@codeagentswarm/cas-cloud 0.0.6 → 0.0.15

package/README.md

@@ -22,6 +22,19 @@ bundled CodeAgentSwarm MCP. It also installs the guarded global instructions
 that publish each session's title, activity and work-phase status. Run
 `cas-cli setup` to perform that same setup explicitly.
 
+To connect this host to CodeAgentSwarm Desktop, keep `serve` running and ask it
+for a temporary Desktop link:
+
+```sh
+cas-cli connect
+```
+
+Open the printed link on the Mac, or paste it into **Remote devices**. Desktop
+reviews and saves the host; its projects and open sessions then appear in the
+normal Agents list and New Agent launcher while the VPS is online. The link is
+single-use, expires after five minutes, uses the existing encrypted relay and
+does not open an inbound VPS port.
+
 To let a Cloud session read or start work on your Mac, enable **Session
 communication** on the Mac, create a Mobile Connect pairing code, and keep the
 Cloud service running while you link it:
@@ -38,7 +51,7 @@ list eligible Mac sessions, read a bounded user/assistant transcript, or list an
 opaque project and start one new Mac session with a prompt when you explicitly
 ask. Only assistant prose returns; paths, reasoning and tool output do not.
 
-Desktop's ordinary CAS Cloud pairing provides the reverse direction. With both
+The Desktop connection created by `cas-cli connect` provides the reverse direction. With both
 links approved, a Mac session can perform the same explicit read, remote start,
 or focused request/response exchange with an eligible CAS Cloud session. Those
 messages stay end-to-end encrypted and are not retained for replay by the relay.

package/dist/cas.js

@@ -8393,6 +8393,9 @@ var require_mcp_entry_ownership = __commonJS({
     function hasStaleSourceCheckoutRuntime(text) {
       const candidates = [text.trim(), ...[...text.matchAll(/["']([^"']+)["']/g)].map((match) => match[1])];
       return candidates.some((candidate) => {
+        if (candidate.includes(WORKTREE_MARKER)) return false;
+        const ownedPaths = [OWNED_SOURCE_RUNTIME, OWNED_SOURCE_LAUNCHER].map(normalizeRuntimePath);
+        if (ownedPaths.some((owned) => candidate !== owned && candidate.includes(owned))) return false;
         if (!SOURCE_CHECKOUT_SUFFIXES.some((suffix) => candidate.endsWith(suffix))) return false;
         if (!/^(?:[a-z]:\/|\/)/i.test(candidate)) return false;
         const withoutRoot = candidate.replace(/^[a-z]:\//i, "").replace(/^\/+/, "");
@@ -18501,10 +18504,144 @@ var require_jsonrpc_line_parser = __commonJS({
   }
 });
 
+// src/shared/provider-error-presentation.js
+var require_provider_error_presentation = __commonJS({
+  "src/shared/provider-error-presentation.js"(exports2, module2) {
+    var MODEL_USAGE_LIMIT_CODE = "model_usage_limit_reached";
+    var MODEL_USAGE_LIMIT_MESSAGE = "This model's usage limit has been reached. Switch models or try again after the limit resets.";
+    var USAGE_LIMIT_CODES = /* @__PURE__ */ new Set([
+      "billinghardlimitreached",
+      "creditsexhausted",
+      "insufficientquota",
+      "modelusagelimitreached",
+      "quotaexhausted",
+      "ratelimit",
+      "ratelimited",
+      "ratelimiterror",
+      "ratelimitreached",
+      "resourceexhausted",
+      "usagelimit",
+      "usagelimitexceeded",
+      "workspaceownerusagelimitreached",
+      "workspacememberusagelimitreached"
+    ]);
+    var USAGE_LIMIT_MESSAGE_PATTERN = /(?:credit balance is too low|credits? (?:have been )?exhausted|insufficient[ _-]quota|too many requests|(?:model|rate|usage) limit (?:has been )?(?:exceeded|reached)|(?:hit|reached|exceeded) (?:(?:your|the) )?(?:model|rate|usage) limit|quota (?:has been )?(?:exceeded|exhausted|reached)|resource[ _-]exhausted)/i;
+    function structuredErrorInfoValues(value) {
+      if (!value || typeof value !== "object") return [value];
+      return Object.entries(value).flatMap(([kind, detail]) => [
+        kind,
+        typeof detail === "string" || typeof detail === "number" ? detail : void 0,
+        detail == null ? void 0 : detail.httpStatusCode,
+        detail == null ? void 0 : detail.statusCode,
+        detail == null ? void 0 : detail.http_status
+      ]);
+    }
+    function errorSignalValues(event) {
+      var _a, _b;
+      const payload = (event == null ? void 0 : event.payload) || {};
+      const payloadErrorData = payload.errorData || {};
+      const detail = payload.detail || {};
+      const detailError = detail.error || {};
+      const detailData = detail.data || {};
+      const detailErrorData = detailError.data || {};
+      const rawPayload = ((_a = event == null ? void 0 : event.raw) == null ? void 0 : _a.payload) || {};
+      const rawError = rawPayload.error || ((_b = rawPayload.turn) == null ? void 0 : _b.error) || {};
+      return [
+        payload.message,
+        payload.errorMessage,
+        ...structuredErrorInfoValues(payload.code),
+        ...structuredErrorInfoValues(payload.errorCode),
+        payloadErrorData,
+        payloadErrorData.message,
+        payloadErrorData.code,
+        payloadErrorData.errorCode,
+        payloadErrorData.httpStatusCode,
+        payloadErrorData.statusCode,
+        payloadErrorData.http_status,
+        payloadErrorData.reason,
+        payloadErrorData.stopReason,
+        detail.code,
+        detail.message,
+        detail.errorCode,
+        detail.httpStatusCode,
+        detail.statusCode,
+        detail.http_status,
+        ...structuredErrorInfoValues(detail.codexErrorInfo),
+        detail.stopReason,
+        detailError.code,
+        detailError.message,
+        detailError.errorCode,
+        detailError.httpStatusCode,
+        detailError.statusCode,
+        detailError.http_status,
+        ...structuredErrorInfoValues(detailError.codexErrorInfo),
+        detailData.code,
+        detailData.message,
+        detailData.errorCode,
+        detailData.httpStatusCode,
+        detailData.statusCode,
+        detailData.http_status,
+        detailData.reason,
+        detailData.stopReason,
+        detailErrorData.code,
+        detailErrorData.message,
+        detailErrorData.errorCode,
+        detailErrorData.httpStatusCode,
+        detailErrorData.statusCode,
+        detailErrorData.http_status,
+        detailErrorData.reason,
+        detailErrorData.stopReason,
+        rawPayload.stopReason,
+        rawError.message,
+        rawError.code,
+        rawError.errorCode,
+        rawError.httpStatusCode,
+        rawError.statusCode,
+        rawError.http_status,
+        ...structuredErrorInfoValues(rawError.codexErrorInfo)
+      ];
+    }
+    function isModelUsageLimitError(event) {
+      const values = errorSignalValues(event);
+      if (values.some((value) => typeof value === "string" && USAGE_LIMIT_MESSAGE_PATTERN.test(value))) {
+        return true;
+      }
+      if (values.some((value) => typeof value === "string" && USAGE_LIMIT_CODES.has(value.toLowerCase().replace(/[^a-z0-9]/g, "")))) return true;
+      if (values.some((value) => Number(value) === 429)) return true;
+      return (event == null ? void 0 : event.provider) === "grok" && values.some((value) => Number(value) === -32003);
+    }
+    function normalizeProviderErrorEvent(event) {
+      if (!event || !["runtime.error", "turn.completed", "session.exited"].includes(event.type)) {
+        return event;
+      }
+      if (!isModelUsageLimitError(event)) return event;
