@cydm/happy-elves 0.1.0-beta.43 → 0.1.0-beta.44

package/README.md

@@ -11,5 +11,7 @@ happy-elves account create --relay https://relay.happyelves.ai --device-name "CL
 ## Self-host relay
 
 ```bash
+HAPPY_ELVES_ENV=production \
+HAPPY_ELVES_ALLOWED_ORIGINS=https://your-controller.example \
 happy-elves relay serve --host 0.0.0.0 --port 8787 --json
 ```

package/apps/cli/dist/commands/account.js

@@ -49,4 +49,3 @@ export async function handleAccount({ domain, action, flags }) {
     }
     return false;
 }
-//# sourceMappingURL=account.js.map

package/apps/cli/dist/commands/app.js

@@ -97,4 +97,3 @@ function cliVersion() {
     }
     return "0.1.0";
 }
-//# sourceMappingURL=app.js.map

package/apps/cli/dist/commands/collect.js

@@ -28,4 +28,3 @@ export async function handleCollect({ domain, action, flags }) {
     }
     return true;
 }
-//# sourceMappingURL=collect.js.map

package/apps/cli/dist/commands/command.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=command.js.map

package/apps/cli/dist/commands/config.js

@@ -28,4 +28,3 @@ export async function handleConfig({ domain, action, flags }) {
     }
     return false;
 }
-//# sourceMappingURL=config.js.map

package/apps/cli/dist/commands/daemon.js

@@ -216,4 +216,3 @@ export async function handleDaemon({ domain, action, flags }) {
     }
     return false;
 }
-//# sourceMappingURL=daemon.js.map

package/apps/cli/dist/commands/lib/args.js

@@ -79,4 +79,3 @@ export function parseCliFlags(argv) {
     }
     return parsed;
 }
-//# sourceMappingURL=args.js.map

package/apps/cli/dist/commands/lib/audit.js

@@ -23,4 +23,3 @@ export async function readLocalAuditLog(tail = 100) {
         throw error;
     }
 }
-//# sourceMappingURL=audit.js.map

package/apps/cli/dist/commands/lib/bootstrap-config.js

@@ -147,4 +147,3 @@ export function startRelayUrl(flags, existing) {
     const relayUrl = normalizeRelayUrl(defaultHostedRelayUrl);
     return { relayUrl, explicit: false };
 }
-//# sourceMappingURL=bootstrap-config.js.map

package/apps/cli/dist/commands/lib/bootstrap-daemon.js

@@ -43,4 +43,3 @@ export async function waitForMachineProjection(client, machineId, timeoutMs = 50
     }
     return lastSeen;
 }
-//# sourceMappingURL=bootstrap-daemon.js.map

package/apps/cli/dist/commands/lib/bootstrap-output.js

@@ -37,4 +37,3 @@ export function openUrl(url) {
         return { opened: false, error: error instanceof Error ? error.message : String(error) };
     }
 }
-//# sourceMappingURL=bootstrap-output.js.map

package/apps/cli/dist/commands/lib/bootstrap.js

@@ -93,4 +93,3 @@ export async function startBootstrap(flags) {
         daemon: data.daemon,
     });
 }
-//# sourceMappingURL=bootstrap.js.map

package/apps/cli/dist/commands/lib/config.js

@@ -146,4 +146,3 @@ export async function writeConfig(config) {
     await fs.writeFile(configPath, JSON.stringify(config, null, 2) + "\n", { mode: 0o600 });
     await fs.chmod(configPath, 0o600);
 }
-//# sourceMappingURL=config.js.map

package/apps/cli/dist/commands/lib/doctor.js

@@ -46,4 +46,3 @@ export async function topLevelDoctor(flags) {
         console.log(`${check.ok ? "ok" : "fail"} ${check.name}: ${check.message}`);
     }
 }
-//# sourceMappingURL=doctor.js.map

package/apps/cli/dist/commands/lib/exit.js

@@ -129,4 +129,3 @@ export function handleCliError(error) {
     }, enriched.capability);
     process.exit(1);
 }
-//# sourceMappingURL=exit.js.map

