@hwip/cli 0.0.1 → 0.1.0

package/dist/secret-mask.js

@@ -0,0 +1,245 @@
+"use strict";
+/**
+ * Best-effort masking of secret-looking strings in a patch, before it is sealed
+ * for the phone. It keeps the patch's shape — the same lines, the same diff
+ * marker on each, the same headers — so line numbers and hunks still line up;
+ * only text after the marker changes.
+ *
+ * This is a list of well-known token formats and secret-named assignments, not
+ * a promise: a secret in a form no rule knows goes through, and so does key
+ * material whose BEGIN line is outside the patch (the rules see one line at a
+ * time, plus whether a key block opened above). The count of masked spots is
+ * part of the answer so the reader is told something was hidden, and is never
+ * told nothing was.
+ *
+ * Every pattern is bounded: the patch comes from a repository the agent may
+ * have cloned from anywhere, the masking runs on the listener's event loop, and
+ * an unbounded `x*` retried from every start of a 200 KB line is quadratic.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.maskSecrets = exports.maskText = void 0;
+const redact_js_1 = require("./redact.js");
+const MASK = '***';
+/** Token formats with a recognisable prefix. Whole match is replaced. */
+const TOKEN_FORMATS = [
+    /\bAKIA[0-9A-Z]{16}\b/g,
+    /\bgh[pousr]_[A-Za-z0-9]{20,255}/g,
+    /\bgithub_pat_[A-Za-z0-9_]{20,255}/g,
+    /\bsk-[A-Za-z0-9_-]{20,255}/g,
+    /\bxox[abprs]-[A-Za-z0-9-]{10,255}/g,
+    /\bBearer[ \t]+[A-Za-z0-9._~+/-]{16,512}=*/g,
+    // npm CLI tokens: npm_ plus exactly 36 word characters (env names such as
+    // npm_config_registry hold an underscore inside, so the boundary keeps them out).
+    /\bnpm_[A-Za-z0-9]{36}\b/g,
+    // GitLab personal access tokens.
+    /\bglpat-[A-Za-z0-9_]{20,64}/g,
+    // HTTP Basic credentials: the base64 blob needs a digit, sign or padding - a
+    // plain English word after Basic (Basic authentication is...) stays.
+    /\bBasic[ \t]+(?=[A-Za-z0-9+/=]*[0-9+/=])[A-Za-z0-9+/=]{16,512}/g,
+    /\beyJ[A-Za-z0-9_-]{5,256}\.[A-Za-z0-9_-]{5,1024}\.[A-Za-z0-9_-]{5,1024}/g,
+];
+/** A line longer than this is not read by a person on a phone and is not
+ *  scanned: it is masked whole. Keeps the scan linear in the patch. */
+const MAX_SCANNED_LINE = 8 * 1024;
+/**
+ * `name = value` / `name: value` / `"name": "value"` where the name says it is
+ * a secret and the value is at least eight characters. Only the value is
+ * replaced. A value that is a reference to somewhere the secret lives
+ * (`process.env.X`, `$VAR`) is not the secret.
+ */
+const SECRET_ASSIGNMENT = /((?:secret|token|passw(?:or)?d|api[_-]?key|private[_-]?key|credential)[A-Za-z0-9_]{0,64}["']?[ \t]{0,16}[=:][ \t]{0,16}["'`]?)([^\s"'`,;)}\]]{8,2048})/gi;
+/** The same secret-named assignments, with the value quoted: a quoted value may hold
+ *  spaces (password = "hunter2 abc"), so the unquoted rule no-whitespace value
+ *  misses it. Same eight-character floor as the unquoted rule; run before it, so a
+ *  value is counted once even when its first word alone would match there. */
+const SECRET_QUOTED_VALUE = /((?:secret|token|passw(?:or)?d|api[_-]?key|private[_-]?key|credential)[A-Za-z0-9_]{0,64}["']?[ \t]{0,16}[=:][ \t]{0,16}["'])([^"'`\n]{8,2048}?)(["'])/gi;
+const ENV_REFERENCE = /^(?:process\.env|import\.meta\.env|os\.environ|os\.getenv|System\.getenv|ENV\[|\$\{?[A-Za-z_])/;
+/** An unquoted member chain or call (`response.data.token`, `createToken(cfg)`) is code, not a literal.
