@linzumi/cli 0.0.2-beta → 0.0.4-beta

package/README.md

@@ -1,19 +1,19 @@
 # @linzumi/cli
 
 ```text
-        .  *  .        .      *
-   *       _.-"""-._        .
-        .-'  _   _  '-.  *
-       /    (o)_(o)    \
-      |        .-.       |       mouse in the grove
-      |     .-(   )-.    |       listening for Kandan
-       \   /   '-'   \  /
-        '-.\__     __/.-'
-            /|     |\
-          _/ |  |  | \_
-        .'   |__|__|   '.
-       /   .  /___\  .   \
-      '._.'  /_____\  '._.'
+            ___       ___
+         .-'   '-. .-'   '-.
+       .'         '         '.
+      /     _           _     \
+     |    .' '.       .' '.    |
+     |   /     \ .-. /     \   |
+      \  \      (o o)      /  /
+       '._'._    \_/    _.'_.'
+            |     |     |
+            |    /|\    |
+            |___/ | \___|
+                \_|_/
+                 / \
 ```
 
 Linzumi's CLI package. It installs the `linzumi` executable.
@@ -27,7 +27,7 @@ runner. It wraps the same local runner that was previously started with
 Install the exact beta version:
 
 ```bash
-npm install -g @linzumi/cli@0.0.2-beta
+npm install -g @linzumi/cli@0.0.4-beta
 ```
 
 Or install the current beta tag:
@@ -47,50 +47,43 @@ linzumi --version
 Expected CLI output:
 
 ```bash
-linzumi 0.0.2-beta
+linzumi 0.0.4-beta
 ```
 
-## Equivalent Command
+## Prod Quick Start
 
-The old local runner command:
+For the Linzumi workspace in prod, this is the first command to try:
 
 ```bash
-bun run start -- \
+npm install -g @linzumi/cli@0.0.4-beta
+
+linzumi connect \
   --kandan-url wss://serve.kandanai.com \
   --workspace linzumi \
   --channel seans-playground \
-  --kandan-thread-id 6d454179-8c6c-45c6-a447-06f01cb6fa71 \
-  --listen-user sean \
-  --cwd /Users/seans/code/linzumi-main \
   --codex-bin codex \
-  --model gpt-5.5 \
-  --reasoning-effort low \
-  --fast \
-  --launch-tui \
-  --oauth-callback-host 100.71.192.98
+  --launch-tui
 ```
 
-is now:
+The runner handles OAuth itself. If the cached Kandan token is missing or
+rejected, it opens the OAuth flow and saves the refreshed auth cache.
+By default it listens for replies from the authenticated Kandan user.
+
+For a more explicit launch that pins the Codex model, reasoning effort, and
+fast service tier:
 
 ```bash
 linzumi connect \
   --kandan-url wss://serve.kandanai.com \
   --workspace linzumi \
   --channel seans-playground \
-  --kandan-thread-id 6d454179-8c6c-45c6-a447-06f01cb6fa71 \
-  --listen-user sean \
-  --cwd /Users/seans/code/linzumi-main \
   --codex-bin codex \
   --model gpt-5.5 \
   --reasoning-effort low \
   --fast \
-  --launch-tui \
-  --oauth-callback-host 100.71.192.98
+  --launch-tui
 ```
 
-The runner handles OAuth itself. If the cached Kandan token is missing or
-rejected, it opens the OAuth flow and saves the refreshed auth cache.
-
 ## Basic Use
 
