@birdybeep/cli 0.2.0 → 0.3.0

package/dist/index.cjs

@@ -1,7 +1,9 @@
 "use strict";
+var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -15,6 +17,14 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/index.ts
@@ -35,6 +45,8 @@ module.exports = __toCommonJS(index_exports);
 // src/commands/agent.ts
 var import_claude_code = require("@birdybeep/claude-code");
 var import_codex = require("@birdybeep/codex");
+var import_copilot = require("@birdybeep/copilot");
+var import_cursor = require("@birdybeep/cursor");
 var import_opencode = require("@birdybeep/opencode");
 
 // src/framework.ts
@@ -108,8 +120,11 @@ function parseGlobalFlags(argv) {
   }
   return { flags, rest };
 }
-function isUnknownFlag(token) {
-  return token.startsWith("-") && !GLOBAL_FLAG_TOKENS.has(token);
+function isUnknownFlag(token, allowed) {
+  if (!token.startsWith("-")) return false;
+  if (GLOBAL_FLAG_TOKENS.has(token)) return false;
+  const eq = token.indexOf("=");
+  return !allowed.has(eq >= 0 ? token.slice(0, eq) : token);
 }
 function renderRootHelp(version, commands) {
   const width = Math.max(...commands.map((c) => c.name.length));
@@ -130,6 +145,16 @@ function renderRootHelp(version, commands) {
     "  -v, --version       Show the CLI version"
   ].join("\n");
 }
+function commandFlagTokens(...commands) {
+  const tokens = /* @__PURE__ */ new Set();
+  for (const command of commands) {
+    for (const option of command?.options ?? []) {
+      tokens.add(option.flag);
+      for (const alias of option.aliases ?? []) tokens.add(alias);
+    }
+  }
+  return tokens;
+}
 function renderCommandHelp(path, command) {
   const lines = [
     `birdybeep ${path} \u2014 ${command.summary}`,
@@ -137,6 +162,17 @@ function renderCommandHelp(path, command) {
     "Usage:",
     `  ${command.usage ?? `birdybeep ${path} [options]`}`
   ];
+  if (command.options && command.options.length > 0) {
+    const labels = command.options.map(
+      (o) => `${[o.flag, ...o.aliases ?? []].join(", ")}${o.value ? ` ${o.value}` : ""}`
+    );
+    const width = Math.max(...labels.map((l) => l.length));
+    lines.push(
+      "",
+      "Options:",
+      ...command.options.map((o, i) => `  ${labels[i]?.padEnd(width)}  ${o.summary}`)
+    );
+  }
   if (command.subcommands && command.subcommands.length > 0) {
     const width = Math.max(...command.subcommands.map((c) => c.name.length));
     lines.push(
@@ -161,6 +197,7 @@ async function dispatch(argv, deps) {
     return EXIT.OK;
   }
   let command = deps.commands.find((c) => c.name === rest[0]);
+  let parent;
   const pathParts = [];
   let argsStart = 1;
   if (command) {
@@ -168,6 +205,7 @@ async function dispatch(argv, deps) {
     if (command.subcommands && command.subcommands.length > 0) {
       const sub = command.subcommands.find((c) => c.name === rest[1]);
       if (sub) {
+        parent = command;
         command = sub;
         pathParts.push(sub.name);
         argsStart = 2;
@@ -191,6 +229,7 @@ async function dispatch(argv, deps) {
       name: path,
       summary: command.summary,
       usage: command.usage,
+      options: command.options,
       subcommands: command.subcommands?.map((c) => ({ name: c.name, summary: c.summary }))
     });
     return EXIT.OK;
@@ -200,7 +239,8 @@ async function dispatch(argv, deps) {
     return EXIT.USAGE;
   }
   const args = rest.slice(argsStart);
-  const unknown = args.find(isUnknownFlag);
+  const allowed = commandFlagTokens(command, parent);
+  const unknown = args.find((token) => isUnknownFlag(token, allowed));
   if (unknown !== void 0) {
     io.errline(`birdybeep ${path}: unknown option "${unknown}".`);
     return EXIT.USAGE;
@@ -228,13 +268,28 @@ async function dispatch(argv, deps) {
 }
 
 // src/commands/agent.ts
-var DEFAULT_ADAPTERS = [import_claude_code.claudeCodeAdapter, import_codex.codexAdapter, import_opencode.opencodeAdapter];
+var DEFAULT_ADAPTERS = [
+  import_claude_code.claudeCodeAdapter,
+  import_codex.codexAdapter,
+  import_opencode.opencodeAdapter,
+  import_cursor.cursorAdapter,
+  import_copilot.copilotAdapter
+];
 var TARGET_TO_ID = {
   claude: "claude_code",
   codex: "codex",
-  opencode: "opencode"
+  opencode: "opencode",
+  cursor: "cursor",
+  copilot: "copilot"
 };
-var AGENT_TARGETS = ["all", "claude", "codex", "opencode"];
+var AGENT_TARGETS = [
+  "all",
+  "claude",
+  "codex",
+  "opencode",
+  "cursor",
+  "copilot"
+];
 function selectAdapters(target, adapters) {
   if (target === "all") return adapters;
   const id = TARGET_TO_ID[target];
@@ -325,18 +380,18 @@ function createAgentCommand(deps = {}) {
   return {
     name: "agent",
     summary: "Install or uninstall harness adapters",
-    usage: "birdybeep agent <install|uninstall> [all|claude|codex|opencode]",
