@hivefloor/cli 0.1.5 → 0.1.8

package/dist/chunk-XAXKZ572.js

@@ -0,0 +1,106 @@
+#!/usr/bin/env node
+import { createRequire as __hfCreateRequire } from 'node:module';
+const require = __hfCreateRequire(import.meta.url);
+import {
+  findBin,
+  home
+} from "./chunk-XPGL7VYE.js";
+
+// src/service/control/proc.ts
+import { execFile } from "child_process";
+function runFile(file, args, opts = {}) {
+  return new Promise((resolve) => {
+    try {
+      const child = execFile(file, args, { timeout: opts.timeoutMs ?? 5e3, maxBuffer: 1024 * 1024, windowsHide: true, ...opts.env ? { env: opts.env } : {} }, (err, stdout, stderr) => {
+        if (!err) return resolve({ code: 0, stdout: String(stdout), stderr: String(stderr) });
+        const e = err;
+        const spawnError = typeof e.code === "string";
+        resolve({ code: typeof e.code === "number" ? e.code : null, stdout: String(stdout ?? ""), stderr: String(stderr ?? ""), ...spawnError ? { spawnError: true } : {} });
+      });
+      if (opts.input !== void 0) {
+        child.stdin?.on("error", () => void 0);
+        child.stdin?.end(opts.input);
+      }
+    } catch {
+      resolve({ code: null, stdout: "", stderr: "", spawnError: true });
+    }
+  });
+}
+
+// src/service/claude-bin.ts
+import fs from "fs";
+import path from "path";
+var CLAUDE_BIN_ENV = "HIVEFLOOR_CLAUDE_BIN";
+var SHELLS = /* @__PURE__ */ new Set(["sh", "bash", "zsh", "fish", "dash", "ksh"]);
+var NOT_FOUND_TTL_MS = 6e4;
+var LOGIN_SHELL_TIMEOUT_MS = 3e3;
+function userBinDirs(homeDir = home()) {
+  return [path.join(homeDir, ".local", "bin"), path.join(homeDir, ".claude", "local"), "/opt/homebrew/bin", "/usr/local/bin"];
+}
+function claudeFallbackPaths(homeDir = home()) {
+  return userBinDirs(homeDir).map((d) => path.join(d, "claude"));
+}
+var isExecutableFile = (p) => {
+  try {
+    if (!fs.statSync(p).isFile()) return false;
+    fs.accessSync(p, fs.constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+};
+var lastAbsLine = (out) => {
+  const lines = out.split(/\r?\n/).map((l) => l.trim()).filter(Boolean);
+  for (let i = lines.length - 1; i >= 0; i--) if (path.isAbsolute(lines[i])) return lines[i];
+  return void 0;
+};
+function createClaudeResolver(deps = {}) {
+  const isExec = deps.isExecutable ?? isExecutableFile;
+  const now = deps.now ?? Date.now;
+  let found;
+  let missAt = -Infinity;
+  let warnedBadEnv = false;
+  const search = async () => {
+    const env = deps.env ?? process.env;
+    const homeDir = deps.home ?? home();
+    if ((deps.platform ?? process.platform) === "win32") {
+      return findBin("claude", env);
+    }
+    const explicit = env[CLAUDE_BIN_ENV];
+    if (explicit) {
+      if (path.isAbsolute(explicit) && isExec(explicit)) return explicit;
+      if (!warnedBadEnv) {
+        warnedBadEnv = true;
+        (deps.log ?? ((m) => console.error(m)))(`hivefloor: ${CLAUDE_BIN_ENV} is set but is not an absolute path to an executable file; ignoring it and searching for claude`);
+      }
+    }
+    for (const dir of (env.PATH ?? "").split(path.delimiter)) {
+      if (!dir || !path.isAbsolute(dir)) continue;
+      const p2 = path.join(dir, "claude");
+      if (isExec(p2)) return p2;
+    }
+    for (const p2 of claudeFallbackPaths(homeDir)) if (isExec(p2)) return p2;
+    const shell = env.SHELL;
+    if (!shell || !path.isAbsolute(shell) || !SHELLS.has(path.basename(shell)) || !isExec(shell)) return void 0;
+    const r = await (deps.run ?? runFile)(shell, ["-lc", "command -v claude"], { timeoutMs: LOGIN_SHELL_TIMEOUT_MS });
+    if (r.code !== 0) return void 0;
+    const p = lastAbsLine(r.stdout);
+    return p && isExec(p) ? p : void 0;
+  };
+  return async () => {
+    if (found && isExec(found)) return found;
+    found = void 0;
+    if (now() - missAt < NOT_FOUND_TTL_MS) return void 0;
+    found = await search();
+    if (!found) missAt = now();
+    return found;
+  };
+}
+var shared;
+var resolveClaudeBin = () => (shared ??= createClaudeResolver())();
+
+export {
+  runFile,
+  userBinDirs,
+  resolveClaudeBin
+};

