@birdybeep/cli 0.2.0 → 0.3.0

package/dist/{chunk-OCS5IDYI.js → chunk-U4EIHC5C.js}

@@ -69,8 +69,11 @@ function parseGlobalFlags(argv) {
   }
   return { flags, rest };
 }
-function isUnknownFlag(token) {
-  return token.startsWith("-") && !GLOBAL_FLAG_TOKENS.has(token);
+function isUnknownFlag(token, allowed) {
+  if (!token.startsWith("-")) return false;
+  if (GLOBAL_FLAG_TOKENS.has(token)) return false;
+  const eq = token.indexOf("=");
+  return !allowed.has(eq >= 0 ? token.slice(0, eq) : token);
 }
 function renderRootHelp(version, commands) {
   const width = Math.max(...commands.map((c) => c.name.length));
@@ -91,6 +94,16 @@ function renderRootHelp(version, commands) {
     "  -v, --version       Show the CLI version"
   ].join("\n");
 }
+function commandFlagTokens(...commands) {
+  const tokens = /* @__PURE__ */ new Set();
+  for (const command of commands) {
+    for (const option of command?.options ?? []) {
+      tokens.add(option.flag);
+      for (const alias of option.aliases ?? []) tokens.add(alias);
+    }
+  }
+  return tokens;
+}
 function renderCommandHelp(path, command) {
   const lines = [
     `birdybeep ${path} \u2014 ${command.summary}`,
@@ -98,6 +111,17 @@ function renderCommandHelp(path, command) {
     "Usage:",
     `  ${command.usage ?? `birdybeep ${path} [options]`}`
   ];
+  if (command.options && command.options.length > 0) {
+    const labels = command.options.map(
+      (o) => `${[o.flag, ...o.aliases ?? []].join(", ")}${o.value ? ` ${o.value}` : ""}`
+    );
+    const width = Math.max(...labels.map((l) => l.length));
+    lines.push(
+      "",
+      "Options:",
+      ...command.options.map((o, i) => `  ${labels[i]?.padEnd(width)}  ${o.summary}`)
+    );
+  }
   if (command.subcommands && command.subcommands.length > 0) {
     const width = Math.max(...command.subcommands.map((c) => c.name.length));
     lines.push(
@@ -122,6 +146,7 @@ async function dispatch(argv, deps) {
     return EXIT.OK;
   }
   let command = deps.commands.find((c) => c.name === rest[0]);
+  let parent;
   const pathParts = [];
   let argsStart = 1;
   if (command) {
@@ -129,6 +154,7 @@ async function dispatch(argv, deps) {
     if (command.subcommands && command.subcommands.length > 0) {
       const sub = command.subcommands.find((c) => c.name === rest[1]);
       if (sub) {
+        parent = command;
         command = sub;
         pathParts.push(sub.name);
         argsStart = 2;
@@ -152,6 +178,7 @@ async function dispatch(argv, deps) {
       name: path,
       summary: command.summary,
       usage: command.usage,
+      options: command.options,
       subcommands: command.subcommands?.map((c) => ({ name: c.name, summary: c.summary }))
     });
     return EXIT.OK;
@@ -161,7 +188,8 @@ async function dispatch(argv, deps) {
     return EXIT.USAGE;
   }
   const args = rest.slice(argsStart);
-  const unknown = args.find(isUnknownFlag);
+  const allowed = commandFlagTokens(command, parent);
+  const unknown = args.find((token) => isUnknownFlag(token, allowed));
   if (unknown !== void 0) {
     io.errline(`birdybeep ${path}: unknown option "${unknown}".`);
     return EXIT.USAGE;
@@ -189,19 +217,36 @@ async function dispatch(argv, deps) {
 }
 
 // src/version.ts
-var CLI_VERSION = "0.2.0".length > 0 ? "0.2.0" : "0.0.0";
+var CLI_VERSION = "0.3.0".length > 0 ? "0.3.0" : "0.0.0";
 
 // src/commands/agent.ts
 import { claudeCodeAdapter } from "@birdybeep/claude-code";
 import { codexAdapter } from "@birdybeep/codex";
+import { copilotAdapter } from "@birdybeep/copilot";
+import { cursorAdapter } from "@birdybeep/cursor";
 import { opencodeAdapter } from "@birdybeep/opencode";
-var DEFAULT_ADAPTERS = [claudeCodeAdapter, codexAdapter, opencodeAdapter];
+var DEFAULT_ADAPTERS = [
+  claudeCodeAdapter,
+  codexAdapter,
+  opencodeAdapter,
+  cursorAdapter,
+  copilotAdapter
+];
 var TARGET_TO_ID = {
   claude: "claude_code",
   codex: "codex",
-  opencode: "opencode"
+  opencode: "opencode",
+  cursor: "cursor",
+  copilot: "copilot"
 };
-var AGENT_TARGETS = ["all", "claude", "codex", "opencode"];
+var AGENT_TARGETS = [
+  "all",
+  "claude",
+  "codex",
+  "opencode",
+  "cursor",
+  "copilot"
+];
 function selectAdapters(target, adapters) {
   if (target === "all") return adapters;
   const id = TARGET_TO_ID[target];