 Running `linzumi` without arguments prints the local runner guide:
@@ -106,8 +99,6 @@ linzumi connect \
   --kandan-url wss://serve.kandanai.com \
   --workspace linzumi \
   --channel seans-playground \
-  --listen-user sean \
-  --cwd /Users/seans/code/linzumi-main \
   --codex-bin codex \
   --launch-tui
 ```
@@ -137,7 +128,7 @@ linzumi auth [auth options]
 --workspace <slug>          Workspace slug, for example linzumi
 --channel <slug|w/c>        Channel slug, or workspace/channel
 --kandan-thread-id <uuid>   Resume an existing Kandan thread
---listen-user <user|all>    User whose replies are accepted, or all
+--listen-user <user|all>    User whose replies are accepted, default authenticated user
 --cwd <path>                Working directory for Codex
 --codex-bin <path>          Codex executable, default codex
 --model <name>              Codex model

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@linzumi/cli",
-  "version": "0.0.2-beta",
+  "version": "0.0.4-beta",
   "description": "Linzumi local Codex runner CLI.",
   "type": "module",
   "bin": {

package/src/channelSessionSupport.ts

@@ -139,18 +139,18 @@ export function senderAllowed(
   event: Pick<KandanChatEvent, "actorSlug" | "actorUserId">,
   runnerIdentity: RunnerIdentity,
 ): boolean {
-  const normalized = listenUser.trim();
+  const normalized = listenUser.trim().toLocaleLowerCase();
 
   if (normalized === "all") {
     return true;
   }
 
-  if (event.actorSlug !== undefined && event.actorSlug === normalized) {
+  if (event.actorSlug !== undefined && event.actorSlug.toLocaleLowerCase() === normalized) {
     return true;
   }
 
   return (
-    runnerIdentity.actorUsername === normalized &&
+    runnerIdentity.actorUsername?.toLocaleLowerCase() === normalized &&
     runnerIdentity.actorUserId !== undefined &&
     event.actorUserId === runnerIdentity.actorUserId
   );

package/src/index.ts

@@ -18,6 +18,7 @@ import { randomUUID } from "node:crypto";
 import { runLocalCodexRunner, type RunnerOptions } from "./runner";
 import { writeCachedLocalRunnerToken } from "./authCache";
 import { resolveLocalRunnerToken } from "./authResolution";
+import { identityFromAccessToken } from "./channelSessionSupport";
 import { acquireLocalRunnerTokenDetails } from "./oauth";
 
 type FlagDefinition = {
@@ -48,11 +49,13 @@ const flagDefinitions = new Map<string, FlagDefinition>([
   ["help", { kind: "boolean" }],
 ]);
 
-try {
-  await main(process.argv.slice(2));
-} catch (error) {
-  process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
-  process.exit(1);
+if (import.meta.main) {
+  try {
+    await main(process.argv.slice(2));
+  } catch (error) {
+    process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+    process.exit(1);
+  }
 }
 
 async function main(args: readonly string[]): Promise<void> {
@@ -63,7 +66,7 @@ async function main(args: readonly string[]): Promise<void> {
       process.stdout.write(connectGuideText());
       return;
     case "version":
-      process.stdout.write("linzumi 0.0.2-beta\n");
+      process.stdout.write("linzumi 0.0.4-beta\n");
       return;
     case "auth":
       await runAuthCommand(parsed.args);
@@ -132,7 +135,7 @@ async function runAuthCommand(args: readonly string[]): Promise<void> {
   process.stdout.write(`Saved Kandan local runner auth for ${cached.kandanBaseUrl}\n`);
 }
 
-async function parseRunnerArgs(args: readonly string[]): Promise<RunnerOptions> {
+export async function parseRunnerArgs(args: readonly string[]): Promise<RunnerOptions> {
   const values = strictFlagValues(args);
 
   if (values.get("help") === true) {
@@ -141,24 +144,25 @@ async function parseRunnerArgs(args: readonly string[]): Promise<RunnerOptions>
   }
 
   if (values.get("version") === true) {
-    process.stdout.write("linzumi 0.0.2-beta\n");
+    process.stdout.write("linzumi 0.0.4-beta\n");
     process.exit(0);
   }
 
-  const channelSession = parseChannelSession(values);
+  const channelTarget = parseChannelSessionTarget(values);
   const kandanUrl = required(values, "kandan-url");
   const explicitToken = stringValue(values, "token");
   const token = await resolveLocalRunnerToken({
       kandanUrl,
       explicitToken,
-      workspaceSlug: channelSession?.workspaceSlug,
-      channelSlug: channelSession?.channelSlug,
+      workspaceSlug: channelTarget?.workspaceSlug,
+      channelSlug: channelTarget?.channelSlug,
       authFilePath: stringValue(values, "auth-file"),
       callbackHost: stringValue(values, "oauth-callback-host"),
       reportRejectedCachedToken: () => {