+    usage: "birdybeep agent <install|uninstall> [all|claude|codex|opencode|cursor|copilot]",
     subcommands: [
       {
         name: "install",
-        summary: "Install adapters (all | claude | codex | opencode)",
-        usage: "birdybeep agent install [all|claude|codex|opencode]",
+        summary: "Install adapters (all | claude | codex | opencode | cursor | copilot)",
+        usage: "birdybeep agent install [all|claude|codex|opencode|cursor|copilot]",
         run: (ctx) => installSelected(adapters, ctx)
       },
       {
         name: "uninstall",
         summary: "Restore harness config to its pre-install state",
-        usage: "birdybeep agent uninstall [all|claude|codex|opencode]",
+        usage: "birdybeep agent uninstall [all|claude|codex|opencode|cursor|copilot]",
         run: (ctx) => uninstallSelected(adapters, ctx)
       }
     ]
@@ -347,6 +402,8 @@ function createAgentCommand(deps = {}) {
 var import_agent_core4 = require("@birdybeep/agent-core");
 var import_claude_code2 = require("@birdybeep/claude-code");
 var import_codex2 = require("@birdybeep/codex");
+var import_copilot2 = require("@birdybeep/copilot");
+var import_cursor2 = require("@birdybeep/cursor");
 var import_opencode2 = require("@birdybeep/opencode");
 
 // src/config.ts
@@ -371,6 +428,8 @@ function writeCliConfig(patch) {
   const merged = {};
   const apiUrl = patch.apiUrl ?? current.apiUrl;
   if (apiUrl !== void 0) merged.apiUrl = apiUrl;
+  const expectEmail = patch.expectEmail ?? current.expectEmail;
+  if (expectEmail !== void 0) merged.expectEmail = expectEmail;
   (0, import_node_fs2.mkdirSync)((0, import_agent_core2.birdyBeepConfigDir)(), { recursive: true, mode: 448 });
   (0, import_node_fs2.writeFileSync)(cliConfigPath(), `${JSON.stringify(merged, null, 2)}
 `, { mode: 384 });
@@ -409,7 +468,13 @@ function machineIdentity() {
 }
 
 // src/commands/doctor.ts
-var DEFAULT_ADAPTERS2 = [import_claude_code2.claudeCodeAdapter, import_codex2.codexAdapter, import_opencode2.opencodeAdapter];
+var DEFAULT_ADAPTERS2 = [
+  import_claude_code2.claudeCodeAdapter,
+  import_codex2.codexAdapter,
+  import_opencode2.opencodeAdapter,
+  import_cursor2.cursorAdapter,
+  import_copilot2.copilotAdapter
+];
 async function defaultProbeNetwork(baseUrl) {
   try {
     const controller = new AbortController();
@@ -492,16 +557,30 @@ function createDoctorCommand(deps = {}) {
 }
 
 // src/commands/hook.ts
+var import_node_child_process = require("child_process");
+var import_node_crypto = require("crypto");
+var import_node_fs3 = require("fs");
+var import_node_os = require("os");
+var import_node_path2 = require("path");
 var import_agent_core5 = require("@birdybeep/agent-core");
 var import_claude_code3 = require("@birdybeep/claude-code");
 var import_codex3 = require("@birdybeep/codex");
+var import_copilot3 = require("@birdybeep/copilot");
+var import_cursor3 = require("@birdybeep/cursor");
 var import_opencode3 = require("@birdybeep/opencode");
 var RUNNERS = {
   claude: import_claude_code3.runClaudeHook,
   codex: import_codex3.runCodexHook,
-  opencode: import_opencode3.runOpenCodeHook
+  opencode: import_opencode3.runOpenCodeHook,
+  cursor: import_cursor3.runCursorHook
 };
-var HOOK_HARNESSES = ["claude", "codex", "opencode"];
+var HOOK_HARNESSES = [
+  "claude",
+  "codex",
+  "opencode",
+  "cursor",
+  "copilot"
+];
 var STDIN_READ_TIMEOUT_MS = 3e3;
 function withTimeout(promise, ms, fallback) {
   return new Promise((resolve) => {
@@ -518,9 +597,13 @@ function withTimeout(promise, ms, fallback) {
   });
 }
 function isHarnessName(value) {
-  return value === "claude" || value === "codex" || value === "opencode";
+  return value === "claude" || value === "codex" || value === "opencode" || value === "cursor" || value === "copilot";
 }
-function runHookCommand(harness, payload, sender) {
+function runHookCommand(harness, payload, sender, copilotEventName) {
+  if (harness === "copilot") {
+    if (copilotEventName === void 0) return Promise.resolve({ outcome: "skipped" });
+    return (0, import_copilot3.runCopilotHook)(copilotEventName, payload, { sender });
+  }
   return RUNNERS[harness](payload, { sender });
 }
 function readStdinDefault() {
@@ -536,24 +619,90 @@ function readStdinDefault() {
     process.stdin.on("error", () => resolve(""));
   });
 }
-async function readHookPayload(args, readStdin) {
-  return args[1] ?? await readStdin();
+async function readHookPayload(args, readStdin, stdinOnly = false) {
+  return stdinOnly ? readStdin() : args[1] ?? await readStdin();
+}
+var NOTIFY_STDIN_FILE_ENV = "BIRDYBEEP_CODEX_NOTIFY_STDIN_FILE";
+function detachCodexNotifyWorker(payload) {
+  if (process.platform === "win32") return false;
+  let file;
+  let fd;
+  try {
+    const birdybeep = (0, import_agent_core5.resolveOnPath)("birdybeep");