@@ -292,18 +337,18 @@ function createAgentCommand(deps = {}) {
   return {
     name: "agent",
     summary: "Install or uninstall harness adapters",
-    usage: "birdybeep agent <install|uninstall> [all|claude|codex|opencode]",
+    usage: "birdybeep agent <install|uninstall> [all|claude|codex|opencode|cursor|copilot]",
     subcommands: [
       {
         name: "install",
-        summary: "Install adapters (all | claude | codex | opencode)",
-        usage: "birdybeep agent install [all|claude|codex|opencode]",
+        summary: "Install adapters (all | claude | codex | opencode | cursor | copilot)",
+        usage: "birdybeep agent install [all|claude|codex|opencode|cursor|copilot]",
         run: (ctx) => installSelected(adapters, ctx)
       },
       {
         name: "uninstall",
         summary: "Restore harness config to its pre-install state",
-        usage: "birdybeep agent uninstall [all|claude|codex|opencode]",
+        usage: "birdybeep agent uninstall [all|claude|codex|opencode|cursor|copilot]",
         run: (ctx) => uninstallSelected(adapters, ctx)
       }
     ]
@@ -316,6 +361,8 @@ import {
 } from "@birdybeep/agent-core";
 import { claudeCodeAdapter as claudeCodeAdapter2 } from "@birdybeep/claude-code";
 import { codexAdapter as codexAdapter2 } from "@birdybeep/codex";
+import { copilotAdapter as copilotAdapter2 } from "@birdybeep/copilot";
+import { cursorAdapter as cursorAdapter2 } from "@birdybeep/cursor";
 import { opencodeAdapter as opencodeAdapter2 } from "@birdybeep/opencode";
 
 // src/config.ts
@@ -340,6 +387,8 @@ function writeCliConfig(patch) {
   const merged = {};
   const apiUrl = patch.apiUrl ?? current.apiUrl;
   if (apiUrl !== void 0) merged.apiUrl = apiUrl;
+  const expectEmail = patch.expectEmail ?? current.expectEmail;
+  if (expectEmail !== void 0) merged.expectEmail = expectEmail;
   mkdirSync2(birdyBeepConfigDir2(), { recursive: true, mode: 448 });
   writeFileSync(cliConfigPath(), `${JSON.stringify(merged, null, 2)}
 `, { mode: 384 });
@@ -382,7 +431,13 @@ function machineIdentity() {
 }
 
 // src/commands/doctor.ts
-var DEFAULT_ADAPTERS2 = [claudeCodeAdapter2, codexAdapter2, opencodeAdapter2];
+var DEFAULT_ADAPTERS2 = [
+  claudeCodeAdapter2,
+  codexAdapter2,
+  opencodeAdapter2,
+  cursorAdapter2,
+  copilotAdapter2
+];
 async function defaultProbeNetwork(baseUrl) {
   try {
     const controller = new AbortController();
@@ -465,18 +520,36 @@ function createDoctorCommand(deps = {}) {
 }
 
 // src/commands/hook.ts
+import { spawn } from "child_process";
+import { randomBytes } from "crypto";
+import { closeSync, openSync, rmSync, writeFileSync as writeFileSync2 } from "fs";
+import { tmpdir } from "os";
+import { basename, dirname, join as join2 } from "path";
 import {
-  createSender as defaultCreateSender2
+  createSender as defaultCreateSender2,
+  resolveOnPath
 } from "@birdybeep/agent-core";
 import { runClaudeHook } from "@birdybeep/claude-code";
 import { runCodexHook } from "@birdybeep/codex";
+import {
+  isCopilotHookEventName,
+  runCopilotHook
+} from "@birdybeep/copilot";
+import { runCursorHook } from "@birdybeep/cursor";
 import { runOpenCodeHook } from "@birdybeep/opencode";
 var RUNNERS = {
   claude: runClaudeHook,
   codex: runCodexHook,
-  opencode: runOpenCodeHook
+  opencode: runOpenCodeHook,
+  cursor: runCursorHook
 };
-var HOOK_HARNESSES = ["claude", "codex", "opencode"];
+var HOOK_HARNESSES = [
+  "claude",
+  "codex",
+  "opencode",
+  "cursor",
+  "copilot"
+];
 var STDIN_READ_TIMEOUT_MS = 3e3;
 function withTimeout(promise, ms, fallback) {
   return new Promise((resolve) => {
@@ -493,9 +566,13 @@ function withTimeout(promise, ms, fallback) {
   });
 }
 function isHarnessName(value) {
-  return value === "claude" || value === "codex" || value === "opencode";
+  return value === "claude" || value === "codex" || value === "opencode" || value === "cursor" || value === "copilot";
 }
-function runHookCommand(harness, payload, sender) {
+function runHookCommand(harness, payload, sender, copilotEventName) {
+  if (harness === "copilot") {
+    if (copilotEventName === void 0) return Promise.resolve({ outcome: "skipped" });
+    return runCopilotHook(copilotEventName, payload, { sender });
+  }
   return RUNNERS[harness](payload, { sender });
 }
 function readStdinDefault() {
