@ctrl-spc/cs 0.1.0

package/dist/agents.js

@@ -0,0 +1,39 @@
+import { accessSync, constants } from 'node:fs';
+import { homedir } from 'node:os';
+import { delimiter, join } from 'node:path';
+const AGENTS = ['claude', 'codex'];
+/** Well-known install locations Claude/Codex land in but that a plain
+ *  Terminal's PATH often misses (notably the Codex CLI inside ChatGPT.app). */
+function fallbackPaths(agent) {
+    if (agent === 'claude') {
+        return [join(homedir(), '.local/bin/claude'), '/opt/homebrew/bin/claude', '/usr/local/bin/claude'];
+    }
+    return [
+        process.env.CODEX_CLI_PATH ?? '',
+        '/Applications/ChatGPT.app/Contents/Resources/codex',
+        join(homedir(), '.local/bin/codex'),
+        '/opt/homebrew/bin/codex',
+        '/usr/local/bin/codex',
+    ].filter(Boolean);
+}
+function isExecutable(path) {
+    try {
+        accessSync(path, constants.X_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function resolve(agent) {
+    const dirs = (process.env.PATH ?? '').split(delimiter).filter(Boolean);
+    for (const dir of dirs) {
+        if (isExecutable(join(dir, agent)))
+            return join(dir, agent);
+    }
+    return fallbackPaths(agent).find(isExecutable) ?? null;
+}
+/** Which supported coding agents are installed on this machine, stable order. */
+export function detectAgents() {
+    return AGENTS.filter((a) => resolve(a) !== null);
+}

