@agentrific/server 0.1.5 → 0.1.6

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @agentrific/server
 
+## 0.1.6
+
+### Patch Changes
+
+- 70ffb32: Add an Electron desktop client with encrypted pairing storage and task notifications, macOS preview and signed release builds, and a marketing downloads page backed by public Cloudflare R2 artifacts. Allow the desktop app origin in the server's default origin policy.
+- 5e2d3a2: Show task titles and event-specific notification details, open validated GitHub pull requests from PR alerts, and provide transparent Android notification and adaptive/themed launcher icons. Native icon configuration requires a rebuilt client and a new release runtime. Add an explicitly isolated, expiring local push test mode without weakening production billing checks.
+- 991dd7e: Add a Pair device modal to web Settings with a locally generated QR code, separate six-digit PIN, expiry countdown and retry handling. Authenticated clients can request a single-use invitation from the connected server using its configured public HTTPS URL.
+
 ## 0.1.5
 
 ### Patch Changes

package/README.md

@@ -32,6 +32,8 @@ The server defaults to port 4318 and stores its configuration and state in `~/.a
 
 Open the Agentrific app on iOS or Android. In the server terminal, choose Tailscale Serve, Cloudflare Tunnel, or an existing HTTPS endpoint, then press **p** to display a pairing QR code. Scan it in the app and enter the separately printed six-digit PIN.
 
+Already paired in the web app? Open **Settings → Pair device** to generate a QR code and separate PIN for another device. Invitations expire after five minutes and can be used once. The server must have a public HTTPS URL configured (`AGENTRIFIC_PUBLIC_URL`); restart after changing it. Only share invitations with trusted devices: pairing grants access to run agents as the server’s host user.
+
 Once paired, select a project, create a task and start an agent. The server runs the work and streams progress back to your device. Use HTTPS for remote connections; your phone must be able to reach the configured server address.
 
 See the [server setup and pairing guide](https://agentrific.com/docs/secure-server-setup) for connection options and configuration.

package/cli.js

@@ -30,7 +30,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@agentrific/server",
-      version: "0.1.5",
+      version: "0.1.6",
       description: "Self-hosted control plane for long-running coding agents",
       keywords: [
         "agentrific",
@@ -245,7 +245,7 @@ function createPairingLink(payload) {
   link.searchParams.set("data", JSON.stringify(PairingPayloadSchema.parse(payload)));
   return link.toString();
 }
-var cronBounds, AutomationConfigSchema, AutomationStateSchema, SessionStatusSchema, AgentKindSchema, ModelReferenceSchema, ModelIdentitySchema, ModelOptionSchema, ModelCatalogSchema, GitFlowSchema, GitDeliverySchema, DeliveryRequestSchema, RunPreparationSchema, SessionSchema, MAX_ATTACHMENTS, MAX_ATTACHMENT_BYTES, AttachmentSchema, AttachmentIdsSchema, CreateSessionSchema, SendMessageSchema, SessionEventSchema, RecordedEventSchema, EventHistorySchema, ServerEventSchema, ServerSettingsSchema, ConnectionsStatusSchema, UpdateSettingsSchema, ProjectSchema, TaskStatusSchema, TaskSchema, CreateTaskSchema, UpdateTaskSchema, PROTOCOL_VERSION, ServerUpdateStatusSchema, ServerHealthSchema, PairingPayloadSchema, PairingRequestSchema, DeviceSchema, PairingResultSchema, HandshakeSchema, HandshakeAckSchema;
+var cronBounds, AutomationConfigSchema, AutomationStateSchema, SessionStatusSchema, AgentKindSchema, ModelReferenceSchema, ModelIdentitySchema, ModelOptionSchema, ModelCatalogSchema, GitFlowSchema, GitDeliverySchema, DeliveryRequestSchema, RunPreparationSchema, SessionSchema, MAX_ATTACHMENTS, MAX_ATTACHMENT_BYTES, AttachmentSchema, AttachmentIdsSchema, CreateSessionSchema, SendMessageSchema, SessionEventSchema, RecordedEventSchema, EventHistorySchema, ServerEventSchema, ServerSettingsSchema, ConnectionsStatusSchema, UpdateSettingsSchema, ProjectSchema, TaskStatusSchema, TaskSchema, CreateTaskSchema, UpdateTaskSchema, PROTOCOL_VERSION, ServerUpdateStatusSchema, ServerHealthSchema, PairingPayloadSchema, PairingInvitationSchema, PairingRequestSchema, DeviceSchema, PairingResultSchema, HandshakeSchema, HandshakeAckSchema;
 var init_src = __esm({
   "../../packages/contracts/src/index.ts"() {
     cronBounds = [
@@ -519,6 +519,11 @@ var init_src = __esm({
       serverId: z2.string().uuid(),
       pairingId: z2.string().regex(/^[a-f0-9]{64}$/)
     });
+    PairingInvitationSchema = z2.object({
+      payload: PairingPayloadSchema,
+      pin: z2.string().regex(/^\d{6}$/),
+      expiresAt: z2.number()
+    });
     PairingRequestSchema = z2.object({
       pairingId: z2.string().regex(/^[a-f0-9]{64}$/),
       pin: z2.string().regex(/^\d{6}$/),
@@ -727,6 +732,202 @@ var init_control = __esm({
   }
 });
 
