@oh-hai/cli 0.1.0-beta.0

package/dist/commands/registry.js

@@ -0,0 +1,144 @@
+// The command surface (docs/specs/cli.md §4). #105 registered every command with help
+// text and its owning downstream issue; those bodies have since landed (auth #106,
+// messaging #107, agents #209, health/doctor #108). Subcommands are listed so the
+// dispatcher can form the envelope `command` name (e.g. "ask.submit") and print per-command help.
+export const COMMANDS = [
+    {
+        name: "login",
+        summary: "acquire a token → OS keychain (never printed)",
+        issue: 106,
+        subcommands: [],
+        help: [
+            "oh-hai login — acquire a token and store it in the OS keychain.",
+            "",
+            "Usage: oh-hai login [--base-url <url>]",
+            "       oh-hai login --token-stdin [--base-url <url>] [--account <id>]",
+            "",
+            "Bare `login` runs the device-code flow: it prints a short code + verification URL",
+            "to stderr, you approve in the browser, and the returned token is stored under the",
+            "Hub-scoped key and NEVER printed (cli spec §4.3/§5). Or pipe a token to",
+            "--token-stdin for local bootstrap; it is stored the same way (keychain, or a 0600",
+            "file fallback), also never printed.",
+        ].join("\n"),
+    },
+    {
+        name: "logout",
+        summary: "remove the stored token",
+        issue: 106,
+        subcommands: [],
+        help: [
+            "oh-hai logout — remove the stored token for the current (or --account) identity.",
+            "",
+            "Usage: oh-hai logout [--account <id>] [--all]",
+            "",
+            "Idempotent and offline. --all clears every stored identity.",
+        ].join("\n"),
+    },
+    {
+        name: "whoami",
+        summary: "show agent id + base URL + token presence (never the token)",
+        issue: 106,
+        subcommands: [],
+        help: [
+            "oh-hai whoami — show the resolved identity without revealing the secret.",
+            "",
+            "Usage: oh-hai whoami [--check]",
+            "",
+            "Prints agent id, base URL, and token presence. --check probes the Hub for validity.",
+        ].join("\n"),
+    },
+    {
+        name: "notify",
+        summary: "fire-and-forget FYI / status / digest",
+        issue: 107,
+        subcommands: [],
+        help: [
+            "oh-hai notify — fire-and-forget notification (status / FYI / digest).",
+            "",
+            "Usage: oh-hai notify --title <t> [--body <b>] [--priority <low|normal|high|urgent>]",
+            "                     [--tag <t>]... [--dry-run]",
+            "",
+            "No idempotency key — a notify is fire-and-forget and must not be retried.",
+        ].join("\n"),
+    },
+    {
+        name: "ask",
+        summary: "human decision: submit / await",
+        issue: 107,
+        subcommands: ["submit", "await"],
+        help: [
+            "oh-hai ask — request a human decision.",
+            "",
+            "Usage: oh-hai ask submit --mode <select|input|confirm> --title <t>",
+            "                         --resolver human:<id> [--option k:Label]... [--schema <json>]",
+            "       oh-hai ask await  --id <id> [--interval <ms>] [--await-timeout <ms>]",
+            "",
+            "Carries a REQUIRED idempotency key. See cli spec §4.4.",
+        ].join("\n"),
+    },
+    {
+        name: "task",
+        summary: "manual human action: submit / await",
+        issue: 107,
+        subcommands: ["submit", "await"],
+        help: [
+            "oh-hai task — hand a human a manual action.",
+            "",
+            "Usage: oh-hai task submit --instructions <text> --title <t> --resolver human:<id>",
+            "                          [--checklist <text>]... [--callback pull|push]",
+            "       oh-hai task await  --id <id> [--interval <ms>] [--await-timeout <ms>]",
+            "",
+            "Terminal by default. See cli spec §4.4.",
+        ].join("\n"),
+    },
+    {
+        name: "agents",
+        summary: "list / create / revoke agent identities",
+        issue: 209,
+        subcommands: ["list", "create", "revoke"],
+        help: [
+            "oh-hai agents — account / identity management.",
+            "",
+            "Usage: oh-hai agents list",
+            "       oh-hai agents create --label <label>",
+            "       oh-hai agents revoke --target-agent <id> [--yes]",
+            "",
+            "See cli spec §4.5.",
+        ].join("\n"),
+    },
+    {
+        name: "inbox",
+        summary: "drain + ack your agent's mailbox; heartbeat presence (watch)",
+        issue: 153,
+        subcommands: ["watch"],
+        help: [
+            "oh-hai inbox — the human→agent inbound leg (MA2H v0.4).",
+            "",
+            "Usage: oh-hai inbox watch [--interval <ms>] [--once] [--max <n>]",
+            "",
+            "watch drains your agent's mailbox, streams each directive to stdout for the",
+            "agent runtime, posts a single batched ack, and — because each authenticated",
+            "poll is the presence heartbeat — keeps you 'online' by polling on --interval",
+            "(default 5000ms). Under --json each directive is one NDJSON envelope. --once",
+            "drains a single batch and exits (cron / scripting). --max caps the drain size.",
+            "See cli spec §4.7.",
+        ].join("\n"),
+    },
+    {
+        name: "doctor",
+        summary: "config + keychain + connectivity + test-notify checks",
+        issue: 108,
+        subcommands: [],
+        help: [
+            "oh-hai doctor — diagnose setup (config, keychain, connectivity).",
+            "",
+            "Usage: oh-hai doctor [--test-notify]",
+            "",
+            "Local checks run offline; connectivity + --test-notify are network checks. See cli spec §4.6.",
+        ].join("\n"),
+    },
+];
+export function findCommand(name) {
+    return COMMANDS.find((command) => command.name === name);
+}
+//# sourceMappingURL=registry.js.map