@@ -511,24 +588,90 @@ function readStdinDefault() {
     process.stdin.on("error", () => resolve(""));
   });
 }
-async function readHookPayload(args, readStdin) {
-  return args[1] ?? await readStdin();
+async function readHookPayload(args, readStdin, stdinOnly = false) {
+  return stdinOnly ? readStdin() : args[1] ?? await readStdin();
+}
+var NOTIFY_STDIN_FILE_ENV = "BIRDYBEEP_CODEX_NOTIFY_STDIN_FILE";
+function detachCodexNotifyWorker(payload) {
+  if (process.platform === "win32") return false;
+  let file;
+  let fd;
+  try {
+    const birdybeep = resolveOnPath("birdybeep");
+    if (birdybeep === null) return false;
+    const tmpFile = join2(tmpdir(), `birdybeep-notify-${randomBytes(16).toString("hex")}.json`);
+    file = tmpFile;
+    writeFileSync2(tmpFile, payload, { mode: 384 });
+    fd = openSync(tmpFile, "r");
+    const child = spawn(birdybeep, ["hook", "codex"], {
+      cwd: dirname(birdybeep),
+      // trusted dir, never the inherited/attacker cwd
+      detached: true,
+      // new session (setsid) → survives `codex exec` reaping the group
+      stdio: [fd, "ignore", "ignore"],
+      // stdin = the temp file; this process holds no pipe
+      env: { ...process.env, [NOTIFY_STDIN_FILE_ENV]: tmpFile },
+      // worker cleans it up post-read
+      windowsHide: true
+    });
+    child.on("error", () => {
+      try {
+        rmSync(tmpFile, { force: true });
+      } catch {
+      }
+    });
+    child.unref();
+    return true;
+  } catch {
+    if (file !== void 0) {
+      try {
+        rmSync(file, { force: true });
+      } catch {
+      }
+    }
+    return false;
+  } finally {
+    if (fd !== void 0) {
+      try {
+        closeSync(fd);
+      } catch {
+      }
+    }
+  }
 }
 function createHookCommand(deps = {}) {
   const makeSender = deps.createSender ?? ((baseUrl) => defaultCreateSender2({ baseUrl }));
   const readStdin = deps.readStdin ?? readStdinDefault;
   const stdinTimeoutMs = deps.stdinTimeoutMs ?? STDIN_READ_TIMEOUT_MS;
+  const detachCodexNotify = deps.detachCodexNotify ?? detachCodexNotifyWorker;
   return {
     name: "hook",
     summary: "Internal: normalize + send an event fired by a harness hook",
-    usage: "birdybeep hook <claude|codex|opencode>",
+    usage: "birdybeep hook <claude|codex|opencode|cursor|copilot> [copilot-event]",
     run: async (ctx) => {
       const harness = ctx.args[0];
       if (!isHarnessName(harness)) {
         ctx.io.errline(`birdybeep hook: expected one of ${HOOK_HARNESSES.join("|")}`);
         return EXIT.USAGE;
       }
-      const raw = await withTimeout(readHookPayload(ctx.args, readStdin), stdinTimeoutMs, "");
+      const notifyPayload = ctx.args[1];
+      if (harness === "codex" && notifyPayload !== void 0 && notifyPayload.length > 0 && detachCodexNotify(notifyPayload)) {
+        ctx.io.result({ harness, outcome: "detached" });
+        return EXIT.OK;
+      }
+      const copilotEventName = harness === "copilot" && isCopilotHookEventName(ctx.args[1]) ? ctx.args[1] : void 0;
+      const raw = await withTimeout(
+        readHookPayload(ctx.args, readStdin, harness === "copilot"),
+        stdinTimeoutMs,
+        ""
+      );
+      const notifyStdinFile = process.env[NOTIFY_STDIN_FILE_ENV];
+      if (notifyStdinFile !== void 0 && dirname(notifyStdinFile) === tmpdir() && basename(notifyStdinFile).startsWith("birdybeep-notify-")) {
+        try {
+          rmSync(notifyStdinFile, { force: true });
+        } catch {
+        }
+      }
       let payload;
       try {
         payload = JSON.parse(raw);
@@ -537,52 +680,79 @@ function createHookCommand(deps = {}) {
         return EXIT.OK;
       }
       const sender = makeSender(resolveApiUrl());
-      const result = await runHookCommand(harness, payload, sender);
-      ctx.io.result({ harness, outcome: result.outcome, eventType: result.eventType });
+      const result = await runHookCommand(harness, payload, sender, copilotEventName);
+      ctx.io.result({
+        harness,
+        ...copilotEventName !== void 0 ? { event: copilotEventName } : {},
+        outcome: result.outcome,
+        eventType: result.eventType,
+        ...result.send?.decision ? { decision: result.send.decision } : {},
+        ...result.send?.status !== void 0 ? { status: result.send.status } : {}
+      });