+ *  A digit in the first segment (`ya29.a0…`, `hunter2.0x`) says it is a value. */
+const CODE_EXPRESSION = /^[A-Za-z_]+(?:\.\w+|\()/;
+/** What may follow a BEGIN marker that opens a block: nothing, a closing quote, or a string's escaped newline. */
+const PEM_CLOSING_TAIL = /^(?:\\(?:r\\)?n)?["'`\\\s,+]*$/;
+const PEM_OPENING_TAIL = /^(?:["'`\\\s,+]*|\\(?:r\\)?n.*)$/;
+const PEM_END = /-----END [A-Z0-9 ]{0,40}PRIVATE KEY-----/;
+/** What a key block's body lines look like: base64, or a header such as `Proc-Type: 4,ENCRYPTED`. */
+const PEM_BODY_LINE = /^\s{0,64}(?:#|\/\/|\*|;)?\s{0,64}["'`]?(?:[A-Za-z0-9+/=]{1,8192}|[A-Za-z][A-Za-z0-9-]{0,40}: .{0,200})(?:\\(?:r\\)?n)?["'`]?[,+\s]*$/;
+/** Mask one line of content (marker already taken off). */
+const maskBody = (body) => {
+    let masked = 0;
+    let out = body;
+    for (const format of TOKEN_FORMATS) {
+        out = out.replace(format, () => {
+            masked++;
+            return MASK;
+        });
+    }
+    out = out.replace(SECRET_QUOTED_VALUE, (_whole, head, _value, quote) => {
+        masked++;
+        return head + MASK + quote;
+    });
+    const cleaned = (0, redact_js_1.redactSecrets)(out);
+    if (cleaned !== out) {
+        masked++;
+        out = cleaned;
+    }
+    out = out.replace(SECRET_ASSIGNMENT, (whole, head, value) => {
+        const quoted = /["'`]$/.test(head);
+        if (ENV_REFERENCE.test(value) || (!quoted && CODE_EXPRESSION.test(value)))
+            return whole;
+        masked++;
+        return head + MASK;
+    });
+    return { body: out, masked };
+};
+/** The `@@ -a,b +c,d @@` part of a hunk header; what follows it is a line of the file's own text. */
+const HUNK_RANGE = /^@@ -\d+(?:,\d+)? \+\d+(?:,\d+)? @@/;
+const PEM_MARKER = /-----(BEGIN|END) [A-Z0-9 ]{0,40}PRIVATE KEY-----/g;
+/** A hunk header with the file's context line (`@@ -4,4 +4,4 @@ API_KEY=sk-…`) masked like any other text. */
+const maskHunkHeader = (line) => {
+    const range = HUNK_RANGE.exec(line);
+    if (!range)
+        return { line, masked: 0 };
+    const tail = line.slice(range[0].length);
+    if (tail.length > MAX_SCANNED_LINE)
+        return { line: range[0] + ' ' + MASK, masked: 1 };
+    const result = maskBody(tail);
+    return { line: range[0] + result.body, masked: result.masked };
+};
+/**
+ * Mask one line's content (marker already taken off). `state.inPem` says a key
+ * block opened on an earlier line and carries a block opened on this one out.
+ * A line may hold several key blocks, the end of one and the start of the next,
+ * or a key block beside a token: every piece is read.
+ */
+const maskContent = (body, state) => {
+    let masked = 0;
+    let out = '';
+    const plain = (text) => {
+        const result = maskBody(text);
+        masked += result.masked;
+        out += result.body;
+    };
+    let from = 0;
+    if (state.inPem) {
+        const end = PEM_END.exec(body);
+        if (!end) {
+            // Only lines that look like key material are hidden; anything else means
+            // the block was not one (or has ended out of view) and is read normally.