package/dist/{chunk-TPMFQUAW.js → chunk-XPGL7VYE.js}

@@ -1,4 +1,6 @@
 #!/usr/bin/env node
+import { createRequire as __hfCreateRequire } from 'node:module';
+const require = __hfCreateRequire(import.meta.url);
 
 // src/fsutil.ts
 import fs from "fs";
@@ -17,6 +19,11 @@ var machineFile = () => path.join(configDir(), "machine.json");
 var machineSpoolFile = () => path.join(configDir(), "machine-spool.jsonl");
 var serviceStateFile = () => path.join(configDir(), "service.json");
 var serviceLogFile = () => path.join(configDir(), "service.log");
+var controlFile = () => path.join(configDir(), "control.json");
+var sessionsFile = () => path.join(configDir(), "sessions.json");
+var controlLogFile = () => path.join(configDir(), "control.log");
+var controlInboxDir = () => path.join(configDir(), "control", "inbox");
+var controlDecisionsDir = () => path.join(configDir(), "control", "decisions");
 var cliDir = () => path.join(configDir(), "cli");
 var cliEntry = () => path.join(cliDir(), "index.js");
 function readText(file) {
@@ -221,6 +228,11 @@ export {
   machineSpoolFile,
   serviceStateFile,
   serviceLogFile,
+  controlFile,
+  sessionsFile,
+  controlLogFile,
+  controlInboxDir,
+  controlDecisionsDir,
   cliDir,
   cliEntry,
   readText,

package/dist/{cli-JCBZICR3.js → cli-BFOJWJNG.js}

@@ -1,22 +1,24 @@
 #!/usr/bin/env node
+import { createRequire as __hfCreateRequire } from 'node:module';
+const require = __hfCreateRequire(import.meta.url);
 import {
   parseArgs
-} from "./chunk-TKMIV7BG.js";
+} from "./chunk-QPAFN47B.js";
 import {
   VERSION
-} from "./chunk-C627OKTW.js";
+} from "./chunk-K2IRTZH5.js";
 import {
   ApiError
-} from "./chunk-VX7SCIF2.js";
+} from "./chunk-NRJONTFT.js";
 import {
   defaultCtx
-} from "./chunk-SOXRITAW.js";
+} from "./chunk-QGULSOQ2.js";
 import {
   CLI_BIN_NAME,
   CLI_INSTALL_COMMAND,
   cliNpxCommand
-} from "./chunk-4DRHR7LR.js";
-import "./chunk-K3NQKI34.js";
+} from "./chunk-HWBUESB4.js";
+import "./chunk-2ERPDCOT.js";
 
 // src/help.ts
 var HOST_NOTE = `Host: --host URL, else HIVEFLOOR_URL, else the hosted instance. Self-hosting: pass --host or set HIVEFLOOR_URL.`;
@@ -26,7 +28,7 @@ var COMMAND_HELP = {
 Connect this computer once: every agent on it (Claude profiles, Codex, ...) shows up.
 
