@cordfuse/crosstalk 7.0.0-alpha.7 → 7.0.0-alpha.9

package/bin/crosstalk.js

@@ -31,7 +31,6 @@ const SUBCOMMANDS = {
   up:      'up.js',
   down:    'down.js',
   rm:      'rm.js',
-  auth:    'auth.js',
   restart: 'restart.js',
   pull:    'pull.js',
   logs:    'logs.js',

package/commands/chat.js

@@ -1,110 +1,33 @@
-// crosstalk chat — the single interactive entry point into the container.
+// crosstalk chat — interactive entry into the container.
 //
-// Modes:
-//   crosstalk chat --agent <name>            # interactive with a specific agent
-//   crosstalk chat --agent <name> --login    # OAuth setup flow with browser-open
-//   crosstalk chat --shell                   # bash escape hatch (sysadmin / debug)
+// Modes (alpha.8):
+//   crosstalk chat --agent <name>     # interactive session with an agent CLI
+//   crosstalk chat --shell            # bash escape hatch (debug, install CLIs, run setup commands)
 //
-// --agent is required for non-shell modes. There's no implicit default
-// (containers may have multiple agent CLIs installed; the operator
-// must say which one to invoke).
+// --agent is required for non-shell mode. There's no implicit default;
+// containers may have multiple agent CLIs installed, the operator
+// picks one explicitly.
 //
-// Login flow design (root-cause fix, not a bandaid):
-//   The container has no DISPLAY / no browser / no xdg-open. So the agent
-//   CLI prints a URL and expects the operator to manually open it. THIS
-//   wrapper runs on the HOST — where the browser lives. It intercepts the
-//   URL on the agent's stdout and opens it directly via the OS-native
-//   browser launcher (`open` / `xdg-open` / `wslview` / `start`). Operator
-//   never has to read or copy-paste the URL.
-//
-//   COLUMNS=1000 is still set under --login as a contingency: if browser
-//   open fails (headless SSH session, missing xdg-open, etc.), the URL
-//   still renders unwrapped in the terminal for manual copy. That's the
-//   fallback, not the primary mechanism.
+// `--login` was removed in alpha.8. Per-agent auth is now handled via
+// `data/crosstalk.yaml`'s per-provider `env_file:` (env-injected at
+// agent spawn time inside the engine) plus operator-run setup commands
+// for agents whose auth is a stateful CLI act (e.g. codex). Recipes are
+// documented in transport/auth/README.md.
 
-import { spawn, spawnSync } from 'child_process';
+import { spawnSync } from 'child_process';
 import { requireInitialized } from '../lib/resolve.js';
 import { apiFor, ConnectError } from '../lib/api-client.js';
 import { flag, has } from '../lib/argv.js';
 
 const KNOWN_AGENTS = ['claude', 'codex', 'gemini', 'qwen', 'opencode', 'agy'];
 