+      const payload = { ...event.payload || {}, code: MODEL_USAGE_LIMIT_CODE };
+      if (event.type === "runtime.error") {
+        payload.message = MODEL_USAGE_LIMIT_MESSAGE;
+        payload.class = "usage_limit";
+      } else if (event.type === "turn.completed") {
+        payload.errorMessage = MODEL_USAGE_LIMIT_MESSAGE;
+        payload.errorCode = MODEL_USAGE_LIMIT_CODE;
+      } else {
+        payload.reason = MODEL_USAGE_LIMIT_MESSAGE;
+        payload.errorCode = MODEL_USAGE_LIMIT_CODE;
+      }
+      return { ...event, payload };
+    }
+    module2.exports = {
+      MODEL_USAGE_LIMIT_CODE,
+      MODEL_USAGE_LIMIT_MESSAGE,
+      isModelUsageLimitError,
+      normalizeProviderErrorEvent
+    };
+  }
+});
+
 // src/infrastructure/agent-drivers/provider-events.js
 var require_provider_events = __commonJS({
   "src/infrastructure/agent-drivers/provider-events.js"(exports2, module2) {
     var crypto = require("crypto");
+    var { normalizeProviderErrorEvent } = require_provider_error_presentation();
     var PROVIDER_EVENT_TYPES = Object.freeze([
       "session.state.changed",
       "session.config.updated",
@@ -18596,7 +18733,7 @@ var require_provider_events = __commonJS({
       if (bare.itemId !== void 0) event.itemId = bare.itemId;
       if (bare.requestId !== void 0) event.requestId = bare.requestId;
       if (bare.raw !== void 0) event.raw = bare.raw;
-      return event;
+      return normalizeProviderErrorEvent(event);
     }
     function normalizeExecutionOrigin(value) {
       return EXECUTION_ORIGINS.includes(value) ? value : "unknown";
@@ -18674,6 +18811,7 @@ var require_provider_auth = __commonJS({
       /\bunauthenticated\b/i,
       /\bauthentication required\b/i,
       /\bplease (?:run|use) [^\n]*(?:login|log in|sign in)\b/i,
+      /\brun [^\n]*(?:login|log in|sign in)\b/i,
       /\b(?:login|log in|sign in) (?:is )?required\b/i,
       /\bmissing (?:an? )?(?:api key|access token|auth token|credentials?)\b/i,
       /\b(?:invalid|expired) (?:api key|access token|auth token|credentials?)\b/i,
@@ -20864,17 +21002,19 @@ ${text}`;
         }];
       },
       "turn/completed": ({ method, params }) => {
-        var _a;
+        var _a, _b;
         const turn = params == null ? void 0 : params.turn;
         if (!(turn == null ? void 0 : turn.id)) return [];
         const errorMessage = (_a = turn.error) == null ? void 0 : _a.message;
+        const errorCode = (_b = turn.error) == null ? void 0 : _b.codexErrorInfo;
         return [{
           type: "turn.completed",
           threadId: params.threadId,
           turnId: turn.id,
           payload: {
             state: mapTurnStatus(turn.status),
-            ...errorMessage ? { errorMessage } : {}
+            ...errorMessage ? { errorMessage } : {},
+            ...errorCode ? { errorCode } : {}
           },
           raw: buildRaw(method, params)
         }];
@@ -20992,8 +21132,9 @@ ${text}`;
         raw: buildRaw(method, params)
       }],
       error: ({ method, params }) => {
-        var _a;
+        var _a, _b;
         const message = (_a = params == null ? void 0 : params.error) == null ? void 0 : _a.message;
+        const code = (_b = params == null ? void 0 : params.error) == null ? void 0 : _b.codexErrorInfo;
         const base = {
           threadId: params == null ? void 0 : params.threadId,
           turnId: params == null ? void 0 : params.turnId,
@@ -21005,7 +21146,7 @@ ${text}`;
         return [{
           ...base,
           type: "runtime.error",
-          payload: { message, class: "provider_error", detail: params }
+          payload: { message, class: "provider_error", ...code ? { code } : {}, detail: params }
         }];
       }
     });
@@ -25778,12 +25919,15 @@ var require_acp_agent_driver = __commonJS({
         try {
           const result = await prompt;
           const stopReason = result && result.stopReason;
-          completion = {
-            state: stopReason === "cancelled" ? "cancelled" : "completed"
-          };
+          completion = stopReason === "rate_limit" ? { state: "failed", errorMessage: "Rate limit reached", errorCode: "rate_limit" } : { state: stopReason === "cancelled" ? "cancelled" : "completed" };
         } catch (error) {
           if (this._stopping || this._state === "stopped") return;
-          completion = { state: "failed", errorMessage: error.message };
+          completion = {
+            state: "failed",
+            errorMessage: error.message,
+            ...error.rpcCode !== void 0 ? { errorCode: error.rpcCode } : {},
+            ...error.rpcData !== void 0 ? { errorData: error.rpcData } : {}
+          };
         } finally {
           this._promptsInFlight = Math.max(0, this._promptsInFlight - 1);
         }
@@ -25792,7 +25936,11 @@ var require_acp_agent_driver = __commonJS({
             this._emit({
               type: "runtime.error",
               turnId,
-              payload: { message: completion.errorMessage }
+              payload: {
+                message: completion.errorMessage,
+                ...completion.errorCode !== void 0 ? { code: completion.errorCode } : {},
+                ...completion.errorData !== void 0 ? { detail: { data: completion.errorData } } : {}
+              }
             });
           }
           return;
@@ -34806,7 +34954,18 @@ var require_mobile_runtime = __commonJS({
     } = require_chat_history_pagination();
     var PROTOCOL_VERSION = 2;
     var SESSION_SUBSCRIPTIONS_FEATURE = "session-subscriptions";
-    var SUBSCRIPTION_ONLY_EVENT_TYPES = /* @__PURE__ */ new Set(["content.delta", "item.updated", "turn.diff.updated"]);
+    var SUBSCRIPTION_ONLY_EVENT_TYPES = /* @__PURE__ */ new Set([
+      "session.config.updated",
+      "session.commands.updated",
+      "thread.started",
+      "thread.token-usage.updated",
+      "turn.diff.updated",
+      "item.started",
+      "item.updated",
+      "item.completed",
+      "content.delta",
+      "account.rate-limits.updated"
+    ]);
     var STREAM_METRICS_INTERVAL_MS = 6e4;
     var MAX_MESSAGE_BYTES = 1024 * 1024;
     var MAX_ITEMS_PER_SESSION = 500;
@@ -36453,9 +36612,17 @@ var require_mobile_runtime = __commonJS({
         }
         if (command.type === "project.clone") {
           if (typeof this.cloneProject !== "function") throw new Error("Remote project cloning is unavailable");
-          exactPayload(["rootId", "url", "relativePath", "requestId"]);
+          exactPayload(["rootId", "url", "relativePath", "displayName", "color", "icon", "requestId"]);
           if (typeof payload.requestId !== "string" || !payload.requestId) throw new Error("A clone requestId is required");
-          return this.cloneProject({ rootId: payload.rootId, url: payload.url, relativePath: payload.relativePath, requestId: payload.requestId });
+          return this.cloneProject({
+            rootId: payload.rootId,
+            url: payload.url,
+            relativePath: payload.relativePath,
+            displayName: payload.displayName,
+            color: payload.color,
+            icon: payload.icon,
+            requestId: payload.requestId
+          });
         }
         if (command.type === "project.clone.cancel") {
           if (typeof this.cancelProjectClone !== "function") throw new Error("Remote clone cancellation is unavailable");
@@ -36980,7 +37147,8 @@ var require_mobile_runtime = __commonJS({
