@geohar/un-bien 0.9.0 → 0.14.0

package/README.md

@@ -100,7 +100,7 @@ current turn, and receive any later reply through the inbox/turn flow with
 `re` correlating it to the original message id.
 
 Peers on the same machine talk over a Unix domain socket at
-`~/.pi/un-bien/sessions/<session-name>/broker.sock`. When sibling PCs are paired,
+`~/.local/state/un-bien/sessions/<session-name>/broker.sock`. When sibling PCs are paired,
 a leader-capable Extension or MCP participant bridges the opaque cross-PC
 addresses over the relay; local-only use stays on UDS when relay access is off.
 Useful for splitting work across roles (`backend`, `frontend`, `tests`,
@@ -240,7 +240,7 @@ Once the relay is up (`/unbien relay status` shows `started` or `paired`):
 
 A QR code is printed in the terminal. Scan it with the Un Bien mobile app.
 Pairing is **per machine** — once a device is paired, every Pi process on
-this machine accepts it (it lives in `~/.pi/un-bien/peers.json`).
+this machine accepts it (it lives in `~/.local/state/un-bien/peers.json`).
 
 To list paired devices:
 
@@ -374,7 +374,7 @@ original message id.
 
 The wire format is a 5-field envelope `{ from, to, id, re, body }` serialized
 as one JSON line per message. The leader's broker writes an `audit.jsonl`
-log at `~/.pi/un-bien/sessions/<name>/audit.jsonl` for postmortem inspection.
+log at `~/.local/state/un-bien/sessions/<name>/audit.jsonl` for postmortem inspection.
 
 Useful commands:
 
@@ -409,56 +409,17 @@ real name to the peer.
 | `/unbien relay url <url>`             | Same as `set-relay`                                                            |
 | `/unbien config`                      | Show the effective relay URL and its source (env / config / unset)             |
 
-### Daemon fleet (one supervisor, N background Pis — see [Daemon mode](#daemon-mode))
-
-| Command                                     | Description                                                                   |
-| ------------------------------------------- | ----------------------------------------------------------------------------- |
-| `/unbien create <cwd> [--name X]`           | Register a folder as a daemon                                                 |
-| `/unbien remove <id>`                       | Unregister a daemon (local config preserved)                                  |
-| `/unbien daemons`                           | List registered daemons + state                                               |
-| `/unbien daemon start`                      | Start every registered daemon                                                 |
-| `/unbien daemon stop`                       | Stop every running daemon (`/unbien stop` stops only the local terminal)      |
-| `/unbien daemon restart`                    | Stop + start all daemons                                                      |
-| `/unbien daemon status`                     | Detailed runtime status (pid, uptime, restart count)                          |
-| `/unbien daemon send <id> "<text>"`         | Send a prompt to a specific daemon                                            |
-| `/unbien cron add <id> "<expr>" "<prompt>"` | Schedule a recurring prompt (`--tz`, `--wake`, `--no-skip-busy`, `--catchup`) |
-| `/unbien cron list`                         | List scheduled jobs (schedule, enabled, next run, last status)                |
-| `/unbien cron run <jobId>`                  | Fire a job now (ignores its schedule)                                         |
-| `/unbien cron enable\|disable <jobId>`      | Toggle a job on/off                                                           |
-| `/unbien cron remove <jobId>`               | Delete a job                                                                  |
-| `/unbien cron log [<jobId>] [--tail N]`     | Read the fire/skip audit log                                                  |
-| `/unbien install`                           | Install `pi-supervisord` as a system service                                  |
-| `/unbien uninstall`                         | Remove the system service (registry preserved)                                |
+### Service install & remote launch (see [Remote launch](#remote-launch))
+
+| Command             | Description                                                                        |
+| ------------------- | ---------------------------------------------------------------------------------- |
+| `/unbien install`   | Install the **unbien-launcher** daemon as a system service + link the `unbien` CLI |
+| `/unbien uninstall` | Remove the launcher service + CLI links (pairing and config preserved)             |
 
 All commands above work both as Pi slash commands (interactive) and as
 shell-level `unbien <subcommand>` when the package is installed
 globally (`npm install -g @geohar/un-bien`).
 
