}
+function sessionTaskUnavailable(task, projectId) {
+  return !task || Boolean(task.deletedAt) || task.projectId !== projectId;
+}
+async function sessionDeliveryAvailable(gitFlow) {
+  if (gitFlow?.delivery !== "pull_request") return true;
+  return (await githubCliStatus()).githubCli.authenticated;
+}
+async function createAndStartSession(input) {
+  maintenance.assertReady();
+  if (!await sessionDeliveryAvailable(input.gitFlow))
+    return { error: "GitHub CLI must be authenticated on the server to open a PR.", status: 400 };
+  const location = await resolveSessionProject(input.projectId);
+  if (location.error !== void 0) return { error: location.error, status: location.status };
+  const projectPath = location.projectPath;
   let files;
   try {
     files = await Effect14.runPromise(
@@ -3323,25 +3386,15 @@ async function createAndStartSession(input) {
   } catch (error) {
     return { error: String(error), status: 400 };
   }
-  let selectedModel;
-  try {
-    const reference = input.model ?? await models.defaultReference();
-    const selected = await models.resolve(reference);
-    if (files.some((file) => file.kind === "image") && !selected.input.includes("image"))
-      return {
-        error: "This model cannot read images. Choose a vision model in Settings.",
-        status: 400
-      };
-    selectedModel = models.identity(selected.provider, selected.id);
-  } catch {
-    return {
-      error: "The default model is unavailable. Choose an available model in Settings.",
-      status: 400
-    };
-  }
+  const selection = await selectSessionModel(
+    input,
+    files.some((file) => file.kind === "image")
+  );
+  if (selection.error !== void 0) return { error: selection.error, status: selection.status };
+  const selectedModel = selection.model;
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const task = input.taskId ? await Effect14.runPromise(store.getTask(input.taskId)) : void 0;
-  if (input.taskId && (!task || task.deletedAt || task.projectId !== input.projectId))
+  if (input.taskId && sessionTaskUnavailable(task, input.projectId))
     return { error: "Task not found.", status: 404 };
   const session = SessionSchema.parse({
     id: randomUUID7(),
@@ -3356,18 +3409,9 @@ async function createAndStartSession(input) {
     createdAt: now,
     updatedAt: now
   });
-  const worktreePath = path9.join(worktreesRoot, session.id);
-  const branch = `agentrific/${session.id.slice(0, 8)}`;
-  const useProjectCheckout = input.gitFlow?.workspace === "checkout";
-  const workspacePath = useProjectCheckout ? projectPath : worktreePath;
-  if (useProjectCheckout) {
-    const serverPath = await realpath2(process.cwd());
-    if (serverPath === projectPath || serverPath.startsWith(`${projectPath}${path9.sep}`))
-      return {
-        error: "The server runs from this project. Choose a worktree for this task.",
-        status: 409
-      };
-  }
+  const workspace = await resolveSessionWorkspace(session.id, input.gitFlow, projectPath);
+  if (workspace.error !== void 0) return { error: workspace.error, status: workspace.status };
+  const { branch, workspacePath } = workspace;
   const initial = { ...session, branch, workspacePath };
   publish({ type: "session.updated", session: initial });
   let running;
@@ -4038,17 +4082,7 @@ async function manageService(action, dataDir, cli) {
   );
   const domain = `gui/${process.getuid?.()}`;
   if (action === "install") {
-    await mkdir(directory, { recursive: true, mode: 448 });
-    await mkdir(path.join(dataDir, "logs"), { recursive: true, mode: 448 });
-    await writeFile(filename, serviceDefinition(platform, process.execPath, cli, dataDir), {
-      mode: 384,
-      flag: "wx"
-    });
-    if (platform === "darwin") await execute("launchctl", ["bootstrap", domain, filename]);
-    else {