             await this.manager.interruptTurn(sessionId);
             return { interrupted: true };
           case "session.stop": {
-            const session = this._session(sessionId);
+            const session = this.sessions.get(sessionId);
+            if (!session || session.state === "stopped") return { stopped: true };
             let result;
             if (typeof this.closeSession === "function") {
               const closed = await this.closeSession({
@@ -37296,7 +37464,7 @@ var require_mobile_relay_client = __commonJS({
     var PEER_BATCH_MAX_BYTES = 5 * 1024 * 1024;
     var PEER_BATCH_ITEM_MAX_BYTES = 256 * 1024;
     var PEER_METRICS_INTERVAL_MS = 6e4;
-    var BATCHABLE_RUNTIME_EVENT_TYPES = /* @__PURE__ */ new Set(["content.delta", "item.updated", "turn.diff.updated"]);
+    var BATCHABLE_RUNTIME_KINDS = /* @__PURE__ */ new Set(["session.event", "cursor.advanced"]);
     var COMPRESSION_THRESHOLD_BYTES = 4096;
     var ID_PATTERN = /^[A-Za-z0-9._:-]{1,128}$/;
     var RELAY_GROUP_PATTERN = /^[A-Za-z0-9_-]{43}$/;
@@ -37340,7 +37508,7 @@ var require_mobile_relay_client = __commonJS({
         this.acceptsDeflate = false;
       }
       send(raw) {
-        var _a, _b;
+        var _a;
         if (this.readyState !== 1) return;
         const json = String(raw);
         const bytes = Buffer.byteLength(json);
@@ -37357,7 +37525,7 @@ var require_mobile_relay_client = __commonJS({
           deviceId: this.device.id,
           ...codec ? { codec } : {},
           box: encryptJson(payload, this.client.keyPair.secretKey, this.device.publicKey, codec)
-        }, payload.kind === "session.event" && BATCHABLE_RUNTIME_EVENT_TYPES.has((_b = payload.event) == null ? void 0 : _b.type));
+        }, BATCHABLE_RUNTIME_KINDS.has(payload.kind));
       }
       receive(box) {
         if (this.readyState !== 1) return;
@@ -38097,7 +38265,7 @@ var require_mobile_relay_client = __commonJS({
           });
           return;
         }
-        if (message.kind === "peer.message" || message.kind === "peer.offline") {
+        if (["peer.message", "peer.offline", "peer.online"].includes(message.kind)) {
           if (message.kind === "peer.offline") {
             this.emit("diagnostic", { event: "peer.route_offline", peer: logRef(message.targetRuntimeId) });
           }
@@ -38356,6 +38524,7 @@ var require_remote_runtime_client = __commonJS({
       "session.identity.updated",
       "projects.updated",
       "projects.operation.updated",
+      "project.icon.generated",
       "tasks.changed",
       "provider.login.event",
       "provider.operation.updated",
@@ -38415,6 +38584,8 @@ var require_remote_runtime_client = __commonJS({
       "session.resume",
       "history.older",
       "projects.list",
+      "project.directories.list",
+      "project.update",
       "project.register",
       "project.clone",
       "project.clone.cancel",
@@ -38446,6 +38617,7 @@ var require_remote_runtime_client = __commonJS({
       "coordination.transcript",
       "coordination.message",
       "projects.list",
+      "project.directories.list",
       "tasks.list",
       "providers.list",
       "provider.login.describe",
@@ -38511,15 +38683,20 @@ var require_remote_runtime_client = __commonJS({
         assertPublicPayload(child, depth + 1);
       }
     }
-    function stripPathFields(value, depth = 0) {
+    function stripPathFields(value, depth = 0, preserveRelativePaths = false) {
       if (depth > 40) throw new Error("Remote runtime payload is too deeply nested");
-      if (Array.isArray(value)) return value.map((item) => stripPathFields(item, depth + 1));
+      if (Array.isArray(value)) return value.map((item) => stripPathFields(item, depth + 1, preserveRelativePaths));
       if (!value || typeof value !== "object") return value;
       const clean = {};
       for (const [key, child] of Object.entries(value)) {
         const normalized = normalizedKey(key);
-        if (PATH_KEYS.has(normalized) || normalized.endsWith("path")) continue;
-        clean[key] = stripPathFields(child, depth + 1);
+        if (PATH_KEYS.has(normalized) || normalized.endsWith("path")) {
+          if (preserveRelativePaths && (child === null || isSafeRelativePath(child))) {
+            clean[key] = typeof child === "string" ? child.replace(/\\/g, "/") : null;
+          }
+          continue;
+        }
+        clean[key] = stripPathFields(child, depth + 1, preserveRelativePaths);
       }
       return clean;
     }
@@ -39064,7 +39241,7 @@ var require_remote_runtime_client = __commonJS({
         }
         if (command.payload !== void 0) {
           assertPublicPayload(command.payload);
-          assertPathlessCommand(command.payload, 0, command.type === "project.register" || command.type === "project.clone" || command.type.startsWith("workspace.files."));
+          assertPathlessCommand(command.payload, 0, command.type === "project.directories.list" || command.type === "project.register" || command.type === "project.clone" || command.type.startsWith("workspace.files."));
           wire.payload = clone(command.payload);
         }
         return wire;
@@ -39316,12 +39493,12 @@ var require_remote_runtime_client = __commonJS({
         if (this.runtimeOnline) this._sendRuntimeHello();
       }
       _handleRuntimeEnvelope(envelope) {
-        var _a, _b;
+        var _a, _b, _c, _d, _e;
         let safe;
         let bytes;
         try {
           bytes = Buffer.byteLength(JSON.stringify(envelope));
-          if (!envelope || typeof envelope !== "object" || bytes > MAX_RUNTIME_MESSAGE_BYTES || !RUNTIME_KINDS.has(envelope.kind)) {
+          if (!envelope || typeof envelope !== "object" || bytes > MAX_RUNTIME_MESSAGE_BYTES) {
             throw new Error("Invalid runtime envelope");
           }
           assertPublicPayload(envelope);
@@ -39330,9 +39507,11 @@ var require_remote_runtime_client = __commonJS({
               throw new Error("Invalid runtime snapshot");
             }
           }
-          safe = stripPathFields(envelope);
+          const commandType = envelope.kind === "command.result" ? (_c = (_b = (_a = this.pendingCommands.get(envelope.commandId)) == null ? void 0 : _a.message) == null ? void 0 : _b.command) == null ? void 0 : _c.type : null;
+          safe = stripPathFields(envelope, 0, commandType === "project.directories.list");
         } catch {
-          this._diagnostic("remote.runtime_rejected", { reason: "invalid_envelope" });
+          const kind = typeof (envelope == null ? void 0 : envelope.kind) === "string" && /^[a-z][a-z0-9.]{0,63}$/.test(envelope.kind) ? envelope.kind : void 0;
+          this._diagnostic("remote.runtime_rejected", { reason: "invalid_envelope", kind });
           return this._protocolFailure(this.socket);
         }
         if (safe.kind === "command.accepted") {
@@ -39383,8 +39562,8 @@ var require_remote_runtime_client = __commonJS({
             totalMs: this.connectTrace ? this.now() - this.connectTrace.startedAt : void 0,
             reset: safe.reset === true,
             bytes,
-            sessions: Array.isArray((_a = safe.snapshot) == null ? void 0 : _a.sessions) ? safe.snapshot.sessions.length : void 0,
-            projects: Array.isArray((_b = safe.snapshot) == null ? void 0 : _b.projects) ? safe.snapshot.projects.length : void 0
+            sessions: Array.isArray((_d = safe.snapshot) == null ? void 0 : _d.sessions) ? safe.snapshot.sessions.length : void 0,