package/apps/cli/dist/commands/lib/index.js

@@ -22,4 +22,3 @@ export * from "./status.js";
 export * from "./types.js";
 export * from "./usage.js";
 export * from "./workspace.js";
-//# sourceMappingURL=index.js.map

package/apps/cli/dist/commands/lib/json.js

@@ -14,4 +14,3 @@ export function wantsJson(flags) {
 export function wantsVerbose(flags) {
     return flags.verbose === true || flags.format === "verbose";
 }
-//# sourceMappingURL=json.js.map

package/apps/cli/dist/commands/lib/local-daemon.js

@@ -130,4 +130,3 @@ export async function stopLocalDaemon(timeoutMs = 5000) {
     }
     return { ...status, stopped: false, running: isPidAlive(status.pid) };
 }
-//# sourceMappingURL=local-daemon.js.map

package/apps/cli/dist/commands/lib/loop-store.js

@@ -75,4 +75,3 @@ export async function appendLoop(loop) {
         return loop;
     });
 }
-//# sourceMappingURL=loop-store.js.map

package/apps/cli/dist/commands/lib/paths.js

@@ -11,4 +11,3 @@ export const startDaemonTimeoutMs = 10_000;
 export const daemonPidPath = path.join(configDir, "daemon.pid");
 export const loopStorePath = path.join(configDir, "loops.json");
 export const loopStoreLockPath = path.join(configDir, "loops.json.lock");
-//# sourceMappingURL=paths.js.map

package/apps/cli/dist/commands/lib/relay-http.js

@@ -99,4 +99,3 @@ export function isAuthTokenInvalid(error) {
     const record = error;
     return record.code === "AUTH_TOKEN_INVALID" || record.message === "Invalid token";
 }
-//# sourceMappingURL=relay-http.js.map

package/apps/cli/dist/commands/lib/scope.d.ts

@@ -1,13 +1,12 @@
-import type { ControllerClient, ScopedTokenScope } from "../../../../../packages/client/dist/index.js";
+import type { ScopedTokenScope } from "../../../../../packages/client/dist/index.js";
 import type { LoopRecord, PermissionMode } from "./types.js";
 export declare const DEFAULT_COMMAND_TIMEOUT_MS: number;
 export declare function parseDurationMs(value: string | boolean | undefined, fallbackMs: number): number;
 export declare function parseCsvFlag(value: string | boolean | undefined): string[] | undefined;
 export declare function scopeAllows(list: string[] | undefined, value: string | undefined): boolean;
 export declare function requireScopedAction(scope: ScopedTokenScope | undefined, action: string): void;
-export declare function requireScopedLoop(scope: ScopedTokenScope | undefined, loop: LoopRecord): void;
-export declare function localScopeFor(client: ControllerClient): Promise<ScopedTokenScope | undefined>;
-export declare function loopVisibleToScope(loop: LoopRecord, scope: ScopedTokenScope | undefined): boolean;
+export declare function requireScopedLoop(scope: ScopedTokenScope | undefined, loop: LoopRecord, tokenId?: string, machineId?: string | undefined): void;
+export declare function loopVisibleToScope(loop: LoopRecord, scope: ScopedTokenScope | undefined, tokenId?: string, machineId?: string | undefined): boolean;
 export declare function parseEventCursor(value: string | boolean | undefined): `cursor_${number}` | number | undefined;
 export declare function parsePermissionMode(value: string | boolean | undefined): PermissionMode | undefined;
 export declare function parseControllerJoinUrl(value: string): {