 Options:
-  --host URL      Hivefloor server (default: HIVEFLOOR_URL, else the hosted instance)
+  --host URL      HiveFloor server (default: HIVEFLOOR_URL, else the hosted instance)
   --name NAME     Display name for this machine (default: the computer's hostname)
   --no-open       Print the sign-in link instead of opening a browser
   --no-service    Do not install the background service
@@ -72,6 +74,35 @@ ${HOST_NOTE}
   service: `Usage: ${CLI_BIN_NAME} service run
 
 Run the background service in the foreground. Your OS starts it for you after connect; you rarely run it by hand.
+`,
+  control: `Usage: ${CLI_BIN_NAME} control on [--verbs message,approve,deny,stop|none] [--from owner|admins] [--replies off|after_message|always] [--orchestrator on|off]
+       ${CLI_BIN_NAME} control off
+       ${CLI_BIN_NAME} control status
+
+Session control: let people you allow send a message to, approve or deny a permission prompt of, or stop a live Claude Code session on this computer.
+Off until you turn it on here. Nothing opens a port: the service asks the server for commands. status says what a compromised server could do with the verbs that are on.
+
+Options:
+  --verbs LIST    Which verbs to turn on (default: message,stop). approve and deny add one synchronous PermissionRequest hook to Claude Code's settings.json
+  --from WHO      owner (default): only the machine's owner; admins: also the project's owners and admins
+  --replies MODE  Send the agent's last message to the server: off, after_message (default) or always
+  --orchestrator on|off  Let the server start one Claude Code session in its own folder and type to it (docs/ORCHESTRATOR.md).
+                  Its tool calls outside reading that folder are asked on the orchestrator page. --verbs none --orchestrator on turns on only this.
+`,
+  orch: `Usage: ${CLI_BIN_NAME} orch enable [--full | --no-full]
+       ${CLI_BIN_NAME} orch disable
+       ${CLI_BIN_NAME} orch status
+
+The orchestrator: let your HiveFloor account start one Claude Code session on this computer and talk to it (docs/ORCHESTRATOR.md).
+
+  enable          Turn the orchestrator on. By default the session is sandboxed: its own folder, none of your settings, every tool call asked on the orchestrator page.
+  --full          Also allow full power: a start from HiveFloor may run the session as a normal Claude Code session of yours (your settings, MCP servers,
+                  skills and environment, any folder, resume any of your sessions by id, permission prompts bypassed when the start asks for it).
+                  That is remote code as you: a session with prompts bypassed asks nothing, so text from fleet reports, scheduled check-ins and
+                  tool output can make it run commands as you. Only this command can turn it on; the server cannot. It asks you to type FULL,
+                  needs a terminal (no pipe or script), and is refused inside a Claude Code session.
+  --no-full       Turn full power off again (a running full-power session is stopped).
+  disable         Turn the orchestrator off (full power too). Session control verbs stay as they are.
 `,
   link: `Usage: ${CLI_BIN_NAME} link [options]
 
@@ -99,7 +130,7 @@ Options:
 `,
   mcp: `Usage: ${CLI_BIN_NAME} mcp [options]
 
-Stdio MCP server that proxies to Hivefloor, for tools that cannot send HTTP headers. Needs a stored token (run ${cliNpxCommand("connect")} first).
+Stdio MCP server that proxies to HiveFloor, for tools that cannot send HTTP headers. Needs a stored token (run ${cliNpxCommand("connect")} first).
 
 Options:
   --url URL       MCP endpoint (default: <host>/mcp)
@@ -131,7 +162,7 @@ If TalkBack is not installed, status and say print the install line and exit 1.
 `,
   hook: `Usage: ${CLI_BIN_NAME} hook <tool> <event> [--profile KEY]
 
-The hook runner that Claude Code, Codex and other tools call. It reads the event JSON on stdin, reports it to Hivefloor, and always exits 0 so a hook never fails the agent. You do not run it by hand; ${cliNpxCommand("connect")} installs the hook entries.
+The hook runner that Claude Code, Codex and other tools call. It reads the event JSON on stdin, reports it to HiveFloor, and always exits 0 so a hook never fails the agent. You do not run it by hand; ${cliNpxCommand("connect")} installs the hook entries.
 