+// src/cli-output.ts
+import { styleText } from "node:util";
+function printHeading(title) {
+  console.log();
+  console.log(styleText("bold", "      #######  ##"));
+  console.log(styleText("bold", "    ###     #####"));
+  console.log(`    ${styleText("bold", "##       ####")}    ${styleText("bold", "AGENTRIFIC")}`);
+  console.log(
+    `    ${styleText("bold", "##   ")}${styleText(["bold", "yellow"], "o")}${styleText("bold", "   ####")}    ${styleText("dim", `${title} \xB7 v${serverVersion}`)}`
+  );
+  console.log(styleText("bold", "    ##       ####"));
+  console.log(styleText("bold", "    ###     #####"));
+  console.log(styleText("bold", "      #######  ##"));
+  console.log();
+}
+function printDetail(label2, value) {
+  console.log(`  ${styleText("dim", "\u203A")} ${styleText("dim", label2.padEnd(10))} ${value}`);
+}
+function printShortcuts(pairingAvailable = false) {
+  console.log();
+  console.log(`  ${styleText("dim", "\u203A")} Press ${styleText("bold", "p")}       \u2502 pair a device`);
+  if (pairingAvailable)
+    console.log(
+      `  ${styleText("dim", "\u203A")} Press ${styleText("bold", "j")}       \u2502 show pairing JSON`
+    );
+  console.log(`  ${styleText("dim", "\u203A")} Press ${styleText("bold", "?")}       \u2502 show shortcuts`);
+  console.log(
+    `  ${styleText("dim", "\u203A")} Press ${styleText("bold", "Ctrl+C")}  \u2502 stop the server
+`
+  );
+}
+function printError(message) {
+  console.error(`
+  ${styleText(["bold", "red"], "Error")} ${message}
+`);
+}
+function printHelp() {
+  printHeading("server");
+  console.log(`  ${styleText("bold", "Usage")} agentrific <command> [options]
+`);
+  for (const [command, description] of [
+    ["init", "Configure the server"],
+    ["start", "Start the server \xB7 press p to pair"],
+    ["pair", "Print a fresh pairing QR code and PIN"],
+    ["devices", "List enrolled devices"],
+    ["revoke <id>", "Revoke a device's access"],
+    ["status", "Show server status"],
+    ["maintenance enter/resume/drain", "Pause new work, resume, or wait for work to finish"],
+    ["service install/uninstall/restart", "Manage the background service"],
+    ["logs", "Follow server logs"],
+    ["update --check", "Check for a newer release"]
+  ])
+    console.log(`  ${styleText("cyan", command.padEnd(34))}${description}`);
+  console.log(`
+  ${styleText("bold", "Options")}
+`);
+  for (const [option, description] of [
+    ["--data-dir <path>", "Use a specific server data directory"],
+    ["--public-url <https-url>", "Use your tunnel URL without prompting"],
+    ["--no-interactive", "Disable prompts and keyboard shortcuts"],
+    ["--show-payload", "Print manual JSON with the pairing QR code"],
+    ["--timeout-ms <0-60000>", "Set the maintenance drain timeout"],
+    ["--version", "Print the server version"],
+    ["--help", "Show this help"]
+  ])
+    console.log(`  ${styleText("cyan", option.padEnd(34))}${description}`);
+  console.log("\n  Connect using Tailscale Serve, cloudflared, or another HTTPS tunnel.\n");
+}
+var init_cli_output = __esm({
+  "src/cli-output.ts"() {
+    "use strict";
+    init_version();
+  }
+});
+
+// src/pairing.ts
+import { z as z4 } from "zod";
+import { styleText as styleText2 } from "node:util";
+import { emitKeypressEvents } from "node:readline";
+import qrcode from "qrcode-terminal";
+function printManualPairing(invitation) {
+  if (Date.now() >= invitation.expiresAt) {
+    printError("This invitation expired. Generate a fresh pairing QR code.");
+    return;
+  }
+  console.log(styleText2("dim", "\n  Manual entry \xB7 paste this JSON into Pairing payload:\n"));
+  console.log(`  ${invitation.payload}
+`);
+}
+function waitForManualPairing(invitation) {
+  console.log(styleText2("dim", "  Press j to show manual entry \xB7 Enter or q to finish.\n"));
+  return new Promise((resolve) => {
+    const input = process.stdin;
+    const previousRaw = input.isRaw;