package/dist/commands/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/commands/registry.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,mFAAmF;AACnF,kFAAkF;AAClF,kGAAkG;AAelG,MAAM,CAAC,MAAM,QAAQ,GAA2B;IAC9C;QACE,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,+CAA+C;QACxD,KAAK,EAAE,GAAG;QACV,WAAW,EAAE,EAAE;QACf,IAAI,EAAE;YACJ,iEAAiE;YACjE,EAAE;YACF,wCAAwC;YACxC,uEAAuE;YACvE,EAAE;YACF,mFAAmF;YACnF,mFAAmF;YACnF,yEAAyE;YACzE,mFAAmF;YACnF,qCAAqC;SACtC,CAAC,IAAI,CAAC,IAAI,CAAC;KACb;IACD;QACE,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,yBAAyB;QAClC,KAAK,EAAE,GAAG;QACV,WAAW,EAAE,EAAE;QACf,IAAI,EAAE;YACJ,kFAAkF;YAClF,EAAE;YACF,+CAA+C;YAC/C,EAAE;YACF,6DAA6D;SAC9D,CAAC,IAAI,CAAC,IAAI,CAAC;KACb;IACD;QACE,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,6DAA6D;QACtE,KAAK,EAAE,GAAG;QACV,WAAW,EAAE,EAAE;QACf,IAAI,EAAE;YACJ,0EAA0E;YAC1E,EAAE;YACF,gCAAgC;YAChC,EAAE;YACF,qFAAqF;SACtF,CAAC,IAAI,CAAC,IAAI,CAAC;KACb;IACD;QACE,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,uCAAuC;QAChD,KAAK,EAAE,GAAG;QACV,WAAW,EAAE,EAAE;QACf,IAAI,EAAE;YACJ,uEAAuE;YACvE,EAAE;YACF,qFAAqF;YACrF,iDAAiD;YACjD,EAAE;YACF,2EAA2E;SAC5E,CAAC,IAAI,CAAC,IAAI,CAAC;KACb;IACD;QACE,IAAI,EAAE,KAAK;QACX,OAAO,EAAE,gCAAgC;QACzC,KAAK,EAAE,GAAG;QACV,WAAW,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;QAChC,IAAI,EAAE;YACJ,wCAAwC;YACxC,EAAE;YACF,oEAAoE;YACpE,wFAAwF;YACxF,6EAA6E;YAC7E,EAAE;YACF,wDAAwD;SACzD,CAAC,IAAI,CAAC,IAAI,CAAC;KACb;IACD;QACE,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,qCAAqC;QAC9C,KAAK,EAAE,GAAG;QACV,WAAW,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;QAChC,IAAI,EAAE;YACJ,6CAA6C;YAC7C,EAAE;YACF,mFAAmF;YACnF,0EAA0E;YAC1E,8EAA8E;YAC9E,EAAE;YACF,yCAAyC;SAC1C,CAAC,IAAI,CAAC,IAAI,CAAC;KACb;IACD;QACE,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,yCAAyC;QAClD,KAAK,EAAE,GAAG;QACV,WAAW,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC;QACzC,IAAI,EAAE;YACJ,gDAAgD;YAChD,EAAE;YACF,2BAA2B;YAC3B,6CAA6C;YAC7C,yDAAyD;YACzD,EAAE;YACF,oBAAoB;SACrB,CAAC,IAAI,CAAC,IAAI,CAAC;KACb;IACD;QACE,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,8DAA8D;QACvE,KAAK,EAAE,GAAG;QACV,WAAW,EAAE,CAAC,OAAO,CAAC;QACtB,IAAI,EAAE;YACJ,yDAAyD;YACzD,EAAE;YACF,kEAAkE;YAClE,EAAE;YACF,6EAA6E;YAC7E,6EAA6E;YAC7E,8EAA8E;YAC9E,8EAA8E;YAC9E,gFAAgF;YAChF,oBAAoB;SACrB,CAAC,IAAI,CAAC,IAAI,CAAC;KACb;IACD;QACE,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,uDAAuD;QAChE,KAAK,EAAE,GAAG;QACV,WAAW,EAAE,EAAE;QACf,IAAI,EAAE;YACJ,kEAAkE;YAClE,EAAE;YACF,sCAAsC;YACtC,EAAE;YACF,+FAA+F;SAChG,CAAC,IAAI,CAAC,IAAI,CAAC;KACb;CACF,CAAC;AAEF,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AAC3D,CAAC"}