-### Scheduled prompts (`cron`)
-
-`unbien cron` schedules **recurring prompts** to daemons through the
-supervisor — e.g. a daily "summarise new PRs". Output flows fire-and-forget to
-the mesh/app like any prompt; the cron layer only audits the dispatch.
-
-- **Schedule** is a cron expression (croner syntax; an optional 6th _seconds_
-  field is supported), with an optional IANA timezone via `--tz`:
-
-  ```sh
-  unbien cron add a1b2c3d4 "0 9 * * *" "Summarise new PRs" --tz America/Sao_Paulo
-  ```
-
-- **Minimum interval is 60s** — more frequent schedules are rejected (guards
-  token cost + pileup). A fire is **skipped when the daemon is mid-turn**
-  (`--no-skip-busy` to override); `--wake` starts a stopped daemon first;
-  `--catchup` runs once on supervisor start if the previous run was missed.
-- **Prerequisite**: the supervisor must run as a service (`unbien install`).
-  Without it there is no scheduler, and `cron` commands say so instead of
-  silently pretending to schedule.
-- **Audit**: every fire **and** every skip appends one line to
-  `~/.pi/un-bien/cron.jsonl` with a `result` of `delivered`,
-  `woke_and_delivered`, `deliver_failed`, `skipped_busy`, `skipped_down`, or
-  `skipped_disabled` — read it with `unbien cron log`.
-
 ### Footer + title
 
 - `📡 local (N)` — current agent session and peer count (local mesh)
@@ -472,105 +433,101 @@ tabs.
 
 ---
 
-## Daemon mode
+## Remote launch
 
-When you want a Pi to keep running in the background (responding to
-mobile prompts at 3am, processing cron jobs, monitoring a folder while
-you're not at the keyboard), promote it to a **daemon** managed by a
-single OS-level supervisor.
+The **unbien-launcher** is a lightweight mesh peer — **not** a Pi session — that
+lets a paired app reach your machine even when no Pi is running. It reuses the
+machine's un-bien config (identity + relay), joins the machine-level control
+room, advertises `remote_launch`, and spawns a `pi` window via `tmux` (default)
+or `herdr` when the app asks for one.
 
 See [`docs/daemon.md`](./docs/daemon.md) for troubleshooting.
 
 ### One-time setup
 
 ```bash
-# Install the package globally so `unbien` and `pi-supervisord`
-# are on your PATH (`pi install npm:@geohar/un-bien` alone makes the Pi
-# extension available but does NOT expose the CLI binaries — see
+# Install the package globally so the `unbien` CLI is on your PATH
+# (`pi install npm:@geohar/un-bien` alone makes the Pi extension available
+# but does NOT expose the CLI binary — see
 # https://docs.npmjs.com/cli/v10/configuring-npm/package-json#bin).
 npm install -g @geohar/un-bien
 
-# Install the supervisor as a user-level system service. Linux uses
+# Install the launcher as a user-level system service. Linux uses
 # systemd --user; macOS uses launchd LaunchAgent. Both auto-start at
 # login and survive reboots.
 unbien install
 ```
 
+Or from inside Pi: `/unbien install` — same service, plus it links the
+`unbien` CLI into `~/.local/bin` so no global npm install is needed.
+
 The `install` command:
 
-- Writes `~/.config/systemd/user/unbien-supervisord.service` (Linux)
-  or `~/Library/LaunchAgents/dev.unbien.supervisord.plist` (macOS)
+- Writes `~/.config/systemd/user/unbien-launcher.service` (Linux) or
+  `~/Library/LaunchAgents/dev.unbien.launcher.plist` (macOS); on Windows it
+  registers a Task Scheduler task (`RemotePiLauncher`) and prompts for
+  elevation once
 - Activates it via `systemctl --user enable --now` or `launchctl bootstrap`
-- The supervisor starts immediately and re-starts on every login
+- The launcher starts immediately and re-starts on every login
 
-### Per-folder workflow
+A standalone package exists for running the launcher in the foreground, no
+service: `npm install -g @geohar/un-bien-launcher` → `unbien-launcher`. Same
+daemon, shipped as its own binary (see the
+[launcher README](../launcher/README.md)).
 
-For each agent you want to keep alive 24/7:
+### Enable remote launch
 
-```bash
-# 1. Configure the agent interactively first (one time).
-cd ~/Movies
-pi                                 # /unbien → setup wizard, /unbien pair, etc
+The launcher only spawns sessions where remote launch is **opted in**:
 
-# 2. Promote to a daemon. The id is derived from the cwd
-#    (sha256(realpath)[:8]), stable across machines.
-unbien create ~/Movies --name "Video Editor"
-# → Daemon registered: id=4e39152d name="Video Editor" cwd=/Users/x/Movies
+- per directory: `allow_remote_launch: true` in `<cwd>/.pi/un-bien/config.json`
+- or machine-wide: `defaults.allow_remote_launch: true` in the global config
+  (`~/.pi/extensions/un-bien.json`)
 
-# 3. Start it (supervisor spawns `pi --mode rpc` for this folder).
-unbien daemon start
-```
-
-Now you can:
+The spawn backend is machine-wide: `launch.backend` in the global config —
+`tmux` (default; one shared `un-bien` tmux session, a window per launched Pi)
+or `herdr`. The backend binary must be on PATH: `unbien install` snapshots
+your PATH at install time, so re-run it after installing new tools.
 