+    const timeout = setTimeout(
+      () => {
+        console.log(
+          styleText2("dim", "\n  Pairing invitation expired. Run agentrific pair again.\n")
+        );
+        close();
+      },
+      Math.max(0, invitation.expiresAt - Date.now())
+    );
+    function close() {
+      clearTimeout(timeout);
+      input.removeListener("keypress", pressed);
+      input.removeListener("end", close);
+      process.removeListener("SIGINT", interrupted);
+      process.removeListener("SIGTERM", terminated);
+      input.setRawMode(previousRaw);
+      input.pause();
+      resolve();
+    }
+    function interrupted() {
+      process.exitCode = 130;
+      close();
+    }
+    function terminated() {
+      process.exitCode = 143;
+      close();
+    }
+    function pressed(text, key) {
+      if (key.ctrl && key.name === "c") {
+        interrupted();
+        return;
+      }
+      if (key.ctrl || key.meta) return;
+      if (text?.toLowerCase() === "j") {
+        printManualPairing(invitation);
+        close();
+      } else if (text?.toLowerCase() === "q" || key.name === "return" || key.name === "escape") {
+        close();
+      }
+    }
+    emitKeypressEvents(input);
+    input.setRawMode(true);
+    input.on("keypress", pressed);
+    input.once("end", close);
+    process.once("SIGINT", interrupted);
+    process.once("SIGTERM", terminated);
+    input.resume();
+  });
+}
+function pairingOrigin(url) {
+  const endpoint = new URL(url);
+  if (endpoint.username || endpoint.password || endpoint.search || endpoint.hash || endpoint.pathname !== "/")
+    throw new Error("Use the HTTPS server origin without a path or credentials.");
+  if (endpoint.protocol !== "https:" && !(process.env.NODE_ENV !== "production" && endpoint.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(endpoint.hostname)))
+    throw new Error("Use HTTPS. Localhost HTTP is for development builds only.");
+  return endpoint.origin;
+}
+async function printPairing(dataDir, url) {
+  if (!url)
+    throw new Error(
+      "Specify --public-url with your Tailscale Serve or Cloudflare Tunnel HTTPS address."
+    );
+  const origin = pairingOrigin(url);
+  const grant = z4.object({
+    pairingId: z4.string(),
+    pin: z4.string(),
+    expiresAt: z4.number(),
+    serverId: z4.string()
+  }).parse(await controlRequest(dataDir, { command: "pair" }));
+  const invitation = {
+    v: 1,
+    url: origin,
+    serverId: grant.serverId,
+    pairingId: grant.pairingId
+  };
+  const payload = JSON.stringify(invitation);
+  const link = createPairingLink(invitation);
+  printHeading("pairing");
+  console.log("  1. Scan below with your phone camera and tap Open Agentrific if offered.");
+  console.log("  2. Or open Agentrific and choose Scan pairing QR code.");
+  console.log("  3. Enter the PIN, then confirm pairing.\n");
+  qrcode.generate(link, { small: true }, (code) => {
+    console.log(
+      code.split("\n").map((line) => `  ${line}`).join("\n")
+    );
+  });
+  console.log();
+  printDetail("PIN:", styleText2(["bold", "yellow"], grant.pin));
+  printDetail("Server", styleText2("cyan", origin));
+  printDetail("Expires", "In five minutes \xB7 one device per code");
+  console.log("\n  Pairing grants this device access to run agents as your host user.\n");
+  return { payload, expiresAt: grant.expiresAt };
+}
+var init_pairing = __esm({
+  "src/pairing.ts"() {
+    "use strict";
+    init_src();
+    init_control();
+    init_cli_output();
+  }
+});
+
 // ../../packages/contracts/src/push.ts
 import { z as z6 } from "zod";
 function pushSigningText(installationId, operation, request) {
@@ -740,7 +941,7 @@ function pushSigningText(installationId, operation, request) {
     request.payload
   ].join("\n");
 }
-var PUSH_API_URL, PushKindSchema, PushPreferencesSchema, PushPublicKeySchema, PushInstallationSchema, PushRegistrationSchema, PushEnrollmentSchema, PushGrantSchema, PushEventSchema, PushSignedRequestSchema, PushEntitlementSchema, PushServerStatusSchema;