package/dist/commands/stub.d.ts

@@ -0,0 +1 @@
+export declare function notImplemented(command: string, issue: number): never;

package/dist/commands/stub.js

@@ -0,0 +1,9 @@
+// The honest not-yet-implemented handler. #105 ships the package + machine contract;
+// each command body lands in its owning downstream issue (#106–#108, blocked on #96).
+// A stub throws a CliError so the entry renders it exactly like any other failure —
+// generic exit 1 with a stable `not_implemented` code (cli spec §7/§8) and an issue pointer.
+import { CliError } from "../envelope.js";
+export function notImplemented(command, issue) {
+    throw new CliError("not_implemented", `oh-hai ${command} is not implemented yet — lands in #${issue} (see docs/specs/cli.md).`);
+}
+//# sourceMappingURL=stub.js.map

package/dist/commands/stub.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stub.js","sourceRoot":"","sources":["../../src/commands/stub.ts"],"names":[],"mappings":"AAAA,qFAAqF;AACrF,sFAAsF;AACtF,oFAAoF;AACpF,6FAA6F;AAE7F,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1C,MAAM,UAAU,cAAc,CAAC,OAAe,EAAE,KAAa;IAC3D,MAAM,IAAI,QAAQ,CAChB,iBAAiB,EACjB,UAAU,OAAO,uCAAuC,KAAK,2BAA2B,CACzF,CAAC;AACJ,CAAC"}

package/dist/commands/task.d.ts

@@ -0,0 +1,2 @@
+import type { CommandContext } from "./context.js";
+export declare function taskCommand(ctx: CommandContext): Promise<void>;