-// URL extraction that survives agent TUI rendering. Naive regex against
-// raw stdout fails because agent CLIs (Claude in particular) draw a box
-// around the URL with line wraps every ~N chars; the captured URL is
-// truncated at the first wrap, with ANSI control chars leaking in at
-// the cut point. Real example from alpha.3 macOS test: extracted URL
-// ended with `%18%6b…` (CAN char + box-drawing artifact) instead of
-// the `redirect_uri=…` param, breaking OAuth.
-//
-// Approach:
-//   1. ANSI-strip everything (CSI / OSC / SS3 escapes).
-//   2. Strip control chars (0x00-0x1F except LF, plus DEL).
-//   3. Join line wraps that occur INSIDE a URL-safe character run —
-//      `<url-char>\n<url-char>` → `<url-char><url-char>`. Preserves real
-//      `<url-char>\n<non-url-char>` boundaries.
-//   4. Match `https?://<url-chars>+` against the joined buffer.
-//   5. Only fire when the character AFTER the matched URL is a true
-//      terminator (whitespace, end-of-buffer) — guards against acting
-//      on a partial URL still being written.
-
-const URL_SAFE_CLASS = "a-zA-Z0-9%/?#&=+\\-._~:@!$()*,;";
-const URL_RE = new RegExp(`https?://[${URL_SAFE_CLASS}]+`);
-
-function extractCompleteUrl(rawBuffer) {
-  // Strip ANSI CSI escapes (\x1B[ ... terminator).
-  let clean = rawBuffer.replace(/\x1B\[[0-9;?]*[a-zA-Z]/g, '');
-  // Strip ANSI OSC escapes (\x1B] ... BEL or ST).
-  clean = clean.replace(/\x1B\][^\x07\x1B]*(?:\x07|\x1B\\)/g, '');
-  // Strip SS3 escapes (\x1BO + one char).
-  clean = clean.replace(/\x1BO./g, '');
-  // Strip remaining single-char escapes that slipped through.
-  clean = clean.replace(/\x1B[^a-zA-Z0-9]/g, '');
-  // Strip control chars except LF (0x0A); we use LF for line-wrap rejoin.
-  clean = clean.replace(/[\x00-\x09\x0B-\x1F\x7F]/g, '');
-  // Rejoin URL-character wrap points: `<url-char>\n<url-char>` becomes
-  // `<url-char><url-char>`. Doesn't merge `<url-char>\n<space>` etc.
-  const safeRe = new RegExp(`[${URL_SAFE_CLASS}]\\n[${URL_SAFE_CLASS}]`, 'g');
-  let prev;
-  do {
-    prev = clean;
-    clean = clean.replace(safeRe, (m) => m[0] + m[2]);
-  } while (clean !== prev);
-
-  const match = clean.match(URL_RE);
-  if (!match) return null;
-  // Require a terminator after the URL — without it, the URL may still
-  // be growing in subsequent stdout chunks. Terminator = whitespace,
-  // quote/angle, or end-of-buffer-with-trailing-newline.
-  const after = clean.slice(match.index + match[0].length);
-  if (after.length === 0) return null;       // EOF-as-grow case, wait
-  if (!/^[\s<>"']/.test(after)) return null; // URL still continuing
-  return match[0];
-}
-
-function openInBrowser(url) {
-  const cmd =
-    process.platform === 'darwin'         ? 'open'      :
-    process.platform === 'win32'          ? 'start'     :
-    process.env['WSL_DISTRO_NAME']        ? 'wslview'   :
-    /* default Linux */                     'xdg-open';
-  try {
-    const r = spawnSync(cmd, [url], { stdio: 'ignore' });
-    return r.status === 0;
-  } catch {
-    return false;
-  }
-}
-
 function usage(exit = 0) {
   const w = exit === 0 ? process.stdout : process.stderr;
   w.write(
-`Usage: crosstalk chat --agent <name> [--login]
+`Usage: crosstalk chat --agent <name>
        crosstalk chat --shell
 
-Opens an interactive session inside the engine container — the single
-PTY-wrapped entry point for everything you'd do inside the container
-(daily chat, OAuth setup, sysadmin).
+Opens an interactive session inside the engine container.
 
 --agent is REQUIRED for any chat mode. Containers can have multiple
 agent CLIs installed; the operator must say which one to invoke.
@@ -112,42 +35,27 @@ agent CLIs installed; the operator must say which one to invoke.
 Supported agents: ${KNOWN_AGENTS.join(', ')}.
 
 Modes:
-  --agent <name>        Interactive with the named agent.
-  --agent <name> --login   First-time auth flow. Intercepts the OAuth
-                        URL on the agent's stdout and opens it in your
-                        default browser via the OS-native launcher.
-                        Falls back to printing the URL unwrapped if no
-                        browser is reachable (headless / SSH session).
-  --shell               Drop into bash (install agent CLIs, debug,
-                        inspect state). No --agent needed.
+  --agent <name>   Interactive with the named agent CLI. Use the
+                   agent's own keys/commands for first-time setup
+                   (see transport/auth/README.md for recipes).
+  --shell          Drop into bash (install agent CLIs, debug, run
+                   one-time auth setup commands like
+                   \`codex login --with-api-key\`).
 