+            projects: Array.isArray((_e = safe.snapshot) == null ? void 0 : _e.projects) ? safe.snapshot.projects.length : void 0
           });
           this.connectTrace = null;
           this._emitEnvelope(safe);
@@ -39410,6 +39589,15 @@ var require_remote_runtime_client = __commonJS({
           return;
         }
         if (seq <= cursor.seq) return;
+        if (!RUNTIME_KINDS.has(safe.kind)) {
+          this._diagnostic("remote.runtime_ignored", { kind: safe.kind, seq });
+          this._setState({
+            ...this.state,
+            cursor: { runtimeId: cursor.runtimeId, seq },
+            error: null
+          });
+          return;
+        }
         this._setState({
           ...this.state,
           cursor: { runtimeId: cursor.runtimeId, seq },
@@ -39871,6 +40059,83 @@ var require_remote_runtime_store = __commonJS({
   }
 });
 
+// src/infrastructure/mobile/desktop-connection-link.js
+var require_desktop_connection_link = __commonJS({
+  "src/infrastructure/mobile/desktop-connection-link.js"(exports2, module2) {
+    var DEFAULT_CONNECT_ORIGIN = "https://codeagentswarm-connect.elcaminodelprogramadorweb.workers.dev";
+    var PUBLIC_CONNECT_ORIGIN = "https://connect.codeagentswarm.com";
+    var PAIRING_CODE = /^[A-HJ-NP-Z2-9]{8}$/;
+    function secureOrigin(value) {
+      try {
+        const url = new URL(value);
+        const local = ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname);
+        if (url.protocol !== "https:" && !(url.protocol === "http:" && local) || url.username || url.password || url.origin !== value) return null;
+        return url.origin;
+      } catch (_) {
+        return null;
+      }
+    }
+    function normalizeCode(value) {
+      const compact = String(value || "").trim().toUpperCase().replace(/[\s-]/g, "");
+      return PAIRING_CODE.test(compact) ? `${compact.slice(0, 4)}-${compact.slice(4)}` : null;
+    }
+    function configuredOrigin() {
+      const value = process.env.CAS_PAIRING_CODE_ORIGIN || DEFAULT_CONNECT_ORIGIN;
+      const origin = secureOrigin(value);
+      if (!origin) throw new Error("The pairing service is not secure");
+      return origin;
+    }
+    function codeFromInput(raw) {
+      const direct = normalizeCode(raw);
+      if (direct) return { code: direct, origin: configuredOrigin() };
+      let url;
+      try {
+        url = new URL(String(raw || "").trim());
+      } catch (_) {
+        return null;
+      }
+      if (["codeagentswarm:", "codeagentswarm-dev:"].includes(url.protocol) && url.hostname === "connect") {
+        const code2 = normalizeCode(url.searchParams.get("code"));
+        if (!code2) throw new Error("This pairing code is not valid");
+        return { code: code2, origin: configuredOrigin() };
+      }
+      if (!/^\/(?:connect|c)\/[^/]+\/?$/.test(url.pathname)) return null;
+      const trusted = /* @__PURE__ */ new Set([DEFAULT_CONNECT_ORIGIN, PUBLIC_CONNECT_ORIGIN, configuredOrigin()]);
+      if (!trusted.has(url.origin) || url.search || url.hash) throw new Error("This pairing code is not valid");
+      const code = normalizeCode(url.pathname.split("/").filter(Boolean).at(-1));
+      if (!code) throw new Error("This pairing code is not valid");
+      return { code, origin: url.origin };
+    }
+    async function resolvePairingInput(raw, fetchImpl = globalThis.fetch) {
+      const connection = codeFromInput(raw);
+      if (!connection) return String(raw || "").trim();
+      try {
+        const response = await fetchImpl(`${connection.origin}/api/mobile/pairing-code/${encodeURIComponent(connection.code)}`, {
+          headers: { Accept: "application/json" },
+          signal: AbortSignal.timeout(1e4)
+        });
+        if (!response.ok) throw new Error();
+        const body = await response.json();
+        if (typeof body.pairingUri !== "string") throw new Error();
+        return body.pairingUri;
+      } catch (_) {
+        throw new Error("This pairing code is invalid or has expired");
+      }
+    }
+    function desktopConnectionLink(pairing) {
+      const code = normalizeCode(pairing == null ? void 0 : pairing.pairingCode);
+      if (!code) throw new Error("CAS Cloud did not return a valid pairing code");
+      return `${configuredOrigin()}/connect/${code}`;
+    }
+    module2.exports = {
+      DEFAULT_CONNECT_ORIGIN,
+      desktopConnectionLink,
+      normalizeCode,
+      resolvePairingInput
+    };
+  }
+});
+
 // src/infrastructure/mobile/peer-runtime-network.js
 var require_peer_runtime_network = __commonJS({
   "src/infrastructure/mobile/peer-runtime-network.js"(exports2, module2) {
@@ -39883,6 +40148,7 @@ var require_peer_runtime_network = __commonJS({
     var MAX_PEERS = 32;
     var PEER_ACCESS_TTL_MS = 7 * 24 * 60 * 6e4;
     var PEER_HANDSHAKE_TIMEOUT_MS = 5e3;
+    var PEER_DENIAL_FEATURE = "peer-denial";
     function peerRef(value) {
       return value ? crypto.createHash("sha256").update(String(value)).digest("hex").slice(0, 10) : void 0;
     }
@@ -39921,7 +40187,18 @@ var require_peer_runtime_network = __commonJS({
           return;
         }
         if (message.kind === "runtime.message" && message.box) {
-          if (!this.network.relay.sendPeerMessage(this.peer.runtimeId, message.box, "to-runtime")) {
+          let box = message.box;
+          try {
+            const payload = decryptJson(box, this.network.keyPair.secretKey, this.peer.publicKey);
+            if ((payload == null ? void 0 : payload.kind) === "hello" && !(Array.isArray(payload.features) && payload.features.includes(PEER_DENIAL_FEATURE))) {
+              box = encryptJson({
+                ...payload,
+                features: [...Array.isArray(payload.features) ? payload.features : [], PEER_DENIAL_FEATURE]
+              }, this.network.keyPair.secretKey, this.peer.publicKey);
+            }
+          } catch {
+          }
+          if (!this.network.relay.sendPeerMessage(this.peer.runtimeId, box, "to-runtime")) {
             this.network._diagnostic("peer.route_failed", { peer: peerRef(this.peer.runtimeId), stream: "to-runtime" });
             this.offline();
           } else if (this.readyState === 1 && !this.handshakeComplete && !this.handshakeTimer) {
@@ -39931,11 +40208,17 @@ var require_peer_runtime_network = __commonJS({
       }
       receive(box) {
         if (this.readyState !== 1) return;
+        let payload;
         try {
-          decryptJson(box, this.network.keyPair.secretKey, this.peer.publicKey);
+          payload = decryptJson(box, this.network.keyPair.secretKey, this.peer.publicKey);
           this.network.relay.emit("diagnostic", { event: "peer.response_verified", stream: "to-client" });
         } catch {
           this.network.relay.emit("diagnostic", { event: "peer.response_rejected", reason: "decrypt_failed" });
+          return;
+        }
+        if ((payload == null ? void 0 : payload.kind) === "peer.denied") {
+          this.network._denyPeer(this.peer.runtimeId);
+          return;
         }
         this.handshakeComplete = true;
         if (this.handshakeTimer) clearTimeout(this.handshakeTimer);
@@ -39974,6 +40257,8 @@ var require_peer_runtime_network = __commonJS({
         this.loadRosters = loadRosters;
         this.saveRosters = saveRosters;
         this.rosters = /* @__PURE__ */ new Map();
+        this.revokedPeers = /* @__PURE__ */ new Set();