package/dist/commands/task.js

@@ -0,0 +1,223 @@
+// `oh-hai task` (docs/specs/cli.md §4.4) — hand a human a manual action. Subcommands `submit` +
+// `await`. Productized from `scripts/task.ts`: account-aware bearer, `--json` envelope, §7 exit
+// codes, injectable fetch. TERMINAL by default — `--callback` is pure opt-in; ≥1 `human:`
+// resolver is REQUIRED for a real submit (the resolve route is human-only). A task Response
+// carries no `value` (resolutions are completed / dismissed / expired).
+import { CliError, buildOk, serializeEnvelope } from "../envelope.js";
+import { parseSubcommandArgs } from "./flags.js";
+import { awaitResolution, printResolution, resolveAwaitTiming } from "./messaging/await.js";
+import { buildTask } from "./messaging/build.js";
+import { submitEnvelope } from "./messaging/http.js";
+import { requireReplayToken, requireToken, resolveSubmitIdentity } from "./messaging/identity.js";
+import { assertNoForeignFlags, dryRunFlag, printDryRunEnvelope, printSubmitAck, requireNonEmpty, resolveRunId, resumeRoutingSuffix, sanitizeForTerminal, stringFlag, } from "./messaging/shared.js";
+import { openResumeState, resolveState } from "./messaging/state.js";
+import { assertTaskEnvelope, hasConcreteHumanResolver, hasHumanResolver, isActor, isCallbackMode, normalizePushUrl, readEnvelopeArg, replayResolvers, } from "./messaging/validate.js";
+const SUBCOMMANDS = ["submit", "await"];
+const TASK_SUBMIT_OPTIONS = {
+    title: { type: "string" },
+    body: { type: "string" },
+    instructions: { type: "string" },
+    checklist: { type: "string", multiple: true },
+    resolver: { type: "string", multiple: true },
+    callback: { type: "string" },
+    "callback-url": { type: "string" },
+    "idempotency-key": { type: "string" },
+    "created-at": { type: "string" },
+    "dry-run": { type: "boolean" },
+    envelope: { type: "string" },
+    state: { type: "string" },
+};
+const TASK_AWAIT_OPTIONS = {
+    id: { type: "string" },
+    interval: { type: "string" },
+    "await-timeout": { type: "string" },
+};
+const TASK_OPTIONS = { ...TASK_SUBMIT_OPTIONS, ...TASK_AWAIT_OPTIONS };
+const AWAIT_ONLY = ["id", "interval", "await-timeout"];
+const SUBMIT_ONLY = Object.keys(TASK_SUBMIT_OPTIONS);
+export async function taskCommand(ctx) {
+    const { values, subcommand } = parseSubcommandArgs(ctx.argv, SUBCOMMANDS, TASK_OPTIONS);
+    const flags = values;
+    if (subcommand === "submit") {
+        assertNoForeignFlags(flags, AWAIT_ONLY, "task submit");
+        await taskSubmit(ctx, flags);
+    }
+    else {
+        assertNoForeignFlags(flags, SUBMIT_ONLY, "task await");
+        await taskAwait(ctx, flags);
+    }
+}
+async function taskSubmit(ctx, flags) {
+    // Strict parse: `--dry-run=true` still previews; a malformed `--dry-run=treu` fails as usage
+    // rather than silently performing a LIVE submit.
+    const dryRun = dryRunFlag(flags["dry-run"]);
+    const envelopeRaw = stringFlag(flags.envelope);
+    if (envelopeRaw !== undefined) {
+        await taskReplay(ctx, envelopeRaw, flags, dryRun);
+        return;
+    }
+    const title = stringFlag(flags.title);
+    if (title === undefined || title.trim() === "") {
+        throw new CliError("usage", "missing required flag: --title (must be non-empty).");
+    }
+    const instructions = stringFlag(flags.instructions);
+    if (instructions === undefined || instructions.trim() === "") {
+        throw new CliError("usage", "missing required flag: --instructions (must be non-empty).");
+    }
+    const callback = resolveCallback(flags); // undefined → terminal task (opt-in)
+    const checklistRaw = Array.isArray(flags.checklist) ? flags.checklist.filter((c) => typeof c === "string") : [];
+    const checklist = checklistRaw.map((text) => ({ text }));
+    const resolvers = resolveResolvers(flags, dryRun, ctx);
+    const action = { instructions };
+    if (checklist.length > 0)
+        action.checklist = checklist;
+    if (resolvers.length > 0)
+        action.allowed_resolvers = resolvers;
+    if (callback !== undefined)