+    if (birdybeep === null) return false;
+    const tmpFile = (0, import_node_path2.join)((0, import_node_os.tmpdir)(), `birdybeep-notify-${(0, import_node_crypto.randomBytes)(16).toString("hex")}.json`);
+    file = tmpFile;
+    (0, import_node_fs3.writeFileSync)(tmpFile, payload, { mode: 384 });
+    fd = (0, import_node_fs3.openSync)(tmpFile, "r");
+    const child = (0, import_node_child_process.spawn)(birdybeep, ["hook", "codex"], {
+      cwd: (0, import_node_path2.dirname)(birdybeep),
+      // trusted dir, never the inherited/attacker cwd
+      detached: true,
+      // new session (setsid) → survives `codex exec` reaping the group
+      stdio: [fd, "ignore", "ignore"],
+      // stdin = the temp file; this process holds no pipe
+      env: { ...process.env, [NOTIFY_STDIN_FILE_ENV]: tmpFile },
+      // worker cleans it up post-read
+      windowsHide: true
+    });
+    child.on("error", () => {
+      try {
+        (0, import_node_fs3.rmSync)(tmpFile, { force: true });
+      } catch {
+      }
+    });
+    child.unref();
+    return true;
+  } catch {
+    if (file !== void 0) {
+      try {
+        (0, import_node_fs3.rmSync)(file, { force: true });
+      } catch {
+      }
+    }
+    return false;
+  } finally {
+    if (fd !== void 0) {
+      try {
+        (0, import_node_fs3.closeSync)(fd);
+      } catch {
+      }
+    }
+  }
 }
 function createHookCommand(deps = {}) {
   const makeSender = deps.createSender ?? ((baseUrl) => (0, import_agent_core5.createSender)({ baseUrl }));
   const readStdin = deps.readStdin ?? readStdinDefault;
   const stdinTimeoutMs = deps.stdinTimeoutMs ?? STDIN_READ_TIMEOUT_MS;
+  const detachCodexNotify = deps.detachCodexNotify ?? detachCodexNotifyWorker;
   return {
     name: "hook",
     summary: "Internal: normalize + send an event fired by a harness hook",
-    usage: "birdybeep hook <claude|codex|opencode>",
+    usage: "birdybeep hook <claude|codex|opencode|cursor|copilot> [copilot-event]",
     run: async (ctx) => {
       const harness = ctx.args[0];
       if (!isHarnessName(harness)) {
         ctx.io.errline(`birdybeep hook: expected one of ${HOOK_HARNESSES.join("|")}`);
         return EXIT.USAGE;
       }
-      const raw = await withTimeout(readHookPayload(ctx.args, readStdin), stdinTimeoutMs, "");
+      const notifyPayload = ctx.args[1];
+      if (harness === "codex" && notifyPayload !== void 0 && notifyPayload.length > 0 && detachCodexNotify(notifyPayload)) {
+        ctx.io.result({ harness, outcome: "detached" });
+        return EXIT.OK;
+      }
+      const copilotEventName = harness === "copilot" && (0, import_copilot3.isCopilotHookEventName)(ctx.args[1]) ? ctx.args[1] : void 0;
+      const raw = await withTimeout(
+        readHookPayload(ctx.args, readStdin, harness === "copilot"),
+        stdinTimeoutMs,
+        ""
+      );
+      const notifyStdinFile = process.env[NOTIFY_STDIN_FILE_ENV];
+      if (notifyStdinFile !== void 0 && (0, import_node_path2.dirname)(notifyStdinFile) === (0, import_node_os.tmpdir)() && (0, import_node_path2.basename)(notifyStdinFile).startsWith("birdybeep-notify-")) {
+        try {
+          (0, import_node_fs3.rmSync)(notifyStdinFile, { force: true });
+        } catch {
+        }
+      }
       let payload;
       try {
         payload = JSON.parse(raw);
@@ -562,8 +711,15 @@ function createHookCommand(deps = {}) {
         return EXIT.OK;
       }
       const sender = makeSender(resolveApiUrl());
-      const result = await runHookCommand(harness, payload, sender);
-      ctx.io.result({ harness, outcome: result.outcome, eventType: result.eventType });
+      const result = await runHookCommand(harness, payload, sender, copilotEventName);
+      ctx.io.result({
+        harness,
+        ...copilotEventName !== void 0 ? { event: copilotEventName } : {},
+        outcome: result.outcome,
+        eventType: result.eventType,
+        ...result.send?.decision ? { decision: result.send.decision } : {},
+        ...result.send?.status !== void 0 ? { status: result.send.status } : {}
+      });
       return EXIT.OK;
     }
   };
@@ -571,57 +727,73 @@ function createHookCommand(deps = {}) {
 
 // src/commands/logout.ts
 var import_agent_core6 = require("@birdybeep/agent-core");
-function createClearTokenCommand(spec, deps = {}) {
+var base = (apiUrl) => apiUrl.replace(/\/$/, "");
+function createLogoutCommand(deps = {}) {
   return {
-    name: spec.name,
-    summary: spec.summary,
-    usage: `birdybeep ${spec.name}`,
+    name: "logout",
+    summary: "Remove the local machine token (does NOT revoke the machine server-side)",
+    usage: "birdybeep logout",
     run: async (ctx) => {
       await (0, import_agent_core6.clearToken)(deps.tokenOptions ?? {});