+        this.deniedPeers = /* @__PURE__ */ new Set();
         this.peers = /* @__PURE__ */ new Map();
         this.clients = /* @__PURE__ */ new Map();
         this.clientSockets = /* @__PURE__ */ new Map();
@@ -39987,7 +40272,11 @@ var require_peer_runtime_network = __commonJS({
         if (this.started) return;
         this.started = true;
         const saved = this.loadRosters() || {};
-        for (const [deviceId, peers] of Object.entries(saved)) {
+        const savedRosters = saved.version === 1 && saved.rosters && typeof saved.rosters === "object" ? saved.rosters : saved;
+        if (saved.version === 1 && Array.isArray(saved.revoked)) {
+          this.revokedPeers = new Set(saved.revoked.filter((runtimeId) => ID_PATTERN.test(runtimeId || "") && runtimeId !== this.runtimeId));
+        }
+        for (const [deviceId, peers] of Object.entries(savedRosters)) {
           if (!ID_PATTERN.test(deviceId) || !Array.isArray(peers)) continue;
           this.rosters.set(deviceId, peers.slice(0, MAX_PEERS).filter((peer) => validPeer(peer, this.runtimeId)));
         }
@@ -40017,9 +40306,15 @@ var require_peer_runtime_network = __commonJS({
           publicKey: peer.publicKey,
           name: peer.name.trim().slice(0, 200) || "Connected host"
         }])).values()];
+        for (const peer of unique) this.deniedPeers.delete(peer.runtimeId);
         if (unique.length) this.rosters.set(deviceId, unique);
         else this.rosters.delete(deviceId);
-        this.saveRosters(Object.fromEntries(this.rosters));
+        for (const runtimeId of this.revokedPeers) {
+          if (![...this.rosters.values()].some((roster) => roster.some((peer) => peer.runtimeId === runtimeId))) {
+            this.revokedPeers.delete(runtimeId);
+          }
+        }
+        this._saveState();
         this._rebuildPeers();
         this._diagnostic("peer.roster_replaced", {
           rosters: this.rosters.size,
@@ -40029,6 +40324,15 @@ var require_peer_runtime_network = __commonJS({
         });
         return { peers: unique.length };
       }
+      removePeer(runtimeId) {
+        if (!ID_PATTERN.test(runtimeId || "")) return false;
+        if (![...this.rosters.values()].some((roster) => roster.some((peer) => peer.runtimeId === runtimeId))) return false;
+        this.revokedPeers.add(runtimeId);
+        this._saveState();
+        this._rebuildPeers();
+        this._diagnostic("peer.removed_by_user", { peer: peerRef(runtimeId) });
+        return true;
+      }
       getClients() {
         return [...this.clients.values()];
       }
@@ -40047,6 +40351,7 @@ var require_peer_runtime_network = __commonJS({
         const next = /* @__PURE__ */ new Map();
         for (const roster of this.rosters.values()) {
           for (const peer of roster) {
+            if (this.revokedPeers.has(peer.runtimeId)) continue;
             const existing = next.get(peer.runtimeId);
             if (existing && existing.publicKey !== peer.publicKey) continue;
             next.set(peer.runtimeId, peer);
@@ -40056,14 +40361,22 @@ var require_peer_runtime_network = __commonJS({
           const previous = this.peers.get(runtimeId);
           const current = next.get(runtimeId);
           if ((current == null ? void 0 : current.publicKey) === previous.publicKey) continue;
+          this.deniedPeers.delete(runtimeId);
           this._removePeer(runtimeId);
         }
         this.peers = next;
         for (const peer of this.peers.values()) {
-          if (!this.clients.has(peer.runtimeId)) this._addPeer(peer);
+          if (!this.deniedPeers.has(peer.runtimeId) && !this.clients.has(peer.runtimeId)) this._addPeer(peer);
         }
         this._notifyClients();
       }
+      _saveState() {
+        this.saveRosters({
+          version: 1,
+          rosters: Object.fromEntries(this.rosters),
+          revoked: [...this.revokedPeers]
+        });
+      }
       _addPeer(peer) {
         const network = this;
         let connection = {
@@ -40118,7 +40431,8 @@ var require_peer_runtime_network = __commonJS({
             ...details,
             scope: "peer",
             peer: peerRef(peer.runtimeId)
-          })
+          }),
+          timeouts: { reconnectMax: 5 * 6e4 }
         });
         client.subscribeEnvelopes((envelope) => {
           for (const listener of this.envelopeListeners) listener(peer.runtimeId, envelope, client);
@@ -40137,8 +40451,34 @@ var require_peer_runtime_network = __commonJS({
         this.serverSockets.delete(runtimeId);
         this._diagnostic("peer.removed", { peer: peerRef(runtimeId) });
       }
+      _denyPeer(runtimeId) {
+        if (!this.peers.has(runtimeId)) return;
+        this.deniedPeers.add(runtimeId);
+        this._removePeer(runtimeId);
+        this._diagnostic("peer.connection_denied", { peer: peerRef(runtimeId) });
+        this._notifyClients();
+      }
+      _rosterPeer(runtimeId) {
+        let found = null;
+        for (const roster of this.rosters.values()) {
+          for (const peer of roster) {
+            if (peer.runtimeId !== runtimeId) continue;
+            if (found && found.publicKey !== peer.publicKey) return null;
+            found = peer;
+          }
+        }
+        return found;
+      }
       _handleRelayEvent(event) {
         var _a, _b, _c;
+        if ((event == null ? void 0 : event.kind) === "peer.online" && ID_PATTERN.test(event.targetRuntimeId || "")) {
+          const client = this.clients.get(event.targetRuntimeId);
+          if (client && client.getState().phase !== "online") {
+            this._diagnostic("peer.online", { peer: peerRef(event.targetRuntimeId) });
+            client.reconnectNow();
+          }
+          return;
+        }
         if ((event == null ? void 0 : event.kind) === "peer.offline" && ID_PATTERN.test(event.targetRuntimeId || "")) {
           this._diagnostic("peer.offline", { peer: peerRef(event.targetRuntimeId) });
           (_a = this.clientSockets.get(event.targetRuntimeId)) == null ? void 0 : _a.offline();
@@ -40149,6 +40489,20 @@ var require_peer_runtime_network = __commonJS({
         if ((event == null ? void 0 : event.kind) !== "peer.message" || !ID_PATTERN.test(event.sourceRuntimeId || "") || !KEY_PATTERN.test(event.sourcePublicKey || "")) return;
         const peer = this.peers.get(event.sourceRuntimeId);
         if (!peer || peer.publicKey !== event.sourcePublicKey) {
+          const revokedPeer = this.revokedPeers.has(event.sourceRuntimeId) ? this._rosterPeer(event.sourceRuntimeId) : null;
+          if ((revokedPeer == null ? void 0 : revokedPeer.publicKey) === event.sourcePublicKey && event.stream === "to-runtime") {
+            let payload2;
+            try {
+              payload2 = decryptJson(event.box, this.keyPair.secretKey, revokedPeer.publicKey);
+            } catch {
+            }
+            if ((payload2 == null ? void 0 : payload2.kind) === "hello" && Array.isArray(payload2.features) && payload2.features.includes(PEER_DENIAL_FEATURE)) {
+              const box = encryptJson({ kind: "peer.denied" }, this.keyPair.secretKey, revokedPeer.publicKey);
+              if (this.relay.sendPeerMessage(revokedPeer.runtimeId, box, "to-client")) {
+                this._diagnostic("peer.denial_sent", { peer: peerRef(revokedPeer.runtimeId) });
+              }
+            }
+          }
           this._diagnostic("peer.message_rejected", {