package/apps/cli/dist/commands/lib/scope.js

@@ -23,7 +23,7 @@ export function parseCsvFlag(value) {
     return value.split(",").map((item) => item.trim()).filter(Boolean);
 }
 export function scopeAllows(list, value) {
-    return !list || list.length === 0 || (value !== undefined && list.includes(value));
+    return Array.isArray(list) && value !== undefined && list.includes(value);
 }
 export function requireScopedAction(scope, action) {
     if (!scope)
@@ -32,21 +32,25 @@ export function requireScopedAction(scope, action) {
         throw new CliError(`Scoped token cannot perform ${action}`, "SCOPED_TOKEN_FORBIDDEN");
     }
 }
-export function requireScopedLoop(scope, loop) {
+export function requireScopedLoop(scope, loop, tokenId, machineId = loop.machineId) {
     if (!scope)
         return;
-    if (!scopeAllows(scope.loops, loop.id) || !scopeAllows(scope.sessions, loop.sessionId)) {
+    const sessionAllowed = scopeAllows(scope.sessions, loop.sessionId);
+    const machineAllowed = scopeAllows(scope.machines, machineId);
+    if (tokenId && loop.creatorTokenId === tokenId && sessionAllowed && machineAllowed)
+        return;
+    if (!scopeAllows(scope.loops, loop.id) || !sessionAllowed || !machineAllowed) {
         throw new CliError("Scoped token cannot access this loop", "SCOPED_TOKEN_FORBIDDEN");
     }
 }
-export async function localScopeFor(client) {
-    const self = await client.tokenSelf();
-    return self.full ? undefined : self.scope;
-}
-export function loopVisibleToScope(loop, scope) {
+export function loopVisibleToScope(loop, scope, tokenId, machineId = loop.machineId) {
     if (!scope)
         return true;
-    return scopeAllows(scope.loops, loop.id) && scopeAllows(scope.sessions, loop.sessionId);
+    const sessionAllowed = scopeAllows(scope.sessions, loop.sessionId);
+    const machineAllowed = scopeAllows(scope.machines, machineId);
+    if (tokenId && loop.creatorTokenId === tokenId && sessionAllowed && machineAllowed)
+        return true;
+    return scopeAllows(scope.loops, loop.id) && sessionAllowed && machineAllowed;
 }
 export function parseEventCursor(value) {
     if (typeof value !== "string")
@@ -97,4 +101,3 @@ export function parseControllerJoinUrl(value) {
     url.hash = "";
     return { relayUrl: normalizeRelayUrl(relay ?? url.toString()), code, inviteSecret };
 }
-//# sourceMappingURL=scope.js.map

package/apps/cli/dist/commands/lib/session-output.js

@@ -96,7 +96,8 @@ export async function writeTurnOutput(sessionId, turnId, events) {
     const paths = outputPaths(sessionId, turnId);
     if (!paths.turn || !paths.metadata)
         throw new CliError("Output path construction failed", "OUTPUT_FAILED");
-    await fs.mkdir(paths.dir, { recursive: true });
+    await fs.mkdir(paths.dir, { recursive: true, mode: 0o700 });
+    await fs.chmod(paths.dir, 0o700).catch(() => { });
     const output = assistantOutputForTurn(events, turnId) || terminalTextForDone(events, turnId);
     const turnEvents = events.filter((event) => event.turnId === turnId);
     const doneEvent = [...turnEvents].reverse().find((event) => event.decoded?.type === "done");
@@ -110,18 +111,23 @@ export async function writeTurnOutput(sessionId, turnId, events) {
         outputPath: paths.turn,
         latestPath: paths.latest,
     };
-    await fs.writeFile(paths.turn, output ? `${output}\n` : "", "utf8");
-    await fs.writeFile(paths.metadata, `${JSON.stringify(metadata, null, 2)}\n`, "utf8");
-    await fs.writeFile(paths.latestMetadata, `${JSON.stringify({ sessionId, turnId, metadataPath: paths.metadata, outputPath: paths.turn }, null, 2)}\n`, "utf8");
+    await writePrivateFile(paths.turn, output ? `${output}\n` : "");
+    await writePrivateFile(paths.metadata, `${JSON.stringify(metadata, null, 2)}\n`);
+    await writePrivateFile(paths.latestMetadata, `${JSON.stringify({ sessionId, turnId, metadataPath: paths.metadata, outputPath: paths.turn }, null, 2)}\n`);
     await fs.rm(paths.latest, { force: true });
     try {
         await fs.symlink(path.basename(paths.turn), paths.latest);
     }
     catch {
         await fs.copyFile(paths.turn, paths.latest);
+        await fs.chmod(paths.latest, 0o600).catch(() => { });
     }
     return { ...metadata, output, metadataPath: paths.metadata };
 }
+async function writePrivateFile(filePath, content) {
+    await fs.writeFile(filePath, content, { encoding: "utf8", mode: 0o600 });
+    await fs.chmod(filePath, 0o600).catch(() => { });
+}
 export async function readStoredTurnOutput(sessionId, turnId) {
     const paths = outputPaths(sessionId, turnId);
     let outputPath = paths.turn;
@@ -373,4 +379,3 @@ export async function readPromptTextFile(filePath) {
         throw new CliError(`Prompt file is not readable: ${filePath}`, "INPUT_FILE_UNREADABLE");
     }
 }
-//# sourceMappingURL=session-output.js.map

