@fulldivevr/workcord-cli 2.17.0 → 3.0.0

package/dist/machine/adapters/claude.js

@@ -0,0 +1,183 @@
+import { execFileSync, spawn } from "node:child_process";
+import { createInterface } from "node:readline";
+import { childEnv } from "../agents.js";
+const TASK_TIMEOUT_MS = 20 * 60_000;
+const STOP_GRACE_MS = 3_000;
+/** The owner's own agent with no permission gate, as Codex runs with approvals and sandbox bypassed. */
+export function claudeArgs(prompt, roots, resume) {
+    return [
+        "-p", "--output-format", "stream-json", "--verbose",
+        "--dangerously-skip-permissions",
+        ...(resume ? ["--resume", resume] : []),
+        ...(roots.length ? ["--add-dir", ...roots] : []),
+        "--",
+        prompt,
+    ];
+}
+const EDIT_TOOLS = new Set(["Edit", "MultiEdit", "Write", "NotebookEdit"]);
+/** A Claude Code tool call in the hub's run-event shape, so its step line reads as a Codex one does. */
+export function claudeToolEvent(block) {
+    const input = block?.input && typeof block.input === "object" ? block.input : {};
+    const name = String(block?.name || "");
+    const base = { event: "tool.started", item_id: String(block?.id || "") };
+    const path = String(input.file_path || input.notebook_path || input.path || "");
+    if (name === "Bash")
+        return { ...base, kind: "commandExecution", command: String(input.command || "") };
+    if (name === "Read")
+        return { ...base, kind: "commandExecution", command_actions: [{ type: "read", path }] };
+    if (name === "Grep" || name === "Glob") {
+        return { ...base, kind: "commandExecution", command_actions: [{ type: "search", query: String(input.pattern || ""), path: String(input.path || "") }] };
+    }
+    if (name === "LS")
+        return { ...base, kind: "commandExecution", command_actions: [{ type: "listFiles", path }] };
+    if (EDIT_TOOLS.has(name))
+        return { ...base, kind: "fileChange", paths: path ? [path] : [] };
+    if (name === "WebSearch" || name === "WebFetch")
+        return { ...base, kind: "webSearch" };
+    if (name === "Task" || name === "Agent")
+        return { ...base, kind: "collabAgentToolCall" };
+    const mcp = name.match(/^mcp__(.+?)__(.+)$/);
+    if (mcp)
+        return { ...base, kind: "mcpToolCall", tool_namespace: mcp[1], tool_name: mcp[2] };
+    return { ...base, kind: "dynamicToolCall", tool_name: name };
+}
+export async function runClaude(input) {
+    const signal = AbortSignal.any([input.signal, AbortSignal.timeout(TASK_TIMEOUT_MS)]);
+    if (!input.resume)
+        return runOnce(input, signal, { started: false });
+    const attempt = { started: false };
+    try {
+        return await runOnce(input, signal, attempt);
+    }
+    catch (error) {
+        // A session Claude Code no longer has fails before the turn starts; the turn then runs in a new session.
+        if (attempt.started || signal.aborted)
+            throw error;
+        return runOnce({ ...input, resume: undefined }, signal, { started: false });
+    }
+}
+function runOnce(input, signal, attempt) {
+    return new Promise((resolve, reject) => {
+        const child = spawn(input.binary ?? "claude", claudeArgs(input.prompt, input.roots, input.resume), {
+            cwd: input.cwd,
+            // One process per turn: a background command would outlive the turn and its answer.
+            // This also lifts Claude Code's block on a long foreground `sleep`, which offers only the background.
+            env: { ...childEnv(input.env), CLAUDE_CODE_DISABLE_BACKGROUND_TASKS: "1" },
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+        const onAbort = () => stopTree(child);
+        if (signal.aborted)
+            onAbort();
+        else
+            signal.addEventListener("abort", onAbort, { once: true });
+        child.on("exit", () => {
+            signal.removeEventListener("abort", onAbort);
+            if (signal.aborted)
+                reject(new Error("The task was stopped."));
+        });
+        let stderr = "";