 Examples:
   crosstalk chat --agent claude               # interactive claude
   crosstalk chat --agent gemini               # interactive gemini
-  crosstalk chat --agent claude --login       # OAuth, claude
-  crosstalk chat --agent codex  --login       # OAuth, codex
   crosstalk chat --shell                      # bash
 `,
   );
   process.exit(exit);
 }
 
-// Detect host terminal dims with sane fallbacks. Pass into the
-// container via -e COLUMNS/LINES so the agent CLI renders at the
-// operator's real terminal size instead of docker's 80×24 fallback.
-// (When stdout is piped — like in --login — docker can't auto-detect
-// the host's stdout terminal, which is mac's alpha.6 bug D.)
-function hostTermDims() {
-  const cols = process.stdout.columns || process.stderr.columns || 120;
-  const rows = process.stdout.rows    || process.stderr.rows    || 40;
-  return { cols, rows };
-}
-
 function runInteractive(container, command, env = {}) {
   // Full TTY passthrough — docker exec -it gives the container a real
   // PTY, and stdio: 'inherit' forwards stdin/stdout/stderr from the
-  // operator's terminal. Agent CLIs get to render their rich TUI
-  // normally.
+  // operator's terminal. Agent CLIs render their rich TUI normally and
+  // SIGWINCH propagates from the host's tty to the container's PTY.
   const envFlags = [];
   for (const [k, v] of Object.entries(env)) {
     envFlags.push('--env', `${k}=${v}`);
@@ -158,106 +66,6 @@ function runInteractive(container, command, env = {}) {
   return r.status ?? 1;
 }
 
-// Per-agent login command. Returns null for agents without an OAuth
-// path (gemini, qwen, opencode) — these need env-var auth, not browser
-// OAuth. The full audit (cachy 2026-06-14) confirmed each agent's
-// surface:
-//   claude  → `claude auth login` (clean single-line URL output)
-//   codex   → `codex login`       (clean single-line URL output)
-//   agy     → `agy --print init`  (triggers OAuth, clean URL)
-// We use the explicit auth subcommand instead of bare invocation —
-// that's mac's bug D fix root cause. Bare `claude` drops into a TUI
-// with line wraps + winsize sensitivity that broke URL extraction
-// across alpha.3 → alpha.6. The official auth subcommand prints a
-// plain single-line URL on stdout, no TUI involved.
-function loginCommand(agent) {
-  if (agent === 'claude') return ['claude', 'auth', 'login'];
-  if (agent === 'codex')  return ['codex', 'login'];
-  if (agent === 'agy')    return ['agy', '--print', 'init'];
-  return null;  // gemini, qwen, opencode — env-based
-}
-
-// Per-agent env-var hint for the no-OAuth agents.
-function envHint(agent) {
-  if (agent === 'gemini')   return 'GEMINI_API_KEY';
-  if (agent === 'qwen')     return 'OPENAI_API_KEY (qwen --auth-type openai)';
-  if (agent === 'opencode') return 'per-provider keys in opencode config';
-  return null;
-}
-
-function runLogin(container, agent) {
-  const cmd = loginCommand(agent);
-  if (!cmd) {
-    const env = envHint(agent);
-    process.stderr.write(
-      `crosstalk chat --login --agent ${agent}: this agent has no browser OAuth flow.\n` +
-      (env ? `  Use environment-based auth instead:\n    crosstalk auth paste --agent ${agent}\n  (or set ${env} directly in docker-compose.yml)\n` : '') +
-      `  Documented in GUIDE-CLI.md § Agent auth.\n`,
-    );
-    return Promise.resolve(1);
-  }
-
-  // Pass host terminal dims explicitly. Docker exec -t normally sizes
-  // the container PTY off its stdout terminal, but we PIPE stdout (to
-  // scrape the OAuth URL), so docker has no TTY to size from and falls
-  // back to 80×24 — that's mac's bug D root cause. Setting COLUMNS/LINES
-  // env vars gets the agent CLI to render at the right size from the
-  // start. (Live SIGWINCH updates aren't propagated — docker env is
-  // set-at-spawn — but OAuth flows are short; operators don't typically
-  // resize the terminal mid-auth.)
-  const { cols, rows } = hostTermDims();
-
-  return new Promise((resolve) => {
-    const child = spawn(
-      'docker',
-      ['exec', '-it',
-       '-e', `COLUMNS=${cols}`,
-       '-e', `LINES=${rows}`,
-       '-e', 'TERM=xterm-256color',
-       container, ...cmd],
-      { stdio: ['inherit', 'pipe', 'inherit'] },
-    );
-
-    // SIGWINCH handler: docker env is set-at-spawn so we can't dynamically
-    // resize the in-container PTY without a control channel (would need
-    // node-pty or a sidecar process). Best-effort: surface that a resize
-    // happened so the operator knows why the TUI may not have responded.
-    const onWinch = () => {
-      const { cols: c, rows: r } = hostTermDims();
-      process.stderr.write(
-        `\n[crosstalk chat] Terminal resized to ${c}×${r} — in-container PTY won't update mid-session. ` +
-        `Exit (Ctrl-C) and retry if rendering is off.\n`,
-      );
-    };
-    process.on('SIGWINCH', onWinch);
-
-    let opened = false;
-    let buffer = '';
-    child.stdout.on('data', (chunk) => {
-      process.stdout.write(chunk);
-      if (opened) return;
-      buffer += chunk.toString();
-      const url = extractCompleteUrl(buffer);
-      if (!url) return;
-      opened = true;
-      const ok = openInBrowser(url);
-      process.stdout.write(
-        ok
-          ? `\n[crosstalk chat] Opened auth URL in your default browser.\n`
-          : `\n[crosstalk chat] Could not auto-open browser. Open this URL manually:\n  ${url}\n`,
-      );
-    });
-    child.on('exit', (code) => {
-      process.removeListener('SIGWINCH', onWinch);
-      resolve(code ?? 0);
-    });
-    child.on('error', () => {
-      process.removeListener('SIGWINCH', onWinch);
-      resolve(1);
-    });
-  });
-}
-
 export async function run(argv) {
   if (has(argv, '--help') || has(argv, '-h')) usage(0);
 