+var PUSH_API_URL, PushKindSchema, PushPreferencesSchema, PushPublicKeySchema, PushInstallationSchema, PushRegistrationSchema, PushEnrollmentSchema, PushGrantSchema, PushPullRequestUrlSchema, PushEventSchema, PushSignedRequestSchema, PushEntitlementSchema, PushServerStatusSchema;
 var init_push = __esm({
   "../../packages/contracts/src/push.ts"() {
     "use strict";
@@ -768,7 +969,14 @@ var init_push = __esm({
       grant: z6.string().regex(/^[a-f0-9]{64}$/),
       expiresAt: z6.number()
     }).strict();
-    PushEventSchema = z6.object({ eventId: z6.string().uuid(), sessionId: z6.string().uuid(), kind: PushKindSchema }).strict();
+    PushPullRequestUrlSchema = z6.string().max(512).regex(/^https:\/\/github\.com\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+\/pull\/[1-9][0-9]*$/);
+    PushEventSchema = z6.object({
+      eventId: z6.string().uuid(),
+      sessionId: z6.string().uuid(),
+      kind: PushKindSchema,
+      taskTitle: z6.string().trim().min(1).max(160).optional(),
+      prUrl: PushPullRequestUrlSchema.optional()
+    }).strict();
     PushSignedRequestSchema = z6.object({
       bindingId: z6.string().uuid(),
       timestamp: z6.number().int(),
@@ -855,10 +1063,11 @@ var init_push2 = __esm({
     "use strict";
     init_push();
     ServerPush = class {
-      constructor(store2, serverId, directory, transport = fetch) {
+      constructor(store2, serverId, directory, transport = fetch, apiUrl = PUSH_API_URL) {
         this.store = store2;
         this.serverId = serverId;
         this.transport = transport;
+        this.apiUrl = apiUrl;
         mkdirSync(directory, { recursive: true, mode: 448 });
         const filename = path4.join(directory, "push-signing-key.pem");
         if (!existsSync(filename))
@@ -873,6 +1082,7 @@ var init_push2 = __esm({
       store;
       serverId;
       transport;
+      apiUrl;
       key;
       publicKey;
       draining;
@@ -886,6 +1096,8 @@ var init_push2 = __esm({
           eventId: randomUUID(),
           sessionId: session.id,
           kind,
+          taskTitle: session.title.replace(/[\r\n\t]+/g, " ").trim().slice(0, 160) || void 0,
+          prUrl: kind === "pr_created" ? PushPullRequestUrlSchema.safeParse(session.gitDelivery?.url).data : void 0,
           remaining: state.bindings,
           createdAt: Date.now(),
           attempts: 0,
@@ -908,7 +1120,7 @@ var init_push2 = __esm({
           Buffer.from(pushSigningText(installationId, operation, request)),
           this.key
         ).toString("hex");
-        return this.transport(`${PUSH_API_URL}/v1/installations/${installationId}/${operation}`, {
+        return this.transport(`${this.apiUrl}/v1/installations/${installationId}/${operation}`, {
           method: "POST",
           headers: { "Content-Type": "application/json" },
           body: JSON.stringify({ ...request, signature }),
@@ -982,7 +1194,13 @@ var init_push2 = __esm({
                 binding.installationId,
                 binding.bindingId,
                 "events",
-                JSON.stringify({ eventId: job.eventId, sessionId: job.sessionId, kind: job.kind })
+                JSON.stringify({
+                  eventId: job.eventId,
+                  sessionId: job.sessionId,
+                  kind: job.kind,
+                  taskTitle: job.taskTitle,
+                  prUrl: job.prUrl
+                })
               );
               if (response.ok) continue;
               if ([401, 403, 404].includes(response.status)) {
@@ -1332,6 +1550,29 @@ async function registerSecurity(app2, security2, version, allowedOrigins2) {
     const result = await security2.pair(input.data, request.ip);
     return result ?? reply.code(401).send({ error: "Pairing expired, locked, or invalid. Run agentrific pair again." });
   });
