@magic-markdown/cli 0.3.18 → 0.3.20

package/dist/index.js

@@ -270,7 +270,7 @@ var require_punycode = __commonJS({
 });
 
 // src/index.ts
-import { readFile as readFile7 } from "node:fs/promises";
+import { readFile as readFile8 } from "node:fs/promises";
 import { resolve as resolve6 } from "node:path";
 
 // ../core/src/types.ts
@@ -11263,7 +11263,7 @@ var RemoteDocumentIO = class {
 };
 
 // src/agent.ts
-var CLI_VERSION = "0.3.18";
+var CLI_VERSION = "0.3.20";
 var CLI_PACKAGE_NAME = "@magic-markdown/cli";
 var AGENT_COMMANDS = [
   {
@@ -11534,34 +11534,36 @@ var AGENT_COMMANDS = [
   },
   {
     name: "bridge setup",
-    summary: "Initialize, validate, request approval for, and start an agent filesystem bridge.",
-    usage: "mdocs bridge setup --workspace <id> --root <path> --root-id <id> [--folder-id <id>] --url <base-url> --actor-name <agent-name> --request-token",
+    summary: "Initialize, validate, claim, and start an agent filesystem bridge.",
+    usage: "mdocs bridge setup --workspace <id> --root <path> --root-id <id> [--folder-id <id>] --url <base-url> --actor-name <agent-name> --claim <claim-token>",
     output: "long-running",
     mutates: true,
     examples: [
-      "mdocs bridge setup --workspace workspace_abc --root . --root-id agentfs-hermes --url https://magic.example.com --actor-name Hermes --request-token"
+      "mdocs bridge setup --workspace workspace_abc --root . --root-id agentfs-hermes --url https://magic.example.com --actor-name Hermes --claim mdocsclaim_abc123"
     ],
     notes: [
       "Runs init and doctor before starting the bridge.",
-      "--request-token opens a human approval URL and avoids pasting bridge secrets into an agent session.",
+      "--claim exchanges a one-time binding claim for the durable bridge token over HTTPS, then stores the durable token in the local CLI profile.",
+      "--request-token remains available as a legacy human-approval fallback, but Magic binding packets should prefer --claim.",
       "--token (or MDOCS_BRIDGE_TOKEN) still works when a scoped bridge token is already available."
     ]
   },
   {
     name: "bridge resume",
     summary: "Backfill missed Magic changes after an agent restart, then keep the bridge running.",
-    usage: "mdocs bridge resume --root <path> [--url <base-url>] [--workspace <id>] [--root-id <id>] [--request-token] [--forever] [--once]",
+    usage: "mdocs bridge resume --root <path> [--url <base-url>] [--workspace <id>] [--root-id <id>] [--forever] [--once]",
     output: "long-running",
     mutates: true,
     examples: [
-      "mdocs bridge resume --root . --forever --request-token",
-      "mdocs bridge resume --root . --once --request-token"
+      "mdocs bridge resume --root . --forever",
+      "mdocs bridge resume --root . --once"
     ],
     notes: [
       "Reads non-secret connection defaults from .mdocs/bridge.json written by bridge setup.",
+      "Reads the durable bridge token from the local CLI profile written by claim-backed bridge setup.",
       "Use this after a sandbox/container/agent session restarts. It backfills canonical Magic changes before publishing local edits.",
       "--forever is the intended startup/sandbox command: keep it running for live collaboration and liveness heartbeats.",
-      "--request-token opens a human approval URL when no MDOCS_BRIDGE_TOKEN is available; do not ask users to paste bridge tokens by default.",
+      "If the local CLI profile token is missing, rerun bridge setup from a fresh Magic binding packet. Do not ask users to paste bridge tokens by default.",
       "--once performs only the backfill/reconcile step and exits."
     ]
   },
@@ -11580,18 +11582,19 @@ var AGENT_COMMANDS = [
       "Run this after bridge setup has written .mdocs/bridge.json.",
       "Sandbox providers should put the returned startupCommand in their on-start hook.",
       "--install installs and starts the generated launchd/systemd user service when the host supports it.",
-      "The generated runner stores no bridge token; provide MDOCS_BRIDGE_TOKEN through platform secrets if you use manual tokens."
+      "The generated runner stores no bridge token; it reuses the durable token saved by bridge setup in the local CLI profile."
     ]
   },
   {
     name: "bridge",
     summary: "Sync a local Markdown root with a Magic workspace over WebSocket (long-running).",
-    usage: "mdocs bridge --workspace <id> --root <path> --url <base-url> --request-token",
+    usage: "mdocs bridge --workspace <id> --root <path> --url <base-url> --claim <claim-token>",
     output: "long-running",
     mutates: true,
-    examples: ["mdocs bridge --workspace workspace_abc --root . --root-id root_abc --url https://magic.example.com --request-token"],
+    examples: ["mdocs bridge --workspace workspace_abc --root . --root-id root_abc --url https://magic.example.com --claim mdocsclaim_abc123"],
     notes: [
-      "--request-token opens a human approval URL and avoids pasting bridge secrets into an agent session.",
+      "--claim exchanges a one-time binding claim for the durable bridge token over HTTPS, then stores the durable token in the local CLI profile.",
+      "--request-token remains available as a legacy human-approval fallback.",
       "--token (or MDOCS_BRIDGE_TOKEN) still works when a scoped bridge token is already available.",
       "--url (or MDOCS_BASE_URL) is required; the bridge never assumes a localhost server."
     ]
@@ -11654,7 +11657,9 @@ Run \`mdocs help <command>\` (or \`mdocs <command> --help\`) for usage, examples
 