-      ctx.io.emit(spec.humanMessage, { [spec.jsonKey]: true });
+      ctx.io.emit("Logged out \u2014 the machine token was removed.", { loggedOut: true });
       return EXIT.OK;
     }
   };
 }
-function createLogoutCommand(deps = {}) {
-  return createClearTokenCommand(
-    {
-      name: "logout",
-      summary: "Remove the local machine token (same as `unpair`)",
-      humanMessage: "Logged out \u2014 the machine token was removed.",
-      jsonKey: "loggedOut"
-    },
-    deps
-  );
+async function revokeSelf(token, fetchImpl, timeoutMs) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const res = await fetchImpl(`${base(resolveApiUrl())}/v1/machine/revoke-self`, {
+      method: "POST",
+      headers: { authorization: `Bearer ${token}` },
+      signal: controller.signal
+    });
+    if (res.ok || res.status === 403) return "revoked";
+    return "rejected";
+  } catch {
+    return "unreachable";
+  } finally {
+    clearTimeout(timer);
+  }
 }
 function createUnpairCommand(deps = {}) {
-  return createClearTokenCommand(
-    {
-      name: "unpair",
-      summary: "Unpair this machine \u2014 remove the local machine token (same as `logout`)",
-      humanMessage: "Unpaired \u2014 the machine token was removed.",
-      jsonKey: "unpaired"
-    },
-    deps
-  );
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const timeoutMs = deps.timeoutMs ?? 1e4;
+  return {
+    name: "unpair",
+    summary: "Unpair this machine \u2014 revoke it server-side and remove the local token",
+    usage: "birdybeep unpair",
+    run: async (ctx) => {
+      const token = await (0, import_agent_core6.getToken)(deps.tokenOptions ?? {});
+      const outcome = token === null ? "no_token" : await revokeSelf(token, fetchImpl, timeoutMs);
+      await (0, import_agent_core6.clearToken)(deps.tokenOptions ?? {});
+      const serverRevoked = outcome === "revoked";
+      const human = outcome === "revoked" ? "Unpaired \u2014 the machine was revoked and removed from your account." : outcome === "no_token" ? "Already unpaired \u2014 there was no local token to remove." : outcome === "unreachable" ? "Unpaired locally, but the server was unreachable \u2014 the machine may still show in the app. Open BirdyBeep and revoke it there to fully remove it." : "Unpaired locally, but the server didn't confirm removal \u2014 if the machine still shows in the app, revoke it there.";
+      ctx.io.emit(human, { unpaired: true, serverRevoked });
+      return EXIT.OK;
+    }
+  };
 }
 
 // src/commands/pair.ts
+var import_node_fs4 = require("fs");
 var import_agent_core8 = require("@birdybeep/agent-core");
 var import_uqr = require("uqr");
 
 // src/pairing.ts
 var import_agent_core7 = require("@birdybeep/agent-core");
-function base(apiUrl) {
+function base2(apiUrl) {
   return apiUrl.replace(/\/$/, "");
 }
 async function pairStart(apiUrl, input, fetchImpl) {
   const body = {
     machine_label: input.machineLabel,
     ...input.os !== void 0 ? { os: input.os } : {},
-    ...input.cliVersion !== void 0 ? { cli_version: input.cliVersion } : {}
+    ...input.cliVersion !== void 0 ? { cli_version: input.cliVersion } : {},
+    ...input.codeChallenge !== void 0 ? { code_challenge: input.codeChallenge } : {}
   };
-  const res = await fetchImpl(`${base(apiUrl)}/v1/pair/start`, {
+  const res = await fetchImpl(`${base2(apiUrl)}/v1/pair/start`, {
     method: "POST",
     headers: { "content-type": "application/json" },
     body: JSON.stringify(body)
@@ -639,12 +811,13 @@ var TERMINAL_TOKEN_ERRORS = /* @__PURE__ */ new Set([
   "not_found",
   "payload_too_large"
 ]);
-async function pairTokenPoll(apiUrl, deviceCode, fetchImpl, machineFingerprint) {
+async function pairTokenPoll(apiUrl, deviceCode, fetchImpl, machineFingerprint, codeVerifier) {
   const body = {
     device_code: deviceCode,
-    ...machineFingerprint !== void 0 ? { machine_fingerprint: machineFingerprint } : {}
+    ...machineFingerprint !== void 0 ? { machine_fingerprint: machineFingerprint } : {},
+    ...codeVerifier !== void 0 ? { code_verifier: codeVerifier } : {}
   };
-  const res = await fetchImpl(`${base(apiUrl)}/v1/pair/token`, {
+  const res = await fetchImpl(`${base2(apiUrl)}/v1/pair/token`, {
     method: "POST",
     headers: { "content-type": "application/json" },
     body: JSON.stringify(body)
@@ -655,7 +828,10 @@ async function pairTokenPoll(apiUrl, deviceCode, fetchImpl, machineFingerprint)
     return {
       status: "paired",
       machineToken: parsed.data.machine_token,
-      machineId: parsed.data.machine_id
+      machineId: parsed.data.machine_id,
+      // Only surface the key when the server reported it (exactOptionalPropertyTypes: no explicit
+      // undefined). Older servers omit approved_by_email; newer ones (dgxd) include it.
