@moxt-ai/mobius 0.0.13 → 0.0.14

package/dist/cli.js

@@ -2732,469 +2732,6 @@ var AuditStore = class {
 
 // src/config.ts
 import { join as join12 } from "node:path";
-function loadDefaultWorkspace() {
-  const { MOBIUS_DEFAULT_WORKSPACE: configuredWorkspace } = process.env;
-  return configuredWorkspace ?? join12(readStateDirectory(), "workspace");
-}
-function createDaemonConfig(connection, agents = [], installableAgents = []) {
-  return {
-    agents,
-    defaultWorkspace: connection.defaultWorkspace,
-    auditDatabasePath: connection.auditDatabasePath,
-    bindingId: "workspace",
-    catalog: new LocalAgentCatalog(agents, installableAgents),
-    channelId: connection.channelId,
-    installableAgents,
-    relayUrl: connection.relayUrl
-  };
-}
-
-// src/pairing/pair-local-machine.ts
-import { randomUUID } from "node:crypto";
-import {
-  mkdir as mkdir3,
-  open as open5,
-  realpath as realpath5,
-  rename as rename3,
-  stat as stat5,
-  writeFile as writeFile2
-} from "node:fs/promises";
-import { hostname } from "node:os";
-import { basename, join as join13, resolve as resolve3 } from "node:path";
-import { fetch as fetch2 } from "undici";
-var PAIRING_TIMEOUT_MILLISECONDS = 2e4;
-var PAIRING_CODE_PATTERN = /^[A-HJ-NP-Z2-9]{4}(?:-[A-HJ-NP-Z2-9]{4}){4}$/;
-var IDENTIFIER_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/;
-var TOKEN_PATTERN = /^[a-zA-Z0-9_-]{32,256}$/;
-var MAX_CONNECTION_FILE_LENGTH = 16 * 1024;
-var CLAIM_RESPONSE_KEYS = [
-  "channelId",
-  "daemonToken",
-  "runtimeId"
-];
-var SAVED_CONNECTION_KEYS = [
-  "defaultWorkspace",
-  "channelId",
-  "daemonToken",
-  "relayOrigin"
-];
-var PairingClientError = class extends Error {
-  code;
-  constructor(code, message, options = {}) {
-    super(message, options);
-    this.code = code;
-    this.name = "PairingClientError";
-  }
-};
-function isRecord4(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function hasExactKeys(value, expectedKeys) {
-  const keys = Object.keys(value);
-  return keys.length === expectedKeys.length && expectedKeys.every((key) => Object.hasOwn(value, key));
-}
-function readSingleOption(arguments_, option) {
-  const values = [];
-  for (let index = 0; index < arguments_.length; index += 1) {
-    if (arguments_[index] !== option) {
-      continue;
-    }
-    const value = arguments_[index + 1];
-    if (value === void 0 || value.startsWith("--")) {
-      throw new PairingClientError(
-        "invalid_arguments",
-        `${option} requires a value`
-      );
-    }
-    values.push(value);
-    index += 1;
-  }
-  if (values.length !== 1) {
-    throw new PairingClientError(
-      "invalid_arguments",
-      `${option} must be provided exactly once`
-    );
-  }
-  return values[0] ?? "";
-}
-function assertKnownArguments(arguments_) {
-  for (let index = 0; index < arguments_.length; index += 2) {
-    const option = arguments_[index];
-    if (option !== "--url" && option !== "--code" && option !== "--workspace") {
-      throw new PairingClientError(
-        "invalid_arguments",
-        `Unknown pairing option: ${option ?? "missing option"}`
-      );
-    }
-  }
-}
-function parseRelayOrigin(value) {
-  let url2;
-  try {
-    url2 = new URL(value);
-  } catch (error61) {
-    throw new PairingClientError(
-      "invalid_relay_url",
-      "The relay URL is invalid",
-      { cause: error61 }
-    );
-  }
-  if (url2.protocol !== "https:" && url2.protocol !== "http:") {
-    throw new PairingClientError(
-      "invalid_relay_url",
-      "The relay URL must use http or https"
-    );
-  }
-  if (url2.username.length > 0 || url2.password.length > 0) {
-    throw new PairingClientError(
-      "invalid_relay_url",
-      "The relay URL cannot contain credentials"
-    );
-  }
-  if (url2.protocol === "http:" && url2.hostname !== "127.0.0.1" && url2.hostname !== "localhost") {
-    throw new PairingClientError(
-      "invalid_relay_url",
-      "A remote relay must use https"
-    );
-  }
-  url2.hash = "";
-  url2.pathname = "/";
-  url2.search = "";
-  return url2;
-}
-function parsePairingCode(value) {
-  const code = value.trim().toUpperCase();
-  if (!PAIRING_CODE_PATTERN.test(code)) {
-    throw new PairingClientError(
-      "invalid_pairing_code",
-      "The pairing code must match the code shown in the browser"
-    );
-  }
-  return code;
-}
-function parsePairCommand(arguments_) {
-  assertKnownArguments(arguments_);
-  return {
-    code: parsePairingCode(readSingleOption(arguments_, "--code")),
-    relayOrigin: parseRelayOrigin(readSingleOption(arguments_, "--url")),
-    workspace: arguments_.includes("--workspace") ? readSingleOption(arguments_, "--workspace") : loadDefaultWorkspace()
-  };
-}
-function parseChannelArgument(arguments_) {
-  if (arguments_.length !== 2 || arguments_[0] !== "--channel") {
-    throw new PairingClientError(
-      "invalid_arguments",
-      "Usage: mobius start --channel <channel-id>"
-    );
-  }
-  const channelId = arguments_[1] ?? "";
-  if (!IDENTIFIER_PATTERN.test(channelId)) {
-    throw new PairingClientError(
-      "invalid_channel_id",
-      "The saved channel ID is invalid"
-    );
-  }
-  return channelId;
-}
-async function resolveDefaultWorkspace(path2) {