 ## Filesystem Bridge / Resume
 
-When a human asks you to bind an editable local Markdown filesystem to Magic Markdown, use the latest official package and the human-approval token flow:
+When a human asks you to bind an editable Markdown filesystem to Magic Markdown, use the latest official package and the one-time claim from the binding packet. The claim is not the durable bridge token; the CLI exchanges it over HTTPS and stores the durable token in the local CLI profile.
+
+Bind the path-addressable Markdown root. Some agent platforms expose a native or projected filesystem backed by SQLite or another virtual store; treat that projection as normal files and run setup from the projected directory. Never point \`--root\` at the SQLite database file or raw state tables. If the platform only exposes agent state through APIs or tables, first mirror the intended Markdown files into a path-addressable workspace directory, then bind that directory.
 
 \`\`\`bash
 npx --yes --package=@magic-markdown/cli@latest mdocs bridge setup \\
@@ -11663,18 +11668,18 @@ npx --yes --package=@magic-markdown/cli@latest mdocs bridge setup \\
   --root-id <root-id> \\
   --url <magic-url> \\
   --actor-name "<agent name>" \\
-  --request-token
+  --claim <claim-token>
 \`\`\`
 
-Return the Magic approval link and keep the bridge process running after approval. Success looks like \`mdocs bridge connected ...\`.
+Keep the bridge process running. Success looks like \`mdocs bridge connected ...\`.
 
-If your sandbox, container, terminal, or agent session restarts after setup, do not ask for a raw bridge token. Start the latest CLI again and resume from the same root:
+If your sandbox, container, terminal, or agent session restarts after setup, do not ask for a raw bridge token or a new approval. Start the latest CLI again and resume from the same root:
 
 \`\`\`bash
-npx --yes --package=@magic-markdown/cli@latest mdocs bridge resume --root . --forever --request-token
+npx --yes --package=@magic-markdown/cli@latest mdocs bridge resume --root . --forever
 \`\`\`
 
-\`bridge resume --forever\` reads non-secret defaults from \`.mdocs/bridge.json\`, backfills missed Magic changes before publishing local edits, and then keeps polling/watching with liveness heartbeats. Use \`--once\` only when the user asked for a one-shot backfill rather than a live bridge.
+\`bridge resume --forever\` reads non-secret defaults from \`.mdocs/bridge.json\`, reads the durable bridge token from the local CLI profile, backfills missed Magic changes before publishing local edits, and then keeps polling/watching with liveness heartbeats. Use \`--once\` only when the user asked for a one-shot backfill rather than a live bridge. If the local profile token is missing, rerun \`bridge setup\` from a fresh Magic binding packet.
 