       return EXIT.OK;
     }
   };
 }
 
 // src/commands/logout.ts
-import { clearToken } from "@birdybeep/agent-core";
-function createClearTokenCommand(spec, deps = {}) {
+import { clearToken, getToken as getToken2 } from "@birdybeep/agent-core";
+var base = (apiUrl) => apiUrl.replace(/\/$/, "");
+function createLogoutCommand(deps = {}) {
   return {
-    name: spec.name,
-    summary: spec.summary,
-    usage: `birdybeep ${spec.name}`,
+    name: "logout",
+    summary: "Remove the local machine token (does NOT revoke the machine server-side)",
+    usage: "birdybeep logout",
     run: async (ctx) => {
       await clearToken(deps.tokenOptions ?? {});
-      ctx.io.emit(spec.humanMessage, { [spec.jsonKey]: true });
+      ctx.io.emit("Logged out \u2014 the machine token was removed.", { loggedOut: true });
       return EXIT.OK;
     }
   };
 }
-function createLogoutCommand(deps = {}) {
-  return createClearTokenCommand(
-    {
-      name: "logout",
-      summary: "Remove the local machine token (same as `unpair`)",
-      humanMessage: "Logged out \u2014 the machine token was removed.",
-      jsonKey: "loggedOut"
-    },
-    deps
-  );
+async function revokeSelf(token, fetchImpl, timeoutMs) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const res = await fetchImpl(`${base(resolveApiUrl())}/v1/machine/revoke-self`, {
+      method: "POST",
+      headers: { authorization: `Bearer ${token}` },
+      signal: controller.signal
+    });
+    if (res.ok || res.status === 403) return "revoked";
+    return "rejected";
+  } catch {
+    return "unreachable";
+  } finally {
+    clearTimeout(timer);
+  }
 }
 function createUnpairCommand(deps = {}) {
-  return createClearTokenCommand(
-    {
-      name: "unpair",
-      summary: "Unpair this machine \u2014 remove the local machine token (same as `logout`)",
-      humanMessage: "Unpaired \u2014 the machine token was removed.",
-      jsonKey: "unpaired"
-    },
-    deps
-  );
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const timeoutMs = deps.timeoutMs ?? 1e4;
+  return {
+    name: "unpair",
+    summary: "Unpair this machine \u2014 revoke it server-side and remove the local token",
+    usage: "birdybeep unpair",
+    run: async (ctx) => {
+      const token = await getToken2(deps.tokenOptions ?? {});
+      const outcome = token === null ? "no_token" : await revokeSelf(token, fetchImpl, timeoutMs);
+      await clearToken(deps.tokenOptions ?? {});
+      const serverRevoked = outcome === "revoked";
+      const human = outcome === "revoked" ? "Unpaired \u2014 the machine was revoked and removed from your account." : outcome === "no_token" ? "Already unpaired \u2014 there was no local token to remove." : outcome === "unreachable" ? "Unpaired locally, but the server was unreachable \u2014 the machine may still show in the app. Open BirdyBeep and revoke it there to fully remove it." : "Unpaired locally, but the server didn't confirm removal \u2014 if the machine still shows in the app, revoke it there.";
+      ctx.io.emit(human, { unpaired: true, serverRevoked });
+      return EXIT.OK;
+    }
+  };
 }
 
 // src/commands/pair.ts
-import { getMachineIdentity as getMachineIdentity2, setToken } from "@birdybeep/agent-core";
+import { closeSync as closeSync2, openSync as openSync2 } from "fs";
+import {
+  deriveCodeChallengeS256,
+  generateCodeVerifier,
+  getMachineIdentity as getMachineIdentity2,
+  setToken
+} from "@birdybeep/agent-core";
 import { renderUnicodeCompact } from "uqr";
 
 // src/pairing.ts
@@ -591,16 +761,17 @@ import {
   pairStartResponseSchema,
   pairTokenResponseSchema
 } from "@birdybeep/agent-core";
-function base(apiUrl) {
+function base2(apiUrl) {
   return apiUrl.replace(/\/$/, "");
 }
 async function pairStart(apiUrl, input, fetchImpl) {
   const body = {
     machine_label: input.machineLabel,
     ...input.os !== void 0 ? { os: input.os } : {},
-    ...input.cliVersion !== void 0 ? { cli_version: input.cliVersion } : {}
+    ...input.cliVersion !== void 0 ? { cli_version: input.cliVersion } : {},
+    ...input.codeChallenge !== void 0 ? { code_challenge: input.codeChallenge } : {}
   };
-  const res = await fetchImpl(`${base(apiUrl)}/v1/pair/start`, {
+  const res = await fetchImpl(`${base2(apiUrl)}/v1/pair/start`, {
     method: "POST",