+      ...parsed.data.approved_by_email !== void 0 ? { approvedByEmail: parsed.data.approved_by_email } : {}
     };
   }
   let errBody = null;
@@ -676,7 +852,7 @@ async function pairTokenPoll(apiUrl, deviceCode, fetchImpl, machineFingerprint)
 }
 
 // src/version.ts
-var CLI_VERSION = "0.2.0".length > 0 ? "0.2.0" : "0.0.0";
+var CLI_VERSION = "0.3.0".length > 0 ? "0.3.0" : "0.0.0";
 
 // src/commands/pair.ts
 var DEFAULT_POLL_INTERVAL_MS = 2e3;
@@ -684,22 +860,172 @@ var HEARTBEAT_MS = 15e3;
 function renderQrMatrix(qrPayload) {
   return (0, import_uqr.renderUnicodeCompact)(qrPayload, { border: 2 });
 }
+function parsePairFlags(args) {
+  const flags = { yes: false };
+  for (let i = 0; i < args.length; i += 1) {
+    const token = args[i] ?? "";
+    if (token === "--yes" || token === "-y") {
+      flags.yes = true;
+    } else if (token === "--expect-email" || token.startsWith("--expect-email=")) {
+      const inline = token.startsWith("--expect-email=") ? token.slice("--expect-email=".length) : void 0;
+      const value = inline ?? args[++i];
+      if (value === void 0 || value.length === 0 || value.startsWith("-")) {
+        return { ...flags, error: "--expect-email requires an email address" };
+      }
+      flags.expectEmail = value;
+    } else {
+      return { ...flags, error: `unexpected argument "${token}"` };
+    }
+  }
+  return flags;
+}
+function sameEmail(a, b) {
+  const fold = (v) => v.trim().toLowerCase();
+  const rawEqual = fold(a) === fold(b);
+  const nfkcEqual = fold(a.normalize("NFKC")) === fold(b.normalize("NFKC"));
+  return rawEqual && nfkcEqual;
+}
+function decidePairConfirmation(input) {
+  const { approvedByEmail, expectEmail } = input;
+  const platform = input.platform ?? process.platform;
+  if (expectEmail !== void 0) {
+    if (approvedByEmail === void 0) {
+      const remedy = input.expectEmailSource === "config" ? `Remove or correct the "expectEmail" key in ${input.configPath ?? "the BirdyBeep CLI config"} (or upgrade the backend to one that reports the approving account) and re-run.` : "Re-run without --expect-email (and confirm interactively) if that is expected.";
+      return {
+        action: "reject",
+        reason: "expected_email_unverifiable",
+        message: `Pairing refused: ${expectEmail} was pinned as the expected approving account, but the server did not report which account approved this machine, so the pin could not be verified. The machine token was NOT stored. ${remedy}`
+      };
+    }
+    if (sameEmail(approvedByEmail, expectEmail)) {
+      return { action: "approve", reason: "expected_email_match" };
+    }
+    return {
+      action: "reject",
+      reason: "expected_email_mismatch",
+      message: `Pairing refused: this machine was approved by ${approvedByEmail}, but ${expectEmail} was expected. The machine token was NOT stored. If you did not expect that account to approve it, open BirdyBeep and revoke the machine, then re-run \`birdybeep pair\`.`
+    };
+  }
+  if (input.yes) return { action: "approve", reason: "yes_flag" };
+  const question = approvedByEmail !== void 0 ? `Pair this machine to ${approvedByEmail}? [y/N] ` : "The server did not report which account approved this machine. Pair anyway? [y/N] ";
+  if (!input.nonInteractive) {
+    if (input.stdinIsTTY) return { action: "prompt", question, on: "stdin" };
+    if (input.controllingTerminalAvailable) {
+      return { action: "prompt", question, on: "controlling-terminal" };
+    }
+  }
+  const who = approvedByEmail !== void 0 ? ` (approved by ${approvedByEmail})` : "";
+  const winptyHint = platform === "win32" && !input.nonInteractive ? " In Git Bash / MSYS, `winpty birdybeep pair` attaches a real console so the prompt can appear." : "";
+  return {
+    action: "reject",
+    reason: "non_interactive",
+    message: `Pairing needs confirmation${who}, but there is no terminal to ask on, so the machine token was NOT stored. Re-run with \`--expect-email <addr>\` to pin the approving account (recommended for CI), or \`--yes\` to accept whichever account approved it.` + winptyHint
+  };
+}
+function isAffirmative(answer) {
+  return /^(y|yes)$/i.test(answer.trim());
+}
+function controllingTerminalPath() {
+  return "/dev/tty";
+}
+function canOpenControllingTerminal(path = controllingTerminalPath(), platform = process.platform) {
+  if (platform === "win32") return false;
+  let fd;
+  try {
+    fd = (0, import_node_fs4.openSync)(path, "r");
+    return true;
+  } catch {
+    return false;
+  } finally {
+    if (fd !== void 0) {
+      try {
+        (0, import_node_fs4.closeSync)(fd);
+      } catch {
+      }
+    }
+  }
+}
+async function promptForAnswer(question, on) {
+  const { createInterface } = await import("readline/promises");