+        let result;
+        let lastText = "";
+        let sessionId = "";
+        child.stdout.setEncoding("utf8");
+        child.stderr.setEncoding("utf8");
+        child.stderr.on("data", (chunk) => {
+            if (stderr.length < 8_192)
+                stderr += chunk;
+        });
+        createInterface({ input: child.stdout }).on("line", (line) => {
+            let message;
+            try {
+                message = JSON.parse(line);
+            }
+            catch {
+                return;
+            }
+            if (typeof message?.session_id === "string" && message.session_id && message.session_id !== sessionId) {
+                sessionId = message.session_id;
+                input.onThread?.(sessionId);
+            }
+            if (message?.type === "result") {
+                result = message;
+                return;
+            }
+            if (message?.type === "assistant")
+                attempt.started = true;
+            const content = Array.isArray(message?.message?.content) ? message.message.content : [];
+            for (const block of content) {
+                if (message.type === "assistant" && block?.type === "tool_use")
+                    input.onEvent?.(claudeToolEvent(block));
+                else if (message.type === "assistant" && block?.type === "text" && String(block.text || "").trim()) {
+                    lastText = String(block.text);
+                    input.onEvent?.({ event: "message.completed", output: lastText });
+                }
+                else if (message.type === "user" && block?.type === "tool_result") {
+                    input.onEvent?.({ event: "tool.completed", item_id: String(block.tool_use_id || "") });
+                }
+            }
+        });
+        child.on("error", (error) => {
+            reject(new Error(error.code === "ENOENT"
+                ? "Claude Code is not installed on this machine (no `claude` on PATH)."
+                : error.message));
+        });
+        child.on("close", (code) => {
+            if (!result) {
+                reject(new Error(`Claude Code exited with ${code}: ${stderr.trim().slice(0, 500)}`));
+                return;
+            }
+            if (result.is_error || code !== 0) {
+                reject(new Error(String(result.result || stderr || `Claude Code exited with ${code}`).slice(0, 1_000)));
+                return;
+            }
+            resolve(String(result.result ?? lastText));
+        });
+    });
+}
+function descendants(root) {
+    if (process.platform === "win32")
+        return [];
+    let table = "";
+    try {
+        table = execFileSync("ps", ["-axo", "pid=,ppid="], { encoding: "utf8" });
+    }
+    catch {
+        return [];
+    }
+    const children = new Map();
+    for (const line of table.split("\n")) {
+        const [pid, ppid] = line.trim().split(/\s+/).map(Number);
+        if (pid && ppid)
+            children.set(ppid, [...(children.get(ppid) ?? []), pid]);
+    }
+    const found = [];
+    for (let queue = [root]; queue.length;) {
+        for (const pid of children.get(queue.shift()) ?? []) {
+            found.push(pid);
+            queue.push(pid);
+        }
+    }
+    return found;
+}
+/**
+ * Claude Code runs its Bash tool in a detached shell of its own process group, and on
+ * SIGTERM it ends those shells itself. A Claude that does not exit in time is killed with
+ * the tree it had, which no process-group signal would reach.
+ */
+function stopTree(child) {
+    if (!child.pid || child.exitCode !== null || child.signalCode !== null)
+        return;
+    const tree = descendants(child.pid);
+    child.kill("SIGTERM");
+    setTimeout(() => {
+        if (child.exitCode === null && child.signalCode === null)
+            child.kill("SIGKILL");
+        for (const pid of tree) {
+            try {
+                process.kill(pid, "SIGKILL");
+            }
+            catch { }
+        }
+    }, STOP_GRACE_MS).unref();
+}
+//# sourceMappingURL=claude.js.map