-      await execute("systemctl", ["--user", "daemon-reload"]);
-      await execute("systemctl", ["--user", "enable", "--now", "agentrific.service"]);
-    }
+    await installService(platform, directory, filename, domain, dataDir, cli);
     return;
   }
   if (action === "restart") {
@@ -4062,6 +4096,19 @@ async function manageService(action, dataDir, cli) {
   await unlink(filename);
   if (platform === "linux") await execute("systemctl", ["--user", "daemon-reload"]);
 }
+async function installService(platform, directory, filename, domain, dataDir, cli) {
+  await mkdir(directory, { recursive: true, mode: 448 });
+  await mkdir(path.join(dataDir, "logs"), { recursive: true, mode: 448 });
+  await writeFile(filename, serviceDefinition(platform, process.execPath, cli, dataDir), {
+    mode: 384,
+    flag: "wx"
+  });
+  if (platform === "darwin") await execute("launchctl", ["bootstrap", domain, filename]);
+  else {
+    await execute("systemctl", ["--user", "daemon-reload"]);
+    await execute("systemctl", ["--user", "enable", "--now", "agentrific.service"]);
+  }
+}
 
 // src/cli.ts
 init_updates();
@@ -4072,9 +4119,11 @@ import { parseArgs } from "node:util";
 import { z as z16 } from "zod";
 
 // src/pairing.ts
+init_src();
 init_control();
 import { z as z4 } from "zod";
 import { styleText as styleText2 } from "node:util";
+import { emitKeypressEvents } from "node:readline";
 import qrcode from "qrcode-terminal";
 
 // src/cli-output.ts
@@ -4096,9 +4145,13 @@ function printHeading(title) {
 function printDetail(label2, value) {
   console.log(`  ${styleText("dim", "\u203A")} ${styleText("dim", label2.padEnd(10))} ${value}`);
 }
-function printShortcuts() {
+function printShortcuts(pairingAvailable = false) {
   console.log();
   console.log(`  ${styleText("dim", "\u203A")} Press ${styleText("bold", "p")}       \u2502 pair a device`);
+  if (pairingAvailable)
+    console.log(
+      `  ${styleText("dim", "\u203A")} Press ${styleText("bold", "j")}       \u2502 show pairing JSON`
+    );
   console.log(`  ${styleText("dim", "\u203A")} Press ${styleText("bold", "?")}       \u2502 show shortcuts`);
   console.log(
     `  ${styleText("dim", "\u203A")} Press ${styleText("bold", "Ctrl+C")}  \u2502 stop the server
@@ -4134,6 +4187,7 @@ function printHelp() {
     ["--data-dir <path>", "Use a specific server data directory"],
     ["--public-url <https-url>", "Use your tunnel URL without prompting"],
     ["--no-interactive", "Disable prompts and keyboard shortcuts"],
+    ["--show-payload", "Print manual JSON with the pairing QR code"],
     ["--timeout-ms <0-60000>", "Set the maintenance drain timeout"],
     ["--version", "Print the server version"],
     ["--help", "Show this help"]
@@ -4143,6 +4197,69 @@ function printHelp() {
 }
 
 // src/pairing.ts
+function printManualPairing(invitation) {
+  if (Date.now() >= invitation.expiresAt) {
+    printError("This invitation expired. Generate a fresh pairing QR code.");
+    return;
+  }
+  console.log(styleText2("dim", "\n  Manual entry \xB7 paste this JSON into Pairing payload:\n"));
+  console.log(`  ${invitation.payload}
+`);
+}
+function waitForManualPairing(invitation) {
+  console.log(styleText2("dim", "  Press j to show manual entry \xB7 Enter or q to finish.\n"));
+  return new Promise((resolve) => {
+    const input = process.stdin;
+    const previousRaw = input.isRaw;
+    const timeout = setTimeout(
+      () => {
+        console.log(
+          styleText2("dim", "\n  Pairing invitation expired. Run agentrific pair again.\n")
+        );
+        close();
+      },
+      Math.max(0, invitation.expiresAt - Date.now())
+    );
+    function close() {
+      clearTimeout(timeout);
+      input.removeListener("keypress", pressed);
+      input.removeListener("end", close);
+      process.removeListener("SIGINT", interrupted);