+            // A blank line stays inside: an encrypted key puts one between its headers and its body.
+            if (body.trim() === '')
+                return { body, masked: 0 };
+            if (PEM_BODY_LINE.test(body))
+                return { body: MASK, masked: 0 };
+            state.inPem = false;
+        }
+        else {
+            // The block ends on this line: what is before the end marker is its last text.
+            state.inPem = false;
+            const before = body.slice(0, end.index);
+            if (before === '' || PEM_BODY_LINE.test(before))
+                out += before === '' ? '' : MASK;
+            else
+                plain(before);
+            from = end.index;
+        }
+    }
+    // Every marker of the line, found once; `endAt[i]` is the first END among markers i.. — so a line
+    // thick with markers is read in one pass, not once per BEGIN.
+    const markers = [...body.matchAll(PEM_MARKER)];
+    const endAt = new Array(markers.length + 1).fill(-1);
+    for (let i = markers.length - 1; i >= 0; i--)
+        endAt[i] = markers[i][1] === 'END' ? i : endAt[i + 1];
+    let k = 0;
+    for (;;) {
+        while (k < markers.length && (markers[k].index < from || markers[k][1] !== 'BEGIN'))
+            k++;
+        const begin = markers[k];
+        if (!begin) {
+            plain(body.slice(from));
+            break;
+        }
+        const afterBegin = begin.index + begin[0].length;
+        plain(body.slice(from, begin.index));
+        out += begin[0];
+        const endIndex = endAt[k + 1];
+        if (endIndex >= 0) {
+            // Begin and end on one line (a key inside a string literal): the middle goes.
+            masked++;
+            out += MASK;
+            from = markers[endIndex].index;
+            k = endIndex;
+            continue;
+        }
+        // A marker that ends its line (after any quote) opens a block, counted once
+        // however many lines it has; so does one followed by a string's escaped
+        // newline, whose key text on the same line goes too. A marker inside code
+        // (`startsWith("-----BEGIN …") {`) does not.
+        const tail = body.slice(afterBegin);
+        if (PEM_OPENING_TAIL.test(tail)) {
+            masked++;
+            state.inPem = true;
+            out += PEM_CLOSING_TAIL.test(tail) ? tail : MASK;
+            break;
+        }
+        // Not a block: read on, a later marker on the line may be one.
+        from = afterBegin;
+        k++;
+    }
+    return { body: out, masked };
+};
+/**
+ * Mask secret-looking strings in prose or any other text that is not a patch: no marker is taken off a line, so
+ * a token at the head of a line is read like any other. For text that leaves the machine to a reader other than
+ * the user (what `hwip agent read` prints). Same rules, same limits as `maskSecrets`: best effort, not a promise.
+ */
+const maskText = (text) => {
+    let masked = 0;
+    const state = { inPem: false };
+    const lines = text.split('\n').map((line) => {
+        if (line.length > MAX_SCANNED_LINE) {
+            masked++;
+            return MASK;
+        }
+        const result = maskContent(line, state);
+        masked += result.masked;
+        return result.body;
+    });
+    return { text: lines.join('\n'), masked };
+};
+exports.maskText = maskText;
+const maskSecrets = (patch) => {
+    let masked = 0;
+    let inHeader = false;
+    const state = { inPem: false };
+    const lines = patch.split('\n').map((line) => {
+        // File headers run from `diff --git` to the first hunk: a line there that
+        // starts with `+++ ` is a path, not an added line.