package/apps/cli/dist/commands/lib/session-view.js

@@ -194,4 +194,3 @@ export async function machineSessionOverview(client, sessions, machineId) {
         sessions: projectedSessions,
     };
 }
-//# sourceMappingURL=session-view.js.map

package/apps/cli/dist/commands/lib/status.js

@@ -60,4 +60,3 @@ export async function topLevelStatus(flags) {
         console.log(`Run: happy-elves turn run ${latestSession.id} --text "..."`);
     }
 }
-//# sourceMappingURL=status.js.map

package/apps/cli/dist/commands/lib/types.d.ts

@@ -45,6 +45,7 @@ export type OrchestrationSummary = {
 export type LoopRecord = {
     id: string;
     sessionId: string;
+    machineId?: string;
     prompt: string;
     everyMs?: number;
     stopOn: string[];
@@ -60,6 +61,8 @@ export type LoopRecord = {
         name: string;
         runtime?: unknown;
     };
+    creatorTokenId?: string;
+    creatorTokenExpiresAt?: number;
     creatorScope?: ScopedTokenScope;
     lastRun?: LoopRunRecord;
     runs?: LoopRunRecord[];

package/apps/cli/dist/commands/lib/types.js

@@ -1,2 +1 @@
 export const idleSessionStatuses = ["ready", "completed", "cancelled"];
-//# sourceMappingURL=types.js.map

package/apps/cli/dist/commands/lib/usage.js

@@ -252,4 +252,3 @@ export function usage() {
     writeError("USAGE", "Unsupported or incomplete command. Run happy-elves --help for usage.");
     process.exit(1);
 }
-//# sourceMappingURL=usage.js.map

package/apps/cli/dist/commands/lib/workspace.js

@@ -68,4 +68,3 @@ export async function listWorkspaceHistoricalSessions(client, input) {
         machines: rows.map((row) => row.machine),
     };
 }
-//# sourceMappingURL=workspace.js.map