+      process.removeListener("SIGTERM", terminated);
+      input.setRawMode(previousRaw);
+      input.pause();
+      resolve();
+    }
+    function interrupted() {
+      process.exitCode = 130;
+      close();
+    }
+    function terminated() {
+      process.exitCode = 143;
+      close();
+    }
+    function pressed(text, key) {
+      if (key.ctrl && key.name === "c") {
+        interrupted();
+        return;
+      }
+      if (key.ctrl || key.meta) return;
+      if (text?.toLowerCase() === "j") {
+        printManualPairing(invitation);
+        close();
+      } else if (text?.toLowerCase() === "q" || key.name === "return" || key.name === "escape") {
+        close();
+      }
+    }
+    emitKeypressEvents(input);
+    input.setRawMode(true);
+    input.on("keypress", pressed);
+    input.once("end", close);
+    process.once("SIGINT", interrupted);
+    process.once("SIGTERM", terminated);
+    input.resume();
+  });
+}
 function pairingOrigin(url) {
   const endpoint = new URL(url);
   if (endpoint.username || endpoint.password || endpoint.search || endpoint.hash || endpoint.pathname !== "/")
@@ -4163,17 +4280,19 @@ async function printPairing(dataDir, url) {
     expiresAt: z4.number(),
     serverId: z4.string()
   }).parse(await controlRequest(dataDir, { command: "pair" }));
-  const payload = JSON.stringify({
+  const invitation = {
     v: 1,
     url: origin,
     serverId: grant.serverId,
     pairingId: grant.pairingId
-  });
+  };
+  const payload = JSON.stringify(invitation);
+  const link = createPairingLink(invitation);
   printHeading("pairing");
-  console.log("  1. Open Agentrific on your phone.");
-  console.log("  2. Choose Scan pairing QR code and scan below.");
+  console.log("  1. Scan below with your phone camera and tap Open Agentrific if offered.");
+  console.log("  2. Or open Agentrific and choose Scan pairing QR code.");
   console.log("  3. Enter the PIN, then confirm pairing.\n");
-  qrcode.generate(payload, { small: true }, (code) => {
+  qrcode.generate(link, { small: true }, (code) => {
     console.log(
       code.split("\n").map((line) => `  ${line}`).join("\n")
     );
@@ -4183,16 +4302,13 @@ async function printPairing(dataDir, url) {
   printDetail("Server", styleText2("cyan", origin));
   printDetail("Expires", "In five minutes \xB7 one device per code");
   console.log("\n  Pairing grants this device access to run agents as your host user.\n");
-  console.log(styleText2("dim", "  Manual entry \xB7 paste this payload into the app:"));
-  console.log(`Pairing payload:
-${payload}`);
-  console.log();
+  return { payload, expiresAt: grant.expiresAt };
 }
 
 // src/terminal.ts
 import { createInterface } from "node:readline/promises";
 import select from "@inquirer/select";
-import { emitKeypressEvents } from "node:readline";
+import { emitKeypressEvents as emitKeypressEvents2 } from "node:readline";
 import { styleText as styleText3 } from "node:util";
 
 // src/tunnels.ts
@@ -4501,6 +4617,60 @@ async function promptPublicUrl(signal, saved) {
     prompt.close();
   }
 }
+async function selectConnectionMethod(options, signal, saved) {
+  return select(
+    {
+      message: "Connection method",
+      default: saved ? "existing" : void 0,
+      loop: false,
+      choices: [
+        ...options.filter((option) => option.available).map((option) => ({
+          value: option.provider,
+          name: option.provider === "tailscale" ? "Tailscale" : "Cloudflared",
+          description: option.reason
+        })),
+        {
+          value: "existing",
+          name: "Existing HTTPS address",
+          description: saved ? `Paste an address, or keep ${saved}` : "Paste the public address from your tunnel provider."
+        },
+        {
+          value: "local",
+          name: "Local only",
+          description: "Start without a public address."