-```bash
-unbien daemons                     # list + state
-unbien daemon status               # uptime, pid, restart count
-unbien daemon send 4e39152d "Cut the first 30 seconds of latest clip"
-unbien daemon stop                 # stop all
-unbien daemon restart              # restart all
-```
+### Launch names
 
-The agent receives the prompt as if a user typed it; its response flows
-back through the relay/mesh you configured during interactive setup —
-mobile app sees it live, other agents on the same machine can see it
-via the local UDS mesh.
+A `session_launch` request may carry a `name`. On the tmux backend the
+launched Pi gets it as `pi -n <name>` — pi's native session display name —
+which the extension resolves as the session-scoped agent name: the mesh
+join, cwd lock, `room_meta`, and the app's session tile all show it instead
+of the path-derived default. It is per-process (never inherited by
+subagents or child processes) and never persisted — a manual `pi` in the
+same directory keeps its configured `agent_name`. `/unbien rename` still
+wins once it runs. The herdr backend uses the name as the workspace label
+only until it can pass args through to pi.
 
 ### Removing or uninstalling
 
 ```bash
-unbien remove <id>                 # unregister one daemon (config preserved)
-unbien uninstall                   # remove the supervisor service (registry kept)
+unbien uninstall        # remove the launcher service (pairing + config kept)
 ```
 
-`uninstall` is reversible — re-running `install` later brings every
-registered daemon back. To wipe the registry entirely, `rm
-~/.pi/un-bien/daemons.json`.
+`uninstall` is reversible — re-running `install` later brings the launcher
+back. Pairing and identity live in the state root and are never touched.
 
 ### Where to find logs
 
-| Platform | Command                                      |
-| -------- | -------------------------------------------- |
-| Linux    | `journalctl --user -u unbien-supervisord -f` |
-| macOS    | `tail -f ~/.pi/un-bien/supervisord.log`      |
-
-Each spawned daemon's stderr is forwarded into the supervisor's log
-with a `[<cwd>]` prefix, so a single log stream shows every agent.
+| Platform | Command                                                 |
+| -------- | ------------------------------------------------------- |
+| Linux    | `journalctl --user -u unbien-launcher -f`               |
+| macOS    | `tail -f ~/.local/state/un-bien/launcher.log`           |
+| Windows  | `Get-Content ~\.local\state\un-bien\launcher.log -Wait` |
 
 ### Caveats
 
-- **Tool execution is not gated.** Daemons inherit the same Pi config
-  the interactive run uses — Bash, Edit, Write etc. all execute without
-  prompting. Configure Pi's tool permissions to taste before promoting
-  a folder to daemon.
-- **Pairing still happens interactively.** Daemons don't show a QR
-  themselves; the keypair + paired devices come from the prior `pi`
-  session in the same folder.
-- **Single supervisor.** If `pi-supervisord` crashes all daemons go
-  down with it. systemd/launchd restarts it within seconds; daemons
-  come back automatically.
-- **One daemon per cwd.** The `roomIdForCwd` derivation makes daemons
-  by-path; two daemons in the same folder is rejected at `create` time.
+- **Pairing still happens interactively.** The launcher doesn't show a QR; it
+  only trusts owners already paired via `/unbien pair` in a Pi session on
+  this machine.
+- **Tool execution is not gated.** A launched Pi inherits the same Pi config
+  an interactive run uses — Bash, Edit, Write etc. all execute without
+  prompting. Configure Pi's tool permissions to taste before enabling
+  `allow_remote_launch`.
+- **Same identity, same relay.** The launcher reads the machine's global
+  config — `/unbien config` shows exactly what it will use.
 
 ---
 
@@ -578,17 +535,14 @@ with a `[<cwd>]` prefix, so a single log stream shows every agent.
 