package/apps/cli/dist/commands/loop.js

@@ -1,9 +1,10 @@
-import { CliError, ControllerClient, DEFAULT_COMMAND_TIMEOUT_MS, appendLoop, compactText, localScopeFor, loopVisibleToScope, ok, parseDurationMs, parseStopOn, randomId, readConfig, readLoopStore, readPromptTextFile, requirePositional, requireScopedAction, requireScopedLoop, scopeAllows, updateLoop, wantsJson, wantsVerbose } from "./lib/index.js";
+import { CliError, ControllerClient, DEFAULT_COMMAND_TIMEOUT_MS, appendLoop, compactText, loopVisibleToScope, ok, parseDurationMs, parseStopOn, randomId, readConfig, readLoopStore, readPromptTextFile, requirePositional, requireScopedAction, requireScopedLoop, scopeAllows, updateLoop, wantsJson, wantsVerbose } from "./lib/index.js";
 export async function handleLoop({ domain, action, positional, flags }) {
     if (domain === "loop" && action === "create") {
         const config = await readConfig(flags);
         const client = new ControllerClient(config);
-        const localScope = await localScopeFor(client);
+        const scoped = await scopedContext(client);
+        const localScope = scoped.scope;
         requireScopedAction(localScope, "loop.create");
         const sessionId = requirePositional(positional[0], "sessionId");
         const prompt = typeof flags.prompt === "string"
@@ -19,14 +20,18 @@ export async function handleLoop({ domain, action, positional, flags }) {
         const session = await client.getSession(sessionId);
         if (!session)
             throw new CliError("Session not found", "SESSION_NOT_FOUND");
-        if (!scopeAllows(localScope?.sessions, sessionId)) {
+        if (localScope && !scopeAllows(localScope.sessions, sessionId)) {
             throw new CliError("Scoped token cannot access this session", "SCOPED_TOKEN_FORBIDDEN");
         }
+        if (localScope && !scopeAllows(localScope.machines, session.machineId)) {
+            throw new CliError("Scoped token cannot access this machine", "SCOPED_TOKEN_FORBIDDEN");
+        }
         const metadata = await client.decodeSessionMetadata(session);
         const nowIso = new Date().toISOString();
         const loop = {
             id: randomId("loop"),
             sessionId,
+            machineId: session.machineId,
             prompt,
             everyMs,
             stopOn: parseStopOn(flags["stop-on"]),
@@ -41,6 +46,8 @@ export async function handleLoop({ domain, action, positional, flags }) {
                 name: metadata.name ?? session.name,
                 runtime: metadata.runtime,
             },
+            creatorTokenId: scoped.tokenId,
+            creatorTokenExpiresAt: scoped.expiresAt,
             creatorScope: localScope,
         };
         await appendLoop(loop);
@@ -49,10 +56,18 @@ export async function handleLoop({ domain, action, positional, flags }) {
     }
     if (domain === "loop" && action === "list") {
         const config = await readConfig(flags);
-        const localScope = await localScopeFor(new ControllerClient(config));
+        const client = new ControllerClient(config);
+        const scoped = await scopedContext(client);
+        const localScope = scoped.scope;
         requireScopedAction(localScope, "loop.list");
         const store = await readLoopStore();
-        const allLoops = store.loops.filter((loop) => loop.status !== "deleted" && loopVisibleToScope(loop, localScope));
+        const visibleLoops = await Promise.all(store.loops.map(async (loop) => ({
+            loop,
+            machineId: await loopMachineId(client, loop, localScope),
+        })));
+        const allLoops = visibleLoops
+            .filter(({ loop, machineId }) => loop.status !== "deleted" && loopVisibleToScope(loop, localScope, scoped.tokenId, machineId))
+            .map(({ loop }) => loop);
         const loops = flags.all === true ? allLoops : allLoops.filter((loop) => loop.status !== "stopped");
         if (!wantsJson(flags)) {
             if (loops.length === 0) {
@@ -83,24 +98,29 @@ export async function handleLoop({ domain, action, positional, flags }) {
     }
     if (domain === "loop" && action === "show") {
         const config = await readConfig(flags);
-        const localScope = await localScopeFor(new ControllerClient(config));
+        const client = new ControllerClient(config);
+        const scoped = await scopedContext(client);
+        const localScope = scoped.scope;
         const loopId = requirePositional(positional[0], "loopId");
         const store = await readLoopStore();
         const loop = store.loops.find((candidate) => candidate.id === loopId && candidate.status !== "deleted");
         if (!loop)
             throw new CliError("Loop not found", "LOOP_NOT_FOUND");
         requireScopedAction(localScope, "loop.show");
-        requireScopedLoop(localScope, loop);
+        requireScopedLoop(localScope, loop, scoped.tokenId, await loopMachineId(client, loop, localScope));