+        action.callback = callback;
+    const idempotencyKey = requireNonEmpty(flags, "idempotency-key");
+    const createdAt = requireNonEmpty(flags, "created-at");
+    const body = stringFlag(flags.body);
+    // Seal an optional `--state` resume blob (requires MA2H_STATE_SEAL_KEY) before the dry-run
+    // branch so the preview shows the sealed envelope; `task await` opens it on resolution.
+    const state = resolveState(stringFlag(flags.state));
+    let agentId = ctx.config.account ?? "oh-hai/task-bot";
+    let token = "";
+    if (!dryRun) {
+        const identity = await resolveSubmitIdentity(ctx);
+        agentId = identity.agentId;
+        token = identity.token;
+    }
+    const task = buildTask({
+        agent: { id: agentId, run_id: resolveRunId() },
+        title,
+        action,
+        ...(body !== undefined ? { body } : {}),
+        ...(idempotencyKey !== undefined ? { idempotency_key: idempotencyKey } : {}),
+        ...(createdAt !== undefined ? { created_at: createdAt } : {}),
+        ...(state !== undefined ? { state } : {}),
+    });
+    if (dryRun) {
+        printDryRunEnvelope(ctx, "task.submit", task);
+        return;
+    }
+    const ack = await submitEnvelope(ctx, token, task);
+    reportTaskSubmit(ctx, ack, callback, false);
+}
+/** Replay a captured task envelope verbatim (§4.8). Enforces the same human-resolver invariant as
+ *  the compose path — a captured envelope with no human resolver is just as unresolvable. */
+async function taskReplay(ctx, envelopeRaw, flags, dryRun) {
+    const conflicts = ["title", "body", "instructions", "checklist", "resolver", "callback", "callback-url", "idempotency-key", "created-at", "state"].filter((k) => flags[k] !== undefined);
+    if (conflicts.length > 0) {
+        throw new CliError("usage", `--envelope replays a captured envelope verbatim and cannot be combined with composition flags (${conflicts.map((k) => `--${k}`).join(", ")}).`);
+    }
+    // readEnvelopeArg may throw a usage CliError (missing @file); only the JSON.parse is wrapped, so
+    // a truncated/invalid captured envelope is a usage error (exit 2), not the generic error path.
+    const raw = await readEnvelopeArg(envelopeRaw, ctx.runtime.readStdin);
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (error) {
+        throw new CliError("usage", `--envelope is not valid JSON: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    const envelope = assertTaskEnvelope(parsed);
+    if (!hasConcreteHumanResolver(replayResolvers(envelope))) {
+        if (!dryRun) {
+            throw new CliError("usage", "--envelope task has no concrete human:<id> resolver in action.allowed_resolvers (a wildcard can " +
+                "never match): the resolve route is human-only, so it could never be marked done (inbox Done/Dismiss → " +
+                "403) and would sit open forever. Capture the envelope with a concrete human resolver. (Use --dry-run to preview anyway.)");
+        }
+        ctx.io.err("⚠ --envelope task has no concrete human:<id> resolver: this previewed replay would be UNRESOLVABLE.");
+    }
+    if (dryRun) {
+        printDryRunEnvelope(ctx, "task.submit", envelope);
+        return;
+    }
+    const token = await requireReplayToken(ctx, envelope.agent.id);
+    const ack = await submitEnvelope(ctx, token, envelope);
+    reportTaskSubmit(ctx, ack, envelope.action.callback, true);
+}
+async function taskAwait(ctx, flags) {
+    const id = stringFlag(flags.id);
+    if (id === undefined || id.trim() === "")
+        throw new CliError("usage", "missing required flag: --id.");
+    const { intervalMs, budgetMs, perRequestMs } = resolveAwaitTiming(ctx, stringFlag(flags.interval), stringFlag(flags["await-timeout"]), stringFlag(flags.timeout));
+    const token = await requireToken(ctx);
+    const body = await awaitResolution(ctx, { token, id, expectedType: "task", intervalMs, budgetMs, perRequestMs });
+    // Open the agent-owned sealed `state` when MA2H_STATE_SEAL_KEY is set (undefined otherwise).
+    const openedState = openResumeState(body);