package/dist/machine/adapters/codex.js

@@ -0,0 +1,166 @@
+import { spawn } from "node:child_process";
+import { createInterface } from "node:readline";
+import { childEnv } from "../agents.js";
+const TASK_TIMEOUT_MS = 20 * 60_000;
+const INTERRUPT_GRACE_MS = 5_000;
+const TOOL_ITEMS = new Set([
+    "commandExecution", "fileChange", "mcpToolCall", "dynamicToolCall", "collabAgentToolCall",
+    "subAgentActivity", "webSearch", "imageView", "imageGeneration", "sleep",
+]);
+/** The app-server form of `--dangerously-bypass-approvals-and-sandbox`: the owner's own agent, with no gate. */
+export function codexThreadParams(cwd) {
+    return {
+        cwd,
+        sandbox: "danger-full-access",
+        approvalPolicy: "never",
+    };
+}
+/** The item mapping of the hub's Codex runtime adapter (codexruntime/server.go). */
+export function codexItemEvent(method, item) {
+    if (!item || typeof item !== "object")
+        return undefined;
+    if (item.type === "agentMessage") {
+        const text = String(item.text || "");
+        return method === "item/completed" && text.trim() ? { event: "message.completed", item_id: item.id, output: text } : undefined;
+    }
+    if (!TOOL_ITEMS.has(item.type))
+        return undefined;
+    const paths = Array.isArray(item.changes)
+        ? item.changes.map((change) => String(change?.path || "")).filter(Boolean).slice(0, 20)
+        : undefined;
+    return {
+        event: method === "item/completed" ? "tool.completed" : "tool.started",
+        item_id: item.id,
+        kind: item.type,
+        ...(typeof item.command === "string" ? { command: item.command } : {}),
+        ...(Array.isArray(item.commandActions) ? { command_actions: item.commandActions.slice(0, 20) } : {}),
+        ...(paths?.length ? { paths } : {}),
+        ...(typeof item.tool === "string" ? { tool_name: item.tool } : {}),
+        ...(typeof item.namespace === "string" ? { tool_namespace: item.namespace } : {}),
+    };
+}
+/**
+ * One `codex app-server` per task, spoken to over stdio JSON-RPC as the Codex
+ * desktop and mobile clients do: initialize, thread/resume (or thread/start
+ * when there is no thread to resume), turn/start, and turn/interrupt for a cancel.
+ */
+export async function runCodex(input) {
+    const child = spawn(input.binary ?? "codex", ["app-server"], {
+        cwd: input.cwd,
+        env: childEnv(input.env),
+        stdio: ["pipe", "pipe", "pipe"],
+    });
+    child.stdout.setEncoding("utf8");
+    child.stderr.setEncoding("utf8");
+    let stderr = "";
+    child.stderr.on("data", (chunk) => {
+        if (stderr.length < 8_192)
+            stderr += chunk;
+    });
+    let nextId = 0;
+    const pending = new Map();
+    let threadId = "";
+    let turnId = "";
+    let finalText = "";
+    let lastText = "";
+    let settle;
+    const done = new Promise((resolve, reject) => { settle = { resolve, reject }; });
+    done.catch(() => undefined);
+    const write = (message) => {
+        if (child.stdin.writable)
+            child.stdin.write(JSON.stringify({ jsonrpc: "2.0", ...message }) + "\n");
+    };
+    const request = (method, params) => new Promise((resolve, reject) => {
+        const id = ++nextId;
+        pending.set(id, { resolve, reject });
+        write({ id, method, params });
+    });
+    createInterface({ input: child.stdout }).on("line", (line) => {
+        let message;
+        try {
+            message = JSON.parse(line);
+        }
+        catch {
+            return;
+        }
+        if (message.id !== undefined && !message.method) {
+            const waiter = pending.get(Number(message.id));
+            pending.delete(Number(message.id));