     headers: { "content-type": "application/json" },
     body: JSON.stringify(body)
@@ -618,12 +789,13 @@ var TERMINAL_TOKEN_ERRORS = /* @__PURE__ */ new Set([
   "not_found",
   "payload_too_large"
 ]);
-async function pairTokenPoll(apiUrl, deviceCode, fetchImpl, machineFingerprint) {
+async function pairTokenPoll(apiUrl, deviceCode, fetchImpl, machineFingerprint, codeVerifier) {
   const body = {
     device_code: deviceCode,
-    ...machineFingerprint !== void 0 ? { machine_fingerprint: machineFingerprint } : {}
+    ...machineFingerprint !== void 0 ? { machine_fingerprint: machineFingerprint } : {},
+    ...codeVerifier !== void 0 ? { code_verifier: codeVerifier } : {}
   };
-  const res = await fetchImpl(`${base(apiUrl)}/v1/pair/token`, {
+  const res = await fetchImpl(`${base2(apiUrl)}/v1/pair/token`, {
     method: "POST",
     headers: { "content-type": "application/json" },
     body: JSON.stringify(body)
@@ -634,7 +806,10 @@ async function pairTokenPoll(apiUrl, deviceCode, fetchImpl, machineFingerprint)
     return {
       status: "paired",
       machineToken: parsed.data.machine_token,
-      machineId: parsed.data.machine_id
+      machineId: parsed.data.machine_id,
+      // Only surface the key when the server reported it (exactOptionalPropertyTypes: no explicit
+      // undefined). Older servers omit approved_by_email; newer ones (dgxd) include it.
+      ...parsed.data.approved_by_email !== void 0 ? { approvedByEmail: parsed.data.approved_by_email } : {}
     };
   }
   let errBody = null;
@@ -660,22 +835,172 @@ var HEARTBEAT_MS = 15e3;
 function renderQrMatrix(qrPayload) {
   return renderUnicodeCompact(qrPayload, { border: 2 });
 }
+function parsePairFlags(args) {
+  const flags = { yes: false };
+  for (let i = 0; i < args.length; i += 1) {
+    const token = args[i] ?? "";
+    if (token === "--yes" || token === "-y") {
+      flags.yes = true;
+    } else if (token === "--expect-email" || token.startsWith("--expect-email=")) {
+      const inline = token.startsWith("--expect-email=") ? token.slice("--expect-email=".length) : void 0;
+      const value = inline ?? args[++i];
+      if (value === void 0 || value.length === 0 || value.startsWith("-")) {
+        return { ...flags, error: "--expect-email requires an email address" };
+      }
+      flags.expectEmail = value;
+    } else {
+      return { ...flags, error: `unexpected argument "${token}"` };
+    }
+  }
+  return flags;
+}
+function sameEmail(a, b) {
+  const fold = (v) => v.trim().toLowerCase();
+  const rawEqual = fold(a) === fold(b);
+  const nfkcEqual = fold(a.normalize("NFKC")) === fold(b.normalize("NFKC"));
+  return rawEqual && nfkcEqual;
+}
+function decidePairConfirmation(input) {
+  const { approvedByEmail, expectEmail } = input;
+  const platform = input.platform ?? process.platform;
+  if (expectEmail !== void 0) {
+    if (approvedByEmail === void 0) {
+      const remedy = input.expectEmailSource === "config" ? `Remove or correct the "expectEmail" key in ${input.configPath ?? "the BirdyBeep CLI config"} (or upgrade the backend to one that reports the approving account) and re-run.` : "Re-run without --expect-email (and confirm interactively) if that is expected.";
+      return {
+        action: "reject",
+        reason: "expected_email_unverifiable",
+        message: `Pairing refused: ${expectEmail} was pinned as the expected approving account, but the server did not report which account approved this machine, so the pin could not be verified. The machine token was NOT stored. ${remedy}`
+      };
+    }
+    if (sameEmail(approvedByEmail, expectEmail)) {
+      return { action: "approve", reason: "expected_email_match" };
+    }
+    return {
+      action: "reject",
+      reason: "expected_email_mismatch",
+      message: `Pairing refused: this machine was approved by ${approvedByEmail}, but ${expectEmail} was expected. The machine token was NOT stored. If you did not expect that account to approve it, open BirdyBeep and revoke the machine, then re-run \`birdybeep pair\`.`
+    };
+  }
+  if (input.yes) return { action: "approve", reason: "yes_flag" };
+  const question = approvedByEmail !== void 0 ? `Pair this machine to ${approvedByEmail}? [y/N] ` : "The server did not report which account approved this machine. Pair anyway? [y/N] ";