+  let ttyFd;
+  let input;
+  if (on === "stdin") {
+    input = process.stdin;
+  } else {
+    const { ReadStream } = await import("tty");
+    ttyFd = (0, import_node_fs4.openSync)(controllingTerminalPath(), "r");
+    input = new ReadStream(ttyFd);
+  }
+  return new Promise((resolve) => {
+    const rl = createInterface({ input, output: process.stderr });
+    let settled = false;
+    const done = (value) => {
+      if (settled) return;
+      settled = true;
+      rl.close();
+      if (on === "stdin") {
+        process.stdin.unref?.();
+      } else {
+        try {
+          input.unref?.();
+          input.destroy?.();
+        } catch {
+        }
+        if (ttyFd !== void 0) {
+          try {
+            (0, import_node_fs4.closeSync)(ttyFd);
+          } catch {
+          }
+        }
+      }
+      resolve(value);
+    };
+    rl.question(question).then(done, () => done(""));
+    rl.once("close", () => done(""));
+    input.once?.("error", () => done(""));
+  });
+}
 function createPairCommand(deps = {}) {
   const fetchImpl = deps.fetchImpl ?? fetch;
   const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
   const clock = deps.now ?? (() => Date.now());
   const renderQr = deps.renderQr ?? renderQrMatrix;
   const intervalMs = deps.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
+  const promptLine = deps.promptLine ?? promptForAnswer;
+  const hasControllingTerminal = deps.hasControllingTerminal ?? (() => canOpenControllingTerminal());
+  const configuredExpectEmail = deps.configuredExpectEmail ?? (() => {
+    const pinned = readCliConfig().expectEmail;
+    return typeof pinned === "string" && pinned.trim().length > 0 ? pinned : void 0;
+  });
   return {
     name: "pair",
     summary: "Pair this machine with your BirdyBeep account (QR or manual)",
-    usage: "birdybeep pair [--json]",
+    usage: "birdybeep pair [--yes] [--expect-email <addr>] [--json]",
+    options: [
+      {
+        flag: "--yes",
+        aliases: ["-y"],
+        summary: "Skip the approving-account confirmation (headless/CI)"
+      },
+      {
+        flag: "--expect-email",
+        value: "<addr>",
+        summary: "Only trust the pairing if this account approved it (else fail)"
+      }
+    ],
     run: async (ctx) => {
+      const pairFlags = parsePairFlags(ctx.args);
+      if (pairFlags.error !== void 0) {
+        ctx.io.errline(`birdybeep pair: ${pairFlags.error}.`);
+        return EXIT.USAGE;
+      }
       const apiUrl = resolveApiUrl();
       const identity = (0, import_agent_core8.getMachineIdentity)();
+      const codeVerifier = (0, import_agent_core8.generateCodeVerifier)();
+      const codeChallenge = (0, import_agent_core8.deriveCodeChallengeS256)(codeVerifier);
       const start = await pairStart(
         apiUrl,
-        { machineLabel: identity.label, os: identity.os, cliVersion: CLI_VERSION },
+        { machineLabel: identity.label, os: identity.os, cliVersion: CLI_VERSION, codeChallenge },
         fetchImpl
       );
       if (ctx.flags.json) {
@@ -711,12 +1037,14 @@ function createPairCommand(deps = {}) {
         });
       } else {
         ctx.io.line(
-          "To pair this machine, open the BirdyBeep app, tap \u201Cpair a machine\u201D, and scan this QR (or enter the code):"
+          "To pair this machine, open the BirdyBeep app, tap \u201Cpair a machine\u201D, and scan this QR or open the complete link:"
         );
         const isTTY = deps.isTTY ?? process.stdout.isTTY === true;
         if (isTTY) ctx.io.line(renderQr(start.qr_payload));
         ctx.io.line(`   Scan or open:  ${start.qr_payload}`);
-        ctx.io.line(`   Code:  ${start.user_code}`);
+        ctx.io.line(
+          `   Session code (display only; cannot approve by itself):  ${start.user_code}`
+        );
         ctx.io.line("Waiting for you to approve this machine in the app\u2026");
       }
       const deadline = Date.parse(start.expires_at);
@@ -732,7 +1060,9 @@ function createPairCommand(deps = {}) {
           apiUrl,
           start.device_code,
           fetchImpl,
-          identity.fingerprintHash
+          identity.fingerprintHash,
+          codeVerifier
+          // PKCE proof-of-possession (dgxd) — sent on every poll
         );
         if (poll.status === "paired") {
           paired = poll;
@@ -757,15 +1087,44 @@ function createPairCommand(deps = {}) {
       if (paired === void 0 || paired.status !== "paired") {
         ctx.io.result({ paired: false, reason: "timeout" });
         ctx.io.errline(
-          "Pairing timed out before you approved it. In the BirdyBeep app, tap \u201Cpair a machine\u201D, scan the QR (or enter the code), then run `birdybeep pair` again."