+        }
+      ],
+      theme: {
+        prefix: " ",
+        style: {
+          message: (text) => styleText3("bold", text),
+          highlight: (text) => styleText3("cyan", text),
+          answer: (text) => styleText3("cyan", text),
+          description: (text) => styleText3("dim", `  ${text}`),
+          keysHelpTip: () => styleText3("dim", "  \u2191/\u2193 to move \xB7 Enter to select")
+        }
+      }
+    },
+    { signal }
+  );
+}
+async function startSelectedTunnel(options, choice, origin, signal) {
+  const option = options.find((candidate) => candidate.provider === choice);
+  if (!option?.available) throw new Error("The selected tunnel is unavailable.");
+  const tunnel = new ManagedTunnel(option);
+  try {
+    console.log(styleText3("dim", `
+  Starting ${option.provider}\u2026
+`));
+    const url = await tunnel.start(origin, signal);
+    return { url, tunnel, remember: false };
+  } catch (error) {
+    await tunnel.close();
+    if (signal.aborted) throw error;
+    printError(error instanceof Error ? error.message : String(error));
+    return void 0;
+  }
+}
 async function selectPublicConnection(origin, saved) {
   const controller = new AbortController();
   const cancel = () => controller.abort();
@@ -4516,60 +4686,14 @@ async function selectPublicConnection(origin, saved) {
     }
     console.log();
     while (true) {
-      const choice = await select(
-        {
-          message: "Connection method",
-          default: saved ? "existing" : void 0,
-          loop: false,
-          choices: [
-            ...options.filter((option2) => option2.available).map((option2) => ({
-              value: option2.provider,
-              name: option2.provider === "tailscale" ? "Tailscale" : "Cloudflared",
-              description: option2.reason
-            })),
-            {
-              value: "existing",
-              name: "Existing HTTPS address",
-              description: saved ? `Paste an address, or keep ${saved}` : "Paste the public address from your tunnel provider."
-            },
-            {
-              value: "local",
-              name: "Local only",
-              description: "Start without a public address."
-            }
-          ],
-          theme: {
-            prefix: " ",
-            style: {
-              message: (text) => styleText3("bold", text),
-              highlight: (text) => styleText3("cyan", text),
-              answer: (text) => styleText3("cyan", text),
-              description: (text) => styleText3("dim", `  ${text}`),
-              keysHelpTip: () => styleText3("dim", "  \u2191/\u2193 to move \xB7 Enter to select")
-            }
-          }
-        },
-        { signal: controller.signal }
-      );
+      const choice = await selectConnectionMethod(options, controller.signal, saved);
       if (choice === "local") return { remember: false };
       if (choice === "existing") {
         console.log();
         return { url: await promptPublicUrl(controller.signal, saved), remember: true };
       }
-      const option = options.find((candidate) => candidate.provider === choice);
-      if (!option?.available) throw new Error("The selected tunnel is unavailable.");
-      const tunnel = new ManagedTunnel(option);
-      try {
-        console.log(styleText3("dim", `
-  Starting ${option.provider}\u2026
-`));
-        const url = await tunnel.start(origin, controller.signal);
-        return { url, tunnel, remember: false };
-      } catch (error) {
-        await tunnel.close();
-        if (controller.signal.aborted) throw error;
-        printError(error instanceof Error ? error.message : String(error));
-      }
+      const connection = await startSelectedTunnel(options, choice, origin, controller.signal);
+      if (connection) return connection;
     }
   } finally {
     process.removeListener("SIGINT", cancel);
@@ -4581,6 +4705,7 @@ function startTerminal(dataDir, publicUrl, tunnel) {
   const previousRaw = input.isRaw;
   let busy = false;
   let closed = false;
+  let invitation;
   const close = () => {
     if (closed) return;
     closed = true;
@@ -4602,10 +4727,15 @@ function startTerminal(dataDir, publicUrl, tunnel) {
       return;
     }
     if (text === "?" && !busy) {
-      printShortcuts();
+      printShortcuts(Boolean(invitation));
+      return;
+    }
+    if (busy || key.ctrl || key.meta) return;
+    if (text?.toLowerCase() === "j" && invitation) {
+      printManualPairing(invitation);
       return;
     }
-    if (text?.toLowerCase() !== "p" || busy || key.ctrl || key.meta) return;
+    if (text?.toLowerCase() !== "p") return;
     if (tunnel && !tunnel.running()) {
       printError(
         "The managed tunnel is no longer running. Restart the server to reconnect your phone."