         process.stderr.write("Cached Kandan local runner auth was rejected; starting OAuth.\n");
       },
     });
+  const channelSession = parseChannelSession(values, token, channelTarget);
 
   return {
     kandanUrl,
@@ -210,15 +214,16 @@ function strictFlagValues(args: readonly string[]): Map<string, string | true> {
 }
 
 function parseChannelSession(
-  values: Map<string, string | true>
+  values: Map<string, string | true>,
+  token: string,
+  target: { readonly workspaceSlug: string; readonly channelSlug: string } | undefined,
 ): RunnerOptions["channelSession"] {
-  const target = parseOptionalChannelTarget(values);
-
   if (target === undefined) {
     return undefined;
   }
 
-  const listenUser = required(values, "listen-user");
+  const listenUser =
+    stringValue(values, "listen-user") ?? defaultListenUserFromToken(token);
 
   return {
     workspaceSlug: target.workspaceSlug,
@@ -232,6 +237,22 @@ function parseChannelSession(
   };
 }
 
+function parseChannelSessionTarget(
+  values: Map<string, string | true>
+): { readonly workspaceSlug: string; readonly channelSlug: string } | undefined {
+  return parseOptionalChannelTarget(values);
+}
+
+function defaultListenUserFromToken(token: string): string {
+  const username = identityFromAccessToken(token).actorUsername;
+
+  if (username !== undefined) {
+    return username;
+  }
+
+  throw new Error("missing --listen-user and authenticated user is unavailable");
+}
+
 function parseOptionalChannelTarget(
   values: Map<string, string | true>
 ): { readonly workspaceSlug: string; readonly channelSlug: string } | undefined {
@@ -297,7 +318,7 @@ function helpText(): string {
 
 Usage:
   linzumi
-  linzumi connect --kandan-url <ws-url> --workspace <slug> --channel <slug> --listen-user <username|all> [options]
+  linzumi connect --kandan-url <ws-url> --workspace <slug> --channel <slug> [options]
   linzumi auth --kandan-url <ws-url> [--workspace <slug> --channel <slug>]
 
 Required:
@@ -310,7 +331,7 @@ Channel binding:
   --workspace <slug>          Workspace slug
   --channel <slug|w/c>        Channel slug, or workspace/channel
   --kandan-thread-id <uuid>   Resume an existing Kandan thread instead of announcing a new root
-  --listen-user <user|all>    User whose replies are accepted, or all
+  --listen-user <user|all>    User whose replies are accepted, default authenticated user
 
 Codex:
   --cwd <path>                Working directory for Codex, default current directory
@@ -326,15 +347,17 @@ Codex:
 
 Examples:
   Good:
+    linzumi connect --kandan-url wss://serve.kandanai.com --workspace linzumi --channel seans-playground --codex-bin codex --launch-tui
+    linzumi connect --kandan-url wss://serve.kandanai.com --workspace linzumi --channel seans-playground --codex-bin codex --model gpt-5.5 --reasoning-effort low --fast --launch-tui
     linzumi auth --kandan-url ws://127.0.0.1:4160 --workspace default --channel seans-playground
     linzumi auth --kandan-url ws://100.71.192.98:4160 --oauth-callback-host 100.71.192.98 --workspace default --channel seans-playground
-    linzumi connect --kandan-url ws://127.0.0.1:4160 --token "$TOKEN" --workspace default --channel seans-playground --listen-user sean --cwd /tmp/kandan-runner-a
-    linzumi connect --kandan-url ws://127.0.0.1:4160 --workspace default --channel seans-playground --listen-user sean
+    linzumi connect --kandan-url ws://127.0.0.1:4160 --token "$TOKEN" --workspace default --channel seans-playground --cwd /tmp/kandan-runner-a
+    linzumi connect --kandan-url ws://127.0.0.1:4160 --workspace default --channel seans-playground
     linzumi connect --kandan-url ws://127.0.0.1:4160 --token "$TOKEN" --channel default/seans-playground --listen-user all --launch-tui
 
   Bad:
-    linzumi connect --kandan-url ws://127.0.0.1:4160 --workspace default --channel seans-playground
-      Missing --listen-user.
+    linzumi connect --kandan-url ws://127.0.0.1:4160 --token not-a-jwt --workspace default --channel seans-playground
+      Missing --listen-user and authenticated user is unavailable.
     linzumi connect --kandan-url ws://127.0.0.1:4160 --token "$TOKEN" --listen-users sean
       Invalid flag: use --listen-user.
 `;
@@ -346,7 +369,7 @@ function connectGuideText(): string {
 Connect this computer to Kandan as a local Codex runner.
 
 Use:
-  linzumi connect --kandan-url <ws-url> --workspace <slug> --channel <slug> --listen-user <username|all> [options]
+  linzumi connect --kandan-url <ws-url> --workspace <slug> --channel <slug> [options]
 
 For help:
   linzumi connect --help