 For sandboxes, VPSs, or local machines that support startup hooks, generate a durable runner after setup:
 
@@ -11682,7 +11687,7 @@ For sandboxes, VPSs, or local machines that support startup hooks, generate a du
 npx --yes --package=@magic-markdown/cli@latest mdocs bridge startup --root . --json
 \`\`\`
 
-Put the returned \`startupCommand\` into the provider's on-start hook. On local macOS or systemd Linux hosts, \`mdocs bridge startup --root . --install\` writes and starts a user service. The generated runner stores no bridge token; use platform secrets for \`MDOCS_BRIDGE_TOKEN\` if you manage tokens manually.
+Put the returned \`startupCommand\` into the provider's on-start hook. On local macOS or systemd Linux hosts, \`mdocs bridge startup --root . --install\` writes and starts a user service. The generated runner stores no bridge token; it reuses the durable token saved by \`bridge setup\` in the local CLI profile.
 
 If Magic and the local root both changed the same document while you were offline, the bridge keeps the Magic canonical path, saves your local divergent version as a \`.conflict-...\` Markdown copy, and lets the conflict copy sync as a normal file. If Magic reports a server-side conflict, wait for the human to resolve it in Magic Markdown before retrying content pushes.
 
@@ -13775,10 +13780,13 @@ function optionalFolderTarget(value) {
 
 // src/bridge.ts
 import { createHash as createHash2, randomUUID as randomUUID3 } from "node:crypto";
-import { basename as basename2, resolve as resolve4 } from "node:path";
+import { chmod, mkdir as mkdir4, readFile as readFile6, writeFile as writeFile4 } from "node:fs/promises";
+import { homedir } from "node:os";
+import { basename as basename2, join as join4, resolve as resolve4 } from "node:path";
 var BRIDGE_CONFIG_PATH = ".mdocs/bridge.json";
 var BRIDGE_STATUS_PATH = ".mdocs/bridge-status.json";
 var BRIDGE_HEARTBEAT_INTERVAL_MS = 1e4;
+var BRIDGE_TOKEN_STORE_PATH = join4(homedir(), ".mdocs", "bridge-tokens.json");
 function bridgeSetupIdentity(input) {
   const actorName = input.actorName?.trim() || "Agent";
   return {
@@ -13836,7 +13844,7 @@ async function runBridgeResume(options) {
     baseUrl,
     intervalMs: options.intervalMs ?? config2?.intervalMs ?? 1e3,
     token: options.token,
-    requestToken: options.requestToken || !options.token,
+    requestToken: Boolean(options.requestToken),
     pairingTimeoutMs: options.pairingTimeoutMs,
     once: options.once,
     resume: true
@@ -13876,10 +13884,18 @@ async function runBridge(options) {
   let lastHeartbeatSentMs = 0;
   let lastError;
   await writeCurrentBridgeStatus("starting");
-  let token = options.token;
-  if (!token && options.requestToken) {
+  let token = options.token ?? await readStoredBridgeToken(options, rootId).catch(() => void 0);
+  if (!token && options.resume && !options.requestToken) {
+    const message = "Missing stored bridge token. Re-run mdocs bridge setup from a fresh Magic binding packet.";
+    lastError = message;
+    await writeCurrentBridgeStatus("error");
+    throw new Error(message);
+  }
+  if (!token && (options.claimToken || options.requestToken)) {
     try {
-      token = await requestBridgeToken(options, rootId);
+      const issued = await requestBridgeToken(options, rootId);
+      token = issued.token;
+      await writeStoredBridgeToken(options, rootId, issued).catch(() => void 0);
     } catch (error) {
       lastError = errorMessage(error);
       await writeCurrentBridgeStatus("error");
@@ -14371,46 +14387,34 @@ async function runBridge(options) {
   }
 }
 async function requestBridgeToken(options, rootId) {
-  const response = await fetch(new URL("/api/bridge-requests", options.baseUrl), {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({
-      workspaceId: options.workspaceId,
-      rootId,
-      actorId: options.actorId,
-      actorName: options.actorName,
-      folderId: options.folderId,
-      sourceName: options.sourceName,
-      role: "edit"
-    })
-  }).catch((error) => {
-    throw new Error(`Failed to create bridge approval request: ${error instanceof Error ? error.message : String(error)}`);