 ### Files
 
-| Path                                          | Scope             | What's in it                                                                   |
-| --------------------------------------------- | ----------------- | ------------------------------------------------------------------------------ |
-| `~/.pi/extensions/un-bien.json`               | Per-user (global) | `relay` URL, `defaults`, `identity`, `debug` — the global settings (see below) |
-| `<cwd>/.pi/un-bien/config.json`               | Per-directory     | `agent_name`, `auto_start_relay`, `allow_remote_launch`                        |
-| `~/.pi/un-bien/identity.json`                 | Per-machine       | Paired identity keypair (file identity backend; `0600`)                        |
-| `~/.pi/un-bien/peers.json`                    | Per-machine       | Paired mobile devices                                                          |
-| `~/.pi/un-bien/sessions/<name>/`              | Per-session       | Broker socket + `audit.jsonl`                                                  |
-| `~/.pi/un-bien/daemons.json`                  | Per-machine       | Daemon registry                                                                |
-| `~/.pi/un-bien/cron.json` · `cron.jsonl`      | Per-machine       | Cron registry + fire/skip audit log                                            |
-| `~/.pi/un-bien/supervisor.sock`               | Per-machine       | Supervisor control socket                                                      |
-| `~/.pi/un-bien/skills/agent-network/SKILL.md` | Per-user          | Agent skill the LLM reads                                                      |
+| Path                                                   | Scope             | What's in it                                                                   |
+| ------------------------------------------------------ | ----------------- | ------------------------------------------------------------------------------ |
+| `~/.pi/extensions/un-bien.json`                        | Per-user (global) | `relay` URL, `defaults`, `identity`, `debug` — the global settings (see below) |
+| `<cwd>/.pi/un-bien/config.json`                        | Per-directory     | `agent_name`, `auto_start_relay`, `allow_remote_launch`                        |
+| `~/.local/state/un-bien/identity.json`                 | Per-machine       | Paired identity keypair (file identity backend; `0600`)                        |
+| `~/.local/state/un-bien/peers.json`                    | Per-machine       | Paired mobile devices                                                          |
+| `~/.local/state/un-bien/sessions/<name>/`              | Per-session       | Broker socket + `audit.jsonl`                                                  |
+| `~/.local/state/un-bien/skills/agent-network/SKILL.md` | Per-user          | Agent skill the LLM reads                                                      |
 
 ### Global settings — `~/.pi/extensions/un-bien.json`
 
@@ -606,13 +560,19 @@ fields are optional:
   // Pin auto-start once instead of dropping a file into every repo.
   "defaults": { "auto_start_relay": true },
 
+  // Remote-launch backend a `session_launch` request uses on THIS machine:
+  // "tmux" (default; one shared tmux session, a window per launched Pi) or
+  // "herdr". Machine-wide choice — whether remote launch is enabled at all
+  // stays the per-cwd `allow_remote_launch` flag.
+  "launch": { "backend": "tmux" },
+
   // Machine-identity storage. `storage` selects the PRIMARY backend for this
   // Pi's long-term Ed25519 seed: "keychain" (OS-secured, default) or "file"
   // (a 0600 seed file — the SSH-private-key model: cat-able, portable,
   // works headless). `path` overrides the file-backend location
-  // (default ~/.pi/un-bien/identity.json). The unselected backend is still
+  // (default ~/.local/state/un-bien/identity.json). The unselected backend is still
   // READ to recover an existing identity, but never written.
-  "identity": { "storage": "keychain", "path": "~/.pi/un-bien/identity.json" },
+  "identity": { "storage": "keychain", "path": "~/.local/state/un-bien/identity.json" },
 
   // File-based diagnostic logs. Off by default. Read from config (not env)
   // because the daemon fork usually runs detached without a shell's env.
@@ -635,14 +595,23 @@ Written by the `/unbien` setup wizard:
 | Variable               | Purpose                                                                                                                    |
 | ---------------------- | -------------------------------------------------------------------------------------------------------------------------- |
 | `UNBIEN_RELAY`         | Relay URL override (highest precedence, ahead of the config file). CI / one-off use.                                       |
-| `UNBIEN_DIR`           | Absolute override of the **state** dir itself (no `.pi/un-bien` suffix). The knob for an XDG-style relocation.             |
-| `UNBIEN_HOME`          | Stand-in `$HOME`; state lives at `<UNBIEN_HOME>/.pi/un-bien`. When both are set, `UNBIEN_DIR` wins.                        |
+| `UNBIEN_STATE_DIR`     | Absolute override of the **state** dir itself. The knob for relocating state. Highest precedence of the state knobs.       |
+| `UNBIEN_DIR`           | Legacy absolute override of the **state** dir itself (no suffix appended). Lower precedence than `UNBIEN_STATE_DIR`.       |
+| `UNBIEN_HOME`          | Legacy stand-in `$HOME`; state lives at `<UNBIEN_HOME>/.pi/un-bien`. Lower precedence than `UNBIEN_DIR`.                   |
 | `PI_CODING_AGENT_DIR`  | The Pi host's settings root (default `~/.pi`); the global config lives at `<PI_CODING_AGENT_DIR>/extensions/un-bien.json`. |
-| `UNBIEN_DIRECT_CONFIG` | Inline per-cwd config (JSON) instead of a `.pi/un-bien/config.json` file — used by the daemon supervisor.                  |
-
-`UNBIEN_DIR`/`UNBIEN_HOME` relocate un-bien **state** (sessions, daemon
-registries, cwd locks, paired identity). `PI_CODING_AGENT_DIR` relocates only
-the global **config**, so it can sit beside the coding agent's own settings.
+| `UNBIEN_DIRECT_CONFIG` | Inline per-cwd config (JSON) instead of a `.pi/un-bien/config.json` file — CI / one-off use.                               |
+
+The state root resolves as `UNBIEN_STATE_DIR` > `UNBIEN_DIR` > `UNBIEN_HOME` >
+`${XDG_STATE_HOME:-~/.local/state}/un-bien` — the XDG-style default. `UNBIEN_DIR`/
+`UNBIEN_HOME` relocate un-bien **state** (sessions, cwd locks, paired identity) and stay honored for older deployments. On first use
+of the new default, a one-time best-effort migration moves any legacy
+`~/.pi/un-bien` state (peers.json included) into the new root.
+`PI_CODING_AGENT_DIR` relocates only the global **config**, so it can sit
+beside the coding agent's own settings.
+
+**Deprecated**: the relay no longer defaults its SQLite DB to a CWD-relative
+`data/mesh.db` — see the relay README for its `UNBIEN_MESH_DB_PATH` /
+state-root resolution.
 