@@ -307,9 +115,5 @@ export async function run(argv) {
     return 1;
   }
 
-  if (has(argv, '--login')) {
-    return await runLogin(name, agent);
-  }
-
   return runInteractive(name, agent);
 }

package/commands/init.js

@@ -34,7 +34,7 @@ import {
 } from '../lib/resolve.js';
 
 const DEFAULT_IMAGE = process.env.CROSSTALK_IMAGE
-  ?? 'ghcr.io/cordfuse/crosstalk-server:7.0.0-alpha.7';
+  ?? 'ghcr.io/cordfuse/crosstalk-server:7.0.0-alpha.8';
 
 function usage(exit = 0) {
   const w = exit === 0 ? process.stdout : process.stderr;
@@ -129,13 +129,6 @@ export async function run(argv) {
     }
   }
 
-  // Ensure an empty auth.env exists so compose's env_file: can reference
-  // it without erroring on missing file. Operator-owned, 0600 — even
-  // when empty it's where `crosstalk auth paste` will land tokens.
-  if (!existsSync(paths.authEnvFile)) {
-    writeFileSync(paths.authEnvFile, '', { mode: 0o600 });
-  }
-
   // ── Phase 2: Transport scaffold ────────────────────────────────────
   // The template-scaffold check is "does CROSSTALK-VERSION exist?" NOT
   // ".git exists" — git init is a separate phase, and the engine refuses

package/commands/run.js

@@ -10,7 +10,7 @@
 import { readFileSync, existsSync, statSync } from 'fs';
 import { apiFor } from '../lib/api-client.js';
 import { reportAndExit } from '../lib/errors.js';
-import { flag, has } from '../lib/argv.js';
+import { flag, has, positionals } from '../lib/argv.js';
 
 const FLAGS_WITH_VALUE = new Set(['--type', '--to', '--as', '--fanout', '--channel', '--from', '--containername', '-c']);
 
@@ -56,18 +56,11 @@ export async function run(argv) {
   const type = flag(argv, '--type');
   if (type !== 'primitive' && type !== 'workflow') usage(1);
 
