@getrift/rift 0.1.0-beta.2 → 0.1.0-beta.20

package/dist/src/cli/http-client.d.ts

@@ -1,5 +1,5 @@
 import { type KeychainOps } from "../auth/keychain.js";
-export type CliErrorCode = "connection_refused" | "unauthorized" | "not_found" | "conflict" | "rate_limited" | "validation" | "server_error" | "unknown";
+export type CliErrorCode = "connection_refused" | "unauthorized" | "not_found" | "invalid" | "config_too_new" | "conflict" | "rate_limited" | "validation" | "server_error" | "unknown";
 export declare class CliError extends Error {
     readonly code: CliErrorCode;
     readonly statusCode?: number | undefined;
@@ -31,6 +31,98 @@ export interface HttpClient {
     }>;
 }
 export declare function createHttpClient(opts: HttpClientOpts): HttpClient;
+/**
+ * Single source of truth for "where is the config file?" — pure path
+ * resolution, no I/O. Per A-2.1 / A-2.2:
+ *   --config wins over RIFT_CONFIG wins over default
+ *   Empty / whitespace-only RIFT_CONFIG falls through to the default
+ *   Relative paths are resolved with path.resolve at call time
+ *
+ * Callers that need the file to actually exist should use
+ * `requireExistingConfigPath` instead, which also classifies missing
+ * vs invalid distinctly.
+ */
+export declare function resolveConfigPath(globalOpts: {
+    config?: string;
+}): string;
+/**
+ * For commands that need an existing, valid config (search, save,
+ * import, ingest, mcp install, feedback, capture, etc.). Throws a
+ * `CliError` with code "not_found" or "invalid", whose messages are
+ * distinct per A-2.3a / A-2.3c. Caller should let the exception
+ * propagate so the top-level CLI handler renders it.
+ */
+export declare function requireExistingConfigPath(globalOpts: {
+    config?: string;
+}): string;
+/**
+ * Status-only lenient base-URL resolver. `rift status` is a diagnostic and
+ * must stay useful even when the config carries a top-level key this (older)
+ * CLI doesn't recognize yet — e.g. a newer beta wrote `codex_cli` and strict
+ * Zod parsing rejects the whole file. It reads ONLY `server.port` leniently
+ * so status can still probe the daemon and tell the friend to update.
+ *
+ * SECURITY: the host is hard-pinned to `127.0.0.1` — never read from the
+ * config. `rift status` reads the auth token and sends it to this URL, so if
+ * lenient mode honoured an arbitrary `server.host`, a malformed config could
+ * redirect Rift's secret token to a non-loopback address. The strict schema
+ * already constrains host to the `127.0.0.1` literal, so no valid config ever
+ * carries another host — there is nothing legitimate to read, and reading it
+ * would only open an exfiltration path. We pin the daemon address and vary
+ * only the port (the one field a real config legitimately changes).
+ *
+ * NEVER use this for daemon startup or any write path — strict validation
+ * (`resolveBaseUrl` / `requireExistingConfigPath`) stays the only gate there.
+ * This is a read-only, loopback-only diagnostic fallback, nothing more.
+ *
+ * Returns null when the file is missing/unreadable or not valid JSON — those
+ * are real errors the caller should surface, not "the config is just newer".
+ */
+export declare function resolveBaseUrlLenient(configPath: string): string | null;
+/**
+ * No-auth probe of a daemon's /health endpoint at an explicit base URL.
+ * `/health` is unauthenticated by design, so this needs neither a token nor
+ * a round-trip through the authenticated client. Returns the daemon's own
+ * ground truth for `voyage_key_present` — the only correct source for any
+ * "is a Voyage key loaded?" gate, since the daemon (not the calling shell)
+ * is the process that saves and embeds.
+ */
+export declare function probeDaemonHealth(baseUrl: string): Promise<{
+    up: boolean;
+    uptimeSeconds?: number;
+    voyageKeyPresent?: boolean;
+}>;
+/**
+ * No-config, no-auth direct probe of the daemon's /health endpoint at the
+ * default loopback URL. Used by `rift status` only — every other command
+ * needs config and auth. Per A-2.3a/A-2.3b: `rift status` MUST NOT hard-fail
+ * when the config is absent; it renders "config missing" instead, with the
+ * daemon's actual up/down state taken from this probe.
+ */
+export declare function probeDefaultDaemonHealth(): Promise<{
+    up: boolean;
+    uptimeSeconds?: number;
+    voyageKeyPresent?: boolean;
+}>;
+/**
+ * resolveBaseUrl stays strict — only commands that actually need the
+ * daemon URL call it, and they all need a real config. Per A-2.3a:
+ * status's no-config branch MUST NOT route through here; it uses
+ * `probeDefaultDaemonHealth()` instead.
+ */
 export declare function resolveBaseUrl(configPath: string): string;
+/**
+ * Read the current auth token. Checks `~/.rift/token` first, then the
+ * macOS Keychain. Returns `null` only when no token has been issued —
+ * a real "not yet onboarded" state. A locked Keychain (typical over
+ * SSH or in CI without a GUI session) is a recoverable *failure*, not
+ * a missing token, so it surfaces as a typed `CliError` with the exact
+ * `security unlock-keychain` recovery command.
+ *
+ * Without this conversion, CLI commands that call `readToken()` would
+ * leak the raw `security find-generic-password` failure to the user.
+ * Confirmed live on `0.1.0-beta.6` against an SSH'd test user, post-
+ * publish, before this fix landed.
+ */
 export declare function readToken(keychain?: KeychainOps): Promise<string | null>;
 //# sourceMappingURL=http-client.d.ts.map