 Override the relay for a single run without persisting:
 

package/dist/actions/handlers.js.map

@@ -1 +1 @@
-{"version":3,"file":"handlers.js","sourceRoot":"","sources":["../../src/actions/handlers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAuEH;8EAC8E;AAC9E,MAAM,UAAU,aAAa,CAAC,KAAiB;IAC7C,OAAO;QACL,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,cAAc,EAAE,KAAK,CAAC,aAAa;QACnC,gEAAgE;QAChE,2EAA2E;QAC3E,wDAAwD;QACxD,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK;KAChD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"handlers.js","sourceRoot":"","sources":["../../src/actions/handlers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAuEH;8EAC8E;AAC9E,MAAM,UAAU,aAAa,CAAC,KAAiB;IAC7C,OAAO;QACL,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,cAAc,EAAE,KAAK,CAAC,aAAa;QACnC,gEAAgE;QAChE,2EAA2E;QAC3E,wDAAwD;QACxD,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK;KAChD,CAAA;AACH,CAAC"}

package/dist/actions/registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/actions/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AASH,IAAI,iBAAiB,GAA+B,IAAI,CAAC;AAEzD;;;GAGG;AACH,MAAM,aAAa,GAAwB;IACzC,OAAO,KAAI,CAAC;IACZ,YAAY;QACV,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAA+B;IAE/B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,GAAG,EAAE,aAAa,CAAC;QAChC,IAAI,IAAI,EAAE,CAAC;YACT,iBAAiB,GAAG,IAAI,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;IACvE,CAAC;IACD,OAAO,iBAAiB,IAAI,aAAa,CAAC;AAC5C,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,2BAA2B;IACzC,iBAAiB,GAAG,IAAI,CAAC;AAC3B,CAAC"}
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/actions/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AASH,IAAI,iBAAiB,GAA+B,IAAI,CAAA;AAExD;;;GAGG;AACH,MAAM,aAAa,GAAwB;IACzC,OAAO,KAAI,CAAC;IACZ,YAAY;QACV,OAAO,EAAE,CAAA;IACX,CAAC;IACD,IAAI;QACF,OAAO,SAAS,CAAA;IAClB,CAAC;CACF,CAAA;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAA+B;IAE/B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,GAAG,EAAE,aAAa,CAAA;QAC/B,IAAI,IAAI,EAAE,CAAC;YACT,iBAAiB,GAAG,IAAI,CAAA;YACxB,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;IACvE,CAAC;IACD,OAAO,iBAAiB,IAAI,aAAa,CAAA;AAC3C,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,2BAA2B;IACzC,iBAAiB,GAAG,IAAI,CAAA;AAC1B,CAAC"}

package/dist/bin/launcher.js.map

@@ -1 +1 @@
-{"version":3,"file":"launcher.js","sourceRoot":"","sources":["../../src/bin/launcher.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAExD,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,MAAM,aAAa,EAAE,CAAC;IACrC,sCAAsC;IACtC,OAAO,CAAC,GAAG,CACT,gDAAgD,MAAM,CAAC,MAAM,GAAG;QAC9D,QAAQ,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CACvD,CAAC;IAEF,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,EAAE;QAClC,IAAI,YAAY;YAAE,OAAO;QACzB,YAAY,GAAG,IAAI,CAAC;QACpB,sCAAsC;QACtC,OAAO,CAAC,GAAG,CAAC,sBAAsB,MAAM,kBAAkB,CAAC,CAAC;QAC5D,MAAM,CAAC,IAAI,EAAE,CAAC;QACd,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/C,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IAC5B,sCAAsC;IACtC,OAAO,CAAC,KAAK,CACX,6BAA6B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAChF,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"launcher.js","sourceRoot":"","sources":["../../src/bin/launcher.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AAEvD,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,MAAM,aAAa,EAAE,CAAA;IACpC,sCAAsC;IACtC,OAAO,CAAC,GAAG,CACT,gDAAgD,MAAM,CAAC,MAAM,GAAG;QAC9D,QAAQ,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CACvD,CAAA;IAED,IAAI,YAAY,GAAG,KAAK,CAAA;IACxB,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,EAAE;QAClC,IAAI,YAAY;YAAE,OAAM;QACxB,YAAY,GAAG,IAAI,CAAA;QACnB,sCAAsC;QACtC,OAAO,CAAC,GAAG,CAAC,sBAAsB,MAAM,kBAAkB,CAAC,CAAA;QAC3D,MAAM,CAAC,IAAI,EAAE,CAAA;QACb,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAA;IACD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAA;IAC9C,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAA;AAClD,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IAC5B,sCAAsC;IACtC,OAAO,CAAC,KAAK,CACX,6BAA6B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAChF,CAAA;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACjB,CAAC,CAAC,CAAA"}