+          "Pairing timed out before you approved it. In the BirdyBeep app, tap \u201Cpair a machine\u201D, scan a fresh QR or open its complete link, then run `birdybeep pair` again."
+        );
+        return EXIT.ERROR;
+      }
+      const approvedBy = paired.approvedByEmail;
+      const expectEmail = pairFlags.expectEmail ?? configuredExpectEmail();
+      const stdinIsTTY = deps.isStdinTTY ?? process.stdin.isTTY === true;
+      const decision = decidePairConfirmation({
+        ...approvedBy !== void 0 ? { approvedByEmail: approvedBy } : {},
+        ...expectEmail !== void 0 ? { expectEmail } : {},
+        ...expectEmail !== void 0 ? { expectEmailSource: pairFlags.expectEmail !== void 0 ? "flag" : "config" } : {},
+        yes: pairFlags.yes,
+        nonInteractive: ctx.flags.nonInteractive,
+        stdinIsTTY,
+        // Probed ONLY when stdin can't answer — opening /dev/tty is a syscall, and when stdin is
+        // already a terminal the answer is irrelevant.
+        controllingTerminalAvailable: stdinIsTTY ? false : hasControllingTerminal(),
+        configPath: cliConfigPath()
+      });
+      if (decision.action === "reject") {
+        ctx.io.result({ paired: false, reason: decision.reason });
+        ctx.io.errline(decision.message);
+        return EXIT.ERROR;
+      }
+      if (decision.action === "prompt" && !isAffirmative(await promptLine(decision.question, decision.on))) {
+        ctx.io.result({ paired: false, reason: "declined" });
+        ctx.io.errline(
+          "Pairing declined \u2014 the machine token was NOT stored, and this machine will send no events. The machine may still appear in the BirdyBeep app; revoke it there if you did not intend to pair it."
         );
         return EXIT.ERROR;
       }
       await (0, import_agent_core8.setToken)(paired.machineToken, deps.tokenOptions ?? {});
       writeCliConfig({ apiUrl });
-      ctx.io.emit(`\u2713 Paired. Run \`birdybeep test\` to send a test Beep.`, {
+      const humanSuffix = approvedBy !== void 0 ? ` to ${approvedBy}` : "";
+      ctx.io.emit(`\u2713 Paired${humanSuffix}. Run \`birdybeep test\` to send a test Beep.`, {
         paired: true,
-        machineId: paired.machineId
+        machineId: paired.machineId,
+        ...approvedBy !== void 0 ? { approvedByEmail: approvedBy } : {}
       });
       return EXIT.OK;
     }
@@ -798,14 +1157,24 @@ function createQueueCommand() {
 var import_agent_core10 = require("@birdybeep/agent-core");
 var import_claude_code4 = require("@birdybeep/claude-code");
 var import_codex4 = require("@birdybeep/codex");
+var import_copilot4 = require("@birdybeep/copilot");
+var import_cursor4 = require("@birdybeep/cursor");
 var import_opencode4 = require("@birdybeep/opencode");
-var DEFAULT_ADAPTERS3 = [import_claude_code4.claudeCodeAdapter, import_codex4.codexAdapter, import_opencode4.opencodeAdapter];
+var DEFAULT_ADAPTERS3 = [
+  import_claude_code4.claudeCodeAdapter,
+  import_codex4.codexAdapter,
+  import_opencode4.opencodeAdapter,
+  import_cursor4.cursorAdapter,
+  import_copilot4.copilotAdapter
+];
 var ADAPTER_VERSIONS = {
   claude_code: import_claude_code4.CLAUDE_CODE_ADAPTER_VERSION,
   codex: import_codex4.CODEX_ADAPTER_VERSION,
-  opencode: import_opencode4.OPENCODE_ADAPTER_VERSION
+  opencode: import_opencode4.OPENCODE_ADAPTER_VERSION,
+  cursor: import_cursor4.CURSOR_ADAPTER_VERSION,
+  copilot: import_copilot4.COPILOT_ADAPTER_VERSION
 };
-var base2 = (apiUrl) => apiUrl.replace(/\/$/, "");
+var base3 = (apiUrl) => apiUrl.replace(/\/$/, "");
 async function gatherItems(adapters) {
   return Promise.all(
     adapters.map(async (a) => {
@@ -840,7 +1209,7 @@ function createReportStatusCommand(deps = {}) {
       let outcome = "deferred";
       let errorCode;
       try {
-        const res = await fetchImpl(`${base2(resolveApiUrl())}/v1/integrations/status`, {