package/dist/src/cli/http-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-client.d.ts","sourceRoot":"","sources":["../../../src/cli/http-client.ts"],"names":[],"mappings":"AAIA,OAAO,EAAe,KAAK,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEpE,MAAM,MAAM,YAAY,GACpB,oBAAoB,GACpB,cAAc,GACd,WAAW,GACX,UAAU,GACV,cAAc,GACd,YAAY,GACZ,cAAc,GACd,SAAS,CAAC;AAEd,qBAAa,QAAS,SAAQ,KAAK;aAGf,IAAI,EAAE,YAAY;aAClB,UAAU,CAAC,EAAE,MAAM;aACnB,IAAI,CAAC,EAAE,OAAO;gBAH9B,OAAO,EAAE,MAAM,EACC,IAAI,EAAE,YAAY,EAClB,UAAU,CAAC,EAAE,MAAM,YAAA,EACnB,IAAI,CAAC,EAAE,OAAO,YAAA;CAKjC;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,CACF,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,OAAO,EACd,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GAC7C,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC9C,aAAa,CACX,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,QAAQ,EACd,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GAC7C,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC9C,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAC/D;AAkDD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,cAAc,GAAG,UAAU,CAqGjE;AAED,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAGzD;AAED,wBAAsB,SAAS,CAC7B,QAAQ,GAAE,WAAyB,GAClC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAMxB"}
+{"version":3,"file":"http-client.d.ts","sourceRoot":"","sources":["../../../src/cli/http-client.ts"],"names":[],"mappings":"AAKA,OAAO,EAGL,KAAK,WAAW,EACjB,MAAM,qBAAqB,CAAC;AAG7B,MAAM,MAAM,YAAY,GACpB,oBAAoB,GACpB,cAAc,GACd,WAAW,GACX,SAAS,GAKT,gBAAgB,GAChB,UAAU,GACV,cAAc,GACd,YAAY,GACZ,cAAc,GACd,SAAS,CAAC;AAEd,qBAAa,QAAS,SAAQ,KAAK;aAGf,IAAI,EAAE,YAAY;aAClB,UAAU,CAAC,EAAE,MAAM;aACnB,IAAI,CAAC,EAAE,OAAO;gBAH9B,OAAO,EAAE,MAAM,EACC,IAAI,EAAE,YAAY,EAClB,UAAU,CAAC,EAAE,MAAM,YAAA,EACnB,IAAI,CAAC,EAAE,OAAO,YAAA;CAKjC;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,CACF,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,OAAO,EACd,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GAC7C,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC9C,aAAa,CACX,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,QAAQ,EACd,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GAC7C,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC9C,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAC/D;AA6ED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,cAAc,GAAG,UAAU,CAqGjE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAezE;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,EAAE;IACpD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,MAAM,CAqBT;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAyBvE;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;IAChE,EAAE,EAAE,OAAO,CAAC;IACZ,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B,CAAC,CAuBD;AAED;;;;;;GAMG;AACH,wBAAsB,wBAAwB,IAAI,OAAO,CAAC;IACxD,EAAE,EAAE,OAAO,CAAC;IACZ,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B,CAAC,CAED;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAgCzD;AAyBD;;;;;;;;;;;;GAYG;AACH,wBAAsB,SAAS,CAC7B,QAAQ,GAAE,WAAyB,GAClC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAqBxB"}