         ok("loop.show", { loop }, { sessionId: loop.sessionId });
         return true;
     }
     if (domain === "loop" && action === "pause") {
         const config = await readConfig(flags);
-        const localScope = await localScopeFor(new ControllerClient(config));
+        const client = new ControllerClient(config);
+        const scoped = await scopedContext(client);
+        const localScope = scoped.scope;
         const loopId = requirePositional(positional[0], "loopId");
         requireScopedAction(localScope, "loop.pause");
+        const currentLoop = await findLoop(loopId);
+        requireScopedLoop(localScope, currentLoop, scoped.tokenId, await loopMachineId(client, currentLoop, localScope));
         const loop = await updateLoop(loopId, (current) => {
-            requireScopedLoop(localScope, current);
             return { ...current, status: "paused" };
         });
         ok("loop.pause", { loop }, { sessionId: loop.sessionId });
@@ -108,11 +128,14 @@ export async function handleLoop({ domain, action, positional, flags }) {
     }
     if (domain === "loop" && action === "resume") {
         const config = await readConfig(flags);
-        const localScope = await localScopeFor(new ControllerClient(config));
+        const client = new ControllerClient(config);
+        const scoped = await scopedContext(client);
+        const localScope = scoped.scope;
         const loopId = requirePositional(positional[0], "loopId");
         requireScopedAction(localScope, "loop.resume");
+        const currentLoop = await findLoop(loopId);
+        requireScopedLoop(localScope, currentLoop, scoped.tokenId, await loopMachineId(client, currentLoop, localScope));
         const loop = await updateLoop(loopId, (current) => {
-            requireScopedLoop(localScope, current);
             return {
                 ...current,
                 status: "active",
@@ -124,11 +147,14 @@ export async function handleLoop({ domain, action, positional, flags }) {
     }
     if (domain === "loop" && action === "delete") {
         const config = await readConfig(flags);
-        const localScope = await localScopeFor(new ControllerClient(config));
+        const client = new ControllerClient(config);
+        const scoped = await scopedContext(client);
+        const localScope = scoped.scope;
         const loopId = requirePositional(positional[0], "loopId");
         requireScopedAction(localScope, "loop.delete");
+        const currentLoop = await findLoop(loopId);
+        requireScopedLoop(localScope, currentLoop, scoped.tokenId, await loopMachineId(client, currentLoop, localScope));
         const loop = await updateLoop(loopId, (current) => {
-            requireScopedLoop(localScope, current);
             return { ...current, status: "deleted", pendingRunId: undefined };
         });
         ok("loop.delete", { loopId: loop.id, status: "deleted" }, { sessionId: loop.sessionId });
@@ -136,12 +162,15 @@ export async function handleLoop({ domain, action, positional, flags }) {
     }
     if (domain === "loop" && action === "run") {
         const config = await readConfig(flags);
-        const localScope = await localScopeFor(new ControllerClient(config));
+        const client = new ControllerClient(config);
+        const scoped = await scopedContext(client);
+        const localScope = scoped.scope;
         const loopId = requirePositional(positional[0], "loopId");
         requireScopedAction(localScope, "loop.run");
         const runId = randomId("looprun");
+        const currentLoop = await findLoop(loopId);
+        requireScopedLoop(localScope, currentLoop, scoped.tokenId, await loopMachineId(client, currentLoop, localScope));
         const before = await updateLoop(loopId, (current) => {
-            requireScopedLoop(localScope, current);
             return { ...current, pendingRunId: runId };
         });
         const timeoutMs = parseDurationMs(flags.timeout, DEFAULT_COMMAND_TIMEOUT_MS);
@@ -162,4 +191,22 @@ export async function handleLoop({ domain, action, positional, flags }) {
     }
     return false;
 }
-//# sourceMappingURL=loop.js.map
+async function findLoop(loopId) {
+    const store = await readLoopStore();
+    const loop = store.loops.find((candidate) => candidate.id === loopId && candidate.status !== "deleted");
+    if (!loop)
+        throw new CliError("Loop not found", "LOOP_NOT_FOUND");
+    return loop;
+}
+async function loopMachineId(client, loop, scope) {
+    if (loop.machineId)
+        return loop.machineId;
+    if (!scope)
+        return undefined;
+    const session = await client.getSession(loop.sessionId);
+    return session?.machineId;
+}
+async function scopedContext(client) {
+    const self = await client.tokenSelf();
+    return self.full ? {} : { scope: self.scope, tokenId: self.tokenId, expiresAt: self.expiresAt };
+}