             reason: peer ? "key_mismatch" : "not_introduced",
             peer: peerRef(event.sourceRuntimeId)
@@ -40341,7 +40695,7 @@ var require_headless_session_bridge = __commonJS({
       };
     }
     var HeadlessSessionBridge = class {
-      constructor({ runtime, remoteClient, peerRuntimeNetwork = null, dataPath, deliverMessage, randomBytes = crypto.randomBytes } = {}) {
+      constructor({ runtime, remoteClient, peerRuntimeNetwork = null, dataPath, deliverMessage, createPairingLink = null, randomBytes = crypto.randomBytes } = {}) {
         if (!runtime || !remoteClient || typeof deliverMessage !== "function" || !path.isAbsolute(dataPath || "")) {
           throw new Error("CAS Cloud session bridge configuration is invalid");
         }
@@ -40350,6 +40704,7 @@ var require_headless_session_bridge = __commonJS({
         this.peerRuntimeNetwork = peerRuntimeNetwork;
         this.dataPath = dataPath;
         this.deliverMessage = deliverMessage;
+        this.createPairingLink = createPairingLink;
         this.adminToken = randomBytes(32).toString("hex");
         this.sessionSecret = randomBytes(32);
         this.server = null;
@@ -40534,6 +40889,15 @@ var require_headless_session_bridge = __commonJS({
           if (request.method === "GET" && url.pathname === "/admin/remote-runtime") {
             return sendJson(response, 200, publicRemoteState(this.remoteClient));
           }
+          if (request.method === "POST" && url.pathname === "/admin/pairing-link") {
+            if (typeof this.createPairingLink !== "function") return sendJson(response, 503, { error: "Pairing is unavailable" });
+            try {
+              const result = await this.createPairingLink();
+              return sendJson(response, 201, { url: result.url, expiresAt: result.expiresAt });
+            } catch (_) {
+              return sendJson(response, 503, { error: "Could not create a connection link" });
+            }
+          }
           if (request.method === "POST" && url.pathname === "/admin/remote-runtime/pair") {
             const body = await readJson(request);
             if (typeof body.pairing !== "string" || !body.pairing.trim()) {
@@ -41126,6 +41490,19 @@ var require_headless_project_registry = __commonJS({
           const result = this._registerPath(resolved, root ? this._rootByPath(root.rootPath).root_id : null, { legacy: true });
           if (result.changed) changed = true;
         }
+        for (const row of this.db.prepare("SELECT project_id, path FROM runtime_projects WHERE registered = 1").all()) {
+          let resolved;
+          try {
+            resolved = fs.realpathSync(row.path);
+          } catch (_) {
+            continue;
+          }
+          if (resolved === row.path) continue;
+          const canonical = this.db.prepare("SELECT project_id FROM runtime_projects WHERE path = ? AND registered = 1").get(resolved);
+          if (!canonical || canonical.project_id === row.project_id) continue;
+          this.db.prepare("UPDATE runtime_projects SET registered = 0, updated_at = CURRENT_TIMESTAMP WHERE project_id = ?").run(row.project_id);
+          changed = true;
+        }
         return changed;
       }
       _resolveDirectory(candidate, label) {
@@ -41393,12 +41770,20 @@ var require_headless_project_registry = __commonJS({
         const revision = this._bumpRevision();
         return this._recordRequest(requestId, hash, { projectId: project.projectId, revision, updated: true });
       }
-      clone({ rootId, url, relativePath, requestId }) {
+      clone({ rootId, url, relativePath, displayName, color, icon, requestId }) {
         const normalizedUrl = validateGitUrl(url);
         const root = this._root(rootId);
         this._assertSecureCloneRoot(root);
         const normalizedRelative = validateCloneChildName(relativePath || cloneDirectoryName(normalizedUrl));
-        const hash = requestHash("clone", { rootId, url: normalizedUrl, relativePath: normalizedRelative });
+        const appearance = {
+          ...displayName !== void 0 ? { displayName: String(displayName || "").trim().slice(0, 120) } : {},
+          ...color !== void 0 ? { color: String(color || "").trim().slice(0, 32) } : {},
+          ...icon !== void 0 ? { icon } : {}
+        };
+        if (appearance.displayName !== void 0 && !appearance.displayName || appearance.icon !== void 0 && appearance.icon !== null && (typeof appearance.icon !== "string" || !ICON_PATTERN.test(appearance.icon))) {
+          throw runtimeError("invalid_project_update", "Project changes are invalid");
+        }
+        const hash = requestHash("clone", { rootId, url: normalizedUrl, relativePath: normalizedRelative, ...appearance });
         const duplicate = this._request(requestId, hash);
         if (duplicate) return duplicate;
         const destinationInfo = this._cloneDestination(root, normalizedRelative, normalizedUrl);
@@ -41415,6 +41800,7 @@ var require_headless_project_registry = __commonJS({
           requestId,
           rootId,
           url: normalizedUrl,
+          appearance,
           destination: destinationInfo.destination,
           temporaryDestination: null,
           temporaryIdentity: null,
@@ -41552,7 +41938,17 @@ var require_headless_project_registry = __commonJS({
               return this._finish(operation, "failed", "path_symlink_escape");
             }
             const registered = this._registerPath(resolved, root.root_id);
-            const revision = registered.changed ? this._bumpRevision() : this.getRevision();
+            if (Object.keys(operation.appearance).length) {
+              this.db.prepare(`UPDATE runtime_projects
+            SET display_name = COALESCE(?, display_name), color = COALESCE(?, color), icon = ?, updated_at = CURRENT_TIMESTAMP
+            WHERE project_id = ?`).run(
+                operation.appearance.displayName ?? null,
+                operation.appearance.color ?? null,
+                operation.appearance.icon === void 0 ? registered.row.icon || null : operation.appearance.icon,
+                registered.row.project_id
+              );
+            }
+            const revision = registered.changed || Object.keys(operation.appearance).length ? this._bumpRevision() : this.getRevision();
             this.db.prepare(`UPDATE runtime_project_operations SET state = 'succeeded', project_id = ?, error = NULL, updated_at = CURRENT_TIMESTAMP WHERE operation_id = ?`).run(registered.row.project_id, operation.operationId);
             this.running.delete(operation.operationId);
             this.destinations.delete(operation.destination);
@@ -48824,12 +49220,15 @@ var require_headless_runtime = __commonJS({
     var os = require("os");
     var path = require("path");
     var { DriverChatManager, SESSION_EVENT } = require_driver_chat_manager();
+    var { CHAT_PERMISSION_MODES } = require_chat_permission_modes();
+    var { classifyProviderStartupError } = require_provider_auth();
     var { boundedConversationMessages } = require_chat_history_pagination();
     var { MobileRuntime } = require_mobile_runtime();
     var { MobileRelayClient } = require_mobile_relay_client();
     var { createKeyPair } = require_mobile_crypto();
     var { RemoteRuntimeClient } = require_remote_runtime_client();
     var { RemoteRuntimeStore } = require_remote_runtime_store();
+    var { desktopConnectionLink } = require_desktop_connection_link();