@@ -4613,12 +4743,15 @@ function startTerminal(dataDir, publicUrl, tunnel) {
       return;
     }
     busy = true;
-    void printPairing(dataDir, publicUrl).catch((error) => printError(error.message)).finally(() => {
+    invitation = void 0;
+    void printPairing(dataDir, publicUrl).then((result) => {
+      invitation = result;
+    }).catch((error) => printError(error.message)).finally(() => {
       busy = false;
-      if (!closed) printShortcuts();
+      if (!closed) printShortcuts(Boolean(invitation));
     });
   }
-  emitKeypressEvents(input);
+  emitKeypressEvents2(input);
   input.setRawMode(true);
   input.on("keypress", pressed);
   input.once("end", close);
@@ -4652,8 +4785,8 @@ var ConfigSchema = z16.object({
   projectsDir: z16.string(),
   publicUrl: z16.string().url().optional()
 });
-async function main() {
-  const { values, positionals } = parseArgs({
+function parseCommandArgs() {
+  return parseArgs({
     allowPositionals: true,
     options: {
       "data-dir": { type: "string" },
@@ -4662,9 +4795,13 @@ async function main() {
       help: { type: "boolean" },
       check: { type: "boolean" },
       "timeout-ms": { type: "string" },
-      "no-interactive": { type: "boolean" }
+      "no-interactive": { type: "boolean" },
+      "show-payload": { type: "boolean" }
     }
   });
+}
+async function main() {
+  const { values, positionals } = parseCommandArgs();
   if (values.version) {
     console.log(serverVersion);
     return;
@@ -4686,111 +4823,132 @@ async function main() {
       })
     )
   );
-  if (command === "init") {
-    await mkdir5(dataDir, { recursive: true, mode: 448 });
-    const publicUrl = values["public-url"] ?? config.publicUrl;
-    if (publicUrl && new URL(publicUrl).protocol !== "https:")
-      throw new Error("Configure an HTTPS URL from Tailscale Serve or Cloudflare Tunnel.");
-    await writeFile4(filename, JSON.stringify({ ...config, publicUrl }, null, 2) + "\n", {
-      mode: 384
-    });
-    console.log(`Configuration saved to ${filename}. Start with agentrific start.`);
-    return;
+  const context = { values, positionals, dataDir, filename, config, command };
+  if (command === "init") return initCommand(context);
+  if (command === "start") return startCommand(context);
+  if (command === "service") return serviceCommand(context);
+  if (command === "logs") return logsCommand(context);
+  if (command === "update") return updateCommand(context);
+  if (command === "pair") return pairCommand(context);
+  if (command === "maintenance") return maintenanceCommand(context);
+  if (command === "devices" || command === "status") return devicesCommand(context);
+  if (command === "revoke") return revokeCommand(context);
+  throw new Error("Unknown command. Run agentrific --help.");
+}
+async function initCommand({ values, dataDir, filename, config }) {
+  await mkdir5(dataDir, { recursive: true, mode: 448 });
+  const publicUrl = values["public-url"] ?? config.publicUrl;
+  if (publicUrl && new URL(publicUrl).protocol !== "https:")
+    throw new Error("Configure an HTTPS URL from Tailscale Serve or Cloudflare Tunnel.");
+  await writeFile4(filename, JSON.stringify({ ...config, publicUrl }, null, 2) + "\n", {
+    mode: 384
+  });
+  console.log(`Configuration saved to ${filename}. Start with agentrific start.`);
+  return;
+}
+async function startCommand({ values, dataDir, filename, config }) {
+  process.env.AGENTRIFIC_DATA_DIR = dataDir;