+        if (line.startsWith('diff --git ')) {
+            inHeader = true;
+            state.inPem = false;
+            return line;
+        }
+        if (inHeader && !line.startsWith('@@'))
+            return line;
+        if (line.startsWith('@@')) {
+            inHeader = false;
+            state.inPem = false;
+            const header = maskHunkHeader(line);
+            masked += header.masked;
+            return header.line;
+        }
+        if (line === '' || line.startsWith('\\'))
+            return line;
+        const marker = line.slice(0, 1);
+        const body = line.slice(1);
+        if (body.length > MAX_SCANNED_LINE) {
+            masked++;
+            return marker + MASK;
+        }
+        const result = maskContent(body, state);
+        masked += result.masked;
+        return marker + result.body;
+    });
+    return { text: lines.join('\n'), masked };
+};
+exports.maskSecrets = maskSecrets;

package/dist/self-register.d.ts

@@ -0,0 +1,45 @@
+/**
+ * This computer's own key in the account's device list, put there when it is missing.
+ *
+ * Every push, question and command is sealed (F16), and the app seals its answer for the computer that asked by the key
+ * the device list holds for it. The listener puts that key there over its socket; a computer that only runs `hwip ask`,
+ * `hwip agent send` or `hwip notify` used to stay off the list, and every question it asked was refused. Each of
+ * those now checks the list it already read: listed under this key, nothing is sent; missing or under another key, one
+ * keyed `PUT /devices/{id}/public-key` (server SERVER-API.md), and the list it goes on with holds the new entry —
+ * no second `GET /devices`.
+ *
+ * The server lets only a `push:read` API key replace a key already listed; another key gets 403 and the old key stays.
+ */
+export interface SelfKey {
+    deviceId: string;
+    publicKey: string;
+}
+/** Why the key is not on the list: the server's status, no answer, or 403 on replacing a key the list already holds. */
+export type RegisterWhy = `http ${number}` | 'network' | 'timeout' | 'replace-forbidden';
+/** Put this computer's key on the list: `null` once the server took it. */
+export type Register = (self: SelfKey) => Promise<RegisterWhy | null>;
+export type SelfListing<D> = {
+    ok: true;
+    devices: D[];
+} | {
+    ok: false;
+    why: RegisterWhy;
+};
+/** The keyed `PUT`, never following a redirect (`apiFetch`). `fetchFn` is read per call, so a stub set later applies. */
+export declare const registerOverApi: (account: {
+    apiKey: string;
+    baseUrl: string;
+}, fetchFn?: typeof fetch) => Register;
+/**
+ * `devices` with this computer listed under `self.publicKey`: as given when it already is, else after one `register`.
+ * The entry it adds is what the server made of it (`type: 'cli'`); one it replaces keeps every other field.
+ */
+export declare const ensureSelfListed: <D extends {
+    deviceId: string;
+    publicKey?: string;
+}>(devices: D[], self: SelfKey, register: Register) => Promise<SelfListing<D>>;
+/** `why` for a person, inside parentheses. */
+export declare const registerWhyText: (why: RegisterWhy) => string;
+/** The refusal of a question or a command whose sender is not on the list: `what` was not sent. */
+export declare const unregisteredText: (what: string, why?: RegisterWhy) => string;
+//# sourceMappingURL=self-register.d.ts.map

package/dist/self-register.js

@@ -0,0 +1,67 @@
+"use strict";
+/**
+ * This computer's own key in the account's device list, put there when it is missing.
+ *
+ * Every push, question and command is sealed (F16), and the app seals its answer for the computer that asked by the key
+ * the device list holds for it. The listener puts that key there over its socket; a computer that only runs `hwip ask`,
+ * `hwip agent send` or `hwip notify` used to stay off the list, and every question it asked was refused. Each of
+ * those now checks the list it already read: listed under this key, nothing is sent; missing or under another key, one
+ * keyed `PUT /devices/{id}/public-key` (server SERVER-API.md), and the list it goes on with holds the new entry —
+ * no second `GET /devices`.