+    printResolution(ctx, body, false, openedState); // a task Response carries no value
+}
+// --- composition helpers ---
+/** The OPT-IN return leg: a callback is attached only when `--callback` is given (omit → terminal
+ *  task). A `--callback-url` without `--callback` is a mistake, rejected rather than dropped. */
+function resolveCallback(flags) {
+    const callbackRaw = stringFlag(flags.callback);
+    const callbackUrl = stringFlag(flags["callback-url"]);
+    if (callbackRaw === undefined) {
+        if (callbackUrl !== undefined) {
+            throw new CliError("usage", "--callback-url is only valid with --callback push (no --callback given).");
+        }
+        return undefined;
+    }
+    if (!isCallbackMode(callbackRaw)) {
+        throw new CliError("usage", `invalid --callback "${callbackRaw}" (expected one of: pull, push).`);
+    }
+    if (callbackRaw === "push") {
+        if (callbackUrl === undefined || callbackUrl.trim() === "") {
+            throw new CliError("usage", "--callback push requires --callback-url.");
+        }
+        return { mode: "push", url: normalizePushUrl(callbackUrl) };
+    }
+    if (callbackUrl !== undefined) {
+        throw new CliError("usage", `--callback-url is only valid with --callback push (got --callback ${callbackRaw}).`);
+    }
+    return { mode: "pull" };
+}
+function resolveResolvers(flags, dryRun, ctx) {
+    const raw = Array.isArray(flags.resolver) ? flags.resolver.filter((r) => typeof r === "string") : [];
+    const resolvers = [];
+    for (const r of raw) {
+        if (!isActor(r))
+            throw new CliError("usage", `invalid --resolver "${r}" (expected <human|agent|system>:<id>).`);
+        if (r.slice(r.indexOf(":") + 1).includes("*")) {
+            throw new CliError("usage", `invalid --resolver "${r}": wildcards are not supported — name a concrete actor like human:owner.`);
+        }
+        resolvers.push(r);
+    }
+    // A task needs a concrete human resolver to be resolvable — the resolve route is human-only, so
+    // a task with none (or only agent:/system: resolvers) can never be marked done and stays open
+    // forever. "Terminal by default" means the AGENT doesn't wait — not that a human can act on a
+    // human-resolver-less task. A real submit without one is a hard error; --dry-run may preview.
+    if (!hasHumanResolver(resolvers)) {
+        if (!dryRun) {
+            const detail = resolvers.length > 0
+                ? `the only --resolver(s) given (${resolvers.join(", ")}) are not human:<id>`
+                : "with none it fails closed to agent:<id> only";
+            throw new CliError("usage", `a task needs at least one --resolver human:<id>: ${detail}, and the resolve route is human-only, so ` +
+                "the task could never be marked done. (Use --dry-run to preview the envelope without one.)");
+        }
+        ctx.io.err("⚠ no --resolver human:<id> given: this previewed task would be UNRESOLVABLE (resolve is human-only).");
+    }
+    return resolvers;
+}
+/** Print the task submit acknowledgement + a callback-appropriate next-step hint. `--json` →
+ *  `{ id, review_url? }` (a task Response has no poll semantics the CLI surfaces on submit). */
+function reportTaskSubmit(ctx, ack, callback, replayed) {
+    if (ctx.json) {
+        ctx.io.log(serializeEnvelope(buildOk("task.submit", { id: ack.id, review_url: ack.review_url })));
+        return;
+    }
+    printSubmitAck(ctx, replayed ? "task submitted (replayed envelope)" : "task submitted", ack, true);
+    if (callback?.mode === "pull") {
+        ctx.io.log(`\nResume (pull): oh-hai task await --id ${sanitizeForTerminal(ack.id)}${resumeRoutingSuffix(ctx)}`);
+    }
+    else if (callback?.mode === "push") {
+        ctx.io.log(`\nResume (push): the Hub will POST the signed Response to ${callback.url} when the human resolves it.`);
+    }
+    else {
+        ctx.io.log("\nHanded off (terminal): the human resolves it in the inbox; the agent expects nothing back.");
+    }
+}
+//# sourceMappingURL=task.js.map