-  const requestedWorkspace = resolve3(path2);
-  try {
-    await mkdir3(requestedWorkspace, { recursive: true, mode: 448 });
-    const defaultWorkspace = await realpath5(requestedWorkspace);
-    const metadata = await stat5(defaultWorkspace);
-    if (!metadata.isDirectory()) {
-      throw new PairingClientError(
-        "invalid_workspace",
-        "The default workspace is not a directory"
-      );
-    }
-    return defaultWorkspace;
-  } catch (error61) {
-    if (error61 instanceof PairingClientError) {
-      throw error61;
-    }
-    throw new PairingClientError(
-      "invalid_workspace",
-      "The default workspace cannot be resolved",
-      { cause: error61 }
-    );
-  }
-}
-async function readJsonResponse(response) {
-  if (response.headers.get("cf-mitigated") === "challenge") {
-    throw new PairingClientError(
-      "relay_challenge",
-      "Cloudflare is protecting this temporary preview. Claim the deployment or use an authenticated deployment, then pair again"
-    );
-  }
-  const encoded = await response.text();
-  try {
-    return JSON.parse(encoded);
-  } catch (error61) {
-    throw new PairingClientError(
-      "invalid_relay_response",
-      "The relay returned an invalid response",
-      { cause: error61 }
-    );
-  }
-}
-function readRelayError(value) {
-  if (isRecord4(value)) {
-    const error61 = value["error"];
-    if (isRecord4(error61)) {
-      const code = error61["code"];
-      const message = error61["message"];
-      if (typeof code === "string" && typeof message === "string") {
-        return new PairingClientError(code, message);
-      }
-    }
-  }
-  return new PairingClientError(
-    "pairing_failed",
-    "The relay could not pair this machine"
-  );
-}
-function decodeClaimResponse(value) {
-  if (!isRecord4(value) || !hasExactKeys(value, CLAIM_RESPONSE_KEYS)) {
-    throw new PairingClientError(
-      "invalid_relay_response",
-      "The relay returned an invalid pairing response"
-    );
-  }
-  const channelId = value["channelId"];
-  const daemonToken = value["daemonToken"];
-  const runtimeId = value["runtimeId"];
-  if (typeof channelId !== "string" || !IDENTIFIER_PATTERN.test(channelId) || typeof daemonToken !== "string" || !TOKEN_PATTERN.test(daemonToken) || typeof runtimeId !== "string" || !IDENTIFIER_PATTERN.test(runtimeId)) {
-    throw new PairingClientError(
-      "invalid_relay_response",
-      "The relay returned an invalid pairing response"
-    );
-  }
-  return { channelId, daemonToken, runtimeId };
-}
-async function claimPairing(options, defaultWorkspace, localAgents, installableAgents, signal) {
-  const agents = localAgents.map((agent) => ({
-    id: agent.id,
-    label: agent.label
-  }));
-  const endpoint = new URL("/mobius/api/pairings/claim", options.relayOrigin);
-  let response;
-  try {
-    response = await fetch2(endpoint, {
-      body: JSON.stringify({
-        agents,
-        installableAgents: installableAgents.map((agent) => ({
-          id: agent.id,
-          label: agent.label,
-          requiresLocalApproval: agent.requiresLocalApproval
-        })),
-        machineName: hostname(),
-        pairingCode: options.code,
-        workspaceName: basename(defaultWorkspace) || "Local workspace"
-      }),
-      dispatcher: environmentProxyDispatcher,
-      headers: { "content-type": "application/json" },
-      method: "POST",
-      signal: AbortSignal.any([
-        signal,
-        AbortSignal.timeout(PAIRING_TIMEOUT_MILLISECONDS)
-      ])
-    });
-  } catch (error61) {
-    throw new PairingClientError(
-      "relay_unavailable",
-      "The pairing relay could not be reached",
-      { cause: error61 }
-    );
-  }
-  const value = await readJsonResponse(response);
-  if (!response.ok) {
-    throw readRelayError(value);
-  }
-  return decodeClaimResponse(value);
-}
-async function persistConnection(channelId, relayOrigin, daemonToken, defaultWorkspace) {
-  const connectionsDirectory = join13(readStateDirectory(), "connections");
-  await mkdir3(connectionsDirectory, { mode: 448, recursive: true });
-  const connectionPath = join13(connectionsDirectory, `${channelId}.json`);
-  const temporaryPath = join13(
-    connectionsDirectory,
-    `.${channelId}.${randomUUID()}.tmp`
-  );
-  await writeFile2(
-    temporaryPath,
-    `${JSON.stringify(
-      {
-        defaultWorkspace,
-        channelId,
-        daemonToken,
-        relayOrigin: relayOrigin.toString()
-      },
-      null,
-      2
-    )}
-`,
-    { flag: "wx", mode: 384 }
-  );
-  await rename3(temporaryPath, connectionPath);
-  return connectionPath;
-}
-function decodeSavedConnection(value, expectedChannelId) {
-  if (!isRecord4(value) || !hasExactKeys(value, SAVED_CONNECTION_KEYS)) {
-    throw new PairingClientError(
-      "invalid_connection",
-      "The saved connection is invalid"
-    );
-  }
-  const defaultWorkspace = value["defaultWorkspace"];
-  const channelId = value["channelId"];
-  const daemonToken = value["daemonToken"];
-  const relayOrigin = value["relayOrigin"];
-  if (typeof defaultWorkspace !== "string" || typeof channelId !== "string" || channelId !== expectedChannelId || !IDENTIFIER_PATTERN.test(channelId) || typeof daemonToken !== "string" || !TOKEN_PATTERN.test(daemonToken) || typeof relayOrigin !== "string") {