package/dist/src/cli/http-client.js

@@ -1,8 +1,10 @@
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
+import { ZodError } from "zod";
 import { loadConfig } from "../config/loader.js";
-import { macKeychain } from "../auth/keychain.js";
+import { macKeychain, LockedKeychainError, } from "../auth/keychain.js";
+import { defaultConfigPath } from "./default-config-path.js";
 export class CliError extends Error {
     code;
     statusCode;
@@ -26,14 +28,33 @@ function isConnectionRefused(err) {
     }
     return false;
 }
+function hasTypedError(body) {
+    return (typeof body === "object" &&
+        body !== null &&
+        typeof body.error === "string");
+}
+function formatTypedBody(body) {
+    if (typeof body === "string")
+        return body;
+    return JSON.stringify(body);
+}
 function mapStatusToError(status, body) {
     switch (status) {
         case 401:
             return new CliError("Authentication failed. Run: rift token issue", "unauthorized", status, body);
         case 404:
-            return new CliError("Endpoint not available", "not_found", status, body);
+            // Daemon-level 404 (no such endpoint) vs. response-level 404 with a
+            // typed `error` field (e.g. id_not_found). Surface the typed body so
+            // callers don't read "Endpoint not available" and route around us.
+            return new CliError(hasTypedError(body)
+                ? `Not found: ${formatTypedBody(body)}`
+                : "Endpoint not available", "not_found", status, body);
         case 409:
-            return new CliError("Another exclusive operation is running", "conflict", status, body);
+            // Same idea: prefer the typed body (e.g. ambiguous_id) over the
+            // generic exclusive-operation message that only applies to jobs.
+            return new CliError(hasTypedError(body)
+                ? `Conflict: ${formatTypedBody(body)}`
+                : "Another exclusive operation is running", "conflict", status, body);
         case 429:
             return new CliError("Rate limited. Retry later.", "rate_limited", status, body);
         default:
@@ -116,18 +137,245 @@ export function createHttpClient(opts) {
         },
     };
 }
+/**
+ * Single source of truth for "where is the config file?" — pure path
+ * resolution, no I/O. Per A-2.1 / A-2.2:
+ *   --config wins over RIFT_CONFIG wins over default
+ *   Empty / whitespace-only RIFT_CONFIG falls through to the default
+ *   Relative paths are resolved with path.resolve at call time
+ *
+ * Callers that need the file to actually exist should use
+ * `requireExistingConfigPath` instead, which also classifies missing
+ * vs invalid distinctly.
+ */
+export function resolveConfigPath(globalOpts) {
+    // When `--config` is explicitly provided, Commander stores it in
+    // globalOpts.config. When the user did not pass `--config`, Commander
+    // populates globalOpts.config with the default we registered in
+    // src/cli/index.ts (i.e. defaultConfigPath()), so the env-var
+    // precedence already happened. We still re-resolve for safety: relative
+    // values from --config or env are normalized here.
+    const fromOpts = globalOpts.config;
+    if (typeof fromOpts === "string" && fromOpts.trim().length > 0) {
+        return path.resolve(fromOpts);
+    }
+    // Fallback path that should be unreachable in practice (Commander
+    // always supplies the default), kept as a defensive belt for tests
+    // that construct GlobalOpts by hand.
+    return defaultConfigPath();
+}
+/**
+ * For commands that need an existing, valid config (search, save,
+ * import, ingest, mcp install, feedback, capture, etc.). Throws a
+ * `CliError` with code "not_found" or "invalid", whose messages are
+ * distinct per A-2.3a / A-2.3c. Caller should let the exception
+ * propagate so the top-level CLI handler renders it.
+ */
+export function requireExistingConfigPath(globalOpts) {
+    const resolved = resolveConfigPath(globalOpts);
+    try {
+        loadConfig(resolved);
+    }
+    catch (err) {
+        if (err instanceof Error &&
+            err.code === "ENOENT") {
+            throw new CliError(`Config not found at ${resolved}. Run \`rift onboard\` to set it up, or set RIFT_CONFIG to a valid path.`, "not_found");
+        }
+        const reason = err instanceof Error ? err.message : String(err);
+        throw new CliError(`Config invalid at ${resolved}: ${reason}.`, "invalid");
+    }
+    return resolved;
+}
+/**
+ * Status-only lenient base-URL resolver. `rift status` is a diagnostic and
+ * must stay useful even when the config carries a top-level key this (older)
+ * CLI doesn't recognize yet — e.g. a newer beta wrote `codex_cli` and strict
+ * Zod parsing rejects the whole file. It reads ONLY `server.port` leniently
+ * so status can still probe the daemon and tell the friend to update.
+ *
+ * SECURITY: the host is hard-pinned to `127.0.0.1` — never read from the
+ * config. `rift status` reads the auth token and sends it to this URL, so if
+ * lenient mode honoured an arbitrary `server.host`, a malformed config could
+ * redirect Rift's secret token to a non-loopback address. The strict schema
+ * already constrains host to the `127.0.0.1` literal, so no valid config ever
+ * carries another host — there is nothing legitimate to read, and reading it
+ * would only open an exfiltration path. We pin the daemon address and vary
+ * only the port (the one field a real config legitimately changes).
+ *
+ * NEVER use this for daemon startup or any write path — strict validation
+ * (`resolveBaseUrl` / `requireExistingConfigPath`) stays the only gate there.
+ * This is a read-only, loopback-only diagnostic fallback, nothing more.
+ *
+ * Returns null when the file is missing/unreadable or not valid JSON — those
+ * are real errors the caller should surface, not "the config is just newer".
+ */
+export function resolveBaseUrlLenient(configPath) {
+    let raw;
+    try {
+        raw = fs.readFileSync(path.resolve(configPath), "utf-8");
+    }
+    catch {
+        return null;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+    // Host is intentionally NOT read from config — always loopback (see above).
+    let port = 3577;
+    if (parsed && typeof parsed === "object") {
+        const server = parsed.server;
+        if (server && typeof server === "object") {
+            const p = server.port;
+            if (typeof p === "number" && Number.isInteger(p) && p >= 1 && p <= 65535) {
+                port = p;
+            }
+        }
+    }
+    return `http://127.0.0.1:${port}`;
+}
+/**
+ * No-auth probe of a daemon's /health endpoint at an explicit base URL.
+ * `/health` is unauthenticated by design, so this needs neither a token nor
+ * a round-trip through the authenticated client. Returns the daemon's own
+ * ground truth for `voyage_key_present` — the only correct source for any
+ * "is a Voyage key loaded?" gate, since the daemon (not the calling shell)
+ * is the process that saves and embeds.
+ */
+export async function probeDaemonHealth(baseUrl) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), 2000);
+    try {
+        const res = await fetch(`${baseUrl.replace(/\/$/, "")}/health`, {
+            signal: controller.signal,
+        });
+        if (!res.ok)
+            return { up: false };
+        const json = (await res.json());
+        if (json.status !== "ok")
+            return { up: false };
+        const result = { up: true };
+        if (typeof json.uptime_seconds === "number")
+            result.uptimeSeconds = json.uptime_seconds;
+        if (typeof json.voyage_key_present === "boolean")
+            result.voyageKeyPresent = json.voyage_key_present;
+        return result;
+    }
+    catch {
+        return { up: false };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/**
+ * No-config, no-auth direct probe of the daemon's /health endpoint at the
+ * default loopback URL. Used by `rift status` only — every other command
+ * needs config and auth. Per A-2.3a/A-2.3b: `rift status` MUST NOT hard-fail
+ * when the config is absent; it renders "config missing" instead, with the
+ * daemon's actual up/down state taken from this probe.
+ */
+export async function probeDefaultDaemonHealth() {
+    return probeDaemonHealth("http://127.0.0.1:3577");
+}
+/**
+ * resolveBaseUrl stays strict — only commands that actually need the
+ * daemon URL call it, and they all need a real config. Per A-2.3a:
+ * status's no-config branch MUST NOT route through here; it uses
+ * `probeDefaultDaemonHealth()` instead.
+ */
 export function resolveBaseUrl(configPath) {
-    const config = loadConfig(configPath);
+    let config;
+    try {
+        config = loadConfig(configPath);
+    }
+    catch (err) {
+        if (err instanceof Error &&
+            err.code === "ENOENT") {
+            throw new CliError(`Config not found at ${configPath}. Run \`rift onboard\` to set it up, or set RIFT_CONFIG to a valid path.`, "not_found");
+        }
+        // Distinguish a forward-compatible config (newer Rift wrote keys this
+        // CLI doesn't recognize) from a genuinely broken one (a known field with
+        // a bad value, wrong type, etc.). Only the former earns the lenient
+        // "your CLI is older than your config" path in `rift status`; a real
+        // break must still surface as "config invalid" so diagnostics don't lie.
+        if (isForwardCompatConfigError(err)) {
+            throw new CliError(`Config at ${configPath} has keys this CLI does not recognize — it was written by a newer Rift.`, "config_too_new");
+        }
+        const reason = err instanceof Error ? err.message : String(err);
+        throw new CliError(`Config invalid at ${configPath}: ${reason}.`, "invalid");
+    }
     return `http://${config.server.host}:${config.server.port}`;
 }
+/**
+ * True only when a config-load failure is caused EXCLUSIVELY by unrecognized
+ * TOP-LEVEL keys — i.e. a strict-schema rejection of whole sections a newer
+ * Rift added that this CLI doesn't know yet (the beta.19 `codex_cli` case).
+ *
+ * The `path.length === 0` guard is load-bearing: every nested schema is also
+ * `.strict()`, so a typo like `server: { poort: 4000 }` ALSO surfaces as an
+ * `unrecognized_keys` issue — but with a non-empty path (`["server"]`). A
+ * nested unknown key is overwhelmingly a typo, not a future feature, so it
+ * must fail closed as "invalid" and let `rift status` say "config invalid"
+ * rather than the misleading "your CLI is older than your config". Likewise a
+ * ZodError mixing `unrecognized_keys` with any other issue (bad type,
+ * out-of-range value) is broken, not forward-compatible. Forward-compat here
+ * is deliberately narrow: only brand-new top-level sections.
+ */
+function isForwardCompatConfigError(err) {
+    if (!(err instanceof ZodError))
+        return false;
+    if (err.issues.length === 0)
+        return false;
+    return err.issues.every((issue) => issue.code === "unrecognized_keys" && issue.path.length === 0);
+}
+/**
+ * Read the current auth token. Checks `~/.rift/token` first, then the
+ * macOS Keychain. Returns `null` only when no token has been issued —
+ * a real "not yet onboarded" state. A locked Keychain (typical over
+ * SSH or in CI without a GUI session) is a recoverable *failure*, not
+ * a missing token, so it surfaces as a typed `CliError` with the exact
+ * `security unlock-keychain` recovery command.
+ *
+ * Without this conversion, CLI commands that call `readToken()` would
+ * leak the raw `security find-generic-password` failure to the user.
+ * Confirmed live on `0.1.0-beta.6` against an SSH'd test user, post-
+ * publish, before this fix landed.
+ */
 export async function readToken(keychain = macKeychain) {
     const fileToken = readTokenFromFile();
     if (fileToken !== null)
         return fileToken;
-    const version = await keychain.findLatestVersion();
+    let version;
+    try {
+        version = await keychain.findLatestVersion();
+    }
+    catch (err) {
+        if (err instanceof LockedKeychainError) {
+            throw lockedKeychainCliError();
+        }
+        throw err;
+    }
     if (version === 0)
         return null;
-    return keychain.read(version);
+    try {
+        return await keychain.read(version);
+    }
+    catch (err) {
+        if (err instanceof LockedKeychainError) {
+            throw lockedKeychainCliError();
+        }
+        throw err;
+    }
+}
+function lockedKeychainCliError() {
+    return new CliError("Login Keychain is locked (typical over SSH). Run: " +
+        "`security unlock-keychain ~/Library/Keychains/login.keychain-db` " +
+        "(it will prompt for your Mac login password), then re-run the command. " +
+        "For local Terminal sessions this should not happen — please file feedback if it does.", "unauthorized");
 }
 function readTokenFromFile() {
     const home = os.homedir();