+            if (message.error)
+                waiter?.reject(new Error(String(message.error.message || "Codex refused the request")));
+            else
+                waiter?.resolve(message.result);
+            return;
+        }
+        if (message.id !== undefined && message.method) {
+            write({ id: message.id, error: { code: -32601, message: "Not supported by the WorkCord machine relay" } });
+            return;
+        }
+        const params = message.params || {};
+        if ((message.method === "item/started" || message.method === "item/completed") && (!turnId || params.turnId === turnId)) {
+            const event = codexItemEvent(message.method, params.item);
+            if (event)
+                input.onEvent?.(event);
+            if (message.method === "item/completed" && params.item?.type === "agentMessage") {
+                const text = String(params.item.text || "");
+                if (params.item.phase === "final_answer")
+                    finalText = text;
+                if (text)
+                    lastText = text;
+            }
+        }
+        else if (message.method === "turn/completed" && params.turn?.id === turnId) {
+            const turn = params.turn;
+            if (turn.status === "completed")
+                settle.resolve(finalText || lastText);
+            else if (turn.status === "interrupted")
+                settle.reject(new Error("The task was stopped."));
+            else
+                settle.reject(new Error(String(turn.error?.message || `Codex ended the turn as ${turn.status}`)));
+        }
+    });
+    child.on("error", (error) => {
+        settle.reject(new Error(error.code === "ENOENT" ? "Codex is not installed on this machine (no `codex` on PATH)." : error.message));
+    });
+    child.on("close", (code) => {
+        for (const waiter of pending.values())
+            waiter.reject(new Error(`Codex exited with ${code}`));
+        pending.clear();
+        settle.reject(new Error(`Codex exited with ${code}: ${stderr.trim().slice(0, 500)}`));
+    });
+    const signal = AbortSignal.any([input.signal, AbortSignal.timeout(TASK_TIMEOUT_MS)]);
+    const onAbort = () => {
+        if (threadId && turnId)
+            void request("turn/interrupt", { threadId, turnId }).catch(() => undefined);
+        else
+            settle.reject(new Error("The task was stopped."));
+        setTimeout(() => child.kill(), INTERRUPT_GRACE_MS).unref();
+    };
+    signal.addEventListener("abort", onAbort, { once: true });
+    try {
+        await request("initialize", { clientInfo: { name: "workcord", title: "WorkCord machine", version: "1" }, capabilities: null });
+        write({ method: "initialized" });
+        const params = codexThreadParams(input.cwd);
+        const resumed = input.resume
+            ? await request("thread/resume", { ...params, threadId: input.resume, excludeTurns: true }).catch(() => undefined)
+            : undefined;
+        const thread = resumed ?? await request("thread/start", params);
+        threadId = String(thread?.thread?.id || "");
+        if (threadId)
+            input.onThread?.(threadId);
+        const started = await request("turn/start", { threadId, input: [{ type: "text", text: input.prompt, text_elements: [] }] });
+        turnId = String(started?.turn?.id || "");
+        if (signal.aborted)
+            onAbort();
+        return await done;
+    }
+    catch (error) {
+        throw error instanceof Error ? error : new Error(String(error));
+    }
+    finally {
+        signal.removeEventListener("abort", onAbort);
+        child.stdin.end();
+        child.kill();
+    }
+}
+//# sourceMappingURL=codex.js.map