-    throw new PairingClientError(
-      "invalid_connection",
-      "The saved connection is invalid"
-    );
-  }
-  return {
-    defaultWorkspace,
-    channelId,
-    daemonToken,
-    relayOrigin: parseRelayOrigin(relayOrigin)
-  };
-}
-async function readSavedConnection(channelId) {
-  const connectionPath = join13(
-    readStateDirectory(),
-    "connections",
-    `${channelId}.json`
-  );
-  let encoded = "";
-  const handle = await open5(connectionPath, "r");
-  try {
-    const metadata = await handle.stat();
-    if (!metadata.isFile() || metadata.size > MAX_CONNECTION_FILE_LENGTH) {
-      throw new PairingClientError(
-        "invalid_connection",
-        "The saved connection is invalid"
-      );
-    }
-    encoded = await handle.readFile({ encoding: "utf8" });
-  } finally {
-    await handle.close();
-  }
-  let value;
-  try {
-    value = JSON.parse(encoded);
-  } catch (error61) {
-    throw new PairingClientError(
-      "invalid_connection",
-      "The saved connection is invalid",
-      { cause: error61 }
-    );
-  }
-  const connection = decodeSavedConnection(value, channelId);
-  return {
-    defaultWorkspace: await resolveDefaultWorkspace(
-      connection.defaultWorkspace
-    ),
-    channelId: connection.channelId,
-    daemonToken: connection.daemonToken,
-    relayOrigin: connection.relayOrigin
-  };
-}
-function assertInventoryUsable(inventory) {
-  if (inventory.available.length + inventory.installable.length === 0) {
-    throw new PairingClientError(
-      "no_supported_agent",
-      "No supported Agent is ready or safely installable on this machine"
-    );
-  }
-}
-function buildPairedDaemon(connection, connectionPath, inventory) {
-  assertInventoryUsable(inventory);
-  const relayUrl = new URL(
-    `/mobius/api/channels/${encodeURIComponent(connection.channelId)}/daemon`,
-    connection.relayOrigin
-  );
-  relayUrl.protocol = relayUrl.protocol === "https:" ? "wss:" : "ws:";
-  relayUrl.searchParams.set("token", connection.daemonToken);
-  const auditDatabasePath = join13(
-    readStateDirectory(),
-    "audit",
-    `${connection.channelId}.sqlite`
-  );
-  return {
-    channelUrl: new URL(
-      `/channels/${encodeURIComponent(connection.channelId)}`,
-      connection.relayOrigin
-    ).toString(),
-    config: createDaemonConfig(
-      {
-        defaultWorkspace: connection.defaultWorkspace,
-        auditDatabasePath,
-        channelId: connection.channelId,
-        relayUrl
-      },
-      inventory.readyAgents(),
-      inventory.installable
-    ),
-    connectionPath
-  };
-}
-async function pairLocalMachine(arguments_, signal = new AbortController().signal) {
-  const options = parsePairCommand(arguments_);
-  const defaultWorkspace = await resolveDefaultWorkspace(options.workspace);
-  const inventory = await discoverLocalAgentInventory({
-    defaultWorkspace,
-    environment: process.env,
-    signal
-  });
-  assertInventoryUsable(inventory);
-  const agents = inventory.readyAgents();
-  const claim2 = await claimPairing(
-    options,
-    defaultWorkspace,
-    agents,
-    inventory.installable,
-    signal
-  );
-  const connectionPath = await persistConnection(
-    claim2.channelId,
-    options.relayOrigin,
-    claim2.daemonToken,
-    defaultWorkspace
-  );
-  return buildPairedDaemon(
-    {
-      defaultWorkspace,
-      channelId: claim2.channelId,
-      daemonToken: claim2.daemonToken,
-      relayOrigin: options.relayOrigin
-    },
-    connectionPath,
-    inventory
-  );
-}
-async function resumeLocalMachine(arguments_, signal = new AbortController().signal) {
-  const channelId = parseChannelArgument(arguments_);
-  const connectionPath = join13(
-    readStateDirectory(),
-    "connections",
-    `${channelId}.json`
-  );
-  const connection = await readSavedConnection(channelId);
-  const inventory = await discoverLocalAgentInventory({
-    defaultWorkspace: connection.defaultWorkspace,
-    environment: process.env,
-    signal
-  });
-  return buildPairedDaemon(connection, connectionPath, inventory);
-}
-
-// src/run-daemon.ts
-import { basename as basename3 } from "node:path";
-import { styleText } from "node:util";
 
 // ../../node_modules/.pnpm/zod@4.5.4/node_modules/zod/v4/classic/external.js
 var external_exports = {};
@@ -3336,7 +2873,7 @@ __export(external_exports, {
   guid: () => guid2,
   hash: () => hash,
   hex: () => hex2,
-  hostname: () => hostname3,
+  hostname: () => hostname2,
   httpUrl: () => httpUrl,
   includes: () => _includes,
   input: () => input,
@@ -5082,7 +4619,7 @@ __export(regexes_exports, {
   extendedDuration: () => extendedDuration,
   guid: () => guid,
   hex: () => hex,
-  hostname: () => hostname2,
+  hostname: () => hostname,
   html5Email: () => html5Email,
   httpProtocol: () => httpProtocol,
   idnEmail: () => idnEmail,
@@ -5164,7 +4701,7 @@ var cidrv4 = /^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(25[0-5]
 var cidrv6 = /^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))\/(12[0-8]|1[01][0-9]|[1-9]?[0-9])$/;
 var base64 = /^$|^(?:[0-9a-zA-Z+/]{4})*(?:(?:[0-9a-zA-Z+/]{2}==)|(?:[0-9a-zA-Z+/]{3}=))?$/;