package/dist/src/cli/http-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"http-client.js","sourceRoot":"","sources":["../../../src/cli/http-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAoB,MAAM,qBAAqB,CAAC;AAYpE,MAAM,OAAO,QAAS,SAAQ,KAAK;IAGf;IACA;IACA;IAJlB,YACE,OAAe,EACC,IAAkB,EAClB,UAAmB,EACnB,IAAc;QAE9B,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,SAAI,GAAJ,IAAI,CAAc;QAClB,eAAU,GAAV,UAAU,CAAS;QACnB,SAAI,GAAJ,IAAI,CAAU;QAG9B,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;IACzB,CAAC;CACF;AAuBD,SAAS,mBAAmB,CAAC,GAAY;IACvC,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,KAAK,GAAI,GAAqC,CAAC,KAAK,CAAC;QAC3D,IAAI,KAAK,EAAE,IAAI,KAAK,cAAc;YAAE,OAAO,IAAI,CAAC;QAChD,MAAM,IAAI,GAAI,GAAyB,CAAC,IAAI,CAAC;QAC7C,IAAI,IAAI,KAAK,cAAc;YAAE,OAAO,IAAI,CAAC;IAC3C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAc,EAAE,IAAa;IACrD,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,GAAG;YACN,OAAO,IAAI,QAAQ,CACjB,8CAA8C,EAC9C,cAAc,EACd,MAAM,EACN,IAAI,CACL,CAAC;QACJ,KAAK,GAAG;YACN,OAAO,IAAI,QAAQ,CAAC,wBAAwB,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QAC3E,KAAK,GAAG;YACN,OAAO,IAAI,QAAQ,CACjB,wCAAwC,EACxC,UAAU,EACV,MAAM,EACN,IAAI,CACL,CAAC;QACJ,KAAK,GAAG;YACN,OAAO,IAAI,QAAQ,CAAC,4BAA4B,EAAE,cAAc,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QAClF;YACE,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;gBAClC,OAAO,IAAI,QAAQ,CACjB,mBAAmB,MAAM,GAAG,EAC5B,YAAY,EACZ,MAAM,EACN,IAAI,CACL,CAAC;YACJ,CAAC;YACD,OAAO,IAAI,QAAQ,CACjB,iBAAiB,MAAM,GAAG,EAC1B,cAAc,EACd,MAAM,EACN,IAAI,CACL,CAAC;IACN,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAoB;IACnD,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;IAChC,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;KACnC,CAAC;IACF,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,IAAI,CAAC,KAAK,EAAE,CAAC;IACpD,CAAC;IAED,KAAK,UAAU,OAAO,CACpB,MAAc,EACd,IAAY,EACZ,OAKC;QAED,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,CAAC;QACrC,MAAM,YAAY,GAAG;YACnB,GAAG,OAAO;YACV,GAAG,CAAC,OAAO,EAAE,OAAO,IAAI,EAAE,CAAC;SAC5B,CAAC;QACF,IAAI,OAAO,EAAE,SAAS,EAAE,CAAC;YACvB,OAAO,YAAY,CAAC,cAAc,CAAC,CAAC;QACtC,CAAC;QAED,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,EAAE;gBACjB,MAAM;gBACN,OAAO,EAAE,YAAY;gBACrB,IAAI,EAAE,OAAO,EAAE,IAAI,IAAI,IAAI;gBAC3B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,IAAI,MAAM,CAAC;aAC1D,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,IAAI,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,QAAQ,CAChB,+BAA+B,IAAI,CAAC,OAAO,kBAAkB,EAC7D,oBAAoB,CACrB,CAAC;YACJ,CAAC;YACD,IAAI,GAAG,YAAY,YAAY,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;gBAC/D,MAAM,IAAI,QAAQ,CAAC,mBAAmB,EAAE,SAAS,CAAC,CAAC;YACrD,CAAC;YACD,MAAM,IAAI,QAAQ,CAChB,kBAAkB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EACpE,SAAS,CACV,CAAC;QACJ,CAAC;QAED,IAAI,IAAa,CAAC;QAClB,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QACjD,IAAI,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACpC,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC1B,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;IACtC,CAAC;IAED,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,IAAY;YACpB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAC5C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,KAAK,CAAC,IAAI,CACR,IAAY,EACZ,IAAc,EACd,OAA8C;YAE9C,OAAO,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE;gBAC3B,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;gBACtD,SAAS,EAAE,OAAO;gBAClB,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1D,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,aAAa,CACjB,IAAY,EACZ,IAAc,EACd,OAA8C;YAE9C,OAAO,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE;gBAC3B,IAAI,EAAE,IAAI;gBACV,SAAS,EAAE,OAAO;gBAClB,SAAS,EAAE,IAAI;gBACf,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1D,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,IAAY;YACpB,OAAO,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACjC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,UAAkB;IAC/C,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IACtC,OAAO,UAAU,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;AAC9D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,WAAwB,WAAW;IAEnC,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;IACtC,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,iBAAiB,EAAE,CAAC;IACnD,IAAI,OAAO,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/B,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,iBAAiB;IACxB,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC1B,MAAM,UAAU,GAAG;QACjB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC;QACjC,sEAAsE;QACtE,sEAAsE;QACtE,sCAAsC;QACtC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,OAAO,CAAC;KACxC,CAAC;IACF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;YACtD,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,GAAG,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,qBAAqB;QACvB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"http-client.js","sourceRoot":"","sources":["../../../src/cli/http-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAC;AAC/B,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EACL,WAAW,EACX,mBAAmB,GAEpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAkB7D,MAAM,OAAO,QAAS,SAAQ,KAAK;IAGf;IACA;IACA;IAJlB,YACE,OAAe,EACC,IAAkB,EAClB,UAAmB,EACnB,IAAc;QAE9B,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,SAAI,GAAJ,IAAI,CAAc;QAClB,eAAU,GAAV,UAAU,CAAS;QACnB,SAAI,GAAJ,IAAI,CAAU;QAG9B,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;IACzB,CAAC;CACF;AAuBD,SAAS,mBAAmB,CAAC,GAAY;IACvC,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,KAAK,GAAI,GAAqC,CAAC,KAAK,CAAC;QAC3D,IAAI,KAAK,EAAE,IAAI,KAAK,cAAc;YAAE,OAAO,IAAI,CAAC;QAChD,MAAM,IAAI,GAAI,GAAyB,CAAC,IAAI,CAAC;QAC7C,IAAI,IAAI,KAAK,cAAc;YAAE,OAAO,IAAI,CAAC;IAC3C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,IAAa;IAClC,OAAO,CACL,OAAO,IAAI,KAAK,QAAQ;QACxB,IAAI,KAAK,IAAI;QACb,OAAQ,IAA4B,CAAC,KAAK,KAAK,QAAQ,CACxD,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,IAAa;IACpC,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAc,EAAE,IAAa;IACrD,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,GAAG;YACN,OAAO,IAAI,QAAQ,CACjB,8CAA8C,EAC9C,cAAc,EACd,MAAM,EACN,IAAI,CACL,CAAC;QACJ,KAAK,GAAG;YACN,oEAAoE;YACpE,qEAAqE;YACrE,mEAAmE;YACnE,OAAO,IAAI,QAAQ,CACjB,aAAa,CAAC,IAAI,CAAC;gBACjB,CAAC,CAAC,cAAc,eAAe,CAAC,IAAI,CAAC,EAAE;gBACvC,CAAC,CAAC,wBAAwB,EAC5B,WAAW,EACX,MAAM,EACN,IAAI,CACL,CAAC;QACJ,KAAK,GAAG;YACN,gEAAgE;YAChE,iEAAiE;YACjE,OAAO,IAAI,QAAQ,CACjB,aAAa,CAAC,IAAI,CAAC;gBACjB,CAAC,CAAC,aAAa,eAAe,CAAC,IAAI,CAAC,EAAE;gBACtC,CAAC,CAAC,wCAAwC,EAC5C,UAAU,EACV,MAAM,EACN,IAAI,CACL,CAAC;QACJ,KAAK,GAAG;YACN,OAAO,IAAI,QAAQ,CAAC,4BAA4B,EAAE,cAAc,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QAClF;YACE,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;gBAClC,OAAO,IAAI,QAAQ,CACjB,mBAAmB,MAAM,GAAG,EAC5B,YAAY,EACZ,MAAM,EACN,IAAI,CACL,CAAC;YACJ,CAAC;YACD,OAAO,IAAI,QAAQ,CACjB,iBAAiB,MAAM,GAAG,EAC1B,cAAc,EACd,MAAM,EACN,IAAI,CACL,CAAC;IACN,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAoB;IACnD,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;IAChC,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;KACnC,CAAC;IACF,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,IAAI,CAAC,KAAK,EAAE,CAAC;IACpD,CAAC;IAED,KAAK,UAAU,OAAO,CACpB,MAAc,EACd,IAAY,EACZ,OAKC;QAED,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,CAAC;QACrC,MAAM,YAAY,GAAG;YACnB,GAAG,OAAO;YACV,GAAG,CAAC,OAAO,EAAE,OAAO,IAAI,EAAE,CAAC;SAC5B,CAAC;QACF,IAAI,OAAO,EAAE,SAAS,EAAE,CAAC;YACvB,OAAO,YAAY,CAAC,cAAc,CAAC,CAAC;QACtC,CAAC;QAED,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,EAAE;gBACjB,MAAM;gBACN,OAAO,EAAE,YAAY;gBACrB,IAAI,EAAE,OAAO,EAAE,IAAI,IAAI,IAAI;gBAC3B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,IAAI,MAAM,CAAC;aAC1D,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,IAAI,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,QAAQ,CAChB,+BAA+B,IAAI,CAAC,OAAO,kBAAkB,EAC7D,oBAAoB,CACrB,CAAC;YACJ,CAAC;YACD,IAAI,GAAG,YAAY,YAAY,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;gBAC/D,MAAM,IAAI,QAAQ,CAAC,mBAAmB,EAAE,SAAS,CAAC,CAAC;YACrD,CAAC;YACD,MAAM,IAAI,QAAQ,CAChB,kBAAkB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EACpE,SAAS,CACV,CAAC;QACJ,CAAC;QAED,IAAI,IAAa,CAAC;QAClB,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QACjD,IAAI,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACpC,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC1B,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;IACtC,CAAC;IAED,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,IAAY;YACpB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAC5C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,KAAK,CAAC,IAAI,CACR,IAAY,EACZ,IAAc,EACd,OAA8C;YAE9C,OAAO,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE;gBAC3B,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;gBACtD,SAAS,EAAE,OAAO;gBAClB,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1D,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,aAAa,CACjB,IAAY,EACZ,IAAc,EACd,OAA8C;YAE9C,OAAO,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE;gBAC3B,IAAI,EAAE,IAAI;gBACV,SAAS,EAAE,OAAO;gBAClB,SAAS,EAAE,IAAI;gBACf,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1D,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,IAAY;YACpB,OAAO,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACjC,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAA+B;IAC/D,iEAAiE;IACjE,sEAAsE;IACtE,gEAAgE;IAChE,8DAA8D;IAC9D,wEAAwE;IACxE,mDAAmD;IACnD,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC;IACnC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/D,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IACD,kEAAkE;IAClE,mEAAmE;IACnE,qCAAqC;IACrC,OAAO,iBAAiB,EAAE,CAAC;AAC7B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,UAEzC;IACC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAC/C,IAAI,CAAC;QACH,UAAU,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IACE,GAAG,YAAY,KAAK;YACnB,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAChD,CAAC;YACD,MAAM,IAAI,QAAQ,CAChB,uBAAuB,QAAQ,0EAA0E,EACzG,WAAW,CACZ,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,IAAI,QAAQ,CAChB,qBAAqB,QAAQ,KAAK,MAAM,GAAG,EAC3C,SAAS,CACV,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAAkB;IACtD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,4EAA4E;IAC5E,IAAI,IAAI,GAAG,IAAI,CAAC;IAChB,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QACzC,MAAM,MAAM,GAAI,MAA+B,CAAC,MAAM,CAAC;QACvD,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YACzC,MAAM,CAAC,GAAI,MAA6B,CAAC,IAAI,CAAC;YAC9C,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC;gBACzE,IAAI,GAAG,CAAC,CAAC;YACX,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,oBAAoB,IAAI,EAAE,CAAC;AACpC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAe;IAKrD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,EAAE;YAC9D,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAI7B,CAAC;QACF,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;QAC/C,MAAM,MAAM,GAAwE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACjG,IAAI,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ;YAAE,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC,cAAc,CAAC;QACxF,IAAI,OAAO,IAAI,CAAC,kBAAkB,KAAK,SAAS;YAAE,MAAM,CAAC,gBAAgB,GAAG,IAAI,CAAC,kBAAkB,CAAC;QACpG,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACvB,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB;IAK5C,OAAO,iBAAiB,CAAC,uBAAuB,CAAC,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,UAAkB;IAC/C,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IACE,GAAG,YAAY,KAAK;YACnB,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAChD,CAAC;YACD,MAAM,IAAI,QAAQ,CAChB,uBAAuB,UAAU,0EAA0E,EAC3G,WAAW,CACZ,CAAC;QACJ,CAAC;QACD,sEAAsE;QACtE,yEAAyE;QACzE,oEAAoE;QACpE,qEAAqE;QACrE,yEAAyE;QACzE,IAAI,0BAA0B,CAAC,GAAG,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,QAAQ,CAChB,aAAa,UAAU,yEAAyE,EAChG,gBAAgB,CACjB,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,IAAI,QAAQ,CAChB,qBAAqB,UAAU,KAAK,MAAM,GAAG,EAC7C,SAAS,CACV,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;AAC9D,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,0BAA0B,CAAC,GAAY;IAC9C,IAAI,CAAC,CAAC,GAAG,YAAY,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,CACrB,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,mBAAmB,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CACzE,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,WAAwB,WAAW;IAEnC,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;IACtC,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACzC,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,QAAQ,CAAC,iBAAiB,EAAE,CAAC;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;YACvC,MAAM,sBAAsB,EAAE,CAAC;QACjC,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,OAAO,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;YACvC,MAAM,sBAAsB,EAAE,CAAC;QACjC,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB;IAC7B,OAAO,IAAI,QAAQ,CACjB,oDAAoD;QAClD,mEAAmE;QACnE,yEAAyE;QACzE,uFAAuF,EACzF,cAAc,CACf,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB;IACxB,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC1B,MAAM,UAAU,GAAG;QACjB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC;QACjC,sEAAsE;QACtE,sEAAsE;QACtE,sCAAsC;QACtC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,OAAO,CAAC;KACxC,CAAC;IACF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;YACtD,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,GAAG,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,qBAAqB;QACvB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/src/cli/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/cli/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAwBpC,wBAAgB,aAAa,IAAI,OAAO,CAkCvC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/cli/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA8BpC,wBAAgB,aAAa,IAAI,OAAO,CAqCvC"}