-  });
-  if (!response.ok) {
-    throw new Error(`Failed to create bridge approval request: ${response.status} ${await response.text()}`);
-  }
-  const created = await response.json();
-  if (!created.requestId || !created.pollToken || !created.approveUrl) {
-    throw new Error("Bridge approval request response was missing requestId, pollToken, or approveUrl.");
-  }
-  process.stdout.write(`mdocs bridge approval needed: ${created.approveUrl}
+  const created = options.claimToken ? await exchangeBridgeClaim(options) : await createBridgeApprovalRequest(options, rootId);
+  if (!created.requestId || !created.pollToken) {
+    throw new Error("Bridge token request response was missing requestId or pollToken.");
+  }
+  if (created.autoApproved) {
+    process.stdout.write("mdocs bridge claim accepted. Finishing bind...\n");
+  } else if (created.approveUrl) {
+    process.stdout.write(`mdocs bridge approval needed: ${created.approveUrl}
 `);
-  if (created.expiresAt) process.stdout.write(`Waiting for approval until ${created.expiresAt}.
+    if (created.expiresAt) process.stdout.write(`Waiting for approval until ${created.expiresAt}.
 `);
+  }
   const deadline = Date.now() + (options.pairingTimeoutMs ?? 1e3 * 60 * 15);
+  let firstPoll = true;
   while (Date.now() < deadline) {
-    await delay(2e3);
+    if (firstPoll) firstPoll = false;
+    else await delay(2e3);
     const pollResponse = await fetch(new URL(`/api/bridge-requests/${encodeURIComponent(created.requestId)}/token`, options.baseUrl), {
       headers: { Authorization: `Bearer ${created.pollToken}` }
     }).catch((error) => {
-      throw new Error(`Bridge approval polling failed: ${error instanceof Error ? error.message : String(error)}`);
+      throw new Error(`Bridge token polling failed: ${error instanceof Error ? error.message : String(error)}`);
     });
     const payload = await pollResponse.json().catch(() => ({}));
     if (pollResponse.status === 202) continue;
     if (pollResponse.ok && payload.token) {
-      process.stdout.write(`mdocs bridge approved${payload.expiresAt ? `; token expires ${payload.expiresAt}` : ""}.
+      process.stdout.write(`mdocs bridge token received${payload.expiresAt ? `; token expires ${payload.expiresAt}` : ""}.
 `);
-      return payload.token;
+      return { token: payload.token, expiresAt: payload.expiresAt };
     }
     if (pollResponse.status === 409 && payload.status === "rejected") {
       throw new Error("Bridge approval request was rejected.");
@@ -14418,9 +14422,43 @@ async function requestBridgeToken(options, rootId) {
     if (pollResponse.status === 410 || payload.status === "expired") {
       throw new Error("Bridge approval request expired before it was approved.");
     }
-    throw new Error(`Bridge approval polling failed with status ${pollResponse.status}.`);
+    throw new Error(`Bridge token polling failed with status ${pollResponse.status}.`);
+  }
+  throw new Error("Bridge token request timed out before a token was issued.");
+}
+async function exchangeBridgeClaim(options) {
+  const response = await fetch(new URL("/api/bridge-claims/exchange", options.baseUrl), {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ claimToken: options.claimToken })
+  }).catch((error) => {
+    throw new Error(`Failed to exchange bridge claim: ${error instanceof Error ? error.message : String(error)}`);
+  });
+  if (!response.ok) {
+    throw new Error(`Failed to exchange bridge claim: ${response.status} ${await response.text()}`);
+  }
+  return await response.json();
+}
+async function createBridgeApprovalRequest(options, rootId) {
+  const response = await fetch(new URL("/api/bridge-requests", options.baseUrl), {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      workspaceId: options.workspaceId,
+      rootId,
+      actorId: options.actorId,
+      actorName: options.actorName,
+      folderId: options.folderId,
+      sourceName: options.sourceName,
+      role: "edit"
+    })
+  }).catch((error) => {
+    throw new Error(`Failed to create bridge approval request: ${error instanceof Error ? error.message : String(error)}`);