 var base64url = /^[A-Za-z0-9_-]*$/;
-var hostname2 = /^(?=.{1,253}\.?$)[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[-0-9a-zA-Z]{0,61}[0-9a-zA-Z])?)*\.?$/;
+var hostname = /^(?=.{1,253}\.?$)[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[-0-9a-zA-Z]{0,61}[0-9a-zA-Z])?)*\.?$/;
 var domain = /^(?=.{1,253}$)([a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,63}$/;
 var httpProtocol = /^https?$/;
 var e164 = /^\+[1-9]\d{6,14}$/;
@@ -8214,7 +7751,7 @@ function bucketFor(state, inst) {
   return bucket;
 }
 var handoff;
-var open6 = [];
+var open5 = [];
 var memo = {
   alloc(_inst, payload, empty) {
     const bucket = handoff;
@@ -8223,7 +7760,7 @@ var memo = {
     handoff = void 0;
     const entry = { value: empty, issues: null };
     bucket.set(payload.value, entry);
-    open6.push(entry);
+    open5.push(entry);
     return empty;
   },
   guard(inst) {
@@ -8289,10 +7826,10 @@ var memo = {
           return payload;
         }
         handoff = bucket;
-        const depth = open6.length;
+        const depth = open5.length;
         const result = base(payload, ctx);
         handoff = void 0;
-        const entry = open6.length > depth ? open6.pop() : void 0;
+        const entry = open5.length > depth ? open5.pop() : void 0;
         if (result instanceof Promise) {
           return result.then((r) => {
             if (entry)
@@ -19676,7 +19213,7 @@ __export(schemas_exports2, {
   guid: () => guid2,
   hash: () => hash,
   hex: () => hex2,
-  hostname: () => hostname3,
+  hostname: () => hostname2,
   httpUrl: () => httpUrl,
   instanceof: () => _instanceof,
   int: () => int,
@@ -20347,7 +19884,7 @@ var ZodCustomStringFormat = /* @__PURE__ */ $constructor("ZodCustomStringFormat"
 function stringFormat(format, fnOrRegex, _params = {}) {
   return _stringFormat(ZodCustomStringFormat, format, fnOrRegex, _params);
 }
-function hostname3(_params) {
+function hostname2(_params) {
   return _stringFormat(ZodCustomStringFormat, "hostname", regexes_exports.hostname, _params);
 }
 function hex2(_params) {
@@ -22138,9 +21675,9 @@ var AGENT_INSTALL_PROGRESS_KIND = "agent.install.progress";
 var AGENT_INSTALL_COMPLETED_KIND = "agent.install.completed";
 var AGENT_INSTALL_FAILED_KIND = "agent.install.failed";
 var AGENT_INSTALL_CANCELLED_KIND = "agent.install.cancelled";
-var IDENTIFIER_PATTERN2 = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/;
+var IDENTIFIER_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/;
 var DIRECTORY_IDENTIFIER_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,2047}$/;
-var IDENTIFIER = external_exports.string().min(1).max(128).regex(IDENTIFIER_PATTERN2);
+var IDENTIFIER = external_exports.string().min(1).max(128).regex(IDENTIFIER_PATTERN);
 var DIRECTORY_IDENTIFIER = external_exports.string().min(1).max(2048).regex(DIRECTORY_IDENTIFIER_PATTERN);
 var SHORT_TEXT = external_exports.string().max(500);
 var LONG_TEXT = external_exports.string().max(1e5);
@@ -22549,7 +22086,7 @@ var SESSION_COMPLETED_KIND = "session.completed";
 var SESSION_FAILED_KIND = "session.failed";
 
 // ../protocol/src/codecs/messages.ts
-var IDENTIFIER_PATTERN3 = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/;
+var IDENTIFIER_PATTERN2 = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/;
 var DIRECTORY_IDENTIFIER_PATTERN2 = /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,2047}$/;
 var MAX_PROMPT_LENGTH = 1e4;
 var MAX_PROMPT_ATTACHMENT_LENGTH = 6e6;
@@ -22581,7 +22118,7 @@ var ProtocolMessageError = class extends Error {
     this.name = "ProtocolMessageError";
   }
 };
-function isRecord5(value) {
+function isRecord4(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function parseJson2(encoded) {
@@ -22593,7 +22130,7 @@ function parseJson2(encoded) {
       cause: error61
     });
   }
-  if (!isRecord5(value)) {
+  if (!isRecord4(value)) {
     throw new ProtocolMessageError("Message must be a JSON object");
   }
   return value;
@@ -22677,7 +22214,7 @@ function readActivityContent(value) {
 }
 function readActivityDetail(value) {
   const field = value["detail"];
-  if (!isRecord5(field)) {
+  if (!isRecord4(field)) {
     throw new ProtocolMessageError("Invalid activity detail field");
   }
   const kind = readString(field, "kind", 32);
@@ -22724,7 +22261,7 @@ function readActivityDetail(value) {
 }
 function readIdentifier(value, key) {
   const field = readString(value, key, 128);
-  if (!IDENTIFIER_PATTERN3.test(field)) {
+  if (!IDENTIFIER_PATTERN2.test(field)) {
     throw new ProtocolMessageError(`Invalid identifier field: ${key}`);
   }
   return field;
@@ -22924,6 +22461,29 @@ function encodeSessionFailedEvent(message) {
   return JSON.stringify(decodeSessionFailedEvent(JSON.stringify(message)));
 }
 
+// ../protocol/src/mobius-api.ts
+var MOBIUS_API_PREFIX = "/mobius/api";
+var API_PREFIX_PATTERN = /^\/[a-zA-Z0-9._~-]+(?:\/[a-zA-Z0-9._~-]+)*$/;
+var MobiusApiConfigurationError = class extends Error {
+  code = "invalid_api_prefix";
+  constructor() {
+    super("The Mobius API prefix must be an absolute path without parameters");
+    this.name = "MobiusApiConfigurationError";
+  }
+};
+function parseMobiusApiPrefix(value) {
+  if (typeof value !== "string" || !API_PREFIX_PATTERN.test(value)) {