package/dist/commands/deps.d.ts

@@ -0,0 +1,156 @@
+import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
+import type { Ed25519Keypair } from "../pairing/crypto.js";
+import type { SelfRevoke } from "../mesh/self_revoke.js";
+import type { MeshTopologySnapshot } from "../mesh/siblings.js";
+import type { Envelope } from "../session/envelope.js";
+import type { MeshNode } from "../session/mesh_node.js";
+import type { AcquiredLock } from "../session/cwd_lock.js";
+import type { RelayClient } from "../transport/relay_client.js";
+import type { PlainPeerChannel } from "../transport/peer_channel.js";
+import type { ThinkingLevel } from "../protocol/types.js";
+/** App↔Pi room meta projected by the ROOT session (see index.ts `_myRoomMeta`). */
+export type RoomMeta = {
+    name: string;
+    cwd: string;
+    model?: string;
+    thinking?: ThinkingLevel;
+    working?: boolean;
+    sessionId?: string;
+};
+/**
+ * The seam between index.ts (composition root) and the `/unbien` command
+ * modules.
+ *
+ * index.ts owns every piece of mutable module state and every lifecycle
+ * helper the command handlers touch. Command modules MUST NOT import from
+ * `../index.js` (that would be a circular import); instead index.ts builds
+ * one `CommandDeps` object (accessor closures over its module state plus
+ * direct function references) and passes it to `registerUnbienCommands`,
+ * which threads it into every handler that needs it.
+ *
+ * Members are added exactly as the moved code requires them — nothing
+ * speculative. Mutable state that commands write is a get/set pair; state
+ * they only read is `readonly`.
+ */
+export interface CommandDeps {
+    /** Remote state machine: `idle` → `started` (`paired` is derived). */
+    state: "idle" | "started";
+    /** Live relay WS connection, null when off. */
+    relay: RelayClient | null;
+    /** URL used by the current relay connection (http(s):// canonical form). */
+    relayUrl: string | null;
+    /** Local UDS mesh node, null when not joined. */
+    meshNode: MeshNode | null;
+    /** Mesh session name (LOCAL_SESSION_NAME once joined). */
+    sessionName: string | null;
+    /** Authoritative local-mesh peer count (broker `list_peers`). */
+    sessionPeerCount: number;
+    /** Cached Ed25519 identity of this connect cycle. */
+    cachedEd25519: Ed25519Keypair | null;
+    /** Last-known model name (root session projection). */
+    currentModel: string | undefined;
+    /** Last-known thinking level (root session projection). */
+    currentThinking: ThinkingLevel | undefined;
+    /** THE App↔Pi room id for the current chat session. */
+    myRoomId: string | null;
+    /** Room meta hello payload persisted for reconnect replay. */
+    myRoomMeta: RoomMeta | null;
+    /** Shortid of the most recently attached peer (UX hint only). */
+    peerShort: string;
+    /** Epoch of this Pi process's session (stamped on first start). */
+    sessionStartedAt: number | null;
+    /** Per-(cwd,name) singleton lock backing the mesh registration. */
+    cwdLock: AcquiredLock | null;
+    /** Name the cwd-lock actually reserved (`name` or `name#N`). */
+    lockedName: string | null;
+    /** Relay candidate generation (invalidates in-flight starts/stops). */
+    relayLifecycleGeneration: number;
+    /** True when a relay start was deferred because no session id existed yet
+     *  (design 01M1CAW0); the root session_start re-runs the start once the id
+     *  is available. */
+    relayStartDeferred: boolean;
+    /** Root replacement authority epoch (session replacements). */
+    rootLifecycleGeneration: number;
+    /** Mesh join candidate generation. */
+    meshJoinGeneration: number;
+    /** SelfRevoke topology producer for the relay path. */
+    selfRevoke: SelfRevoke | null;
+    /** Epoch guarding the SelfRevoke producer identity. */
+    selfRevokeEpoch: number;
+    /** Producer epoch that last published a verified topology. */
+    selfRevokeTopologyReadyEpoch: number;
+    /** Last topology snapshot published by the producer. */
+    selfRevokeTopology: MeshTopologySnapshot | null;
+    /** Auto-listener dispose fn for the current relay connection. */
+    stopAutoListener: (() => void) | null;
+    /** Cached "any device is paired machine-wide" flag (peers.json). */
+    readonly hasGlobalPairings: boolean;