package/dist/machine/agents.js

@@ -0,0 +1,22 @@
+import { access, constants } from "node:fs/promises";
+import { delimiter, join } from "node:path";
+export const ADAPTER_NAMES = ["claude", "codex"];
+export function childEnv(env = process.env) {
+    return Object.fromEntries(Object.entries(env).filter(([name]) => !name.startsWith("WORKCORD_")));
+}
+/** Absolute path of each installed agent CLI, found the way a shell would find it. */
+export async function detectAdapters(env = process.env) {
+    const found = {};
+    const dirs = String(env.PATH || "").split(delimiter).filter(Boolean);
+    for (const name of ADAPTER_NAMES) {
+        for (const dir of dirs) {
+            const candidate = join(dir, name);
+            if (await access(candidate, constants.X_OK).then(() => true, () => false)) {
+                found[name] = candidate;
+                break;
+            }
+        }
+    }
+    return found;
+}
+//# sourceMappingURL=agents.js.map

package/dist/machine/chunks.js

@@ -0,0 +1,57 @@
+import { randomUUID } from "node:crypto";
+export const CHUNK_THRESHOLD_BYTES = 256 * 1024;
+export const MAX_MESSAGE_BYTES = 8 * 1024 * 1024;
+const SEGMENT_BYTES = 160 * 1024;
+const MAX_PENDING_REFS = 8;
+/** Mirrors Codex `server_message_chunk`: a frame over the threshold travels as base64 segments of its JSON. */
+export function encodeFrame(frame) {
+    const json = JSON.stringify(frame);
+    const bytes = Buffer.from(json, "utf8");
+    if (bytes.length <= CHUNK_THRESHOLD_BYTES)
+        return [json];
+    if (bytes.length > MAX_MESSAGE_BYTES)
+        throw new Error(`frame of ${bytes.length} bytes exceeds the ${MAX_MESSAGE_BYTES} byte cap`);
+    const ref = randomUUID();
+    const n = Math.ceil(bytes.length / SEGMENT_BYTES);
+    const out = [];
+    for (let i = 0; i < n; i++) {
+        const chunk = { t: "chunk", ref, i, n, data: bytes.subarray(i * SEGMENT_BYTES, (i + 1) * SEGMENT_BYTES).toString("base64") };
+        out.push(JSON.stringify(chunk));
+    }
+    return out;
+}
+export class ChunkAssembler {
+    pending = new Map();
+    /** Returns the reassembled frame when the last segment arrives, undefined while incomplete. Throws past the cap. */
+    accept(chunk) {
+        const n = Number(chunk.n);
+        const i = Number(chunk.i);
+        if (!chunk.ref || !Number.isSafeInteger(n) || n < 1 || !Number.isSafeInteger(i) || i < 0 || i >= n) {
+            throw new Error("invalid chunk");
+        }
+        if (n * SEGMENT_BYTES > MAX_MESSAGE_BYTES + SEGMENT_BYTES)
+            throw new Error("chunked frame exceeds the size cap");
+        let entry = this.pending.get(chunk.ref);
+        if (!entry) {
+            if (this.pending.size >= MAX_PENDING_REFS)
+                throw new Error("too many chunked frames in flight");
+            entry = { n, parts: [], received: 0, bytes: 0 };
+            this.pending.set(chunk.ref, entry);
+        }
+        if (entry.n !== n)
+            throw new Error("invalid chunk");
+        if (entry.parts[i])
+            return undefined;
+        const part = Buffer.from(String(chunk.data || ""), "base64");
+        entry.bytes += part.length;
+        if (entry.bytes > MAX_MESSAGE_BYTES)
+            throw new Error("chunked frame exceeds the size cap");
+        entry.parts[i] = part;
+        entry.received += 1;
+        if (entry.received < n)
+            return undefined;
+        this.pending.delete(chunk.ref);
+        return JSON.parse(Buffer.concat(entry.parts).toString("utf8"));
+    }
+}
+//# sourceMappingURL=chunks.js.map