-  // The body is the last non-flag arg. Walk argv backwards skipping
-  // flag values.
-  let bodyArg;
-  for (let i = argv.length - 1; i >= 0; i--) {
-    const a = argv[i];
-    if (a.startsWith('-')) break;
-    // Make sure we're not the value of a flag like `--to <value>`
-    const prev = argv[i - 1];
-    if (prev && FLAGS_WITH_VALUE.has(prev)) continue;
-    bodyArg = a;
-    break;
-  }
+  // Body is the last positional. positionals() skips flag values so the
+  // body resolves regardless of flag order — `--containername a8 hello`
+  // and `hello --containername a8` both work.
+  const pos = positionals(argv, [...FLAGS_WITH_VALUE]);
+  const bodyArg = pos[pos.length - 1];
 
   const body = resolveBody(bodyArg);
   if (body == null || body.length === 0) {

package/commands/status.js

@@ -34,10 +34,10 @@ export async function run(argv) {
     if (installed && installed.length > 0) {
       const verb = installed.length === 1 ? 'references it' : 'references them';
       process.stdout.write(
-        `  (${installed.join(', ')} installed in the container but no data/models.yaml entry ${verb} — add one to claim)\n`,
+        `  (${installed.join(', ')} installed in the container but no data/crosstalk.yaml entry ${verb} — add one to claim)\n`,
       );
     } else {
-      process.stdout.write('  (no model CLIs found inside the container — install one via `crosstalk chat --shell` and add an entry to data/models.yaml)\n');
+      process.stdout.write('  (no model CLIs found inside the container — install one via `crosstalk chat --shell` and add an entry to data/crosstalk.yaml)\n');
     }
   } else {
     for (const m of s.claimed_models) process.stdout.write(`  - ${m}\n`);

package/commands/up.js

@@ -24,7 +24,7 @@ import {
 } from '../lib/resolve.js';
 
 const DEFAULT_IMAGE = process.env.CROSSTALK_IMAGE
-  ?? 'ghcr.io/cordfuse/crosstalk-server:7.0.0-alpha.7';
+  ?? 'ghcr.io/cordfuse/crosstalk-server:7.0.0-alpha.8';
 
 function usage(exit = 0) {
   const w = exit === 0 ? process.stdout : process.stderr;
@@ -69,8 +69,6 @@ services:
       - ${paths.transportDir}:/var/lib/crosstalk-transport
       - ${paths.crosstalkRoot}:/crosstalk-root
       - ${paths.crosstalkState}:/var/lib/crosstalk-state
-    env_file:
-      - ${paths.authEnvFile}
     environment:
       CROSSTALK_ALIAS: ${alias}
       CROSSTALK_UID: "${uid}"

package/lib/resolve.js

@@ -66,7 +66,6 @@ export function storagePaths(name, mode = storageMode()) {
     crosstalkState: join(root, 'crosstalk-state'),
     composeFile:    join(root, 'docker-compose.yml'),
     portFile:       join(root, 'api-port'),
-    authEnvFile:    join(root, 'auth.env'),
   };
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cordfuse/crosstalk",
-  "version": "7.0.0-alpha.7",
+  "version": "7.0.0-alpha.9",
   "description": "Crosstalk client — host-side CLI that talks to the crosstalkd daemon running inside the crosstalk-server container.",
   "type": "module",
   "license": "MIT",