package/dist/autostart.js

@@ -0,0 +1,127 @@
+import { execFileSync } from 'node:child_process';
+import { existsSync, mkdirSync, rmSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import { configDir } from './config.js';
+const LABEL = 'com.ctrl-spc.presence';
+/** Set once the user runs `cs autostart off`, so default-on never re-enables it. */
+function offMarkerPath() {
+    return join(configDir(), 'autostart-off');
+}
+/** True if the login item is currently installed for this OS. */
+export function autostartEnabled() {
+    if (process.platform === 'darwin')
+        return existsSync(plistPath());
+    if (process.platform === 'win32')
+        return existsSync(startupVbsPath());
+    return false;
+}
+/**
+ * Default-on: install the login item the first time we come online, unless the
+ * user explicitly opted out. Idempotent and best-effort — already-enabled is a
+ * no-op (so the launchd/VBS-spawned `cs start` doesn't re-install itself), and
+ * an unsupported platform or transient error never breaks coming online.
+ */
+export function ensureAutostart() {
+    if (existsSync(offMarkerPath()) || autostartEnabled())
+        return;
+    try {
+        autostartOn();
+    }
+    catch { /* unsupported platform or transient failure — ignore */ }
+}
+function plistPath() {
+    return join(homedir(), 'Library', 'LaunchAgents', `${LABEL}.plist`);
+}
+/** Absolute path to this package's built entry (dist/index.js). */
+function entryPath() {
+    return join(dirname(fileURLToPath(import.meta.url)), 'index.js');
+}
+/** Comes online automatically at login. Backend per OS. */
+export function autostartOn() {
+    if (existsSync(offMarkerPath()))
+        rmSync(offMarkerPath());
+    if (process.platform === 'darwin')
+        return macOn();
+    if (process.platform === 'win32')
+        return winOn();
+    throw new Error('Auto-start supports macOS and Windows only.');
+}
+/** Stops coming online at login, and pins it off so default-on won't re-enable. */
+export function autostartOff() {
+    mkdirSync(configDir(), { recursive: true });
+    writeFileSync(offMarkerPath(), '');
+    if (process.platform === 'darwin')
+        return macOff();
+    if (process.platform === 'win32')
+        return winOff();
+    throw new Error('Auto-start supports macOS and Windows only.');
+}
+// --- Windows: hidden VBS shim in the user's Startup folder --------------------
+// Runs `cs start` at login with no console window (WScript window style 0).
+// ponytail: no crash-restart supervision like launchd's KeepAlive — a plain
+// login shim. Upgrade to a Scheduled Task with restart settings if the daemon
+// crashing between logins ever matters.
+function startupVbsPath() {
+    const appData = process.env.APPDATA || join(homedir(), 'AppData', 'Roaming');
+    return join(appData, 'Microsoft', 'Windows', 'Start Menu', 'Programs', 'Startup', 'ctrl-spc-presence.vbs');
+}
+function winOn() {
+    const path = startupVbsPath();
+    mkdirSync(dirname(path), { recursive: true });
+    // Doubled quotes escape quotes inside a VBS string literal, so the Run target
+    // becomes: "<node>" "<dist/index.js>" start
+    const command = `"${process.execPath}" "${entryPath()}" start`.replace(/"/g, '""');
+    writeFileSync(path, `Set s = CreateObject("WScript.Shell")\r\ns.Run "${command}", 0, False\r\n`);
+    console.log('Auto-start enabled. CTRL+SPC comes online at login. Disable: cs autostart off');
+}
+function winOff() {
+    const path = startupVbsPath();
+    if (existsSync(path))
+        rmSync(path);
+    console.log('Auto-start disabled.');
+}
+// --- macOS: launchd LaunchAgent ----------------------------------------------
+/** Installs a LaunchAgent that comes online at login, KeepAlive-supervised. */
+function macOn() {
+    const uid = process.getuid?.() ?? 0;
+    const node = process.execPath;
+    const entry = entryPath();
+    const logDir = join(homedir(), '.config', 'ctrl-spc-v2');
+    mkdirSync(logDir, { recursive: true });
+    mkdirSync(dirname(plistPath()), { recursive: true });
+    const plist = `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0"><dict>
+  <key>Label</key><string>${LABEL}</string>
+  <key>ProgramArguments</key><array>
+    <string>${node}</string><string>${entry}</string><string>start</string>
+  </array>
+  <key>RunAtLoad</key><true/>
+  <key>KeepAlive</key><true/>
+  <key>StandardOutPath</key><string>${join(logDir, 'daemon.log')}</string>
+  <key>StandardErrorPath</key><string>${join(logDir, 'daemon.log')}</string>
+  <key>EnvironmentVariables</key><dict><key>PATH</key><string>/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin</string></dict>
+</dict></plist>
+`;
+    writeFileSync(plistPath(), plist);
+    try {
+        execFileSync('launchctl', ['bootout', `gui/${uid}`, plistPath()], { stdio: 'ignore' });
+    }
+    catch { /* not loaded yet — fine */ }
+    execFileSync('launchctl', ['bootstrap', `gui/${uid}`, plistPath()]);
+    console.log('Auto-start enabled. CTRL+SPC comes online at login. Disable: cs autostart off');
+}
+/** Removes the LaunchAgent. */
+function macOff() {
+    const uid = process.getuid?.() ?? 0;
+    if (existsSync(plistPath())) {
+        try {
+            execFileSync('launchctl', ['bootout', `gui/${uid}`, plistPath()], { stdio: 'ignore' });
+        }
+        catch { /* already out */ }
+        rmSync(plistPath());
+    }
+    console.log('Auto-start disabled.');
+}

package/dist/browser.js

@@ -0,0 +1,13 @@
+import { spawn } from 'node:child_process';
+/** Opens `url` in the default browser. Never fatal — callers print the URL too. */
+export function openBrowser(url) {
+    const { command, args } = process.platform === 'darwin' ? { command: 'open', args: [url] }
+        : process.platform === 'win32' ? { command: 'rundll32', args: ['url.dll,FileProtocolHandler', url] }
+            : { command: 'xdg-open', args: [url] };
+    try {
+        const child = spawn(command, args, { detached: true, stdio: 'ignore' });
+        child.on('error', () => { });
+        child.unref();
+    }
+    catch { /* missing opener is non-fatal */ }
+}