+  app2.post("/api/auth/pairing-invitation", (_request, reply) => {
+    const publicUrl = process.env.AGENTRIFIC_PUBLIC_URL;
+    if (!publicUrl)
+      return reply.code(503).send({
+        error: "Configure the server\u2019s public HTTPS URL and restart the server before pairing a device."
+      });
+    let url;
+    try {
+      url = pairingOrigin(publicUrl);
+    } catch {
+      return reply.code(503).send({ error: "The server\u2019s public URL is invalid. Configure a public HTTPS origin." });
+    }
+    try {
+      const grant = security2.createPairing();
+      return {
+        payload: { v: 1, url, serverId: grant.serverId, pairingId: grant.pairingId },
+        pin: grant.pin,
+        expiresAt: grant.expiresAt
+      };
+    } catch {
+      return reply.code(429).send({ error: "Too many pending pairing codes. Wait five minutes and try again." });
+    }
+  });
   app2.get("/api/auth/session", (request) => ({
     serverId: security2.serverId,
     device: security2.authenticate((request.headers.authorization ?? "").slice(7))
@@ -1354,6 +1595,7 @@ var init_security = __esm({
   "src/security.ts"() {
     "use strict";
     init_src();
+    init_pairing();
     secret = () => randomBytes(32).toString("hex");
     digest = (value) => createHash("sha256").update(value).digest("hex");
     ServerSecurity = class {
@@ -3968,7 +4210,7 @@ async function withSessionTaskLock(id, operation) {
   const lockId = session ? await sessionTaskLockId(store, session) : `session-${id}`;
   return withTaskLock(lockId, operation);
 }
-var host, port, defaultProjectsRoot, worktreesRoot, execFileAsync, app, dataRoot, releaseLock, effects, store, security, push, allowedOrigins, attachmentEffects, attachments, attachmentCleanup, models, delivery, preparation, agentEffects, runtime, worktreeCleanup, maxWorktreeAgeDays, pruneWorktrees, worktreeCleanupTimer, updates, maintenance, stopUpdateDiscovery, HistoryQuery, StartTaskBody, automation, automationTimer, closeControl;
+var host, port, defaultProjectsRoot, worktreesRoot, execFileAsync, app, dataRoot, releaseLock, effects, store, security, testPushUrl, push, allowedOrigins, attachmentEffects, attachments, attachmentCleanup, models, delivery, preparation, agentEffects, runtime, worktreeCleanup, maxWorktreeAgeDays, pruneWorktrees, worktreeCleanupTimer, updates, maintenance, stopUpdateDiscovery, HistoryQuery, StartTaskBody, automation, automationTimer, closeControl;
 var init_index = __esm({
   async "src/index.ts"() {
     "use strict";
@@ -4025,9 +4267,13 @@ var init_index = __esm({
     effects = ManagedRuntime.make(SessionStore.layer(path11.join(dataRoot, "sessions.sqlite")));
     store = await effects.runPromise(SessionStore);
     security = new ServerSecurity(store, await Effect16.runPromise(store.serverIdentity()));
-    push = new ServerPush(store, security.serverId, dataRoot);
+    testPushUrl = process.env.AGENTRIFIC_PUSH_TEST_URL;
+    if (testPushUrl && (process.env.AGENTRIFIC_TEST_MODE !== "1" || !new URL(testPushUrl).hostname.endsWith(".ts.net") || new URL(testPushUrl).protocol !== "https:"))
+      throw new Error("Test relay requires explicit test mode and Tailscale HTTPS.");
+    push = new ServerPush(store, security.serverId, dataRoot, fetch, testPushUrl);
     allowedOrigins = [
       .../* @__PURE__ */ new Set([
+        "agentrific-desktop://app",
         ...(process.env.AGENTRIFIC_ALLOWED_ORIGINS ?? "http://localhost:8081,http://127.0.0.1:8081").split(","),
         `http://${host === "::1" ? "[::1]" : host}:${port}`,
         ...process.env.AGENTRIFIC_PUBLIC_URL ? [new URL(process.env.AGENTRIFIC_PUBLIC_URL).origin] : []
@@ -4635,204 +4881,21 @@ async function installService(platform, directory, filename, domain, dataDir, cl
 init_updates();
 init_control();
 init_version();
+init_pairing();
 import { spawn as spawn2 } from "node:child_process";
 import { parseArgs } from "node:util";
 import { z as z18 } from "zod";
 