package/dist/src/cli/index.js

@@ -1,8 +1,12 @@
 #!/usr/bin/env node
 import { Command } from "commander";
+import { realpathSync } from "node:fs";
+import { fileURLToPath } from "node:url";
 import { getBuildInfo } from "../server/build-info.js";
+import { defaultConfigPath } from "./default-config-path.js";
 import { makeTokenIssueCommand } from "./commands/token-issue.js";
 import { makeStatusCommand } from "./commands/status.js";
+import { makeDoctorCommand } from "./commands/doctor.js";
 import { makeStatsCommand } from "./commands/stats.js";
 import { makeSearchCommand } from "./commands/search.js";
 import { makeSaveCommand } from "./commands/save.js";
@@ -22,17 +26,20 @@ import { makeMcpCommand } from "./commands/mcp-install.js";
 import { makeHooksCommand } from "./commands/hooks-install.js";
 import { makeFeedbackCommand } from "./commands/feedback.js";
 import { makeUninstallCommand } from "./commands/uninstall.js";
+import { makeUpdateCommand } from "./commands/update.js";
+import { makeMenuBarCommand } from "./commands/menubar.js";
 export function createProgram() {
     const program = new Command()
         .name("rift")
         .description("CLI for the Rift daemon")
         .version(getBuildInfo().version)
-        .option("--config <path>", "Path to config.json", "config.json")
+        .option("--config <path>", "Path to config.json", defaultConfigPath())
         .option("--json", "Output as JSON", false);
     const tokenCmd = new Command("token").description("Token management");
     tokenCmd.addCommand(makeTokenIssueCommand());
     program.addCommand(tokenCmd);
     program.addCommand(makeStatusCommand());
+    program.addCommand(makeDoctorCommand());
     program.addCommand(makeStatsCommand());
     program.addCommand(makeSearchCommand());
     program.addCommand(makeSaveCommand());
@@ -52,14 +59,30 @@ export function createProgram() {
     program.addCommand(makeHooksCommand());
     program.addCommand(makeFeedbackCommand());
     program.addCommand(makeUninstallCommand());
+    program.addCommand(makeUpdateCommand());
+    program.addCommand(makeMenuBarCommand());
     return program;
 }
 // Only run when executed directly (not when imported for testing).
-const isDirectExecution = typeof process !== "undefined" &&
-    process.argv[1] &&
-    (process.argv[1].endsWith("/cli/index.js") ||
-        process.argv[1].endsWith("/cli/index.ts"));
-if (isDirectExecution) {
+// Compare the realpath of the running script against the realpath of
+// process.argv[1]. This handles the npm-global `bin/rift` symlink case:
+// when invoked as `~/.npm-global/bin/rift`, argv[1] is the symlink path
+// (does not end in `/cli/index.js`), but its realpath resolves to the
+// actual cli/index.js file. Without this realpath compare, every
+// fresh-install CLI invocation silently no-ops.
+function isDirectExecution() {
+    if (typeof process === "undefined" || !process.argv[1])
+        return false;
+    try {
+        const me = realpathSync(fileURLToPath(import.meta.url));
+        const invoked = realpathSync(process.argv[1]);
+        return me === invoked;
+    }
+    catch {
+        return false;
+    }
+}
+if (isDirectExecution()) {
     createProgram().parseAsync().catch((err) => {
         process.stderr.write(`Fatal: ${err instanceof Error ? err.message : String(err)}\n`);
         process.exitCode = 1;