package/dist/config.js

@@ -0,0 +1,57 @@
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync, chmodSync } from 'node:fs';
+import { homedir, hostname } from 'node:os';
+import { randomUUID } from 'node:crypto';
+import { join } from 'node:path';
+/** Own config dir, isolated from the v1 CLI: `~/.config/ctrl-spc-v2`. */
+export function configDir() {
+    return process.env.CTRL_SPC_V2_CONFIG_DIR || join(homedir(), '.config', 'ctrl-spc-v2');
+}
+function filePath(name) {
+    return join(configDir(), name);
+}
+function writeJson(name, value) {
+    mkdirSync(configDir(), { recursive: true });
+    const path = filePath(name);
+    writeFileSync(path, JSON.stringify(value, null, 2), { mode: 0o600 });
+    chmodSync(path, 0o600); // mode arg only applies on create; chmod on rewrite too
+}
+export function machineHostname() {
+    return hostname().replace(/\.local$/i, '') || 'This machine';
+}
+/** Stable per-machine identity, created once and reused. */
+export function getMachineIdentity() {
+    const path = filePath('machine.json');
+    if (existsSync(path)) {
+        try {
+            const s = JSON.parse(readFileSync(path, 'utf8'));
+            if (typeof s.id === 'string' && s.id && typeof s.name === 'string' && s.name) {
+                return { id: s.id, name: s.name };
+            }
+        }
+        catch { /* corrupt → recreate */ }
+    }
+    const identity = { id: randomUUID(), name: machineHostname() };
+    writeJson('machine.json', identity);
+    return identity;
+}
+export function readSession() {
+    const path = filePath('session.json');
+    if (!existsSync(path))
+        return null;
+    try {
+        return JSON.parse(readFileSync(path, 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+export function writeSession(session) {
+    writeJson('session.json', session);
+}
+export function clearSession() {
+    const path = filePath('session.json');
+    if (!existsSync(path))
+        return false;
+    rmSync(path);
+    return true;
+}

package/dist/daemon.js

@@ -0,0 +1,94 @@
+import { getClient } from './supabase.js';
+import { getMachineIdentity } from './config.js';
+import { ensureAutostart } from './autostart.js';
+import { detectAgents } from './agents.js';
+import { HEARTBEAT_INTERVAL_MS, COMMAND_POLL_INTERVAL_MS } from './env.js';
+/**
+ * The resident process. Two dumb PostgREST loops — no Realtime, no sockets:
+ *  - heartbeat: upsert this machine's presence row every ~10s.
+ *  - poll: ack any pending ping commands aimed at this machine.
+ *
+ * Reliability comes from the same stack as the reliable v1 prototype: an
+ * auto-refreshing token (supabase.ts), a TypeError-retrying fetch, and
+ * rebuild-on-error here. Under launchd/KeepAlive (autostart), a hard crash is
+ * restarted by the OS. Nothing here throws on a transient failure.
+ */
+export async function runDaemon() {
+    const identity = getMachineIdentity();
+    const agents = detectAgents();
+    ensureAutostart(); // default-on: install the login item unless the user opted out
+    console.log(`CTRL+SPC — this computer: ${identity.name}`);
+    console.log(`Agents detected: ${agents.length ? agents.join(', ') : 'none'}`);
+    let client = await getClient();
+    const { data: userData } = await client.auth.getUser();
+    const userId = userData.user?.id;
+    if (!userId)
+        throw new Error('Signed-in user could not be resolved. Run `cs login` again.');
+    let running = true;
+    async function heartbeat() {
+        try {
+            const { error } = await client
+                .from('cliv2_agents')
+                .upsert({
+                user_id: userId,
+                machine_id: identity.id,
+                machine_name: identity.name,
+                agents,
+                last_seen_at: new Date().toISOString(),
+            }, { onConflict: 'user_id,machine_id' });
+            if (error)
+                throw error;
+        }
+        catch (err) {
+            // Most likely a rotated/expired session or a network blip. Rebuild the
+            // client from disk (picks up any refreshed token) and try next tick.
+            console.warn(`heartbeat failed, will retry: ${err.message}`);
+            try {
+                client = await getClient();
+            }
+            catch { /* stay down until the next tick */ }
+        }
+    }
+    async function pollCommands() {
+        try {
+            const { data, error } = await client
+                .from('cliv2_commands')
+                .update({ status: 'ack', acked_at: new Date().toISOString() })
+                .eq('machine_id', identity.id)
+                .eq('status', 'pending')
+                .select('id, command');
+            if (error)
+                throw error;
+            for (const cmd of data ?? [])
+                console.log(`Acked ${cmd.command} (${cmd.id})`);
+        }
+        catch (err) {
+            console.warn(`command poll failed, will retry: ${err.message}`);
+        }
+    }
+    await heartbeat();
+    const hb = setInterval(() => void heartbeat(), HEARTBEAT_INTERVAL_MS);
+    const cp = setInterval(() => void pollCommands(), COMMAND_POLL_INTERVAL_MS);
+    async function shutdown() {
+        if (!running)
+            return;
+        running = false;
+        clearInterval(hb);
+        clearInterval(cp);
+        // Best-effort: mark offline immediately so the web sheet doesn't wait out
+        // the freshness window. A stale timestamp reads as offline.
+        try {
+            await client
+                .from('cliv2_agents')
+                .update({ last_seen_at: new Date(0).toISOString() })
+                .eq('machine_id', identity.id);
+        }
+        catch { /* ignore */ }
+        process.exit(0);
+    }
+    process.on('SIGINT', () => void shutdown());
+    process.on('SIGTERM', () => void shutdown());
+    console.log('Online. Heartbeating presence. Ctrl-C to stop.');
+    // Keep the event loop alive.
+    await new Promise(() => { });
+}