+  process.env.AGENTRIFIC_PROJECTS_DIR ??= config.projectsDir;
+  const interactive = Boolean(
+    process.stdin.isTTY && process.stdout.isTTY && !values["no-interactive"]
+  );
+  const explicitUrl = values["public-url"] ?? process.env.AGENTRIFIC_PUBLIC_URL;
+  if (interactive) {
+    process.env.AGENTRIFIC_INTERACTIVE = "1";
+    printHeading("server");
   }
-  if (command === "start") {
-    process.env.AGENTRIFIC_DATA_DIR = dataDir;
-    process.env.AGENTRIFIC_PROJECTS_DIR ??= config.projectsDir;
-    const interactive = Boolean(
-      process.stdin.isTTY && process.stdout.isTTY && !values["no-interactive"]
-    );
-    const explicitUrl = values["public-url"] ?? process.env.AGENTRIFIC_PUBLIC_URL;
-    if (interactive) {
-      process.env.AGENTRIFIC_INTERACTIVE = "1";
-      printHeading("server");
-    }
-    const connection = interactive && !explicitUrl ? await selectPublicConnection(
-      `http://${process.env.AGENTRIFIC_HOST ?? "127.0.0.1"}:${process.env.AGENTRIFIC_PORT ?? "4318"}`,
-      config.publicUrl
-    ) : {
-      url: explicitUrl ? pairingOrigin(explicitUrl) : config.publicUrl,
-      remember: false,
-      tunnel: void 0
-    };
-    const publicUrl = connection.url;
-    try {
-      if (connection.remember && publicUrl) {
-        await mkdir5(dataDir, { recursive: true, mode: 448 });
-        await writeFile4(filename, JSON.stringify({ ...config, publicUrl }, null, 2) + "\n", {
-          mode: 384
-        });
-      }
-      if (publicUrl) process.env.AGENTRIFIC_PUBLIC_URL = pairingOrigin(publicUrl);
-      await init_index().then(() => index_exports);
-      if (interactive) startTerminal(dataDir, publicUrl, connection.tunnel);
-    } catch (error) {
-      await connection.tunnel?.close();
-      throw error;
+  const connection = interactive && !explicitUrl ? await selectPublicConnection(
+    `http://${process.env.AGENTRIFIC_HOST ?? "127.0.0.1"}:${process.env.AGENTRIFIC_PORT ?? "4318"}`,
+    config.publicUrl
+  ) : {
+    url: explicitUrl ? pairingOrigin(explicitUrl) : config.publicUrl,
+    remember: false,
+    tunnel: void 0
+  };
+  const publicUrl = connection.url;
+  try {
+    if (connection.remember && publicUrl) {
+      await mkdir5(dataDir, { recursive: true, mode: 448 });
+      await writeFile4(filename, JSON.stringify({ ...config, publicUrl }, null, 2) + "\n", {
+        mode: 384
+      });
     }
-    return;
-  }
-  if (command === "service") {
-    const cli = fileURLToPath(import.meta.url);
-    if (!cli.endsWith(".js"))
-      throw new Error(
-        "Build and install the compiled server package before registering a service."
-      );
-    await manageService(positionals[1] ?? "", dataDir, cli);
-    console.log(`Service ${positionals[1]} completed.`);
-    return;
-  }
-  if (command === "logs") {
-    const child = process.platform === "linux" ? spawn2("journalctl", ["--user", "-u", "agentrific.service", "-f"], { stdio: "inherit" }) : spawn2("tail", ["-F", path10.join(dataDir, "logs", "server.log")], { stdio: "inherit" });
-    child.on("error", (error) => {
-      console.error(error.message);
-      process.exitCode = 1;
-    });
-    child.on("exit", (code) => {
-      process.exitCode = code ?? 0;
-    });
-    return;
-  }
-  if (command === "update") {
-    if (!values.check)
-      throw new Error(
-        "Use update --check. Automatic installation is unavailable; stop the server and install a reviewed package before restarting."