package/dist/src/cli/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/cli/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAE/D,MAAM,UAAU,aAAa;IAC3B,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE;SAC1B,IAAI,CAAC,MAAM,CAAC;SACZ,WAAW,CAAC,yBAAyB,CAAC;SACtC,OAAO,CAAC,YAAY,EAAE,CAAC,OAAO,CAAC;SAC/B,MAAM,CAAC,iBAAiB,EAAE,qBAAqB,EAAE,aAAa,CAAC;SAC/D,MAAM,CAAC,QAAQ,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC;IAE7C,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC;IACtE,QAAQ,CAAC,UAAU,CAAC,qBAAqB,EAAE,CAAC,CAAC;IAC7C,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAE7B,OAAO,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACxC,OAAO,CAAC,UAAU,CAAC,gBAAgB,EAAE,CAAC,CAAC;IACvC,OAAO,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACxC,OAAO,CAAC,UAAU,CAAC,eAAe,EAAE,CAAC,CAAC;IACtC,OAAO,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACxC,OAAO,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACxC,OAAO,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACzC,OAAO,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACzC,OAAO,CAAC,UAAU,CAAC,oBAAoB,EAAE,CAAC,CAAC;IAC3C,OAAO,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACzC,OAAO,CAAC,UAAU,CAAC,qBAAqB,EAAE,CAAC,CAAC;IAC5C,OAAO,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACzC,OAAO,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACxC,OAAO,CAAC,UAAU,CAAC,mBAAmB,EAAE,CAAC,CAAC;IAC1C,OAAO,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACxC,OAAO,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACzC,OAAO,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC,CAAC;IACrC,OAAO,CAAC,UAAU,CAAC,gBAAgB,EAAE,CAAC,CAAC;IACvC,OAAO,CAAC,UAAU,CAAC,mBAAmB,EAAE,CAAC,CAAC;IAC1C,OAAO,CAAC,UAAU,CAAC,oBAAoB,EAAE,CAAC,CAAC;IAE3C,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,mEAAmE;AACnE,MAAM,iBAAiB,GACrB,OAAO,OAAO,KAAK,WAAW;IAC9B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACf,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC;AAE9C,IAAI,iBAAiB,EAAE,CAAC;IACtB,aAAa,EAAE,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QAClD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,UAAU,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAC/D,CAAC;QACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/cli/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAE3D,MAAM,UAAU,aAAa;IAC3B,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE;SAC1B,IAAI,CAAC,MAAM,CAAC;SACZ,WAAW,CAAC,yBAAyB,CAAC;SACtC,OAAO,CAAC,YAAY,EAAE,CAAC,OAAO,CAAC;SAC/B,MAAM,CAAC,iBAAiB,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,CAAC;SACrE,MAAM,CAAC,QAAQ,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC;IAE7C,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC;IACtE,QAAQ,CAAC,UAAU,CAAC,qBAAqB,EAAE,CAAC,CAAC;IAC7C,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAE7B,OAAO,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACxC,OAAO,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACxC,OAAO,CAAC,UAAU,CAAC,gBAAgB,EAAE,CAAC,CAAC;IACvC,OAAO,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACxC,OAAO,CAAC,UAAU,CAAC,eAAe,EAAE,CAAC,CAAC;IACtC,OAAO,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACxC,OAAO,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACxC,OAAO,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACzC,OAAO,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACzC,OAAO,CAAC,UAAU,CAAC,oBAAoB,EAAE,CAAC,CAAC;IAC3C,OAAO,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACzC,OAAO,CAAC,UAAU,CAAC,qBAAqB,EAAE,CAAC,CAAC;IAC5C,OAAO,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACzC,OAAO,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACxC,OAAO,CAAC,UAAU,CAAC,mBAAmB,EAAE,CAAC,CAAC;IAC1C,OAAO,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACxC,OAAO,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACzC,OAAO,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC,CAAC;IACrC,OAAO,CAAC,UAAU,CAAC,gBAAgB,EAAE,CAAC,CAAC;IACvC,OAAO,CAAC,UAAU,CAAC,mBAAmB,EAAE,CAAC,CAAC;IAC1C,OAAO,CAAC,UAAU,CAAC,oBAAoB,EAAE,CAAC,CAAC;IAC3C,OAAO,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACxC,OAAO,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAEzC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,mEAAmE;AACnE,qEAAqE;AACrE,wEAAwE;AACxE,wEAAwE;AACxE,sEAAsE;AACtE,iEAAiE;AACjE,gDAAgD;AAChD,SAAS,iBAAiB;IACxB,IAAI,OAAO,OAAO,KAAK,WAAW,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrE,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,YAAY,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACxD,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,OAAO,EAAE,KAAK,OAAO,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,IAAI,iBAAiB,EAAE,EAAE,CAAC;IACxB,aAAa,EAAE,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QAClD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,UAAU,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAC/D,CAAC;QACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/src/cli/postinstall-menubar.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Best-effort global-install hook for the SwiftBar menu plugin.
+ *
+ * Why this exists in addition to `scripts/install.sh` and `rift update`:
+ * friends already on beta.13 will run the beta.13 `rift update` command.
+ * That old command can install the beta.14 tarball, but it cannot call the
+ * new beta.14 menu-refresh code after npm finishes. npm's postinstall hook
+ * runs from the newly-installed package, so it bridges that first update.
+ *
+ * Local developer installs skip this by default; only global npm installs
+ * run it. Failures are non-fatal because the CLI/daemon install is more
+ * important than the ambient menu surface.
+ */
+import { installMenuBar } from "./commands/menubar.js";
+type PostinstallMenuBarInstaller = () => ReturnType<typeof installMenuBar>;
+type PostinstallOutput = {
+    write(chunk: string): unknown;
+};
+export declare function shouldRunPostinstallMenuBar(env?: NodeJS.ProcessEnv): boolean;
+export declare function runPostinstallMenuBar(install?: PostinstallMenuBarInstaller, output?: PostinstallOutput): void;
+export {};
+//# sourceMappingURL=postinstall-menubar.d.ts.map