package/commands/auth.js

@@ -1,218 +0,0 @@
-// crosstalk auth — manage agent auth tokens/keys.
-//
-// One subverb: `paste`. Operator runs the agent's headless-token
-// generator on their host (`claude setup-token`, etc.), pastes the
-// resulting token at our prompt, and we persist it in the container's
-// env so subsequent dispatch + chat invocations are authenticated.
-//
-// Storage: <base>/<name>/auth.env (0600, operator-UID owned). Docker
-// Compose's `env_file:` references it; each line is `KEY=value`.
-// Existing keys are replaced in-place; new keys append. Empty lines
-// and `#` comments preserved.
-//
-// Why this exists: 5 of the 6 supported agents work cleanly with env-
-// var auth (the headless path), but none of them have a uniform "set
-// the token" UX inside the container. This verb is the operator's
-// one-stop shop — same UX for any agent.
-//
-// Per-agent env var (the audit on 2026-06-14 confirmed each):
-//   claude → CLAUDE_CODE_OAUTH_TOKEN   (preferred: `claude setup-token`)
-//            ANTHROPIC_API_KEY         (alternate: Console API key)
-//   codex  → OPENAI_API_KEY            (preferred)
-//            CODEX_ACCESS_TOKEN        (alternate: device-auth output)
-//   gemini → GEMINI_API_KEY
-//   qwen   → OPENAI_API_KEY            (qwen --auth-type openai)
-//   agy    → none (interactive OAuth only; errors with hint)
-
-import { existsSync, readFileSync, writeFileSync } from 'fs';
-import { createInterface } from 'readline';
-import { has, flag } from '../lib/argv.js';
-import { requireInitialized, DEFAULT_CONTAINER_NAME } from '../lib/resolve.js';
-
-const AGENT_ENV = {
-  claude:   { default: 'CLAUDE_CODE_OAUTH_TOKEN', label: 'OAuth token' },
-  codex:    { default: 'OPENAI_API_KEY',          label: 'API key' },
-  gemini:   { default: 'GEMINI_API_KEY',          label: 'API key' },
-  qwen:     { default: 'OPENAI_API_KEY',          label: 'API key' },
-  opencode: { default: 'OPENAI_API_KEY',          label: 'provider API key' },
-};
-
-const AGENT_GEN_CMD = {
-  claude:   'claude setup-token        # on a host with a browser',
-  codex:    'echo $OPENAI_API_KEY      # or platform.openai.com/api-keys',
-  gemini:   'echo $GEMINI_API_KEY      # or aistudio.google.com/apikey',
-  qwen:     'echo $OPENAI_API_KEY      # OpenAI-compatible',
-  opencode: 'echo $OPENAI_API_KEY      # or provider-specific',
-};
-
-// Control byte values used by the TTY prompt — avoid embedding raw
-// bytes inline so the file is editor/linter clean.
-const CTRL_C = String.fromCharCode(3);   // 0x03 — interrupt
-const CTRL_D = String.fromCharCode(4);   // 0x04 — EOF
-const BS     = String.fromCharCode(8);   // 0x08 — backspace
-const DEL    = String.fromCharCode(127); // 0x7F — terminal backspace
-
-function usage(exit = 0) {
-  const w = exit === 0 ? process.stdout : process.stderr;
-  w.write(
-`Usage: crosstalk auth paste --agent <name> [--containername <name>]
-
-Persists an auth token/key for an agent CLI into the container's
-environment. Operator generates the value on the host (which has a
-browser) and pastes at the prompt; crosstalk writes it to
-<base>/<name>/auth.env. Subsequent dispatch + chat invocations pick
-it up via the engine container's env.
-
-Options:
-  --agent <name>           One of: claude, codex, gemini, qwen, opencode.
-                           agy is interactive-only; use 'crosstalk chat
-                           --agent agy --login' for OAuth instead.
-  --containername <name>   Which crosstalk container to set the env on
-                           (default: 'crosstalk').
-  -c <name>                Shorthand for --containername.
-
-Reads from stdin (hidden) — if the input isn't a TTY, the entire stdin
-is read as the token (e.g. piped from a setup script).
-
-After paste, run 'crosstalk restart' to pick up the new env.
-`,
-  );
-  process.exit(exit);
-}
-
-function promptHidden(promptText) {
-  return new Promise((resolve) => {
-    process.stderr.write(promptText);
-    if (!process.stdin.isTTY) {
-      let buf = '';