package/dist/machine/handler.js

@@ -0,0 +1,90 @@
+import { randomUUID } from "node:crypto";
+import { resolveCwd } from "./policy.js";
+import { searchSessions } from "./sessions.js";
+/**
+ * Tasks the caller tied to one contextId run one at a time, in arrival order,
+ * as a hub tenant queues a follow-up behind the running turn.
+ */
+export class TaskContexts {
+    tails = new Map();
+    async run(contextId, start) {
+        if (!contextId)
+            return start();
+        const previous = this.tails.get(contextId) ?? Promise.resolve();
+        const task = previous.catch(() => undefined).then(start);
+        const tail = task.catch(() => undefined);
+        this.tails.set(contextId, tail);
+        try {
+            return await task;
+        }
+        finally {
+            if (this.tails.get(contextId) === tail)
+                this.tails.delete(contextId);
+        }
+    }
+}
+export async function handleTask(rpc, ctx) {
+    const id = rpc?.id ?? null;
+    const message = rpc?.params?.message;
+    const parts = Array.isArray(message?.parts) ? message.parts : [];
+    try {
+        const data = parts.find((part) => part?.kind === "data" && part.data && typeof part.data === "object")?.data;
+        if (data?.skill === "sessions.search") {
+            const hits = await searchSessions({
+                query: String(data.query || ""),
+                since: data.since ? new Date(String(data.since)) : undefined,
+                limit: typeof data.limit === "number" ? data.limit : undefined,
+                homeDir: ctx.homeDir,
+            });
+            return reply(id, message?.contextId, [
+                { kind: "text", text: hits.length ? `Found ${hits.length} matching session messages.` : "No matching session messages." },
+                { kind: "data", data: { hits } },
+            ]);
+        }
+        const prompt = parts.filter((part) => part?.kind === "text").map((part) => String(part.text || "")).join("\n").trim();
+        if (!prompt)
+            throw new Error("Send a text task, or a data part {\"skill\":\"sessions.search\",\"query\":\"...\"}.");
+        if (!ctx.roots.length) {
+            throw new Error("This machine was started without --root, so it can only run sessions.search.");
+        }
+        const requested = typeof message?.metadata?.adapter === "string" ? message.metadata.adapter : undefined;
+        const adapterName = requested ?? ctx.adapter ?? Object.keys(ctx.adapters)[0];
+        const runner = adapterName ? ctx.adapters[adapterName] : undefined;
+        if (!runner) {
+            throw new Error(`${adapterName ?? "No coding agent"} is not installed on this machine. Installed: ${Object.keys(ctx.adapters).join(", ") || "none"}.`);
+        }
+        const requestedCwd = typeof message?.metadata?.cwd === "string" ? message.metadata.cwd : undefined;
+        const cwd = await resolveCwd(ctx.roots, requestedCwd);
+        const contextId = typeof message?.contextId === "string" && !message.contextId.startsWith("machine:") ? message.contextId : undefined;
+        const signal = ctx.signal ?? new AbortController().signal;
+        const text = await (ctx.contexts ?? new TaskContexts()).run(contextId, async () => {
+            if (signal.aborted)
+                throw new Error("The task was stopped.");
+            ctx.onEvent?.({ event: "run.started" });
+            const threads = contextId ? ctx.threads : undefined;
+            const resume = threads ? await threads.get(adapterName, contextId).catch(() => undefined) : undefined;
+            return runner({
+                prompt, cwd, roots: ctx.roots, signal, onEvent: ctx.onEvent, resume,
+                onThread: (thread) => { void threads?.set(adapterName, contextId, thread).catch(() => undefined); },
+            });
+        });
+        return reply(id, message?.contextId, [{ kind: "text", text }]);
+    }
+    catch (error) {
+        return { jsonrpc: "2.0", id, error: { code: -32603, message: error.message || String(error) } };
+    }
+}
+function reply(id, contextId, parts) {
+    return {
+        jsonrpc: "2.0",
+        id,
+        result: {
+            kind: "message",
+            role: "agent",
+            messageId: randomUUID(),
+            ...(typeof contextId === "string" ? { contextId } : {}),
+            parts,
+        },
+    };
+}
+//# sourceMappingURL=handler.js.map

package/dist/machine/lock.js

@@ -0,0 +1,36 @@
+import { readFile, rm, writeFile } from "node:fs/promises";
+/** One `machine start` per computer, as the Codex daemon holds daemon.pid + daemon.lock. */
+export async function acquireMachineLock(path) {
+    for (let attempt = 0; attempt < 2; attempt++) {
+        try {
+            await writeFile(path, `${process.pid}\n`, { flag: "wx", mode: 0o600 });
+            return async () => {
+                if ((await readPid(path)) === process.pid)
+                    await rm(path, { force: true });
+            };
+        }
+        catch (err) {
+            if (err.code !== "EEXIST")
+                throw err;
+        }
+        const pid = await readPid(path);
+        if (pid && alive(pid))
+            throw new Error(`workcord machine is already running on this computer (pid ${pid}).`);
+        await rm(path, { force: true });
+    }
+    throw new Error(`Could not take the machine lock at ${path}.`);
+}
+async function readPid(path) {
+    const pid = Number((await readFile(path, "utf8").catch(() => "")).trim());
+    return Number.isSafeInteger(pid) && pid > 0 ? pid : undefined;
+}
+function alive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (err) {
+        return err.code === "EPERM";
+    }
+}
+//# sourceMappingURL=lock.js.map