package/dist/env.js

@@ -0,0 +1,12 @@
+/**
+ * Same Supabase project as the product backend, so v2 shares the user's
+ * account/auth/RLS and the web app reads the same cliv2_* tables. Overridable
+ * for isolated setups.
+ */
+export const SUPABASE_URL = process.env.CTRL_SPC_SUPABASE_URL || 'https://gdioapkjgnlddsutysne.supabase.co';
+export const SUPABASE_KEY = process.env.CTRL_SPC_SUPABASE_KEY || 'sb_publishable_izf3buHACC2LJKm2JH96YQ_safmL1k0';
+/** Heartbeat cadence. Kept well under the web's freshness window so a single
+ *  slow/dropped write never flaps the machine offline. */
+export const HEARTBEAT_INTERVAL_MS = 10_000;
+/** Command (ping) poll cadence. */
+export const COMMAND_POLL_INTERVAL_MS = 3_000;

package/dist/index.js

@@ -0,0 +1,80 @@
+#!/usr/bin/env node
+import { login } from './login.js';
+import { runDaemon } from './daemon.js';
+import { autostartOn, autostartOff } from './autostart.js';
+import { detectAgents } from './agents.js';
+import { getMachineIdentity, clearSession } from './config.js';
+import { getClient, NotLoggedIn } from './supabase.js';
+const HELP = `cs — CTRL+SPC
+
+  cs                Sign in if needed, then come online (front door)
+  cs login          Sign in with your browser and link this computer
+  cs start          Come online now (sign in first with \`cs login\`)
+  cs status         Show sign-in state, computer, and detected agents
+  cs autostart on   Come online automatically at login
+  cs autostart off  Stop coming online at login
+  cs logout         Sign this computer out
+  cs help           Show this help
+`;
+async function status() {
+    const id = getMachineIdentity();
+    const agents = detectAgents();
+    console.log(`Computer: ${id.name}`);
+    console.log(`Agents:   ${agents.length ? agents.join(', ') : 'none'}`);
+    try {
+        const client = await getClient();
+        const { data } = await client.auth.getUser();
+        console.log(`Signed in as ${data.user?.email ?? 'unknown'}`);
+    }
+    catch (err) {
+        console.log(err instanceof NotLoggedIn ? 'Not signed in. Run `cs login`.' : `Session error: ${err.message}`);
+    }
+}
+/** Front door: ensure signed in, then run the presence agent. */
+async function up() {
+    try {
+        await getClient();
+    }
+    catch (err) {
+        if (!(err instanceof NotLoggedIn))
+            throw err;
+        await login();
+        if (process.exitCode)
+            return; // sign-in failed; message already printed
+    }
+    return runDaemon();
+}
+async function main() {
+    const cmd = process.argv[2];
+    const arg = process.argv[3];
+    switch (cmd) {
+        case undefined: return up();
+        case 'login': return login();
+        case 'start': return runDaemon();
+        case 'status': return status();
+        case 'logout':
+            console.log(clearSession() ? 'Signed out.' : 'Was not signed in.');
+            return;
+        case 'autostart':
+            if (arg === 'on')
+                return autostartOn();
+            if (arg === 'off')
+                return autostartOff();
+            console.error('Usage: cs autostart on|off');
+            process.exitCode = 1;
+            return;
+        case 'help':
+        case '--help':
+        case '-h':
+            console.log(HELP);
+            return;
+        default:
+            console.error(`Unknown command: ${cmd}\n`);
+            console.log(HELP);
+            process.exitCode = 1;
+    }
+}
+main().catch((err) => {
+    console.error(err instanceof Error ? err.message : String(err));
+    process.exit(1);
+});