-      process.stdin.on('data', (chunk) => { buf += chunk.toString(); });
-      process.stdin.on('end', () => resolve(buf.trim()));
-      return;
-    }
-    if (typeof process.stdin.setRawMode !== 'function') {
-      const rl = createInterface({ input: process.stdin, output: process.stderr });
-      rl.question('', (ans) => { rl.close(); resolve(ans.trim()); });
-      return;
-    }
-    process.stdin.setRawMode(true);
-    process.stdin.resume();
-    process.stdin.setEncoding('utf-8');
-    let buf = '';
-    const onData = (chunk) => {
-      for (const ch of chunk) {
-        if (ch === '\r' || ch === '\n') {
-          process.stderr.write('\n');
-          process.stdin.setRawMode(false);
-          process.stdin.pause();
-          process.stdin.removeListener('data', onData);
-          resolve(buf.trim());
-          return;
-        }
-        if (ch === CTRL_C || ch === CTRL_D) {
-          process.stderr.write('\n');
-          process.stdin.setRawMode(false);
-          process.exit(130);
-        }
-        if (ch === BS || ch === DEL) {
-          buf = buf.slice(0, -1);
-          continue;
-        }
-        buf += ch;
-      }
-    };
-    process.stdin.on('data', onData);
-  });
-}
-
-// Upsert a KEY=value line in env-file content. Preserves other lines +
-// comments. Returns the new content.
-function upsertEnv(existing, key, value) {
-  const lines = existing.split('\n');
-  let replaced = false;
-  const out = lines.map((line) => {
-    if (line.startsWith(`${key}=`)) {
-      replaced = true;
-      return `${key}=${value}`;
-    }
-    return line;
-  });
-  if (!replaced) {
-    while (out.length > 0 && out[out.length - 1] === '') out.pop();
-    out.push(`${key}=${value}`);
-    out.push('');
-  }
-  return out.join('\n');
-}
-
-export async function run(argv) {
-  if (has(argv, '--help') || has(argv, '-h')) usage(0);
-
-  const pos = argv.filter((a) => !a.startsWith('-'));
-  const subverb = pos[0];
-  if (subverb !== 'paste') {
-    if (subverb) {
-      process.stderr.write(`crosstalk auth: unknown subverb '${subverb}'. Try 'paste'.\n`);
-    } else {
-      usage(1);
-    }
-    return 1;
-  }
-
-  const agent = flag(argv, '--agent');
-  if (!agent) {
-    process.stderr.write(`crosstalk auth paste: --agent <name> is required.\n`);
-    return 1;
-  }
-
-  if (agent === 'agy') {
-    process.stderr.write(
-      `crosstalk auth paste: agy has no headless env-var path — its only auth is interactive OAuth.\n` +
-      `  Use 'crosstalk chat --agent agy --login' to set up auth.\n`,
-    );
-    return 1;
-  }
-
-  const cfg = AGENT_ENV[agent];
-  if (!cfg) {
-    process.stderr.write(
-      `crosstalk auth paste: unknown agent '${agent}'.\n` +
-      `  Supported: ${Object.keys(AGENT_ENV).join(', ')}.\n`,
-    );
-    return 1;
-  }
-
-  const { name, paths } = requireInitialized(argv);
-
-  if (process.stdin.isTTY) {
-    process.stderr.write(
-      `\nPasting ${cfg.label} for ${agent} into '${name}' container.\n` +
-      `  Env var: ${cfg.default}\n` +
-      `  Storage: ${paths.authEnvFile}\n` +
-      `\nGenerate on host:\n  ${AGENT_GEN_CMD[agent] ?? '(see agent docs)'}\n` +
-      `\nPaste the value below (input hidden, press Enter):\n`,
-    );
-  }
-  const value = await promptHidden('> ');
-  if (!value) {
-    process.stderr.write(`crosstalk auth paste: empty input — aborted.\n`);
-    return 1;
-  }
-  if (value.includes('\n')) {
-    process.stderr.write(
-      `crosstalk auth paste: input contains a newline. Tokens are single-line; check copy/paste.\n`,
-    );
-    return 1;
-  }
-
-  const existing = existsSync(paths.authEnvFile)
-    ? readFileSync(paths.authEnvFile, 'utf-8')
-    : '';
-  const updated = upsertEnv(existing, cfg.default, value);
-  writeFileSync(paths.authEnvFile, updated, { mode: 0o600 });
-
-  process.stdout.write(
-    `\nSaved ${cfg.default} to ${paths.authEnvFile}.\n` +
-    `Run 'crosstalk restart${name === DEFAULT_CONTAINER_NAME ? '' : ` --containername ${name}`}' to pick up the new env.\n`,
-  );
-  return 0;
-}