+    throw new MobiusApiConfigurationError();
+  }
+  return value;
+}
+function mobiusApiPath(resourcePath, apiPrefix = MOBIUS_API_PREFIX) {
+  return `${parseMobiusApiPrefix(apiPrefix)}${resourcePath}`;
+}
+function mobiusApiUrl(origin, resourcePath, apiPrefix = MOBIUS_API_PREFIX) {
+  return new URL(mobiusApiPath(resourcePath, apiPrefix), origin);
+}
+
 // ../protocol/src/session-history.ts
 var SESSION_HISTORY_CHARACTER_LIMIT = 256e3;
 var SESSION_HISTORY_MESSAGE_LIMIT = 1e3;
@@ -23083,10 +22643,10 @@ var encodeNativeSessionResult = (value) => JSON.stringify(nativeSessionResultSch
 var decodeNativeSessionCancel = (encoded) => decode4(nativeSessionCancelSchema, encoded);
 
 // ../protocol/src/resource-model.ts
-var IDENTIFIER_PATTERN4 = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/;
+var IDENTIFIER_PATTERN3 = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/;
 var DECIMAL_SEQUENCE_PATTERN = /^(?:0|[1-9][0-9]*)$/;
 var SHA256_PATTERN = /^[a-f0-9]{64}$/;
-var identifierSchema = external_exports.string().min(1).max(128).regex(IDENTIFIER_PATTERN4);
+var identifierSchema = external_exports.string().min(1).max(128).regex(IDENTIFIER_PATTERN3);
 var timestampSchema = external_exports.string().datetime({ offset: true });
 var decimalSequenceSchema = external_exports.string().min(1).max(40).regex(DECIMAL_SEQUENCE_PATTERN);
 var digestSchema = external_exports.string().length(64).regex(SHA256_PATTERN);
@@ -23572,13 +23132,13 @@ var commandReceiptSchema = external_exports.strictObject({
 var SESSION_EVENT_KIND = "session.event";
 var SESSION_EVENT_ACK_KIND = "session.event.ack";
 var SESSION_EVENT_COMMITTED_KIND = "session.event.committed";
-var IDENTIFIER_PATTERN5 = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/;
+var IDENTIFIER_PATTERN4 = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/;
 var CURSOR_PATTERN = /^[A-Za-z0-9_-]{1,512}$/;
 var MAX_RECORDED_EVENT_LENGTH = 8 * 1024 * 1024;
 var DECIMAL_SEQUENCE_PATTERN2 = /^(?:0|[1-9][0-9]*)$/;
 var eventSourceSchema = external_exports.discriminatedUnion("kind", [
   external_exports.strictObject({
-    attemptId: external_exports.string().min(1).max(128).regex(IDENTIFIER_PATTERN5),
+    attemptId: external_exports.string().min(1).max(128).regex(IDENTIFIER_PATTERN4),
     kind: external_exports.literal("attempt"),
     sourceSeq: external_exports.string().min(1).max(40).regex(DECIMAL_SEQUENCE_PATTERN2)
   }).readonly(),
@@ -23588,58 +23148,521 @@ var eventSourceSchema = external_exports.discriminatedUnion("kind", [
   }).readonly()
 ]);
 var eventEnvelopeSchema = external_exports.strictObject({
-  eventId: external_exports.string().min(1).max(128).regex(IDENTIFIER_PATTERN5),
+  eventId: external_exports.string().min(1).max(128).regex(IDENTIFIER_PATTERN4),
   kind: external_exports.literal(SESSION_EVENT_KIND),
   payload: external_exports.string().min(2).max(MAX_RECORDED_EVENT_LENGTH),
-  sessionId: external_exports.string().min(1).max(128).regex(IDENTIFIER_PATTERN5),
+  sessionId: external_exports.string().min(1).max(128).regex(IDENTIFIER_PATTERN4),
   source: eventSourceSchema
 }).readonly();
 var committedEventSchema = external_exports.strictObject({
   cursor: external_exports.string().min(1).max(512).regex(CURSOR_PATTERN),
-  eventId: external_exports.string().min(1).max(128).regex(IDENTIFIER_PATTERN5),
+  eventId: external_exports.string().min(1).max(128).regex(IDENTIFIER_PATTERN4),
   kind: external_exports.literal(SESSION_EVENT_COMMITTED_KIND),
   payload: external_exports.string().min(2).max(MAX_RECORDED_EVENT_LENGTH),
   recordedAt: external_exports.string().datetime({ offset: true }),
   sequence: external_exports.string().min(1).max(40).regex(DECIMAL_SEQUENCE_PATTERN2),
-  sessionId: external_exports.string().min(1).max(128).regex(IDENTIFIER_PATTERN5),
+  sessionId: external_exports.string().min(1).max(128).regex(IDENTIFIER_PATTERN4),
   source: eventSourceSchema
 }).readonly();
 var eventAcknowledgementSchema = external_exports.strictObject({
   cursor: external_exports.string().min(1).max(512).regex(CURSOR_PATTERN),
   duplicate: external_exports.boolean(),
-  eventId: external_exports.string().min(1).max(128).regex(IDENTIFIER_PATTERN5),
+  eventId: external_exports.string().min(1).max(128).regex(IDENTIFIER_PATTERN4),
   kind: external_exports.literal(SESSION_EVENT_ACK_KIND),
   sequence: external_exports.string().min(1).max(40).regex(DECIMAL_SEQUENCE_PATTERN2),
-  sessionId: external_exports.string().min(1).max(128).regex(IDENTIFIER_PATTERN5)
+  sessionId: external_exports.string().min(1).max(128).regex(IDENTIFIER_PATTERN4)
 }).readonly();
 function decode5(encoded, schema) {
   let value;
   try {
     value = JSON.parse(encoded);
-  } catch (cause) {
-    throw new ProtocolMessageError("Message is not valid JSON", { cause });
-  }
-  const decoded = schema.safeParse(value);
-  if (!decoded.success) {
-    throw new ProtocolMessageError("Message does not match its schema", {
-      cause: decoded.error
-    });
+  } catch (cause) {
+    throw new ProtocolMessageError("Message is not valid JSON", { cause });
+  }
+  const decoded = schema.safeParse(value);
+  if (!decoded.success) {
+    throw new ProtocolMessageError("Message does not match its schema", {