+  });
+  if (!response.ok) {
+    throw new Error(`Failed to create bridge approval request: ${response.status} ${await response.text()}`);
   }
-  throw new Error("Bridge approval timed out before a token was issued.");
+  return await response.json();
 }
 async function readBridgeConfig(root) {
   const io = new NodeWorkspaceIO(root);
@@ -14446,6 +14484,49 @@ async function writeBridgeStatus(root, status) {
   await io.writeTextAtomic(BRIDGE_STATUS_PATH, `${JSON.stringify(status, null, 2)}
 `);
 }
+async function readStoredBridgeToken(options, rootId) {
+  const store = await readBridgeTokenStore();
+  const entry = store.tokens[bridgeTokenStoreKey(options, rootId)];
+  if (!entry?.token) return void 0;
+  if (entry.expiresAt && Date.parse(entry.expiresAt) <= Date.now() + 6e4) return void 0;
+  return entry.token;
+}
+async function writeStoredBridgeToken(options, rootId, issued) {
+  const store = await readBridgeTokenStore();
+  store.tokens[bridgeTokenStoreKey(options, rootId)] = {
+    token: issued.token,
+    expiresAt: issued.expiresAt,
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  await mkdir4(join4(homedir(), ".mdocs"), { recursive: true, mode: 448 });
+  await writeFile4(BRIDGE_TOKEN_STORE_PATH, `${JSON.stringify(store, null, 2)}
+`, "utf8");
+  await chmod(BRIDGE_TOKEN_STORE_PATH, 384);
+}
+async function readBridgeTokenStore() {
+  try {
+    const parsed = JSON.parse(await readFile6(BRIDGE_TOKEN_STORE_PATH, "utf8"));
+    if (parsed.schemaVersion === 1 && parsed.tokens && typeof parsed.tokens === "object") {
+      return { schemaVersion: 1, tokens: parsed.tokens };
+    }
+  } catch {
+  }
+  return { schemaVersion: 1, tokens: {} };
+}
+function bridgeTokenStoreKey(options, rootId) {
+  return createHash2("sha256").update(JSON.stringify([normalizeBridgeBaseUrl(options.baseUrl), options.workspaceId, rootId, options.actorId])).digest("hex").slice(0, 32);
+}
+function normalizeBridgeBaseUrl(baseUrl) {
+  try {
+    const url = new URL(baseUrl);
+    url.pathname = url.pathname.replace(/\/+$/, "");
+    url.search = "";
+    url.hash = "";
+    return url.toString();
+  } catch {
+    return baseUrl;
+  }
+}
 async function fetchCanonicalSnapshot(options, rootId) {
   const response = await fetch(new URL(`/api/workspaces/${encodeURIComponent(options.workspaceId)}/roots/${encodeURIComponent(rootId)}/sync`, options.baseUrl), {
     headers: authHeaders(options.token)
@@ -14664,9 +14745,9 @@ function readDocumentPayload(payload) {
 // src/bridge-startup.ts
 import { execFile as execFile2 } from "node:child_process";
 import { createHash as createHash3 } from "node:crypto";
-import { chmod, copyFile, mkdir as mkdir4, readFile as readFile6, stat as stat3, writeFile as writeFile4 } from "node:fs/promises";
-import { homedir, platform } from "node:os";
-import { dirname as dirname5, join as join4, resolve as resolve5 } from "node:path";
+import { chmod as chmod2, copyFile, mkdir as mkdir5, readFile as readFile7, stat as stat3, writeFile as writeFile5 } from "node:fs/promises";
+import { homedir as homedir2, platform } from "node:os";
+import { dirname as dirname5, join as join5, resolve as resolve5 } from "node:path";
 import { promisify as promisify2 } from "node:util";
 var execFileAsync2 = promisify2(execFile2);
 async function runBridgeStartup(options) {
@@ -14674,13 +14755,13 @@ async function runBridgeStartup(options) {
   await assertBridgeConfigured(root);
   const requestedMode = readBridgeStartupMode(options.mode);
   const mode = requestedMode === "auto" ? await autoBridgeStartupMode() : requestedMode;
-  const startupDir = join4(root, ".mdocs", "startup");
-  await mkdir4(startupDir, { recursive: true });
-  const runnerPath = join4(startupDir, "bridge-runner.sh");
+  const startupDir = join5(root, ".mdocs", "startup");
+  await mkdir5(startupDir, { recursive: true });
+  const runnerPath = join5(startupDir, "bridge-runner.sh");
   const runnerArgs = bridgeResumeArgs(root, options);
   const runnerScript = bridgeRunnerScript(root, runnerArgs);
-  await writeFile4(runnerPath, runnerScript, "utf8");
-  await chmod(runnerPath, 493);