+  if (!input.nonInteractive) {
+    if (input.stdinIsTTY) return { action: "prompt", question, on: "stdin" };
+    if (input.controllingTerminalAvailable) {
+      return { action: "prompt", question, on: "controlling-terminal" };
+    }
+  }
+  const who = approvedByEmail !== void 0 ? ` (approved by ${approvedByEmail})` : "";
+  const winptyHint = platform === "win32" && !input.nonInteractive ? " In Git Bash / MSYS, `winpty birdybeep pair` attaches a real console so the prompt can appear." : "";
+  return {
+    action: "reject",
+    reason: "non_interactive",
+    message: `Pairing needs confirmation${who}, but there is no terminal to ask on, so the machine token was NOT stored. Re-run with \`--expect-email <addr>\` to pin the approving account (recommended for CI), or \`--yes\` to accept whichever account approved it.` + winptyHint
+  };
+}
+function isAffirmative(answer) {
+  return /^(y|yes)$/i.test(answer.trim());
+}
+function controllingTerminalPath() {
+  return "/dev/tty";
+}
+function canOpenControllingTerminal(path = controllingTerminalPath(), platform = process.platform) {
+  if (platform === "win32") return false;
+  let fd;
+  try {
+    fd = openSync2(path, "r");
+    return true;
+  } catch {
+    return false;
+  } finally {
+    if (fd !== void 0) {
+      try {
+        closeSync2(fd);
+      } catch {
+      }
+    }
+  }
+}
+async function promptForAnswer(question, on) {
+  const { createInterface } = await import("readline/promises");
+  let ttyFd;
+  let input;
+  if (on === "stdin") {
+    input = process.stdin;
+  } else {
+    const { ReadStream } = await import("tty");
+    ttyFd = openSync2(controllingTerminalPath(), "r");
+    input = new ReadStream(ttyFd);
+  }
+  return new Promise((resolve) => {
+    const rl = createInterface({ input, output: process.stderr });
+    let settled = false;
+    const done = (value) => {
+      if (settled) return;
+      settled = true;
+      rl.close();
+      if (on === "stdin") {
+        process.stdin.unref?.();
+      } else {
+        try {
+          input.unref?.();
+          input.destroy?.();
+        } catch {
+        }
+        if (ttyFd !== void 0) {
+          try {
+            closeSync2(ttyFd);
+          } catch {
+          }
+        }
+      }
+      resolve(value);
+    };
+    rl.question(question).then(done, () => done(""));
+    rl.once("close", () => done(""));
+    input.once?.("error", () => done(""));
+  });
+}
 function createPairCommand(deps = {}) {
   const fetchImpl = deps.fetchImpl ?? fetch;
   const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
   const clock = deps.now ?? (() => Date.now());
   const renderQr = deps.renderQr ?? renderQrMatrix;
   const intervalMs = deps.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
+  const promptLine = deps.promptLine ?? promptForAnswer;
+  const hasControllingTerminal = deps.hasControllingTerminal ?? (() => canOpenControllingTerminal());
+  const configuredExpectEmail = deps.configuredExpectEmail ?? (() => {
+    const pinned = readCliConfig().expectEmail;
+    return typeof pinned === "string" && pinned.trim().length > 0 ? pinned : void 0;
+  });
   return {
     name: "pair",
     summary: "Pair this machine with your BirdyBeep account (QR or manual)",
-    usage: "birdybeep pair [--json]",
+    usage: "birdybeep pair [--yes] [--expect-email <addr>] [--json]",
+    options: [
+      {
+        flag: "--yes",
+        aliases: ["-y"],
+        summary: "Skip the approving-account confirmation (headless/CI)"
+      },
+      {
+        flag: "--expect-email",
+        value: "<addr>",
+        summary: "Only trust the pairing if this account approved it (else fail)"
+      }
+    ],
     run: async (ctx) => {
+      const pairFlags = parsePairFlags(ctx.args);
+      if (pairFlags.error !== void 0) {
+        ctx.io.errline(`birdybeep pair: ${pairFlags.error}.`);
+        return EXIT.USAGE;
+      }
       const apiUrl = resolveApiUrl();
       const identity = getMachineIdentity2();
+      const codeVerifier = generateCodeVerifier();
+      const codeChallenge = deriveCodeChallengeS256(codeVerifier);
       const start = await pairStart(
         apiUrl,
-        { machineLabel: identity.label, os: identity.os, cliVersion: CLI_VERSION },
+        { machineLabel: identity.label, os: identity.os, cliVersion: CLI_VERSION, codeChallenge },