     var { PeerRuntimeNetwork } = require_peer_runtime_network();
     var { HeadlessSessionBridge } = require_headless_session_bridge();
     var { createHeadlessChatPreferences } = require_headless_chat_preferences();
@@ -48896,18 +49295,11 @@ var require_headless_runtime = __commonJS({
       "workspace.git.switch",
       "workspace.git.create"
     ]);
-    var FINAL_COORDINATION_STATUSES = /* @__PURE__ */ new Set(["done", "pushed", "completed", "finished"]);
-    var COORDINATION_IDLE_MS = 30 * 6e4;
     var COORDINATION_COMPLETION_GRACE_MS = 5e3;
-    function isCoordinatedSessionEligible(session, now = Date.now()) {
-      var _a, _b, _c;
-      if (!session || session.state === "stopped" || typeof session.terminalUuid !== "string" || !session.terminalUuid) return false;
-      const status = typeof session.workStatus === "string" ? session.workStatus.trim().toLowerCase() : "";
-      if (FINAL_COORDINATION_STATUSES.has(status)) return false;
-      if (((_a = session.currentTurn) == null ? void 0 : _a.state) === "running" || status === "needs_input" || status === "working") return true;
-      const lastActivity = Number(session.lastActivityAt) || Date.parse(session.lastActivityAt);
-      if (Number.isFinite(lastActivity) && now - lastActivity > COORDINATION_IDLE_MS) return false;
-      return Array.from(((_c = (_b = session.items) == null ? void 0 : _b.values) == null ? void 0 : _c.call(_b)) || []).some((item) => (item == null ? void 0 : item.itemType) === "user_message" || (item == null ? void 0 : item.itemType) === "assistant_message");
+    function isCoordinatedSessionEligible(session) {
+      return Boolean(
+        session && session.state !== "stopped" && typeof session.terminalUuid === "string" && session.terminalUuid
+      );
     }
     function appDataPath({ env = process.env, platform = process.platform, home = os.homedir() } = {}) {
       if (platform === "linux") {
@@ -49163,7 +49555,8 @@ var require_headless_runtime = __commonJS({
       quotaService: suppliedQuotaService = null,
       generateConversationTitle: generateConversationTitleFn = generateConversationTitle,
       forkConversation: forkConversationFn = forkConversation,
-      spawnImpl
+      spawnImpl,
+      getuid = typeof process.getuid === "function" ? () => process.getuid() : null
     } = {}) {
       if (typeof getToken !== "function") throw new Error("CAS CLI requires an access token provider");
       if (!validIdentity(identity)) throw new Error("CAS CLI identity is invalid");
@@ -49205,7 +49598,17 @@ var require_headless_runtime = __commonJS({
       const startSessionWithPreferences = async (options) => {
         const launchOptions = chatPreferences.apply(options.agent, options);
         if (launchOptions.permissionMode === void 0) launchOptions.permissionMode = "default";
-        const started = await manager.startSession(launchOptions);
+        if (options.agent === "claude" && launchOptions.permissionMode === CHAT_PERMISSION_MODES.FULL_ACCESS && (getuid == null ? void 0 : getuid()) === 0) launchOptions.permissionMode = "default";
+        let started;
+        try {
+          started = await manager.startSession(launchOptions);
+        } catch (error) {
+          const status = classifyProviderStartupError(options.agent, error);
+          if (status) {
+            error.code = status.state === "not_installed" ? "provider_not_installed" : "provider_unauthenticated";
+          }
+          throw error;
+        }
         chatPreferences.write(started.agent || options.agent, {
           permissionMode: started.permissionMode,
           effort: started.effort
@@ -49652,10 +50055,8 @@ ${message}`;
         handoffSession,
         sessionAction,
         closeSession: async ({ sessionId }) => {
-          var _a;
-          return {
-            success: ((_a = await manager.stopSession(sessionId)) == null ? void 0 : _a.stopped) === true
-          };
+          await manager.stopSession(sessionId);
+          return { success: true };
         },
         minimizeSession: ({ sessionId }) => updateIdentity(sessionId, { minimized: true }),
         restoreSession: ({ sessionId }) => updateIdentity(sessionId, { minimized: false }),
@@ -49712,7 +50113,11 @@ ${message}`;
         remoteClient: remoteRuntimeClient,
         peerRuntimeNetwork,
         dataPath: resolvedDataPath,
-        deliverMessage: deliverCoordinatedMessage
+        deliverMessage: deliverCoordinatedMessage,
+        createPairingLink: async () => {
+          const pairing = await relay.createPairing();
+          return { url: desktopConnectionLink(pairing), expiresAt: pairing.expiresAt };
+        }
       });
       return {
         identity,
@@ -49755,7 +50160,7 @@ ${message}`;
                     }
                     terminalOrder = Math.max(terminalOrder, saved.terminalOrder || 0);
                     try {
-                      const started = await manager.startSession({
+                      const started = await startSessionWithPreferences({
                         agent: saved.agent,
                         ...saved.accountId && saved.accountId !== "current" ? { accountId: saved.accountId } : {},
                         cwd: saved.cwd,
@@ -50163,6 +50568,9 @@ var require_mobile_pairing_ipc = __commonJS({
   "src/infrastructure/mobile/mobile-pairing-ipc.js"(exports2, module2) {
     var MOBILE_PAIRING_EVENT = "mobile-pairing:event";
     var { PRODUCTION_MOBILE_WEB_ORIGIN } = require_mobile_build_channel();
+    var WARM_PAIRING_MIN_REMAINING_MS = 2 * 6e4;
+    var WARM_PAIRING_CHECK_INTERVAL_MS = 3e4;
+    var WARM_PAIRING_SERVE_MIN_REMAINING_MS = 15e3;
     function pairingPayload(pairing, mobileWebOrigin = PRODUCTION_MOBILE_WEB_ORIGIN) {
       const credentials = new URL("codeagentswarm://pair");
       credentials.searchParams.set("relay", new URL(pairing.relayOrigin).origin);
@@ -50184,13 +50592,49 @@ var require_mobile_pairing_ipc = __commonJS({
       setKeepAvailable = () => false,
       createQrDataUrl = (payload, options) => require("qrcode").toDataURL(payload, options)
     }) {
+      var _a;
       const broadcast = (message) => {
         for (const window2 of BrowserWindow.getAllWindows()) {
           if (!window2.isDestroyed()) window2.webContents.send(MOBILE_PAIRING_EVENT, message);
         }
       };
-      relayClient.on("status", (status) => broadcast({ type: "status", status }));
-      relayClient.on("event", (event) => broadcast({ type: "relay", event }));
+      const buildPairing = async () => {
+        const pairing = await relayClient.createPairing();
+        const qrDataUrl = await createQrDataUrl(
+          pairingPayload(pairing, mobileWebOrigin),
+          {
+            scale: 8,
+            margin: 4,
+            errorCorrectionLevel: "L",
+            color: { dark: "#111827", light: "#ffffff" }
+          }
+        );
+        return { expiresAt: pairing.expiresAt, pairingCode: pairing.pairingCode, qrDataUrl };
+      };
+      let warm = null;
+      let warming = null;
+      const warmPairing = () => {
+        if (warming || relayClient.status !== "online") return warming;
+        const remaining = warm ? warm.expiresAt - Date.now() : 0;
+        if (warm && (warm.served ? remaining > 0 : remaining > WARM_PAIRING_MIN_REMAINING_MS)) return null;
+        warming = buildPairing().then((result) => {
+          warm = result;
+        }, () => {