 Arguments:
   tool            claude, codex, ...
@@ -156,11 +187,12 @@ Commands:
   disconnect   Remove everything connect added, the machine on the server included (--tool <name> for one agent tool)
   status       This machine and its service; the per-repo agent, its projects and live sessions
   where        [tool] Which account to run next on (read only; --json for the raw answer)
+  control      on [--verbs ...] [--from owner|admins] | off | status: let people message, approve or stop live sessions
   service      run: the background service (started by your OS; you rarely run it by hand)
   link         Link this repo to another project (--project ID | --new NAME [--path PREFIX])
   token        Print the stored token for shell use (--reveal to print to a terminal)
   voice        status | list [--agent-id ID] | say "<text>" --out file.wav: TalkBack's spoken voice on this computer
-  mcp          Stdio MCP server that proxies to Hivefloor (for tools without HTTP header support)
+  mcp          Stdio MCP server that proxies to HiveFloor (for tools without HTTP header support)
   hook         <tool> <event>: the hook runner the tools call (reads JSON on stdin)
   help         Show this help (hivefloor <command> --help, or help <command>, for one command)
   --version    Print the version
@@ -197,29 +229,33 @@ async function run(argv, ctx = defaultCtx()) {
   try {
     switch (cmd) {
       case "connect":
-        return await (await import("./connect-2HLVPEOL.js")).connect(ctx, p);
+        return await (await import("./connect-ZJ4JXBAJ.js")).connect(ctx, p);
       case "disconnect":
-        return await (await import("./disconnect-WQMDCUXT.js")).disconnect(ctx, p);
+        return await (await import("./disconnect-3T25NTKX.js")).disconnect(ctx, p);
       case "status":
-        return await (await import("./status-GOCFNO7K.js")).status(ctx, p);
+        return await (await import("./status-QXOOJGGN.js")).status(ctx, p);
       case "where":
-        return await (await import("./where-XFXRTP7E.js")).where(ctx, p);
+        return await (await import("./where-CMUORQIO.js")).where(ctx, p);
       case "service":
         if (p.positionals[0] !== "run") {
           ctx.err("hivefloor: usage: hivefloor service run\n");
           return 2;
         }
-        return await (await import("./run-ZAZ45MKQ.js")).runService({ ctx });
+        return await (await import("./run-JL2OZWK3.js")).runService({ ctx });
+      case "control":
+        return await (await import("./control-6GHTZQJV.js")).control(ctx, p);
+      case "orch":
+        return await (await import("./orch-KVRL2YA2.js")).orch(ctx, p);
       case "link":
-        return await (await import("./link-ORT4LID6.js")).link(ctx, p);
+        return await (await import("./link-EAS5F5PC.js")).link(ctx, p);
       case "token":
-        return await (await import("./token-EMM4AJAU.js")).token(ctx, p);
+        return await (await import("./token-BFWWQIDA.js")).token(ctx, p);
       case "voice":
-        return await (await import("./voice-F5MIS3IZ.js")).voice(ctx, p);
+        return await (await import("./voice-QXHFXRWG.js")).voice(ctx, p);
       case "mcp":
-        return await (await import("./mcp-2SF6Y73M.js")).runMcpProxy(ctx, p);
+        return await (await import("./mcp-LVIYR3EN.js")).runMcpProxy(ctx, p);
       case "hook": {
-        const { runHook, readStdin } = await import("./hook-AYJNRGIY.js");
+        const { runHook, readStdin } = await import("./hook-TPSHBCWU.js");
         await runHook(rest, { env: ctx.env, cwd: ctx.cwd, fetch: ctx.fetch, now: ctx.now, readStdin });
         return 0;
       }

package/dist/connect-ZJ4JXBAJ.js

@@ -0,0 +1,27 @@
+#!/usr/bin/env node
+import { createRequire as __hfCreateRequire } from 'node:module';
+const require = __hfCreateRequire(import.meta.url);
+import {
+  connect,
+  connectAgent,
+  resolveHost
+} from "./chunk-TIR4CV3P.js";
+import "./chunk-FPJNGKT5.js";
+import "./chunk-QBBKGORP.js";
+import "./chunk-X2KH6AR4.js";
+import "./chunk-BLLPDPTL.js";
+import "./chunk-QLMLB7RB.js";
+import "./chunk-QPAFN47B.js";
+import "./chunk-K2IRTZH5.js";
+import "./chunk-LX5A25O6.js";
+import "./chunk-NRJONTFT.js";
+import "./chunk-XAXKZ572.js";
+import "./chunk-XPGL7VYE.js";
+import "./chunk-QGULSOQ2.js";
+import "./chunk-HWBUESB4.js";
+import "./chunk-2ERPDCOT.js";
+export {
+  connect,
+  connectAgent,
+  resolveHost
+};