+  await writeFile5(runnerPath, runnerScript, "utf8");
+  await chmod2(runnerPath, 493);
   const nativePlan = mode === "launchd" ? await writeLaunchdPlan(root, startupDir, runnerPath) : mode === "systemd" ? await writeSystemdPlan(root, startupDir, runnerPath) : void 0;
   if (options.install && !nativePlan) {
     throw new CliError("usage_error", "Shell startup mode does not have a native service to install.", {
@@ -14700,11 +14781,11 @@ async function runBridgeStartup(options) {
     installCommands: nativePlan?.installCommands ?? [],
     notes: [
       "Sandbox providers such as Daytona, Sprites, and Modal should run startupCommand from their on-start hook.",
-      "The runner stores no bridge token. If you use manual tokens, provide MDOCS_BRIDGE_TOKEN through the platform secret environment.",
-      "If no MDOCS_BRIDGE_TOKEN is present, the runner uses --request-token and logs a Magic approval URL."
+      "The runner stores no bridge token; it reuses the durable token saved by bridge setup in the local CLI profile.",
+      "If you move the root to a different machine or profile, run bridge setup from a fresh Magic binding packet again."
     ]
   };
-  await writeFile4(join4(startupDir, "bridge-startup.json"), `${JSON.stringify(result, null, 2)}
+  await writeFile5(join5(startupDir, "bridge-startup.json"), `${JSON.stringify(result, null, 2)}
 `, "utf8");
   return result;
 }
@@ -14731,7 +14812,7 @@ exec npx --yes --package=@magic-markdown/cli@latest mdocs ${shellCommand(args)}
 }
 function bridgeResumeArgs(root, options) {
   const args = ["bridge", "resume", "--root", root, "--forever"];
-  if (options.requestToken !== false) args.push("--request-token");
+  if (options.requestToken === true) args.push("--request-token");
   if (options.baseUrl) args.push("--url", options.baseUrl);
   if (options.intervalMs) args.push("--interval", String(options.intervalMs));
   return args;
@@ -14750,9 +14831,9 @@ async function autoBridgeStartupMode() {
   return "shell";
 }
 async function assertBridgeConfigured(root) {
-  const configPath = join4(root, ".mdocs", "bridge.json");
+  const configPath = join5(root, ".mdocs", "bridge.json");
   try {
-    const config2 = JSON.parse(await readFile6(configPath, "utf8"));
+    const config2 = JSON.parse(await readFile7(configPath, "utf8"));
     if (config2.schemaVersion !== 1) throw new Error("invalid schema");
   } catch {
     throw new CliError("usage_error", "This root does not have a bridge configuration yet.", {
@@ -14762,11 +14843,11 @@ async function assertBridgeConfigured(root) {
 }
 async function writeLaunchdPlan(root, startupDir, runnerPath) {
   const label = serviceLabel(root);
-  const servicePath = join4(startupDir, `${label}.plist`);
-  const installPath = join4(homedir(), "Library", "LaunchAgents", `${label}.plist`);
-  const outLog = join4(root, ".mdocs", "bridge.log");
-  const errLog = join4(root, ".mdocs", "bridge.err.log");
-  await writeFile4(servicePath, launchdPlist(label, root, runnerPath, outLog, errLog), "utf8");
+  const servicePath = join5(startupDir, `${label}.plist`);
+  const installPath = join5(homedir2(), "Library", "LaunchAgents", `${label}.plist`);
+  const outLog = join5(root, ".mdocs", "bridge.log");
+  const errLog = join5(root, ".mdocs", "bridge.err.log");
+  await writeFile5(servicePath, launchdPlist(label, root, runnerPath, outLog, errLog), "utf8");
   const target = `gui/$(id -u)`;
   return {
     servicePath,
@@ -14780,7 +14861,7 @@ async function writeLaunchdPlan(root, startupDir, runnerPath) {
       `launchctl kickstart -k ${target}/${label}`
     ],
     install: async () => {
-      await mkdir4(dirname5(installPath), { recursive: true });
+      await mkdir5(dirname5(installPath), { recursive: true });
       await copyFile(servicePath, installPath);
       const uid = typeof process.getuid === "function" ? process.getuid() : void 0;
       if (uid === void 0) return;
@@ -14794,9 +14875,9 @@ async function writeLaunchdPlan(root, startupDir, runnerPath) {
 }
 async function writeSystemdPlan(root, startupDir, runnerPath) {
   const unitName = `${serviceLabel(root)}.service`;