-// src/pairing.ts
-init_src();
-init_control();
-import { z as z4 } from "zod";
-import { styleText as styleText2 } from "node:util";
-import { emitKeypressEvents } from "node:readline";
-import qrcode from "qrcode-terminal";
-
-// src/cli-output.ts
-init_version();
-import { styleText } from "node:util";
-function printHeading(title) {
-  console.log();
-  console.log(styleText("bold", "      #######  ##"));
-  console.log(styleText("bold", "    ###     #####"));
-  console.log(`    ${styleText("bold", "##       ####")}    ${styleText("bold", "AGENTRIFIC")}`);
-  console.log(
-    `    ${styleText("bold", "##   ")}${styleText(["bold", "yellow"], "o")}${styleText("bold", "   ####")}    ${styleText("dim", `${title} \xB7 v${serverVersion}`)}`
-  );
-  console.log(styleText("bold", "    ##       ####"));
-  console.log(styleText("bold", "    ###     #####"));
-  console.log(styleText("bold", "      #######  ##"));
-  console.log();
-}
-function printDetail(label2, value) {
-  console.log(`  ${styleText("dim", "\u203A")} ${styleText("dim", label2.padEnd(10))} ${value}`);
-}
-function printShortcuts(pairingAvailable = false) {
-  console.log();
-  console.log(`  ${styleText("dim", "\u203A")} Press ${styleText("bold", "p")}       \u2502 pair a device`);
-  if (pairingAvailable)
-    console.log(
-      `  ${styleText("dim", "\u203A")} Press ${styleText("bold", "j")}       \u2502 show pairing JSON`
-    );
-  console.log(`  ${styleText("dim", "\u203A")} Press ${styleText("bold", "?")}       \u2502 show shortcuts`);
-  console.log(
-    `  ${styleText("dim", "\u203A")} Press ${styleText("bold", "Ctrl+C")}  \u2502 stop the server
-`
-  );
-}
-function printError(message) {
-  console.error(`
-  ${styleText(["bold", "red"], "Error")} ${message}
-`);
-}
-function printHelp() {
-  printHeading("server");
-  console.log(`  ${styleText("bold", "Usage")} agentrific <command> [options]
-`);
-  for (const [command, description] of [
-    ["init", "Configure the server"],
-    ["start", "Start the server \xB7 press p to pair"],
-    ["pair", "Print a fresh pairing QR code and PIN"],
-    ["devices", "List enrolled devices"],
-    ["revoke <id>", "Revoke a device's access"],
-    ["status", "Show server status"],
-    ["maintenance enter/resume/drain", "Pause new work, resume, or wait for work to finish"],
-    ["service install/uninstall/restart", "Manage the background service"],
-    ["logs", "Follow server logs"],
-    ["update --check", "Check for a newer release"]
-  ])
-    console.log(`  ${styleText("cyan", command.padEnd(34))}${description}`);
-  console.log(`
-  ${styleText("bold", "Options")}
-`);
-  for (const [option, description] of [
-    ["--data-dir <path>", "Use a specific server data directory"],
-    ["--public-url <https-url>", "Use your tunnel URL without prompting"],
-    ["--no-interactive", "Disable prompts and keyboard shortcuts"],
-    ["--show-payload", "Print manual JSON with the pairing QR code"],
-    ["--timeout-ms <0-60000>", "Set the maintenance drain timeout"],
-    ["--version", "Print the server version"],
-    ["--help", "Show this help"]
-  ])
-    console.log(`  ${styleText("cyan", option.padEnd(34))}${description}`);
-  console.log("\n  Connect using Tailscale Serve, cloudflared, or another HTTPS tunnel.\n");
-}
-
-// src/pairing.ts
-function printManualPairing(invitation) {
-  if (Date.now() >= invitation.expiresAt) {
-    printError("This invitation expired. Generate a fresh pairing QR code.");
-    return;
-  }
-  console.log(styleText2("dim", "\n  Manual entry \xB7 paste this JSON into Pairing payload:\n"));
-  console.log(`  ${invitation.payload}
-`);
-}
-function waitForManualPairing(invitation) {
-  console.log(styleText2("dim", "  Press j to show manual entry \xB7 Enter or q to finish.\n"));
-  return new Promise((resolve) => {
-    const input = process.stdin;
-    const previousRaw = input.isRaw;
-    const timeout = setTimeout(
-      () => {
-        console.log(