+ *
+ * The server lets only a `push:read` API key replace a key already listed; another key gets 403 and the old key stays.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.unregisteredText = exports.registerWhyText = exports.ensureSelfListed = exports.registerOverApi = void 0;
+const node_os_1 = require("node:os");
+const api_js_1 = require("./api.js");
+const crypto_js_1 = require("./crypto.js");
+const REGISTER_TIMEOUT_MS = 10_000;
+/** The name a new device record gets: the one the listener connects under. The server keeps an existing record's name. */
+const nickname = () => (0, node_os_1.hostname)() || 'listener';
+/** The keyed `PUT`, never following a redirect (`apiFetch`). `fetchFn` is read per call, so a stub set later applies. */
+const registerOverApi = (account, fetchFn) => async (self) => {
+    let res;
+    try {
+        res = await (0, api_js_1.apiFetch)(fetchFn ?? fetch, (0, api_js_1.apiUrl)(account.baseUrl, `/devices/${encodeURIComponent(self.deviceId)}/public-key`), account.apiKey, REGISTER_TIMEOUT_MS, {
+            method: 'PUT',
+            body: JSON.stringify({ publicKey: self.publicKey, nickname: nickname() }),
+        });
+    }
+    catch (err) {
+        return err instanceof DOMException && err.name === 'TimeoutError' ? 'timeout' : 'network';
+    }
+    try {
+        await res.arrayBuffer();
+    }
+    catch { /* the answer's body is not needed */ }
+    return res.ok ? null : `http ${res.status}`;
+};
+exports.registerOverApi = registerOverApi;
+/**
+ * `devices` with this computer listed under `self.publicKey`: as given when it already is, else after one `register`.
+ * The entry it adds is what the server made of it (`type: 'cli'`); one it replaces keeps every other field.
+ */
+const ensureSelfListed = async (devices, self, register) => {
+    const listed = devices.find((d) => d.deviceId === self.deviceId);
+    if (listed?.publicKey && (0, crypto_js_1.samePublicKey)(listed.publicKey, self.publicKey))
+        return { ok: true, devices };
+    const why = await register(self);
+    if (why !== null)
+        return { ok: false, why: why === 'http 403' && listed?.publicKey ? 'replace-forbidden' : why };
+    if (listed)
+        return { ok: true, devices: devices.map((d) => (d === listed ? { ...d, publicKey: self.publicKey } : d)) };
+    // The server answers with the record; the list only needs what it is read for: an id, a key and a kind.
+    return { ok: true, devices: [...devices, { deviceId: self.deviceId, publicKey: self.publicKey, type: 'cli' }] };
+};
+exports.ensureSelfListed = ensureSelfListed;
+/** `why` for a person, inside parentheses. */
+const registerWhyText = (why) => why === 'replace-forbidden'
+    ? 'the account lists another key for it, and only an API key with push:read may replace it'
+    : why === 'network' ? 'could not reach the server'
+        : why === 'timeout' ? 'the server did not answer in time'
+            : `the server answered HTTP ${why.slice(5)}`;
+exports.registerWhyText = registerWhyText;
+/** The refusal of a question or a command whose sender is not on the list: `what` was not sent. */
+const unregisteredText = (what, why) => `could not register this machine's key in the account's device list${why ? ` (${(0, exports.registerWhyText)(why)})` : ''}; the ${what} was not sent`;
+exports.unregisteredText = unregisteredText;

package/dist/send.d.ts

@@ -0,0 +1,56 @@
+import { type AgentTargetDevice } from './agent-target.js';
+import { type AgentCommandPayload, type CommandSealDeps } from './command-seal.js';
+export interface SendDeps {
+    listDevices: () => Promise<AgentTargetDevice[]>;
+    sendAgentCommand: (payload: AgentCommandPayload) => Promise<{
+        pushId: string;
+    }>;
+    /** What `sealedCommand` needs; absent in tests that send plain. */
+    seal: CommandSealDeps;
+    /** This process's own agent session, or null outside tmux. */
+    context: () => {
+        agentDeviceId: string;
+        agentSessionName: string;
+    } | null;
+    hostname: () => string;
+    out: (line: string) => void;
+    err: (line: string) => void;
+}
+/** `hwip agent send` is the name; `hwip send` is the older one for the same command (C82). */
+export type SendCommand = 'send' | 'agent send';
+export declare const usageFor: (command: SendCommand) => string;
+export declare const USAGE: string;
+/** `hwip agent` takes `send`, `list` or `read`; null when that is what was typed. */
+export declare const agentSubcommandError: (subcommand: string) => string | null;
+/**
+ * `-` as the whole message: read it from stdin. An agent writes a summary on a
+ * quoted heredoc (`hwip agent send <key> - <<'EOF'`), where the shell expands nothing;
+ * inside double quotes its backticks or `$(…)` would run. Only on `-`: a bare
+ * target with an open, empty stdin would wait forever.