package/dist/control-6GHTZQJV.js

@@ -0,0 +1,25 @@
+#!/usr/bin/env node
+import { createRequire as __hfCreateRequire } from 'node:module';
+const require = __hfCreateRequire(import.meta.url);
+import {
+  FULL_POWER_MEANS,
+  control,
+  describeFull
+} from "./chunk-HW3KRNCO.js";
+import "./chunk-5XXYQQG6.js";
+import "./chunk-4G362W6G.js";
+import "./chunk-X2KH6AR4.js";
+import "./chunk-QPAFN47B.js";
+import "./chunk-KQMPCV57.js";
+import "./chunk-L6EFW2SJ.js";
+import "./chunk-LX5A25O6.js";
+import "./chunk-NRJONTFT.js";
+import "./chunk-XPGL7VYE.js";
+import "./chunk-QGULSOQ2.js";
+import "./chunk-HWBUESB4.js";
+import "./chunk-2ERPDCOT.js";
+export {
+  FULL_POWER_MEANS,
+  control,
+  describeFull
+};

package/dist/{disconnect-WQMDCUXT.js → disconnect-3T25NTKX.js}

@@ -1,38 +1,45 @@
 #!/usr/bin/env node
+import { createRequire as __hfCreateRequire } from 'node:module';
+const require = __hfCreateRequire(import.meta.url);
 import {
   removeCliCopy,
   removeMachineHooks
-} from "./chunk-U6RRUAC2.js";
+} from "./chunk-5XXYQQG6.js";
+import "./chunk-4G362W6G.js";
 import {
-  claudeJson,
   geminiSettings,
-  readManifest,
-  removeClaude,
-  removeCodex,
   removeCursor,
   removeGemini,
   removeGrok,
-  removeRcLine,
+  removeRcLine
+} from "./chunk-QBBKGORP.js";
+import {
+  claudeJson,
+  readManifest,
+  removeClaude,
+  removeCodex,
   updateManifest
-} from "./chunk-6XVIEX75.js";
+} from "./chunk-X2KH6AR4.js";
 import {
   KEYCHAIN_SERVICE,
   deleteCredentials,
   readCredentials,
   uninstallService
-} from "./chunk-6MDJB3BV.js";
+} from "./chunk-QLMLB7RB.js";
 import {
   checkUnknownFlags,
   flagStr
-} from "./chunk-TKMIV7BG.js";
-import "./chunk-J36OIJBM.js";
+} from "./chunk-QPAFN47B.js";
+import "./chunk-KQMPCV57.js";
+import "./chunk-L6EFW2SJ.js";
 import {
   readMachine,
   removeMachineFile
-} from "./chunk-IJRHCDIG.js";
+} from "./chunk-LX5A25O6.js";
 import {
   apiRequest
-} from "./chunk-VX7SCIF2.js";
+} from "./chunk-NRJONTFT.js";
+import "./chunk-XAXKZ572.js";
 import {
   ConfigError,
   REAL_TOOLS,
@@ -43,14 +50,14 @@ import {
   removeFile,
   serviceLogFile,
   serviceStateFile
-} from "./chunk-TPMFQUAW.js";
+} from "./chunk-XPGL7VYE.js";
 import {
   hostFromFlag,
   runCmd,
   sameOrigin
-} from "./chunk-SOXRITAW.js";
-import "./chunk-4DRHR7LR.js";
-import "./chunk-K3NQKI34.js";
+} from "./chunk-QGULSOQ2.js";
+import "./chunk-HWBUESB4.js";
+import "./chunk-2ERPDCOT.js";
 
 // src/disconnect.ts
 import fs from "fs";
@@ -139,7 +146,7 @@ async function disconnect(ctx, p) {
   });
   const m = readManifest();
   if (Object.keys(m.tools).length === 0 && m.rc.length === 0) removeFile(manifestFile());
-  if (lines.length === 0 && warnings.length === 0) ctx.out("Nothing to remove: no Hivefloor entries found.\n");
+  if (lines.length === 0 && warnings.length === 0) ctx.out("Nothing to remove: no HiveFloor entries found.\n");
   else if (lines.length > 0) {
     ctx.out("Disconnected:\n");
     for (const l of lines) ctx.out(`  ${l}