package/apps/cli/dist/commands/machine.js

@@ -258,4 +258,3 @@ export async function handleMachine({ domain, action, positional, flags }) {
     }
     return false;
 }
-//# sourceMappingURL=machine.js.map

package/apps/cli/dist/commands/relay.js

@@ -6,6 +6,8 @@ export async function handleRelay({ domain, action, flags }) {
         if (!Number.isInteger(relayPort) || relayPort <= 0 || relayPort > 65535) {
             throw new CliError(`Invalid --port: ${flags.port}`, "INVALID_ARGUMENT");
         }
+        if (wantsJson(flags))
+            process.env.HAPPY_ELVES_RELAY_LOG_STDERR = "1";
         const { startRelay } = await import("../../../relay/dist/index.js");
         const address = await startRelay({ host, port: relayPort });
         ok("relay.serve", {
@@ -19,7 +21,24 @@ export async function handleRelay({ domain, action, flags }) {
     }
     if (domain === "relay" && action === "status") {
         const relayUrl = typeof flags.relay === "string" ? requireRelayUrl(flags) : "http://localhost:8787";
-        const health = await relayHealth(relayUrl);
+        let health;
+        try {
+            health = await relayHealth(relayUrl);
+        }
+        catch (error) {
+            if (!wantsJson(flags))
+                throw error;
+            health = {
+                ok: false,
+                status: 0,
+                body: {
+                    error: {
+                        code: "RELAY_UNREACHABLE",
+                        message: error instanceof Error ? error.message : String(error),
+                    },
+                },
+            };
+        }
         if (wantsJson(flags)) {
             ok("relay.status", { relayUrl, health });
         }
@@ -58,4 +77,3 @@ export async function handleRelay({ domain, action, flags }) {
     }
     return false;
 }
-//# sourceMappingURL=relay.js.map

package/apps/cli/dist/commands/remote.js

@@ -140,4 +140,3 @@ export async function handleRemote({ domain, action, positional, flags }) {
     }
     return false;
 }
-//# sourceMappingURL=remote.js.map

package/apps/cli/dist/commands/session.js

@@ -745,4 +745,3 @@ export async function handleSession({ domain, action, positional, flags }) {
     }
     return false;
 }
-//# sourceMappingURL=session.js.map

package/apps/cli/dist/commands/token.js

@@ -48,4 +48,3 @@ export async function handleToken({ domain, action, positional, flags }) {
     }
     return false;
 }
-//# sourceMappingURL=token.js.map

package/apps/cli/dist/commands/turn.js

@@ -244,4 +244,3 @@ export async function handleTurn({ domain, action, positional, flags }) {
     }
     return false;
 }
-//# sourceMappingURL=turn.js.map

package/apps/cli/dist/errors.js

@@ -6,4 +6,3 @@ export class CliError extends Error {
         this.name = "CliError";
     }
 }
-//# sourceMappingURL=errors.js.map

package/apps/cli/dist/index.js

@@ -1,4 +1,3 @@
 #!/usr/bin/env node
 import { handleCliError, main } from "./commands/app.js";
 main().catch(handleCliError);
-//# sourceMappingURL=index.js.map

package/apps/daemon/dist/app.js

@@ -115,4 +115,3 @@ export function handleDaemonError(error) {
     console.error(error instanceof Error ? error.message : String(error));
     process.exit(1);
 }
-//# sourceMappingURL=app.js.map

package/apps/daemon/dist/args.js

@@ -12,4 +12,3 @@ export function requireString(flags, key) {
     }
     return value;
 }
-//# sourceMappingURL=args.js.map

package/apps/daemon/dist/audit.js

@@ -48,4 +48,3 @@ export async function showLogs(argv) {
         console.log(JSON.stringify(entry));
     }
 }
-//# sourceMappingURL=audit.js.map

package/apps/daemon/dist/cli.js

@@ -1,3 +1,2 @@
 import { handleDaemonError, main } from "./app.js";
 main().catch(handleDaemonError);
-//# sourceMappingURL=cli.js.map

package/apps/daemon/dist/config.js

@@ -88,4 +88,3 @@ export async function writeConfig(config) {
     await fs.writeFile(configPath, JSON.stringify(config, null, 2) + "\n", { mode: 0o600 });
     await fs.chmod(configPath, 0o600);
 }
-//# sourceMappingURL=config.js.map

package/apps/daemon/dist/errors.js

@@ -19,4 +19,3 @@ export function writeJsonError(error) {
         },
     }, null, 2));
 }
-//# sourceMappingURL=errors.js.map