+ */
+export declare const sendReadsStdin: (argv: string[]) => boolean;
+/** The target and the message `hwip send` / `hwip agent send` got, or the usage error to exit 2 with. */
+export declare const parseSendArgs: (argv: string[], stdin?: string, command?: SendCommand) => {
+    target: string;
+    message: string;
+} | {
+    error: string;
+};
+/**
+ * `hwip agent send <target> <message…>` (and `hwip send`, the older name) — type a message into another agent session,
+ * the CLI twin of the MCP `hwip_agent_send` for agents without MCP (pi).
+ * Takes what `parseSendArgs` read. Exit 0 stored by the server · 1 anything else.
+ */
+export declare const runSend: ({ target, message }: {
+    target: string;
+    message: string;
+}, deps: SendDeps, command?: SendCommand) => Promise<number>;
+export declare const liveSendDeps: (hook: {
+    listDevices: SendDeps["listDevices"];
+    sendAgentCommand: SendDeps["sendAgentCommand"];
+    account: {
+        apiKey: string;
+        baseUrl: string;
+    };
+}) => SendDeps;
+//# sourceMappingURL=send.d.ts.map

package/dist/send.js

@@ -0,0 +1,104 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.liveSendDeps = exports.runSend = exports.parseSendArgs = exports.sendReadsStdin = exports.agentSubcommandError = exports.USAGE = exports.usageFor = void 0;
+const node_os_1 = require("node:os");
+const agent_session_js_1 = require("./agent-session.js");
+const agent_target_js_1 = require("./agent-target.js");
+const ask_js_1 = require("./ask.js");
+const command_seal_js_1 = require("./command-seal.js");
+const usageFor = (command) => `Usage: hwip [--key …] [--base-url …] ${command} <deviceId:session | name> <message… | - (read stdin)>`;
+exports.usageFor = usageFor;
+exports.USAGE = (0, exports.usageFor)('send');
+/** `hwip agent` takes `send`, `list` or `read`; null when that is what was typed. */
+const agentSubcommandError = (subcommand) => subcommand === 'send' || subcommand === 'list' || subcommand === 'read'
+    ? null
+    : `hwip agent: subcommands are send, list, read${subcommand ? `, not '${subcommand}'` : ''}\n${(0, exports.usageFor)('agent send')}`;
+exports.agentSubcommandError = agentSubcommandError;
+// A CLI flag after `send`. Everything there is message text, so `--key ak_…`
+// would be typed into the other session in plaintext: refuse it instead. A
+// message quoted as one argument that mentions `--key` is not a flag.
+const MISPLACED_FLAG = /^--(key|base-url)(=|$)/;
+/**
+ * `-` as the whole message: read it from stdin. An agent writes a summary on a
+ * quoted heredoc (`hwip agent send <key> - <<'EOF'`), where the shell expands nothing;
+ * inside double quotes its backticks or `$(…)` would run. Only on `-`: a bare
+ * target with an open, empty stdin would wait forever.