+    /** Connected owner channels, keyed by canonical owner pubkey. */
+    readonly activePeers: Map<string, PlainPeerChannel>;
+    /** Set by session_shutdown; blocks outgoing candidates until rearm. */
+    readonly disposed: boolean;
+    /** Always-fresh session_start ctx (model/registry fallback). */
+    readonly lastEventCtx: Pick<ExtensionContext, "compact" | "abort" | "ui"> | null;
+    /** The ROOT session's ExtensionAPI (never a subagent child's). */
+    readonly pi: ExtensionAPI | null;
+    /** The root session's pi sessionId, null pre-sessionManager. */
+    readonly rootSessionId: string | null;
+    /** True while `generation` is the current root lifecycle epoch. */
+    isCurrentRootLifecycle(generation: number): boolean;
+    /** Friendly (configured or derived) agent name for a cwd. */
+    displayName(cwd: string): string;
+    /** Room id for the current chat session, derived from the stable pi
+     *  session id — or null when no session id exists yet, in which case the
+     *  caller must NOT announce/join a room (design 01M1CAW0; the cwd-derived
+     *  fallback is retired). */
+    deriveRoomId(cwd: string, name: string): string | null;
+    /** Friendly model name for room_meta. */
+    currentModelName(): string | undefined;
+    /** The ROOT session's state record (turn/agentRun/sessionManager). */
+    rootState(): {
+        sessionManager?: {
+            getSessionId(): string;
+        } | null;
+    };
+    /** Full teardown of relay-side state (relay off, bridge detached). */
+    goIdle(): void;
+    /** Reconnect backoff entry for a closed relay. */
+    onRelayClose(closedRelay: RelayClient): void;
+    /** Attach the pair_request auto-listener to a live relay. */
+    installAutoListener(relay: RelayClient): () => void;
+    /** Repaint the footer status line from current state. */
+    refreshFooter(ctx?: {
+        ui?: {
+            setStatus?: unknown;
+            setTitle?: unknown;
+        };
+    } | null): void;
+    /** Tear down an owner's live channel + report the revocation. */
+    revokeActiveOwnerRuntime(canonicalOwnerPubkey: string): void;
+    /** Attach the cross-PC bridge once relay + leader are both up. */
+    attachBridgeIfReady(): void;
+    /** Broadcast relay connectivity state to RPC clients. */
+    emitRelayState(force?: boolean): void;
+    /** Re-query the broker for the authoritative local peer count. */
+    refreshSessionPeerCount(peer: MeshNode, ctx?: Pick<ExtensionContext, "ui"> | null): void;
+    /** Queue an inbound mesh message for agent delivery. */
+    deliverMeshMessageToAgent(env: Envelope): void;
+    /** Reads peers.json and refreshes the global-pairings cache + footer. */
+    refreshPairingsCache(): void;
+    /** Tear down a connected owner's channel (revoke / disconnect). */
+    detachPeerChannel(appPeerId: string): void;
+    /** RPC control channel verbs (`relay:toggle` / `relay:on` / `relay:off`). */
+    handleControl(cmd: string): Promise<void>;
+    /** Relay connectivity label for status output. */
+    relayStatus(): "connected" | "reconnecting" | "disconnected";
+    /** Test-visible state: `idle` | `started` | derived `paired`. */
+    getState(): "idle" | "started" | "paired";
+    /** Hidden dev-only e2e UI harness (`/unbien test <scenario>`). */
+    runTestScenario(scenario: string): string;
+    /** ctx.ui.notify that never throws (stale-ctx safe). */
+    safeNotify(message: string, level?: "info" | "warning" | "error", preferred?: {
+        ui?: unknown;
+    } | null): void;
+    /** Rename this agent (mesh + relay room) — `/unbien rename`. */
+    renameAgent(newName: string): Promise<void>;
+}

package/dist/commands/deps.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=deps.js.map

package/dist/commands/deps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deps.js","sourceRoot":"","sources":["../../src/commands/deps.ts"],"names":[],"mappings":""}

package/dist/commands/fork_link.d.ts

@@ -0,0 +1,4 @@
+/** Record that `sessionId` was born from the app fork request `req`. Best-effort. */
+export declare function writeForkLink(sessionDir: string, sessionId: string, req: string): void;
+/** Read + delete the fork request id for `sessionId`, or undefined when none. */
+export declare function takeForkLink(sessionDir: string, sessionId: string): string | undefined;