package/dist/machine/pair.js

@@ -0,0 +1,67 @@
+import { createRequire } from "node:module";
+import { normalizeBaseUrl } from "../http.js";
+import { writeMachineFileAtomic } from "./rotate.js";
+const require = createRequire(import.meta.url);
+const qrcode = require("qrcode-terminal");
+export function renderQr(payload) {
+    let out = "";
+    qrcode.generate(payload, { small: true }, (qr) => { out = qr; });
+    return out;
+}
+/**
+ * Codex host pairing (server/pair, then pair/status until claimed): this computer
+ * asks for a code, the owner claims it in the app, and the key is handed over once.
+ */
+export async function pairComputer(input) {
+    const fetchImpl = input.fetchImpl ?? fetch;
+    const print = input.print ?? ((line) => process.stderr.write(`${line}\n`));
+    const base = normalizeBaseUrl(input.baseUrl);
+    const created = await fetchImpl(new URL("/api/v1/machine-agents/pairings", base), {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({
+            name: input.name,
+            platform: `${process.platform}-${process.arch}`,
+            cliVersion: input.cliVersion,
+            installationId: input.installationId,
+        }),
+        signal: AbortSignal.timeout(30_000),
+    });
+    if (!created.ok)
+        throw new Error(`pairing request refused with ${created.status}: ${(await created.text()).slice(0, 300)}`);
+    const offer = (await created.json());
+    print(`Pairing code: ${offer.code}`);
+    print(`Open ${offer.qrPayload} in WorkCord, or scan:`);
+    print(renderQr(offer.qrPayload));
+    print(`The code expires at ${new Date(offer.expiresAt).toLocaleTimeString()}. Waiting for you to confirm it...`);
+    for (;;) {
+        const response = await fetchImpl(new URL(`/api/v1/machine-agents/pairings/${encodeURIComponent(offer.pairingId)}`, base), {
+            headers: { "x-pairing-secret": offer.secret },
+            signal: AbortSignal.timeout(30_000),
+        }).catch(() => undefined);
+        if (response?.ok) {
+            const status = (await response.json());
+            if (status.status === "expired")
+                throw new Error("The pairing code expired. Run `workcord machine pair` again.");
+            if (status.status === "claimed") {
+                if (!status.machineId || !status.machineKey) {
+                    throw new Error("The pairing was claimed but its key was already handed out. Run `workcord machine pair` again.");
+                }
+                const file = {
+                    machineId: status.machineId,
+                    key: status.machineKey,
+                    baseUrl: base,
+                    name: input.name,
+                    rotatedAt: new Date().toISOString(),
+                };
+                await writeMachineFileAtomic(input.path, file);
+                return file;
+            }
+        }
+        else if (response && response.status !== 503 && response.status !== 502) {
+            throw new Error(`pairing status refused with ${response.status}`);
+        }
+        await new Promise((resolve) => setTimeout(resolve, input.pollMs ?? 2_000));
+    }
+}
+//# sourceMappingURL=pair.js.map

package/dist/machine/policy.js

@@ -0,0 +1,24 @@
+import { realpath } from "node:fs/promises";
+import { sep } from "node:path";
+export async function resolveRoots(roots) {
+    return Promise.all(roots.map((root) => realpath(root)));
+}
+/** `roots` are already realpath-resolved, once at start. */
+export async function resolveCwd(roots, requested) {
+    if (!roots.length)
+        throw new Error("This machine was started without --root, so it can only search sessions.");
+    if (!requested)
+        return roots[0];
+    let target;
+    try {
+        target = await realpath(requested);
+    }
+    catch {
+        throw new Error(`${requested} does not exist on this machine.`);
+    }
+    if (!roots.some((root) => target === root || target.startsWith(root + sep))) {
+        throw new Error(`${requested} is outside the allowed roots.`);
+    }
+    return target;
+}
+//# sourceMappingURL=policy.js.map