+      cause: decoded.error
+    });
+  }
+  return decoded.data;
+}
+var encode4 = (message, schema) => {
+  const decoded = schema.safeParse(message);
+  if (!decoded.success) {
+    throw new ProtocolMessageError("Message does not match its schema", {
+      cause: decoded.error
+    });
+  }
+  return JSON.stringify(decoded.data);
+};
+var encodeSessionEventEnvelope = (message) => encode4(message, eventEnvelopeSchema);
+var decodeSessionEventAcknowledgement = (encoded) => decode5(encoded, eventAcknowledgementSchema);
+
+// src/config.ts
+function loadDefaultWorkspace() {
+  const { MOBIUS_DEFAULT_WORKSPACE: configuredWorkspace } = process.env;
+  return configuredWorkspace ?? join12(readStateDirectory(), "workspace");
+}
+function createDaemonConfig(connection, agents = [], installableAgents = []) {
+  return {
+    agents,
+    defaultWorkspace: connection.defaultWorkspace,
+    auditDatabasePath: connection.auditDatabasePath,
+    bindingId: "workspace",
+    catalog: new LocalAgentCatalog(agents, installableAgents),
+    channelId: connection.channelId,
+    installableAgents,
+    relayUrl: connection.relayUrl
+  };
+}
+
+// src/pairing/pair-local-machine.ts
+import { randomUUID } from "node:crypto";
+import {
+  mkdir as mkdir3,
+  open as open6,
+  realpath as realpath5,
+  rename as rename3,
+  stat as stat5,
+  writeFile as writeFile2
+} from "node:fs/promises";
+import { hostname as hostname3 } from "node:os";
+import { basename, join as join13, resolve as resolve3 } from "node:path";
+import { fetch as fetch2 } from "undici";
+var PAIRING_TIMEOUT_MILLISECONDS = 2e4;
+var PAIRING_CODE_PATTERN = /^[A-HJ-NP-Z2-9]{4}(?:-[A-HJ-NP-Z2-9]{4}){4}$/;
+var IDENTIFIER_PATTERN5 = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/;
+var TOKEN_PATTERN = /^[a-zA-Z0-9_-]{32,256}$/;
+var MAX_CONNECTION_FILE_LENGTH = 16 * 1024;
+var CLAIM_RESPONSE_KEYS = [
+  "channelId",
+  "daemonToken",
+  "runtimeId"
+];
+var SAVED_CONNECTION_KEYS = [
+  "defaultWorkspace",
+  "channelId",
+  "daemonToken",
+  "relayOrigin"
+];
+var PairingClientError = class extends Error {
+  code;
+  constructor(code, message, options = {}) {
+    super(message, options);
+    this.code = code;
+    this.name = "PairingClientError";
+  }
+};
+function isRecord5(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function hasExactKeys(value, expectedKeys) {
+  const keys = Object.keys(value);
+  return keys.length === expectedKeys.length && expectedKeys.every((key) => Object.hasOwn(value, key));
+}
+function readSingleOption(arguments_, option) {
+  const values = [];
+  for (let index = 0; index < arguments_.length; index += 1) {
+    if (arguments_[index] !== option) {
+      continue;
+    }
+    const value = arguments_[index + 1];
+    if (value === void 0 || value.startsWith("--")) {
+      throw new PairingClientError(
+        "invalid_arguments",
+        `${option} requires a value`
+      );
+    }
+    values.push(value);
+    index += 1;
+  }
+  if (values.length !== 1) {
+    throw new PairingClientError(
+      "invalid_arguments",
+      `${option} must be provided exactly once`
+    );
+  }
+  return values[0] ?? "";
+}
+function assertKnownArguments(arguments_) {
+  for (let index = 0; index < arguments_.length; index += 2) {
+    const option = arguments_[index];
+    if (option !== "--url" && option !== "--code" && option !== "--workspace") {
+      throw new PairingClientError(
+        "invalid_arguments",
+        `Unknown pairing option: ${option ?? "missing option"}`
+      );
+    }
+  }
+}
+function parseRelayOrigin(value) {
+  let url2;
+  try {
+    url2 = new URL(value);
+  } catch (error61) {
+    throw new PairingClientError(
+      "invalid_relay_url",
+      "The relay URL is invalid",
+      { cause: error61 }
+    );
+  }
+  if (url2.protocol !== "https:" && url2.protocol !== "http:") {
+    throw new PairingClientError(
+      "invalid_relay_url",
+      "The relay URL must use http or https"
+    );
+  }
+  if (url2.username.length > 0 || url2.password.length > 0) {
+    throw new PairingClientError(
+      "invalid_relay_url",
+      "The relay URL cannot contain credentials"
+    );
+  }
+  if (url2.protocol === "http:" && url2.hostname !== "127.0.0.1" && url2.hostname !== "localhost") {
+    throw new PairingClientError(
+      "invalid_relay_url",
+      "A remote relay must use https"
+    );
+  }
+  url2.hash = "";
+  url2.pathname = "/";
+  url2.search = "";
+  return url2;
+}
+function parsePairingCode(value) {
+  const code = value.trim().toUpperCase();
+  if (!PAIRING_CODE_PATTERN.test(code)) {
+    throw new PairingClientError(
+      "invalid_pairing_code",
+      "The pairing code must match the code shown in the browser"
+    );
+  }
+  return code;
+}
+function parsePairCommand(arguments_) {
+  assertKnownArguments(arguments_);
+  return {
+    code: parsePairingCode(readSingleOption(arguments_, "--code")),
+    relayOrigin: parseRelayOrigin(readSingleOption(arguments_, "--url")),
+    workspace: arguments_.includes("--workspace") ? readSingleOption(arguments_, "--workspace") : loadDefaultWorkspace()
+  };
+}
+function parseChannelArgument(arguments_) {
+  if (arguments_.length !== 2 || arguments_[0] !== "--channel") {