package/dist/login.js

@@ -0,0 +1,181 @@
+import { createServer } from 'node:http';
+import { randomBytes, timingSafeEqual } from 'node:crypto';
+import { SUPABASE_URL, SUPABASE_KEY } from './env.js';
+import { openBrowser } from './browser.js';
+import { writeSession, getMachineIdentity } from './config.js';
+import { getClient } from './supabase.js';
+const LOGIN_TIMEOUT_MS = 5 * 60 * 1000;
+const MAX_BODY_BYTES = 64 * 1024;
+export async function login() {
+    const outcome = await runServer();
+    if (outcome.ok) {
+        getMachineIdentity(); // ensure a stable machine id exists post-login
+        console.log(`Signed in as ${outcome.email}`);
+        process.exitCode = 0;
+    }
+    else {
+        console.error(outcome.message);
+        process.exitCode = 1;
+    }
+}
+function runServer() {
+    return new Promise((resolve) => {
+        let settled = false;
+        // Anti-fixation nonce: the served page must echo this back on POST, so a
+        // cross-origin request guessing the ephemeral port can't inject tokens.
+        const state = randomBytes(32).toString('hex');
+        const server = createServer((req, res) => void handle(req, res, state, finish));
+        const timer = setTimeout(() => finish({ ok: false, message: 'Login timed out after 5 minutes. Run `cs login` again.' }), LOGIN_TIMEOUT_MS);
+        function finish(outcome) {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            server.close();
+            resolve(outcome);
+        }
+        server.on('error', (err) => finish({ ok: false, message: `Local login server failed: ${err.message}` }));
+        server.listen(0, '127.0.0.1', () => {
+            const addr = server.address();
+            if (!addr)
+                return finish({ ok: false, message: 'Failed to start local login server.' });
+            const url = `http://localhost:${addr.port}/`;
+            console.log(`Opening browser to sign in — if it doesn't open, visit ${url}`);
+            openBrowser(url);
+        });
+    });
+}
+async function handle(req, res, state, finish) {
+    const path = (req.url ?? '/').split('?')[0];
+    if (req.method === 'GET' && path === '/') {
+        res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+        res.end(renderPage(state));
+        return;
+    }
+    if (req.method === 'POST' && path === '/callback') {
+        await handleCallback(req, res, state, finish);
+        return;
+    }
+    res.writeHead(404, { 'Content-Type': 'text/plain' });
+    res.end('Not found');
+}
+async function handleCallback(req, res, state, finish) {
+    let body;
+    try {
+        body = JSON.parse(await readBody(req));
+    }
+    catch {
+        res.writeHead(400, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ ok: false, error: 'Invalid or oversized body' }));
+        return;
+    }
+    const { access_token, refresh_token, state: given } = (body ?? {});
+    if (typeof access_token !== 'string' || typeof refresh_token !== 'string' || typeof given !== 'string') {
+        res.writeHead(400, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ ok: false, error: 'Missing access_token/refresh_token/state' }));
+        return;
+    }
+    if (!constantTimeEqual(given, state)) {
+        res.writeHead(400, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ ok: false, error: 'Invalid or missing state' }));
+        return;
+    }
+    writeSession({ access_token, refresh_token });
+    try {
+        const client = await getClient();
+        const { data, error } = await client.auth.getUser();
+        if (error || !data.user?.email)
+            throw new Error(error?.message ?? 'No user for this session.');
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ ok: true }));
+        finish({ ok: true, email: data.user.email });
+    }
+    catch (err) {
+        const message = `Session could not be verified: ${err.message}`;
+        res.writeHead(500, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ ok: false, error: message }));
+        finish({ ok: false, message });
+    }
+}
+function readBody(req) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        let size = 0;
+        req.on('data', (c) => {
+            size += c.length;
+            if (size > MAX_BODY_BYTES) {
+                req.pause();
+                reject(new Error('too large'));
+                return;
+            }
+            chunks.push(c);
+        });
+        req.on('end', () => resolve(Buffer.concat(chunks).toString('utf8')));