+        }).finally(() => {
+          warming = null;
+        });
+        return warming;
+      };
+      const warmTimer = setInterval(warmPairing, WARM_PAIRING_CHECK_INTERVAL_MS);
+      (_a = warmTimer.unref) == null ? void 0 : _a.call(warmTimer);
+      relayClient.on("status", (status) => {
+        broadcast({ type: "status", status });
+        if ((status == null ? void 0 : status.status) === "online") void warmPairing();
+      });
+      relayClient.on("event", (event) => {
+        if ((event == null ? void 0 : event.kind) === "pair.scanned") warm = null;
+        broadcast({ type: "relay", event });
+      });
       ipcMain.handle("mobile-pairing:status", () => ({
         success: true,
         ...relayClient.getStatus(),
@@ -50222,23 +50666,16 @@ var require_mobile_pairing_ipc = __commonJS({
       ipcMain.handle("mobile-pairing:create", async () => {
         try {
           if (getKeepAvailable() == null) setKeepAvailable(true);
-          const pairing = await relayClient.createPairing();
-          const qrDataUrl = await createQrDataUrl(
-            pairingPayload(pairing, mobileWebOrigin),
-            {
-              scale: 8,
-              margin: 4,
-              errorCorrectionLevel: "L",
-              color: { dark: "#111827", light: "#ffffff" }
-            }
-          );
+          if (warming) await warming;
+          if (!warm || warm.expiresAt - Date.now() < WARM_PAIRING_SERVE_MIN_REMAINING_MS) warm = await buildPairing();
+          warm.served = true;
           return {
             success: true,
-            expiresAt: pairing.expiresAt,
-            pairingCode: pairing.pairingCode,
+            expiresAt: warm.expiresAt,
+            pairingCode: warm.pairingCode,
             webUrl: mobileWebOrigin,
             keepAvailable: getKeepAvailable() === true,
-            qrDataUrl
+            qrDataUrl: warm.qrDataUrl
           };
         } catch (error) {
           return { success: false, error: error.message };
@@ -50274,6 +50711,7 @@ var require_cas = __commonJS({
     var { pairingPayload } = require_mobile_pairing_ipc();
     var { mobileWebOrigin } = require_mobile_build_channel();
     var { requestHeadlessBridge } = require_headless_session_bridge();
+    var { resolvePairingInput } = require_desktop_connection_link();
     var {
       DEFAULT_BACKEND_URL,
       appDataPath,
@@ -50282,8 +50720,7 @@ var require_cas = __commonJS({
       loadIdentity,
       resolveProject
     } = require_headless_runtime();
-    var version = true ? "0.0.6" : JSON.parse(fs.readFileSync(path.join(__dirname, "..", "..", "package.json"), "utf8")).version;
-    var DEFAULT_PAIRING_CODE_ORIGIN = "https://codeagentswarm-connect.elcaminodelprogramadorweb.workers.dev";
+    var version = true ? "0.0.15" : JSON.parse(fs.readFileSync(path.join(__dirname, "..", "..", "package.json"), "utf8")).version;
     function help() {
       return `CAS CLI ${version}
 
@@ -50293,6 +50730,7 @@ Usage:
   cas-cli setup
   cas-cli doctor
   cas-cli update
+  cas-cli connect
   cas-cli link PAIRING_CODE
   cas-cli remote-status
   cas-cli unlink
@@ -50319,7 +50757,7 @@ host-local configuration; either repeatable flag may be omitted.
       });
       const requestedCommand = parsed.positionals.shift() || "serve";
       const command = requestedCommand === "cloud" ? "serve" : requestedCommand;
-      if (!["serve", "setup", "doctor", "update", "help", "link", "remote-status", "unlink"].includes(command)) {
+      if (!["serve", "setup", "doctor", "update", "help", "connect", "link", "remote-status", "unlink"].includes(command)) {
         throw new Error(`Unknown command: ${command}`);
       }
       const pairingInput = command === "link" ? parsed.positionals.shift() : null;
@@ -50331,28 +50769,6 @@ host-local configuration; either repeatable flag may be omitted.
       const { ["projects-root"]: projectsRoot, ...values } = parsed.values;
       return { command, ...values, projectsRoot, ...pairingInput ? { pairingInput } : {} };
     }
-    async function resolvePairingInput(raw, fetchImpl = globalThis.fetch) {
-      const compact = String(raw || "").trim().toUpperCase().replace(/[\s-]/g, "");
-      if (!/^[A-HJ-NP-Z2-9]{8}$/.test(compact)) throw new Error("This pairing code is not valid");
-      const code = `${compact.slice(0, 4)}-${compact.slice(4)}`;
-      const origin = new URL(process.env.CAS_PAIRING_CODE_ORIGIN || DEFAULT_PAIRING_CODE_ORIGIN);
-      const local = ["localhost", "127.0.0.1", "[::1]"].includes(origin.hostname);
-      if (origin.protocol !== "https:" && !(origin.protocol === "http:" && local) || origin.username || origin.password) {
-        throw new Error("The pairing service is not secure");
-      }
-      try {
-        const response = await fetchImpl(`${origin.origin}/api/mobile/pairing-code/${encodeURIComponent(code)}`, {
-          headers: { Accept: "application/json" },
-          signal: AbortSignal.timeout(1e4)
-        });
-        if (!response.ok) throw new Error();
-        const body = await response.json();
-        if (typeof body.pairingUri !== "string") throw new Error();
-        return body.pairingUri;
-      } catch (_) {
-        throw new Error("This pairing code is invalid or has expired");
-      }
-    }
     async function linkRemoteRuntime(pairingInput, { output = console.log, request = requestHeadlessBridge } = {}) {
       var _a, _b;
       const pairing = await resolvePairingInput(pairingInput);
@@ -50374,6 +50790,13 @@ host-local configuration; either repeatable flag may be omitted.
       }
       throw new Error("Pairing timed out before it was confirmed on the Mac");
     }
+    async function createDesktopConnectionLink({ output = console.log, request = requestHeadlessBridge } = {}) {
+      const result = await request(appDataPath(), "POST", "/admin/pairing-link");
+      output("Open this link on the Mac running CodeAgentSwarm Desktop:");
+      output(result.url);
+      output("The link is single-use and expires in 5 minutes.");
+      return result;
+    }
     async function printRemoteStatus({ output = console.log, request = requestHeadlessBridge } = {}) {
       var _a, _b;
       const state = await request(appDataPath(), "GET", "/admin/remote-runtime");
@@ -50538,6 +50961,7 @@ CAS Cloud is serving ${host.projects.length} registered project${host.projects.l
       if (options.command === "doctor") return doctor();
       if (options.command === "setup") return setupCloud();
       if (options.command === "update") return updateInstallation();
+      if (options.command === "connect") return createDesktopConnectionLink();
       if (options.command === "link") return linkRemoteRuntime(options.pairingInput);
       if (options.command === "remote-status") return printRemoteStatus();
       if (options.command === "unlink") return unlinkRemoteRuntime();
@@ -50552,6 +50976,7 @@ CAS Cloud is serving ${host.projects.length} registered project${host.projects.l
     module2.exports = {
       AGENT_BINARIES,
       doctor,
+      createDesktopConnectionLink,
       help,
       linkRemoteRuntime,
       main,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codeagentswarm/cas-cloud",
-  "version": "0.0.6",
+  "version": "0.0.15",
   "description": "CAS Cloud runtime for remote CodeAgentSwarm sessions",
   "author": "Arturo Garcia <hello@codeagentswarm.com>",
   "license": "PolyForm-Noncommercial-1.0.0",