+    throw new PairingClientError(
+      "invalid_arguments",
+      "Usage: mobius start --channel <channel-id>"
+    );
+  }
+  const channelId = arguments_[1] ?? "";
+  if (!IDENTIFIER_PATTERN5.test(channelId)) {
+    throw new PairingClientError(
+      "invalid_channel_id",
+      "The saved channel ID is invalid"
+    );
+  }
+  return channelId;
+}
+async function resolveDefaultWorkspace(path2) {
+  const requestedWorkspace = resolve3(path2);
+  try {
+    await mkdir3(requestedWorkspace, { recursive: true, mode: 448 });
+    const defaultWorkspace = await realpath5(requestedWorkspace);
+    const metadata = await stat5(defaultWorkspace);
+    if (!metadata.isDirectory()) {
+      throw new PairingClientError(
+        "invalid_workspace",
+        "The default workspace is not a directory"
+      );
+    }
+    return defaultWorkspace;
+  } catch (error61) {
+    if (error61 instanceof PairingClientError) {
+      throw error61;
+    }
+    throw new PairingClientError(
+      "invalid_workspace",
+      "The default workspace cannot be resolved",
+      { cause: error61 }
+    );
+  }
+}
+async function readJsonResponse(response) {
+  if (response.headers.get("cf-mitigated") === "challenge") {
+    throw new PairingClientError(
+      "relay_challenge",
+      "Cloudflare is protecting this temporary preview. Claim the deployment or use an authenticated deployment, then pair again"
+    );
+  }
+  const encoded = await response.text();
+  try {
+    return JSON.parse(encoded);
+  } catch (error61) {
+    throw new PairingClientError(
+      "invalid_relay_response",
+      "The relay returned an invalid response",
+      { cause: error61 }
+    );
+  }
+}
+function readRelayError(value) {
+  if (isRecord5(value)) {
+    const error61 = value["error"];
+    if (isRecord5(error61)) {
+      const code = error61["code"];
+      const message = error61["message"];
+      if (typeof code === "string" && typeof message === "string") {
+        return new PairingClientError(code, message);
+      }
+    }
+  }
+  return new PairingClientError(
+    "pairing_failed",
+    "The relay could not pair this machine"
+  );
+}
+function decodeClaimResponse(value) {
+  if (!isRecord5(value) || !hasExactKeys(value, CLAIM_RESPONSE_KEYS)) {
+    throw new PairingClientError(
+      "invalid_relay_response",
+      "The relay returned an invalid pairing response"
+    );
+  }
+  const channelId = value["channelId"];
+  const daemonToken = value["daemonToken"];
+  const runtimeId = value["runtimeId"];
+  if (typeof channelId !== "string" || !IDENTIFIER_PATTERN5.test(channelId) || typeof daemonToken !== "string" || !TOKEN_PATTERN.test(daemonToken) || typeof runtimeId !== "string" || !IDENTIFIER_PATTERN5.test(runtimeId)) {
+    throw new PairingClientError(
+      "invalid_relay_response",
+      "The relay returned an invalid pairing response"
+    );
+  }
+  return { channelId, daemonToken, runtimeId };
+}
+async function claimPairing(options, defaultWorkspace, localAgents, installableAgents, signal) {
+  const agents = localAgents.map((agent) => ({
+    id: agent.id,
+    label: agent.label
+  }));
+  const endpoint = mobiusApiUrl(options.relayOrigin, "/pairings/claim");
+  let response;
+  try {
+    response = await fetch2(endpoint, {
+      body: JSON.stringify({
+        agents,
+        installableAgents: installableAgents.map((agent) => ({
+          id: agent.id,
+          label: agent.label,
+          requiresLocalApproval: agent.requiresLocalApproval
+        })),
+        machineName: hostname3(),
+        pairingCode: options.code,
+        workspaceName: basename(defaultWorkspace) || "Local workspace"
+      }),
+      dispatcher: environmentProxyDispatcher,
+      headers: { "content-type": "application/json" },
+      method: "POST",
+      signal: AbortSignal.any([
+        signal,
+        AbortSignal.timeout(PAIRING_TIMEOUT_MILLISECONDS)
+      ])
+    });
+  } catch (error61) {
+    throw new PairingClientError(
+      "relay_unavailable",
+      "The pairing relay could not be reached",
+      { cause: error61 }
+    );
+  }
+  const value = await readJsonResponse(response);
+  if (!response.ok) {
+    throw readRelayError(value);
+  }
+  return decodeClaimResponse(value);
+}
+async function persistConnection(channelId, relayOrigin, daemonToken, defaultWorkspace) {
+  const connectionsDirectory = join13(readStateDirectory(), "connections");
+  await mkdir3(connectionsDirectory, { mode: 448, recursive: true });
+  const connectionPath = join13(connectionsDirectory, `${channelId}.json`);
+  const temporaryPath = join13(
+    connectionsDirectory,
+    `.${channelId}.${randomUUID()}.tmp`
+  );
+  await writeFile2(
+    temporaryPath,
+    `${JSON.stringify(
+      {
+        defaultWorkspace,
+        channelId,
+        daemonToken,
+        relayOrigin: relayOrigin.toString()
+      },
+      null,
+      2
+    )}
+`,
+    { flag: "wx", mode: 384 }
+  );
+  await rename3(temporaryPath, connectionPath);
+  return connectionPath;
+}
+function decodeSavedConnection(value, expectedChannelId) {
+  if (!isRecord5(value) || !hasExactKeys(value, SAVED_CONNECTION_KEYS)) {
+    throw new PairingClientError(
+      "invalid_connection",