         fetchImpl
       );
       if (ctx.flags.json) {
@@ -687,12 +1012,14 @@ function createPairCommand(deps = {}) {
         });
       } else {
         ctx.io.line(
-          "To pair this machine, open the BirdyBeep app, tap \u201Cpair a machine\u201D, and scan this QR (or enter the code):"
+          "To pair this machine, open the BirdyBeep app, tap \u201Cpair a machine\u201D, and scan this QR or open the complete link:"
         );
         const isTTY = deps.isTTY ?? process.stdout.isTTY === true;
         if (isTTY) ctx.io.line(renderQr(start.qr_payload));
         ctx.io.line(`   Scan or open:  ${start.qr_payload}`);
-        ctx.io.line(`   Code:  ${start.user_code}`);
+        ctx.io.line(
+          `   Session code (display only; cannot approve by itself):  ${start.user_code}`
+        );
         ctx.io.line("Waiting for you to approve this machine in the app\u2026");
       }
       const deadline = Date.parse(start.expires_at);
@@ -708,7 +1035,9 @@ function createPairCommand(deps = {}) {
           apiUrl,
           start.device_code,
           fetchImpl,
-          identity.fingerprintHash
+          identity.fingerprintHash,
+          codeVerifier
+          // PKCE proof-of-possession (dgxd) — sent on every poll
         );
         if (poll.status === "paired") {
           paired = poll;
@@ -733,15 +1062,44 @@ function createPairCommand(deps = {}) {
       if (paired === void 0 || paired.status !== "paired") {
         ctx.io.result({ paired: false, reason: "timeout" });
         ctx.io.errline(
-          "Pairing timed out before you approved it. In the BirdyBeep app, tap \u201Cpair a machine\u201D, scan the QR (or enter the code), then run `birdybeep pair` again."
+          "Pairing timed out before you approved it. In the BirdyBeep app, tap \u201Cpair a machine\u201D, scan a fresh QR or open its complete link, then run `birdybeep pair` again."
+        );
+        return EXIT.ERROR;
+      }
+      const approvedBy = paired.approvedByEmail;
+      const expectEmail = pairFlags.expectEmail ?? configuredExpectEmail();
+      const stdinIsTTY = deps.isStdinTTY ?? process.stdin.isTTY === true;
+      const decision = decidePairConfirmation({
+        ...approvedBy !== void 0 ? { approvedByEmail: approvedBy } : {},
+        ...expectEmail !== void 0 ? { expectEmail } : {},
+        ...expectEmail !== void 0 ? { expectEmailSource: pairFlags.expectEmail !== void 0 ? "flag" : "config" } : {},
+        yes: pairFlags.yes,
+        nonInteractive: ctx.flags.nonInteractive,
+        stdinIsTTY,
+        // Probed ONLY when stdin can't answer — opening /dev/tty is a syscall, and when stdin is
+        // already a terminal the answer is irrelevant.
+        controllingTerminalAvailable: stdinIsTTY ? false : hasControllingTerminal(),
+        configPath: cliConfigPath()
+      });
+      if (decision.action === "reject") {
+        ctx.io.result({ paired: false, reason: decision.reason });
+        ctx.io.errline(decision.message);
+        return EXIT.ERROR;
+      }
+      if (decision.action === "prompt" && !isAffirmative(await promptLine(decision.question, decision.on))) {
+        ctx.io.result({ paired: false, reason: "declined" });
+        ctx.io.errline(
+          "Pairing declined \u2014 the machine token was NOT stored, and this machine will send no events. The machine may still appear in the BirdyBeep app; revoke it there if you did not intend to pair it."
         );
         return EXIT.ERROR;
       }
       await setToken(paired.machineToken, deps.tokenOptions ?? {});
       writeCliConfig({ apiUrl });
-      ctx.io.emit(`\u2713 Paired. Run \`birdybeep test\` to send a test Beep.`, {
+      const humanSuffix = approvedBy !== void 0 ? ` to ${approvedBy}` : "";
+      ctx.io.emit(`\u2713 Paired${humanSuffix}. Run \`birdybeep test\` to send a test Beep.`, {
         paired: true,
-        machineId: paired.machineId
+        machineId: paired.machineId,
+        ...approvedBy !== void 0 ? { approvedByEmail: approvedBy } : {}
       });
       return EXIT.OK;
     }
@@ -773,19 +1131,29 @@ function createQueueCommand() {
 // src/commands/report-status.ts
 import {
   errorEnvelopeSchema as errorEnvelopeSchema2,
-  getToken as getToken2,
+  getToken as getToken3,