-      );
-    console.log(JSON.stringify(await checkForUpdates(), null, 2));
-    return;
+    if (publicUrl) process.env.AGENTRIFIC_PUBLIC_URL = pairingOrigin(publicUrl);
+    await init_index().then(() => index_exports);
+    if (interactive) startTerminal(dataDir, publicUrl, connection.tunnel);
+  } catch (error) {
+    await connection.tunnel?.close();
+    throw error;
   }
-  if (command === "pair") {
-    const status = await controlRequest(dataDir, { command: "status" });
-    await printPairing(
-      dataDir,
-      values["public-url"] ?? process.env.AGENTRIFIC_PUBLIC_URL ?? ("publicUrl" in status ? status.publicUrl : void 0) ?? config.publicUrl
+  return;
+}
+async function serviceCommand({ positionals, dataDir }) {
+  const cli = fileURLToPath(import.meta.url);
+  if (!cli.endsWith(".js"))
+    throw new Error("Build and install the compiled server package before registering a service.");
+  await manageService(positionals[1] ?? "", dataDir, cli);
+  console.log(`Service ${positionals[1]} completed.`);
+  return;
+}
+async function logsCommand({ dataDir }) {
+  const child = process.platform === "linux" ? spawn2("journalctl", ["--user", "-u", "agentrific.service", "-f"], { stdio: "inherit" }) : spawn2("tail", ["-F", path10.join(dataDir, "logs", "server.log")], { stdio: "inherit" });
+  child.on("error", (error) => {
+    console.error(error.message);
+    process.exitCode = 1;
+  });
+  child.on("exit", (code) => {
+    process.exitCode = code ?? 0;
+  });
+  return;
+}
+async function updateCommand({ values }) {
+  if (!values.check)
+    throw new Error(
+      "Use update --check. Automatic installation is unavailable; stop the server and install a reviewed package before restarting."
     );
-    return;
-  }
-  if (command === "maintenance") {
-    const action = z16.enum(["enter", "resume", "drain"]).parse(positionals[1]);
-    const result = await controlRequest(dataDir, {
-      command,
-      action,
-      timeoutMs: z16.coerce.number().int().min(0).max(6e4).parse(values["timeout-ms"] ?? 3e4)
-    });
-    console.log(JSON.stringify(result, null, 2));
-    if (action === "drain" && "drained" in result && !result.drained) process.exitCode = 1;
-    return;
-  }
-  if (command === "devices" || command === "status") {
-    console.log(JSON.stringify(await controlRequest(dataDir, { command }), null, 2));
-    return;
-  }
-  if (command === "revoke") {
-    const id = z16.string().uuid().parse(positionals[1]);
-    console.log(JSON.stringify(await controlRequest(dataDir, { command, id })));
-    return;
+  console.log(JSON.stringify(await checkForUpdates(), null, 2));
+  return;
+}
+async function pairCommand({ values, dataDir, config }) {
+  const status = await controlRequest(dataDir, { command: "status" });
+  const invitation = await printPairing(
+    dataDir,
+    values["public-url"] ?? process.env.AGENTRIFIC_PUBLIC_URL ?? ("publicUrl" in status ? status.publicUrl : void 0) ?? config.publicUrl
+  );
+  if (values["show-payload"]) {
+    printManualPairing(invitation);
+  } else if (process.stdin.isTTY && process.stdout.isTTY && !values["no-interactive"]) {
+    await waitForManualPairing(invitation);
+  } else {
+    console.log("  For manual entry, run agentrific pair --show-payload.\n");
   }
-  throw new Error("Unknown command. Run agentrific --help.");
+  return;
+}
+async function maintenanceCommand({ values, positionals, dataDir }) {
+  const action = z16.enum(["enter", "resume", "drain"]).parse(positionals[1]);
+  const result = await controlRequest(dataDir, {
+    command: "maintenance",
+    action,
+    timeoutMs: z16.coerce.number().int().min(0).max(6e4).parse(values["timeout-ms"] ?? 3e4)
+  });
+  console.log(JSON.stringify(result, null, 2));
+  if (action === "drain" && "drained" in result && !result.drained) process.exitCode = 1;
+  return;
+}
+async function devicesCommand({ dataDir, command }) {
+  console.log(
+    JSON.stringify(
+      await controlRequest(dataDir, { command: z16.enum(["devices", "status"]).parse(command) }),
+      null,
+      2
+    )
+  );
+  return;
+}
+async function revokeCommand({ positionals, dataDir }) {
+  const id = z16.string().uuid().parse(positionals[1]);
+  console.log(JSON.stringify(await controlRequest(dataDir, { command: "revoke", id })));
+  return;
 }
 void main().catch((error) => {
   if (["ExitPromptError", "AbortPromptError", "AbortError"].includes(error.name)) {