package/dist/commands/fork_link.js

@@ -0,0 +1,45 @@
+/**
+ * Fork-born linkage: a tiny marker persisted by `_cmdFork`'s `withSession`
+ * (running in the NEW forked session) and consumed by that session's FIRST
+ * `session_sync_end`, which echoes the app's originating fork request id as
+ * `forked_from_req` so the app can auto-navigate to the new session.
+ *
+ * Why a FILE and not a module variable: `ctx.fork` replaces the AgentSession,
+ * and the pi TUI host re-evaluates this extension module fresh for the new
+ * session (jiti moduleCache:false), so a module-level stash set in withSession
+ * would be lost before the new session handles the app's session_sync. The
+ * marker is keyed by the new session id and lives in the session dir, so it
+ * survives the re-eval (and a process restart) and is unambiguous.
+ *
+ * Consumed ONCE (take = read + unlink): the app navigates on the first sync;
+ * leaving it would re-fire the jump on every reconnect.
+ */
+import { existsSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+function _linkPath(sessionDir, sessionId) {
+    return join(sessionDir, `.unbien-fork-${sessionId}.json`);
+}
+/** Record that `sessionId` was born from the app fork request `req`. Best-effort. */
+export function writeForkLink(sessionDir, sessionId, req) {
+    try {
+        writeFileSync(_linkPath(sessionDir, sessionId), JSON.stringify({ req, ts: Date.now() }));
+    }
+    catch {
+        /* best-effort — a missing link just means no auto-nav */
+    }
+}
+/** Read + delete the fork request id for `sessionId`, or undefined when none. */
+export function takeForkLink(sessionDir, sessionId) {
+    const path = _linkPath(sessionDir, sessionId);
+    try {
+        if (!existsSync(path))
+            return undefined;
+        const parsed = JSON.parse(readFileSync(path, "utf8"));
+        unlinkSync(path);
+        return typeof parsed.req === "string" ? parsed.req : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=fork_link.js.map

package/dist/commands/fork_link.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fork_link.js","sourceRoot":"","sources":["../../src/commands/fork_link.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAC7E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC,SAAS,SAAS,CAAC,UAAkB,EAAE,SAAiB;IACtD,OAAO,IAAI,CAAC,UAAU,EAAE,gBAAgB,SAAS,OAAO,CAAC,CAAA;AAC3D,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,aAAa,CAC3B,UAAkB,EAClB,SAAiB,EACjB,GAAW;IAEX,IAAI,CAAC;QACH,aAAa,CACX,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC,EAChC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CACxC,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACP,yDAAyD;IAC3D,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,YAAY,CAC1B,UAAkB,EAClB,SAAiB;IAEjB,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC,CAAA;IAC7C,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAA;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAsB,CAAA;QAC1E,UAAU,CAAC,IAAI,CAAC,CAAA;QAChB,OAAO,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAA;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC"}

package/dist/commands/housekeeping.d.ts

@@ -0,0 +1,34 @@
+/**
+ * `/unbien` housekeeping commands: service install/uninstall, the
+ * agent-network skill deploy, extension-dir/skill-path resolution, and the
+ * `unbien claude` CLI launcher.
+ *
+ * None of these touch index.ts module state, so they take no CommandDeps —
+ * everything they use is imported from pi-independent modules. Carved out
+ * of index.ts (phase 1 of the index.ts carve-up).
+ *
+ * NOTE: this file lives one directory deeper than index.ts used to, so the
+ * import.meta.url-based path math (extension dir, packaged skill, mesh
+ * server) climbs one extra level — behavior is otherwise identical.
+ */
+import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
+/**
+ * `linkCli` controls whether we symlink `un-bien` into `~/.local/bin/`. The
+ * slash-command path passes `true` (user is inside Pi's TUI — they installed
+ * via `pi install npm:un-bien` and need us to expose the CLI for them). The
+ * standalone-CLI path passes `false` because the user is already running our
+ * binary from PATH (they did `npm install -g un-bien`), so re-linking would
+ * point their `un-bien` at the Pi-extension copy and diverge on upgrades.
+ */
+/** Returns true on success, false when install failed (so the standalone CLI
+ *  can exit non-zero — e.g. the Cockpit / CI detect failure by exit code).
+ *  We do NOT process.exit here: this also runs inside the Pi TUI, where exiting
+ *  would kill the session. */
+export declare function _cmdInstall(ctx: Pick<ExtensionContext, "ui">, opts?: {
+    linkCli?: boolean;
+}): boolean;
+export declare function _cmdUninstall(ctx: Pick<ExtensionContext, "ui">, opts?: {
+    linkCli?: boolean;
+}): void;
+export declare function _deployAgentNetworkSkill(): void;
+export declare function _cmdClaudeCli(args: string[]): Promise<void>;