+        req.on('error', reject);
+    });
+}
+function constantTimeEqual(a, b) {
+    const bufA = Buffer.from(a, 'utf8');
+    const bufB = Buffer.from(b, 'utf8');
+    if (bufA.length !== bufB.length)
+        return false;
+    return timingSafeEqual(bufA, bufB);
+}
+function renderPage(state) {
+    return `<!doctype html><html lang="en"><head>
+<meta charset="utf-8"/><meta name="viewport" content="width=device-width, initial-scale=1"/>
+<title>Sign in — CTRL+SPC</title>
+<style>
+  :root { color-scheme: light dark; font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; }
+  body { max-width: 360px; margin: 12vh auto 0; padding: 0 24px; }
+  h1 { font-size: 20px; margin-bottom: 2px; } p.sub { color: #666; margin-top: 0; font-size: 14px; }
+  .tabs { display:flex; gap:8px; margin:14px 0; border-bottom:1px solid #ccc; }
+  .tabs button { background:none; border:none; padding:8px 4px; font-size:14px; cursor:pointer; color:#666; border-bottom:2px solid transparent; }
+  .tabs button.active { color:#111; border-bottom-color:#111; font-weight:600; }
+  form { display:none; flex-direction:column; gap:10px; } form.active { display:flex; }
+  label { font-size:13px; display:flex; flex-direction:column; gap:4px; }
+  input { padding:8px 10px; font-size:14px; border:1px solid #ccc; border-radius:6px; }
+  button[type=submit] { margin-top:6px; padding:9px; border:none; border-radius:6px; background:#111; color:#fff; cursor:pointer; }
+  .error { color:#c0392b; font-size:13px; min-height:16px; }
+  @media (prefers-color-scheme: dark){ body{background:#111;color:#eee;} input{background:#1c1c1c;border-color:#333;color:#eee;} button[type=submit]{background:#eee;color:#111;} }
+</style></head><body>
+<div id="app">
+  <h1>CTRL+SPC</h1><p class="sub">Sign in to link this computer.</p>
+  <div class="tabs"><button id="t-in" class="active">Sign in</button><button id="t-up">Sign up</button></div>
+  <form id="f-in" class="active">
+    <label>Email<input type="email" id="in-email" required autocomplete="email"/></label>
+    <label>Password<input type="password" id="in-pw" required autocomplete="current-password"/></label>
+    <div class="error" id="in-err"></div><button type="submit">Sign in</button>
+  </form>
+  <form id="f-up">
+    <label>Name<input type="text" id="up-name" required autocomplete="name"/></label>
+    <label>Email<input type="email" id="up-email" required autocomplete="email"/></label>
+    <label>Password<input type="password" id="up-pw" required autocomplete="new-password" minlength="6"/></label>
+    <div class="error" id="up-err"></div><button type="submit">Sign up</button>
+  </form>
+</div>
+<script type="module">
+  const STATE = ${JSON.stringify(state)}
+  const $ = (id) => document.getElementById(id)
+  const tin=$('t-in'), tup=$('t-up'), fin=$('f-in'), fup=$('f-up')
+  tin.onclick=()=>{tin.classList.add('active');tup.classList.remove('active');fin.classList.add('active');fup.classList.remove('active')}
+  tup.onclick=()=>{tup.classList.add('active');tin.classList.remove('active');fup.classList.add('active');fin.classList.remove('active')}
+  const { createClient } = await import('https://esm.sh/@supabase/supabase-js@2')
+  const sb = createClient(${JSON.stringify(SUPABASE_URL)}, ${JSON.stringify(SUPABASE_KEY)})
+  async function done(session){
+    const r = await fetch('/callback',{method:'POST',headers:{'Content-Type':'application/json'},
+      body:JSON.stringify({access_token:session.access_token,refresh_token:session.refresh_token,state:STATE})})
+    const b = await r.json().catch(()=>({}))
+    if(!r.ok) throw new Error(b.error||'Local CLI rejected the session.')
+    $('app').innerHTML='<h1>Signed in — you can close this tab.</h1>'
+  }
+  fin.onsubmit=async(e)=>{e.preventDefault();$('in-err').textContent=''
+    try{const {data,error}=await sb.auth.signInWithPassword({email:$('in-email').value,password:$('in-pw').value})
+      if(error)throw error; await done(data.session)}catch(err){$('in-err').textContent=err.message||String(err)}}
+  fup.onsubmit=async(e)=>{e.preventDefault();$('up-err').textContent=''
+    try{const {data,error}=await sb.auth.signUp({email:$('up-email').value,password:$('up-pw').value,options:{data:{name:$('up-name').value}}})
+      if(error)throw error
+      if(!data.session){$('up-err').textContent='Account created. Confirm via email, then sign in.';return}
+      await done(data.session)}catch(err){$('up-err').textContent=err.message||String(err)}}
+</script></body></html>`;
+}