package/dist/src/cli/postinstall-menubar.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"postinstall-menubar.d.ts","sourceRoot":"","sources":["../../../src/cli/postinstall-menubar.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvD,KAAK,2BAA2B,GAAG,MAAM,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC;AAC3E,KAAK,iBAAiB,GAAG;IAAE,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,CAAC;AAE3D,wBAAgB,2BAA2B,CACzC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAIT;AAED,wBAAgB,qBAAqB,CACnC,OAAO,GAAE,2BAA4C,EACrD,MAAM,GAAE,iBAAkC,GACzC,IAAI,CAaN"}

package/dist/src/cli/postinstall-menubar.js

@@ -0,0 +1,39 @@
+/**
+ * Best-effort global-install hook for the SwiftBar menu plugin.
+ *
+ * Why this exists in addition to `scripts/install.sh` and `rift update`:
+ * friends already on beta.13 will run the beta.13 `rift update` command.
+ * That old command can install the beta.14 tarball, but it cannot call the
+ * new beta.14 menu-refresh code after npm finishes. npm's postinstall hook
+ * runs from the newly-installed package, so it bridges that first update.
+ *
+ * Local developer installs skip this by default; only global npm installs
+ * run it. Failures are non-fatal because the CLI/daemon install is more
+ * important than the ambient menu surface.
+ */
+import { installMenuBar } from "./commands/menubar.js";
+export function shouldRunPostinstallMenuBar(env = process.env) {
+    if (env.RIFT_SKIP_POSTINSTALL_MENUBAR === "1")
+        return false;
+    if (env.RIFT_POSTINSTALL_MENUBAR === "1")
+        return true;
+    return env.npm_config_global === "true" || env.npm_config_location === "global";
+}
+export function runPostinstallMenuBar(install = installMenuBar, output = process.stdout) {
+    try {
+        const result = install();
+        if (result.skipped) {
+            output.write(`Rift menu bar skipped: ${result.reason ?? "not available"}\n`);
+        }
+        else {
+            output.write("Rift menu bar installed.\n");
+        }
+    }
+    catch (err) {
+        output.write(`Rift menu bar install skipped: ${err instanceof Error ? err.message : String(err)}\n`);
+    }
+}
+if (shouldRunPostinstallMenuBar()) {
+    runPostinstallMenuBar();
+}
+//# sourceMappingURL=postinstall-menubar.js.map

package/dist/src/cli/postinstall-menubar.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"postinstall-menubar.js","sourceRoot":"","sources":["../../../src/cli/postinstall-menubar.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAKvD,MAAM,UAAU,2BAA2B,CACzC,MAAyB,OAAO,CAAC,GAAG;IAEpC,IAAI,GAAG,CAAC,6BAA6B,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAC5D,IAAI,GAAG,CAAC,wBAAwB,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACtD,OAAO,GAAG,CAAC,iBAAiB,KAAK,MAAM,IAAI,GAAG,CAAC,mBAAmB,KAAK,QAAQ,CAAC;AAClF,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,UAAuC,cAAc,EACrD,SAA4B,OAAO,CAAC,MAAM;IAE1C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC;QACzB,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,CAAC,KAAK,CAAC,0BAA0B,MAAM,CAAC,MAAM,IAAI,eAAe,IAAI,CAAC,CAAC;QAC/E,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CACV,kCAAkC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CACvF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,IAAI,2BAA2B,EAAE,EAAE,CAAC;IAClC,qBAAqB,EAAE,CAAC;AAC1B,CAAC"}

package/dist/src/cli/status/friend-header.d.ts

@@ -11,7 +11,7 @@
  * substrings stay in the renderer's input contract — the caller is
  * responsible for never passing a full Voyage key into `voyageLast4`.
  */
-import type { FriendStatusPayload } from "../../server/routes/friend-status.js";
+import type { FriendStatusOnboarding, FriendStatusPayload } from "../../server/routes/friend-status.js";
 export interface McpClientStatus {
     /** Display label (e.g., "claude-desktop"). */
     client: string;
@@ -29,5 +29,12 @@ export interface RenderHeaderInput {
 }
 export declare function renderFriendHeader(input: RenderHeaderInput): string[];
 export declare function formatAge(iso: string, now: number): string;
+/**
+ * Render the `time_to_first_useful_recall` line. Returns null when the
+ * state is `hidden` so the caller can drop the line entirely — a fresh
+ * post-onboard install should not advertise a metric it has not yet
+ * earned the right to display.
+ */
+export declare function renderOnboardingLine(onboarding: FriendStatusOnboarding | undefined, now: number): string | null;
 export declare function formatDuration(seconds: number): string;
 //# sourceMappingURL=friend-header.d.ts.map

package/dist/src/cli/status/friend-header.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"friend-header.d.ts","sourceRoot":"","sources":["../../../../src/cli/status/friend-header.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAEhF,MAAM,WAAW,eAAe;IAC9B,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,6DAA6D;IAC7D,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACnC,yEAAyE;IACzE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,qDAAqD;IACrD,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,yDAAyD;IACzD,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,iBAAiB,GAAG,MAAM,EAAE,CA0CrE;AA6ED,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAI1D;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAUtD"}
+{"version":3,"file":"friend-header.d.ts","sourceRoot":"","sources":["../../../../src/cli/status/friend-header.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EACV,sBAAsB,EACtB,mBAAmB,EACpB,MAAM,sCAAsC,CAAC;AAG9C,MAAM,WAAW,eAAe;IAC9B,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,6DAA6D;IAC7D,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACnC,yEAAyE;IACzE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,qDAAqD;IACrD,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,yDAAyD;IACzD,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAiFrE;AAkWD,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAI1D;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,sBAAsB,GAAG,SAAS,EAC9C,GAAG,EAAE,MAAM,GACV,MAAM,GAAG,IAAI,CAef;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAUtD"}