+        const res = await fetchImpl(`${base3(resolveApiUrl())}/v1/integrations/status`, {
           method: "POST",
           headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
           body: JSON.stringify({ integrations: items })
@@ -891,8 +1260,16 @@ function createReportStatusCommand(deps = {}) {
 var import_agent_core11 = require("@birdybeep/agent-core");
 var import_claude_code5 = require("@birdybeep/claude-code");
 var import_codex5 = require("@birdybeep/codex");
+var import_copilot5 = require("@birdybeep/copilot");
+var import_cursor5 = require("@birdybeep/cursor");
 var import_opencode5 = require("@birdybeep/opencode");
-var DEFAULT_ADAPTERS4 = [import_claude_code5.claudeCodeAdapter, import_codex5.codexAdapter, import_opencode5.opencodeAdapter];
+var DEFAULT_ADAPTERS4 = [
+  import_claude_code5.claudeCodeAdapter,
+  import_codex5.codexAdapter,
+  import_opencode5.opencodeAdapter,
+  import_cursor5.cursorAdapter,
+  import_copilot5.copilotAdapter
+];
 function createStatusCommand(deps = {}) {
   const adapters = deps.adapters ?? DEFAULT_ADAPTERS4;
   const makeSender = deps.createSender ?? ((baseUrl) => (0, import_agent_core11.createSender)(
@@ -932,7 +1309,7 @@ function createStatusCommand(deps = {}) {
 }
 
 // src/commands/test.ts
-var import_node_crypto = require("crypto");
+var import_node_crypto2 = require("crypto");
 var import_agent_core12 = require("@birdybeep/agent-core");
 function buildTestEvent(opts = {}) {
   const machine = (0, import_agent_core12.getMachineIdentity)();
@@ -944,7 +1321,7 @@ function buildTestEvent(opts = {}) {
       // schema requires a harness; the "test" type distinguishes it
       // Unique per run: a repeat `birdybeep test` inside the backend's dedupe window must
       // still beep — a constant id made the second test silently "deduped" (9fh).
-      source_session_id: `birdybeep-cli-test-${(0, import_node_crypto.randomUUID)()}`,
+      source_session_id: `birdybeep-cli-test-${(0, import_node_crypto2.randomUUID)()}`,
       machine: { label: machine.label, os: machine.os },
       workspace: { cwd: process.cwd() },
       title: "BirdyBeep test event",
@@ -1014,8 +1391,8 @@ function buildCommands() {
 }
 
 // src/update-check.ts
-var import_node_fs3 = require("fs");
-var import_node_path2 = require("path");
+var import_node_fs5 = require("fs");
+var import_node_path3 = require("path");
 var import_agent_core13 = require("@birdybeep/agent-core");
 var PACKAGE_NAME = "@birdybeep/cli";
 var PACKAGE_PATH = "@birdybeep%2Fcli";
@@ -1070,11 +1447,11 @@ function isNewer(current, latest) {
   return cur !== null && lat !== null && compareSemver(cur, lat) < 0;
 }
 function updateCachePath() {
-  return (0, import_node_path2.join)((0, import_agent_core13.birdyBeepConfigDir)(), UPDATE_CACHE_FILE);
+  return (0, import_node_path3.join)((0, import_agent_core13.birdyBeepConfigDir)(), UPDATE_CACHE_FILE);
 }
 function readUpdateCache() {
   try {
-    const parsed = JSON.parse((0, import_node_fs3.readFileSync)(updateCachePath(), "utf8"));
+    const parsed = JSON.parse((0, import_node_fs5.readFileSync)(updateCachePath(), "utf8"));
     if (typeof parsed !== "object" || parsed === null) return null;
     const { checkedAt, latest } = parsed;
     if (typeof checkedAt !== "number") return null;
@@ -1085,8 +1462,8 @@ function readUpdateCache() {
   }
 }
 function writeUpdateCache(cache) {
-  (0, import_node_fs3.mkdirSync)((0, import_agent_core13.birdyBeepConfigDir)(), { recursive: true, mode: 448 });
-  (0, import_node_fs3.writeFileSync)(updateCachePath(), `${JSON.stringify(cache)}
+  (0, import_node_fs5.mkdirSync)((0, import_agent_core13.birdyBeepConfigDir)(), { recursive: true, mode: 448 });
+  (0, import_node_fs5.writeFileSync)(updateCachePath(), `${JSON.stringify(cache)}
 `, { mode: 384 });
 }
 async function fetchLatestVersion(registryUrl, fetchImpl, timeoutMs) {