-          styleText2("dim", "\n  Pairing invitation expired. Run agentrific pair again.\n")
-        );
-        close();
-      },
-      Math.max(0, invitation.expiresAt - Date.now())
-    );
-    function close() {
-      clearTimeout(timeout);
-      input.removeListener("keypress", pressed);
-      input.removeListener("end", close);
-      process.removeListener("SIGINT", interrupted);
-      process.removeListener("SIGTERM", terminated);
-      input.setRawMode(previousRaw);
-      input.pause();
-      resolve();
-    }
-    function interrupted() {
-      process.exitCode = 130;
-      close();
-    }
-    function terminated() {
-      process.exitCode = 143;
-      close();
-    }
-    function pressed(text, key) {
-      if (key.ctrl && key.name === "c") {
-        interrupted();
-        return;
-      }
-      if (key.ctrl || key.meta) return;
-      if (text?.toLowerCase() === "j") {
-        printManualPairing(invitation);
-        close();
-      } else if (text?.toLowerCase() === "q" || key.name === "return" || key.name === "escape") {
-        close();
-      }
-    }
-    emitKeypressEvents(input);
-    input.setRawMode(true);
-    input.on("keypress", pressed);
-    input.once("end", close);
-    process.once("SIGINT", interrupted);
-    process.once("SIGTERM", terminated);
-    input.resume();
-  });
-}
-function pairingOrigin(url) {
-  const endpoint = new URL(url);
-  if (endpoint.username || endpoint.password || endpoint.search || endpoint.hash || endpoint.pathname !== "/")
-    throw new Error("Use the HTTPS server origin without a path or credentials.");
-  if (endpoint.protocol !== "https:" && !(process.env.NODE_ENV !== "production" && endpoint.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(endpoint.hostname)))
-    throw new Error("Use HTTPS. Localhost HTTP is for development builds only.");
-  return endpoint.origin;
-}
-async function printPairing(dataDir, url) {
-  if (!url)
-    throw new Error(
-      "Specify --public-url with your Tailscale Serve or Cloudflare Tunnel HTTPS address."
-    );
-  const origin = pairingOrigin(url);
-  const grant = z4.object({
-    pairingId: z4.string(),
-    pin: z4.string(),
-    expiresAt: z4.number(),
-    serverId: z4.string()
-  }).parse(await controlRequest(dataDir, { command: "pair" }));
-  const invitation = {
-    v: 1,
-    url: origin,
-    serverId: grant.serverId,
-    pairingId: grant.pairingId
-  };
-  const payload = JSON.stringify(invitation);
-  const link = createPairingLink(invitation);
-  printHeading("pairing");
-  console.log("  1. Scan below with your phone camera and tap Open Agentrific if offered.");
-  console.log("  2. Or open Agentrific and choose Scan pairing QR code.");
-  console.log("  3. Enter the PIN, then confirm pairing.\n");
-  qrcode.generate(link, { small: true }, (code) => {
-    console.log(
-      code.split("\n").map((line) => `  ${line}`).join("\n")
-    );
-  });
-  console.log();
-  printDetail("PIN:", styleText2(["bold", "yellow"], grant.pin));
-  printDetail("Server", styleText2("cyan", origin));
-  printDetail("Expires", "In five minutes \xB7 one device per code");
-  console.log("\n  Pairing grants this device access to run agents as your host user.\n");
-  return { payload, expiresAt: grant.expiresAt };
-}
-
 // src/terminal.ts
+init_pairing();
+init_cli_output();
 import { createInterface } from "node:readline/promises";
 import select from "@inquirer/select";
 import { emitKeypressEvents as emitKeypressEvents2 } from "node:readline";
 import { styleText as styleText3 } from "node:util";
 
 // src/tunnels.ts
+init_cli_output();
 import { spawn } from "node:child_process";
 import { access, stat } from "node:fs/promises";
 import { constants } from "node:fs";
@@ -5301,6 +5364,7 @@ function startTerminal(dataDir, publicUrl, tunnel) {
 }
 
 // src/cli.ts
+init_cli_output();
 var ConfigSchema = z18.object({
   dataDir: z18.string(),
   projectsDir: z18.string(),