+ */
+const sendReadsStdin = (argv) => argv.length === 2 && argv[1] === '-';
+exports.sendReadsStdin = sendReadsStdin;
+/** The target and the message `hwip send` / `hwip agent send` got, or the usage error to exit 2 with. */
+const parseSendArgs = (argv, stdin, command = 'send') => {
+    const flag = argv.find((word) => MISPLACED_FLAG.test(word));
+    if (flag) {
+        return { error: `hwip ${command}: ${flag.split('=')[0]} goes before '${command.split(' ')[0]}' — after it, it is message text\n${(0, exports.usageFor)(command)}` };
+    }
+    const [target, ...words] = argv;
+    const message = ((0, exports.sendReadsStdin)(argv) ? (stdin ?? '') : words.join(' ')).trim();
+    return target && message ? { target, message } : { error: (0, exports.usageFor)(command) };
+};
+exports.parseSendArgs = parseSendArgs;
+/**
+ * The header the receiver reads first. It matches the MCP tool's
+ * (mcp-server/src/tools/agent-send.ts `senderHeader`); the web app is to parse
+ * the same shape to caption the bubble. The reply key is offered only for a
+ * session the listener reports, and never for a subagent or a `hwip sh` shell:
+ * `resolveAgentTarget` takes none of them, so the reply would not resolve.
+ */
+const senderHeader = (devices, deps) => {
+    const ctx = deps.context();
+    const own = ctx ? devices.find((d) => d.deviceId === ctx.agentDeviceId) : undefined;
+    const host = own?.nickname ?? deps.hostname();
+    const listed = !!ctx && !!own?.agentSessions?.some((s) => s.name === ctx.agentSessionName && (0, agent_target_js_1.isAgentTarget)(s));
+    if (!ctx || !listed)
+        return { header: `[from ${ctx?.agentSessionName ?? 'cli'}@${host}]` };
+    const ownKey = `${ctx.agentDeviceId}:${ctx.agentSessionName}`;
+    const label = own?.agentSessionAliases?.[ctx.agentSessionName] ?? ctx.agentSessionName;
+    return { header: `[from ${label}@${host} · reply: ${ownKey}]`, ownKey };
+};
+/**
+ * `hwip agent send <target> <message…>` (and `hwip send`, the older name) — type a message into another agent session,
+ * the CLI twin of the MCP `hwip_agent_send` for agents without MCP (pi).
+ * Takes what `parseSendArgs` read. Exit 0 stored by the server · 1 anything else.
+ */
+const runSend = async ({ target, message }, deps, command = 'send') => {
+    try {
+        const devices = await deps.listDevices();
+        const { header, ownKey } = senderHeader(devices, deps);
+        const resolved = (0, agent_target_js_1.resolveAgentTarget)(devices, target, ownKey);
+        if (resolved.key === ownKey) {
+            deps.err(`hwip ${command}: the target is this session itself — pick another agent`);
+            return 1;
+        }
+        const text = `${header} ${message}`;
+        const prepared = await (0, command_seal_js_1.sealedCommand)({ targetDeviceId: resolved.deviceId, session: resolved.name, message: text }, deps.seal);
+        if (prepared.kind === 'refused') {
+            deps.err(`hwip ${command}: ${(0, command_seal_js_1.commandRefusalMessage)(prepared.cause, prepared.why)}`);
+            return 1;
+        }
+        await deps.sendAgentCommand({
+            targetDeviceId: resolved.deviceId,
+            agentSessionName: resolved.name,
+            isEncrypted: true,
+            ...prepared.fields,
+        });
+        // The server stored it. The listener may still refuse it (rate limit, a shell pane, a session gone since), and this
+        // command does not wait to hear of it.
+        deps.out(`sent → ${resolved.key} (stored; not confirmed typed)`);
+        return 0;
+    }
+    catch (err) {
+        deps.err(`hwip ${command}: ${err instanceof Error ? err.message : String(err)}`);
+        return 1;
+    }
+};
+exports.runSend = runSend;
+const liveSendDeps = (hook) => ({
+    listDevices: () => hook.listDevices(),
+    sendAgentCommand: (payload) => hook.sendAgentCommand(payload),
+    seal: (0, ask_js_1.liveSealDeps)(hook.account.apiKey, hook.account.baseUrl),
+    context: agent_session_js_1.agentSessionContext,
+    hostname: node_os_1.hostname,
+    out: (line) => console.log(line),
+    err: (line) => console.error(line),
+});
+exports.liveSendDeps = liveSendDeps;