package/dist/supabase.js

@@ -0,0 +1,63 @@
+import { createClient } from '@supabase/supabase-js';
+import { SUPABASE_URL, SUPABASE_KEY } from './env.js';
+import { readSession, writeSession } from './config.js';
+export class NotLoggedIn extends Error {
+    constructor(message = 'Not logged in. Run `cs login` first.') {
+        super(message);
+        this.name = 'NotLoggedIn';
+    }
+}
+/**
+ * Network-layer retry — the v1 CLI's most valuable robustness trick. Retries
+ * only fetch-level failures (DNS/wifi drop surface as TypeError); real HTTP
+ * error responses pass straight through so callers see the status.
+ */
+const RETRY_DELAYS_MS = [250, 1000, 3000];
+const retryingFetch = async (input, init) => {
+    let lastErr;
+    for (let attempt = 0; attempt <= RETRY_DELAYS_MS.length; attempt++) {
+        try {
+            return await fetch(input, init);
+        }
+        catch (err) {
+            if (!(err instanceof TypeError))
+                throw err;
+            lastErr = err;
+            const delay = RETRY_DELAYS_MS[attempt];
+            if (delay === undefined)
+                break;
+            await new Promise((r) => setTimeout(r, delay));
+        }
+    }
+    throw lastErr;
+};
+/**
+ * Authenticated client built from the stored session.
+ *
+ * The two fixes over v1 that make presence reliable across the ~1h JWT
+ * lifetime: `autoRefreshToken: true` (v1 had it false with no refresh loop, so
+ * after an hour every write 401'd silently) and the retrying fetch above.
+ * Rotated tokens are written straight back to disk via onAuthStateChange.
+ */
+export async function getClient() {
+    const stored = readSession();
+    if (!stored?.access_token || !stored?.refresh_token)
+        throw new NotLoggedIn();
+    const client = createClient(SUPABASE_URL, SUPABASE_KEY, {
+        auth: { persistSession: false, autoRefreshToken: true },
+        global: { fetch: retryingFetch },
+    });
+    client.auth.onAuthStateChange((_event, session) => {
+        if (session) {
+            writeSession({ access_token: session.access_token, refresh_token: session.refresh_token });
+        }
+    });
+    const { data, error } = await client.auth.setSession({
+        access_token: stored.access_token,
+        refresh_token: stored.refresh_token,
+    });
+    if (error || !data.session) {
+        throw new NotLoggedIn(`Stored session is invalid or expired (${error?.message ?? 'no session'}). Run \`cs login\` again.`);
+    }
+    return client;
+}

package/package.json

@@ -0,0 +1,30 @@
+{
+  "name": "@ctrl-spc/cs",
+  "version": "0.1.0",
+  "description": "CTRL+SPC — minimal, reliable per-machine agent presence. Sign-in, auto-start, agent detection, heartbeat presence, and ping acknowledgement.",
+  "engines": {
+    "node": ">=22"
+  },
+  "type": "module",
+  "bin": {
+    "cs": "dist/index.js"
+  },
+  "files": [
+    "dist"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc",
+    "start": "npm run build && node dist/index.js"
+  },
+  "license": "UNLICENSED",
+  "dependencies": {
+    "@supabase/supabase-js": "^2.110.1"
+  },
+  "devDependencies": {
+    "@types/node": "^26.1.1",
+    "typescript": "^5.9.3"
+  }
+}