-  const servicePath = join4(startupDir, unitName);
-  const installPath = join4(homedir(), ".config", "systemd", "user", unitName);
-  await writeFile4(servicePath, systemdUnit(unitName, root, runnerPath), "utf8");
+  const servicePath = join5(startupDir, unitName);
+  const installPath = join5(homedir2(), ".config", "systemd", "user", unitName);
+  await writeFile5(servicePath, systemdUnit(unitName, root, runnerPath), "utf8");
   return {
     servicePath,
     installPath,
@@ -14807,7 +14888,7 @@ async function writeSystemdPlan(root, startupDir, runnerPath) {
       shellCommand(["systemctl", "--user", "enable", "--now", unitName])
     ],
     install: async () => {
-      await mkdir4(dirname5(installPath), { recursive: true });
+      await mkdir5(dirname5(installPath), { recursive: true });
       await copyFile(servicePath, installPath);
       await runCommand("systemctl", ["--user", "daemon-reload"]);
       await runCommand("systemctl", ["--user", "enable", "--now", unitName]);
@@ -15080,7 +15161,7 @@ async function main() {
           root,
           mode: typeof parsed.flags.mode === "string" ? parsed.flags.mode : void 0,
           install: Boolean(parsed.flags.install),
-          requestToken: !parsed.flags["no-request-token"],
+          requestToken: Boolean(parsed.flags["request-token"] || parsed.flags.pair),
           baseUrl: optionalBridgeBaseUrl(parsed.flags),
           intervalMs: typeof parsed.flags.interval === "string" ? Number(parsed.flags.interval) : void 0
         });
@@ -15225,7 +15306,7 @@ async function readRequiredTextFlag2(flags, cwd, names) {
 async function readOptionalTextFlag2(flags, cwd, names) {
   for (const name of names) {
     const fileValue = flags[`${name}-file`];
-    if (typeof fileValue === "string") return readFile7(resolve6(cwd, fileValue), "utf8");
+    if (typeof fileValue === "string") return readFile8(resolve6(cwd, fileValue), "utf8");
     const value = flags[name];
     if (typeof value === "string") return value;
   }
@@ -15295,18 +15376,18 @@ Commands:
   remote events|history|restore       Poll events, list commits, restore snapshots
   remote library|create-folder|update-folder|move-root|invite-folder
                                       Organize the joined project library
-  bridge setup --workspace <id> --root . --url <base-url> [--folder-id <id>] --request-token
-                                      Initialize, validate, request approval,
+  bridge setup --workspace <id> --root . --url <base-url> [--folder-id <id>] --claim <claim-token>
+                                      Initialize, validate, claim,
                                       and start an agent filesystem bridge
-  bridge resume --root . --forever --request-token [--once]
+  bridge resume --root . --forever [--once]
                                       Backfill missed Magic changes, then keep
                                       the bridge running unless --once is set
   bridge startup|daemon --root . [--mode auto|shell|launchd|systemd] [--install]
                                       Write a bridge runner and startup hook
                                       for sandboxes, launchd, or systemd
-  bridge --workspace <id> --root . --url <base-url> --request-token
-                                      Request human approval, then sync an
-                                      approved local root with the workspace
+  bridge --workspace <id> --root . --url <base-url> --claim <claim-token>
+                                      Claim, then sync an approved local root
+                                      with the workspace
   bridge --workspace <id> --root . --url <base-url> --token <bridge-token>
                                       Sync an approved local root with the workspace
                                       (or set MDOCS_BRIDGE_TOKEN)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@magic-markdown/cli",
-  "version": "0.3.18",
+  "version": "0.3.20",
   "description": "Magic Markdown agent CLI (mdocs): read, review, comment on, suggest edits to, and sync clean Markdown workspaces.",
   "type": "module",
   "license": "MIT",