+      "The saved connection is invalid"
+    );
+  }
+  const defaultWorkspace = value["defaultWorkspace"];
+  const channelId = value["channelId"];
+  const daemonToken = value["daemonToken"];
+  const relayOrigin = value["relayOrigin"];
+  if (typeof defaultWorkspace !== "string" || typeof channelId !== "string" || channelId !== expectedChannelId || !IDENTIFIER_PATTERN5.test(channelId) || typeof daemonToken !== "string" || !TOKEN_PATTERN.test(daemonToken) || typeof relayOrigin !== "string") {
+    throw new PairingClientError(
+      "invalid_connection",
+      "The saved connection is invalid"
+    );
+  }
+  return {
+    defaultWorkspace,
+    channelId,
+    daemonToken,
+    relayOrigin: parseRelayOrigin(relayOrigin)
+  };
+}
+async function readSavedConnection(channelId) {
+  const connectionPath = join13(
+    readStateDirectory(),
+    "connections",
+    `${channelId}.json`
+  );
+  let encoded = "";
+  const handle = await open6(connectionPath, "r");
+  try {
+    const metadata = await handle.stat();
+    if (!metadata.isFile() || metadata.size > MAX_CONNECTION_FILE_LENGTH) {
+      throw new PairingClientError(
+        "invalid_connection",
+        "The saved connection is invalid"
+      );
+    }
+    encoded = await handle.readFile({ encoding: "utf8" });
+  } finally {
+    await handle.close();
+  }
+  let value;
+  try {
+    value = JSON.parse(encoded);
+  } catch (error61) {
+    throw new PairingClientError(
+      "invalid_connection",
+      "The saved connection is invalid",
+      { cause: error61 }
+    );
   }
-  return decoded.data;
+  const connection = decodeSavedConnection(value, channelId);
+  return {
+    defaultWorkspace: await resolveDefaultWorkspace(
+      connection.defaultWorkspace
+    ),
+    channelId: connection.channelId,
+    daemonToken: connection.daemonToken,
+    relayOrigin: connection.relayOrigin
+  };
 }
-var encode4 = (message, schema) => {
-  const decoded = schema.safeParse(message);
-  if (!decoded.success) {
-    throw new ProtocolMessageError("Message does not match its schema", {
-      cause: decoded.error
-    });
+function assertInventoryUsable(inventory) {
+  if (inventory.available.length + inventory.installable.length === 0) {
+    throw new PairingClientError(
+      "no_supported_agent",
+      "No supported Agent is ready or safely installable on this machine"
+    );
   }
-  return JSON.stringify(decoded.data);
-};
-var encodeSessionEventEnvelope = (message) => encode4(message, eventEnvelopeSchema);
-var decodeSessionEventAcknowledgement = (encoded) => decode5(encoded, eventAcknowledgementSchema);
+}
+function buildPairedDaemon(connection, connectionPath, inventory) {
+  assertInventoryUsable(inventory);
+  const relayUrl = mobiusApiUrl(
+    connection.relayOrigin,
+    `/channels/${encodeURIComponent(connection.channelId)}/daemon`
+  );
+  relayUrl.protocol = relayUrl.protocol === "https:" ? "wss:" : "ws:";
+  relayUrl.searchParams.set("token", connection.daemonToken);
+  const auditDatabasePath = join13(
+    readStateDirectory(),
+    "audit",
+    `${connection.channelId}.sqlite`
+  );
+  return {
+    channelUrl: new URL(
+      `/channels/${encodeURIComponent(connection.channelId)}`,
+      connection.relayOrigin
+    ).toString(),
+    config: createDaemonConfig(
+      {
+        defaultWorkspace: connection.defaultWorkspace,
+        auditDatabasePath,
+        channelId: connection.channelId,
+        relayUrl
+      },
+      inventory.readyAgents(),
+      inventory.installable
+    ),
+    connectionPath
+  };
+}
+async function pairLocalMachine(arguments_, signal = new AbortController().signal) {
+  const options = parsePairCommand(arguments_);
+  const defaultWorkspace = await resolveDefaultWorkspace(options.workspace);
+  const inventory = await discoverLocalAgentInventory({
+    defaultWorkspace,
+    environment: process.env,
+    signal
+  });
+  assertInventoryUsable(inventory);
+  const agents = inventory.readyAgents();
+  const claim2 = await claimPairing(
+    options,
+    defaultWorkspace,
+    agents,
+    inventory.installable,
+    signal
+  );
+  const connectionPath = await persistConnection(
+    claim2.channelId,
+    options.relayOrigin,
+    claim2.daemonToken,
+    defaultWorkspace
+  );
+  return buildPairedDaemon(
+    {
+      defaultWorkspace,
+      channelId: claim2.channelId,
+      daemonToken: claim2.daemonToken,
+      relayOrigin: options.relayOrigin
+    },
+    connectionPath,
+    inventory
+  );
+}
+async function resumeLocalMachine(arguments_, signal = new AbortController().signal) {
+  const channelId = parseChannelArgument(arguments_);
+  const connectionPath = join13(
+    readStateDirectory(),
+    "connections",
+    `${channelId}.json`
+  );
+  const connection = await readSavedConnection(channelId);
+  const inventory = await discoverLocalAgentInventory({
+    defaultWorkspace: connection.defaultWorkspace,
+    environment: process.env,
+    signal
+  });
+  return buildPairedDaemon(connection, connectionPath, inventory);
+}
 
 // src/run-daemon.ts
+import { basename as basename3 } from "node:path";
+import { styleText } from "node:util";
 import { WebSocket as WebSocket2 } from "undici";
 
 // src/acp/session-manager.ts