   integrationStatusResponseSchema
 } from "@birdybeep/agent-core";
 import { CLAUDE_CODE_ADAPTER_VERSION, claudeCodeAdapter as claudeCodeAdapter3 } from "@birdybeep/claude-code";
 import { CODEX_ADAPTER_VERSION, codexAdapter as codexAdapter3 } from "@birdybeep/codex";
+import { COPILOT_ADAPTER_VERSION, copilotAdapter as copilotAdapter3 } from "@birdybeep/copilot";
+import { CURSOR_ADAPTER_VERSION, cursorAdapter as cursorAdapter3 } from "@birdybeep/cursor";
 import { OPENCODE_ADAPTER_VERSION, opencodeAdapter as opencodeAdapter3 } from "@birdybeep/opencode";
-var DEFAULT_ADAPTERS3 = [claudeCodeAdapter3, codexAdapter3, opencodeAdapter3];
+var DEFAULT_ADAPTERS3 = [
+  claudeCodeAdapter3,
+  codexAdapter3,
+  opencodeAdapter3,
+  cursorAdapter3,
+  copilotAdapter3
+];
 var ADAPTER_VERSIONS = {
   claude_code: CLAUDE_CODE_ADAPTER_VERSION,
   codex: CODEX_ADAPTER_VERSION,
-  opencode: OPENCODE_ADAPTER_VERSION
+  opencode: OPENCODE_ADAPTER_VERSION,
+  cursor: CURSOR_ADAPTER_VERSION,
+  copilot: COPILOT_ADAPTER_VERSION
 };
-var base2 = (apiUrl) => apiUrl.replace(/\/$/, "");
+var base3 = (apiUrl) => apiUrl.replace(/\/$/, "");
 async function gatherItems(adapters) {
   return Promise.all(
     adapters.map(async (a) => {
@@ -806,7 +1174,7 @@ function createReportStatusCommand(deps = {}) {
     summary: "Internal: report integration status to the backend",
     usage: "birdybeep report-status [--json]",
     run: async (ctx) => {
-      const token = await getToken2(deps.tokenOptions ?? {});
+      const token = await getToken3(deps.tokenOptions ?? {});
       if (token === null) {
         ctx.io.errline("No machine token \u2014 run `birdybeep pair` first.");
         return EXIT.ERROR;
@@ -820,7 +1188,7 @@ function createReportStatusCommand(deps = {}) {
       let outcome = "deferred";
       let errorCode;
       try {
-        const res = await fetchImpl(`${base2(resolveApiUrl())}/v1/integrations/status`, {
+        const res = await fetchImpl(`${base3(resolveApiUrl())}/v1/integrations/status`, {
           method: "POST",
           headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
           body: JSON.stringify({ integrations: items })
@@ -873,8 +1241,16 @@ import {
 } from "@birdybeep/agent-core";
 import { claudeCodeAdapter as claudeCodeAdapter4 } from "@birdybeep/claude-code";
 import { codexAdapter as codexAdapter4 } from "@birdybeep/codex";
+import { copilotAdapter as copilotAdapter4 } from "@birdybeep/copilot";
+import { cursorAdapter as cursorAdapter4 } from "@birdybeep/cursor";
 import { opencodeAdapter as opencodeAdapter4 } from "@birdybeep/opencode";
-var DEFAULT_ADAPTERS4 = [claudeCodeAdapter4, codexAdapter4, opencodeAdapter4];
+var DEFAULT_ADAPTERS4 = [
+  claudeCodeAdapter4,
+  codexAdapter4,
+  opencodeAdapter4,
+  cursorAdapter4,
+  copilotAdapter4
+];
 function createStatusCommand(deps = {}) {
   const adapters = deps.adapters ?? DEFAULT_ADAPTERS4;
   const makeSender = deps.createSender ?? ((baseUrl) => defaultCreateSender3(
@@ -1000,8 +1376,8 @@ function buildCommands() {
 }
 
 // src/update-check.ts
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
-import { join as join2 } from "path";
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync2, writeFileSync as writeFileSync3 } from "fs";
+import { join as join3 } from "path";
 import { birdyBeepConfigDir as birdyBeepConfigDir3 } from "@birdybeep/agent-core";
 var PACKAGE_NAME = "@birdybeep/cli";
 var PACKAGE_PATH = "@birdybeep%2Fcli";
@@ -1056,7 +1432,7 @@ function isNewer(current, latest) {
   return cur !== null && lat !== null && compareSemver(cur, lat) < 0;
 }
 function updateCachePath() {
-  return join2(birdyBeepConfigDir3(), UPDATE_CACHE_FILE);
+  return join3(birdyBeepConfigDir3(), UPDATE_CACHE_FILE);
 }
 function readUpdateCache() {
   try {
@@ -1072,7 +1448,7 @@ function readUpdateCache() {
 }
 function writeUpdateCache(cache) {
   mkdirSync3(birdyBeepConfigDir3(), { recursive: true, mode: 448 });
-  writeFileSync2(updateCachePath(), `${JSON.stringify(cache)}
+  writeFileSync3(updateCachePath(), `${JSON.stringify(cache)}
 `, { mode: 384 });
 }
 async function fetchLatestVersion(registryUrl, fetchImpl, timeoutMs) {
@@ -1160,4 +1536,4 @@ export {
   buildCommands,
   runCli
 };
-//# sourceMappingURL=chunk-OCS5IDYI.js.map
+//# sourceMappingURL=chunk-U4EIHC5C.js.map