package/dist/commands/task.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"task.js","sourceRoot":"","sources":["../../src/commands/task.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,gGAAgG;AAChG,0FAA0F;AAC1F,4FAA4F;AAC5F,wEAAwE;AAExE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAEtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC5F,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAClG,OAAO,EACL,oBAAoB,EACpB,UAAU,EACV,mBAAmB,EACnB,cAAc,EACd,eAAe,EACf,YAAY,EACZ,mBAAmB,EACnB,mBAAmB,EACnB,UAAU,GACX,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EACL,kBAAkB,EAClB,wBAAwB,EACxB,gBAAgB,EAChB,OAAO,EACP,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,eAAe,GAChB,MAAM,yBAAyB,CAAC;AAGjC,MAAM,WAAW,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAU,CAAC;AAEjD,MAAM,mBAAmB,GAAG;IAC1B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxB,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;IAC7C,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;IAC5C,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5B,cAAc,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAClC,iBAAiB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACrC,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC9B,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;CACjB,CAAC;AACX,MAAM,kBAAkB,GAAG;IACzB,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACtB,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5B,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;CAC3B,CAAC;AACX,MAAM,YAAY,GAAG,EAAE,GAAG,mBAAmB,EAAE,GAAG,kBAAkB,EAAE,CAAC;AACvE,MAAM,UAAU,GAAG,CAAC,IAAI,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;AACvD,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;AAErD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAmB;IACnD,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC;IACxF,MAAM,KAAK,GAAG,MAAiC,CAAC;IAChD,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC5B,oBAAoB,CAAC,KAAK,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;QACvD,MAAM,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;SAAM,CAAC;QACN,oBAAoB,CAAC,KAAK,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC;QACvD,MAAM,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,GAAmB,EAAE,KAA8B;IAC3E,6FAA6F;IAC7F,iDAAiD;IACjD,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;IAE5C,MAAM,WAAW,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,UAAU,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAClD,OAAO;IACT,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC/C,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,qDAAqD,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,YAAY,GAAG,UAAU,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACpD,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC7D,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,4DAA4D,CAAC,CAAC;IAC5F,CAAC;IAED,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,qCAAqC;IAC9E,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7H,MAAM,SAAS,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IAEvD,MAAM,MAAM,GAAe,EAAE,YAAY,EAAE,CAAC;IAC5C,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC;IACvD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,CAAC,iBAAiB,GAAG,SAAS,CAAC;IAC/D,IAAI,QAAQ,KAAK,SAAS;QAAE,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAEvD,MAAM,cAAc,GAAG,eAAe,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACpC,2FAA2F;IAC3F,wFAAwF;IACxF,MAAM,KAAK,GAAG,YAAY,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IAEpD,IAAI,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,iBAAiB,CAAC;IACtD,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAClD,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;QAC3B,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;IACzB,CAAC;IAED,MAAM,IAAI,GAAG,SAAS,CAAC;QACrB,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE;QAC9C,KAAK;QACL,MAAM;QACN,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC,CAAC;IAEH,IAAI,MAAM,EAAE,CAAC;QACX,mBAAmB,CAAC,GAAG,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC;QAC9C,OAAO;IACT,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACnD,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;AAC9C,CAAC;AAED;6FAC6F;AAC7F,KAAK,UAAU,UAAU,CACvB,GAAmB,EACnB,WAAmB,EACnB,KAA8B,EAC9B,MAAe;IAEf,MAAM,SAAS,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,cAAc,EAAE,iBAAiB,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC,MAAM,CACvJ,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAC9B,CAAC;IACF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,QAAQ,CAChB,OAAO,EACP,kGAAkG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAChJ,CAAC;IACJ,CAAC;IAED,iGAAiG;IACjG,+FAA+F;IAC/F,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACtE,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,iCAAiC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACzH,CAAC;IACD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,CAAC,wBAAwB,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QACzD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,QAAQ,CAChB,OAAO,EACP,kGAAkG;gBAChG,wGAAwG;gBACxG,0HAA0H,CAC7H,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,qGAAqG,CAAC,CAAC;IACpH,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACX,mBAAmB,CAAC,GAAG,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;QAClD,OAAO;IACT,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/D,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IACvD,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;AAC7D,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,GAAmB,EAAE,KAA8B;IAC1E,MAAM,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAChC,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,8BAA8B,CAAC,CAAC;IACtG,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,kBAAkB,CAAC,GAAG,EAAE,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,UAAU,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,EAAE,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAClK,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;IACjH,6FAA6F;IAC7F,MAAM,WAAW,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IAC1C,eAAe,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,mCAAmC;AACrF,CAAC;AAED,8BAA8B;AAE9B;iGACiG;AACjG,SAAS,eAAe,CAAC,KAA8B;IACrD,MAAM,WAAW,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,WAAW,GAAG,UAAU,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;IACtD,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,0EAA0E,CAAC,CAAC;QAC1G,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,uBAAuB,WAAW,kCAAkC,CAAC,CAAC;IACpG,CAAC;IACD,IAAI,WAAW,KAAK,MAAM,EAAE,CAAC;QAC3B,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC3D,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,0CAA0C,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC;IAC9D,CAAC;IACD,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,qEAAqE,WAAW,IAAI,CAAC,CAAC;IACpH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,gBAAgB,CAAC,KAA8B,EAAE,MAAe,EAAE,GAAmB;IAC5F,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClH,MAAM,SAAS,GAAY,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACpB,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAC,yCAAyC,CAAC,CAAC;QAChH,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAC,0EAA0E,CAAC,CAAC;QAClI,CAAC;QACD,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IACD,gGAAgG;IAChG,8FAA8F;IAC9F,8FAA8F;IAC9F,8FAA8F;IAC9F,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,CAAC;QACjC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC;gBACjC,CAAC,CAAC,iCAAiC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,sBAAsB;gBAC7E,CAAC,CAAC,8CAA8C,CAAC;YACnD,MAAM,IAAI,QAAQ,CAChB,OAAO,EACP,oDAAoD,MAAM,4CAA4C;gBACpG,2FAA2F,CAC9F,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,sGAAsG,CAAC,CAAC;IACrH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;gGACgG;AAChG,SAAS,gBAAgB,CAAC,GAAmB,EAAE,GAAc,EAAE,QAA8B,EAAE,QAAiB;IAC9G,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACb,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC;QAClG,OAAO;IACT,CAAC;IACD,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,oCAAoC,CAAC,CAAC,CAAC,gBAAgB,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACnG,IAAI,QAAQ,EAAE,IAAI,KAAK,MAAM,EAAE,CAAC;QAC9B,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,2CAA2C,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClH,CAAC;SAAM,IAAI,QAAQ,EAAE,IAAI,KAAK,MAAM,EAAE,CAAC;QACrC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,6DAA6D,QAAQ,CAAC,GAAG,8BAA8B,CAAC,CAAC;IACtH,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,8FAA8F,CAAC,CAAC;IAC7G,CAAC;AACH,CAAC"}

package/dist/commands/whoami.d.ts

@@ -0,0 +1,6 @@
+import type { CommandContext } from "./context.js";
+/** A redaction-safe fingerprint of a token (§5.4). Real bearer tokens are long + high-entropy,
+ *  so the last 4 chars identify one without revealing it; for an unexpectedly short token we
+ *  fall back to a non-reversible hash prefix so the fingerprint can never be the token itself. */
+export declare function fingerprintToken(token: string): string;
+export declare function whoamiCommand(ctx: CommandContext): Promise<void>;

package/dist/commands/whoami.js

@@ -0,0 +1,90 @@
+// `oh-hai whoami` (docs/specs/cli.md §4.3). Show the resolved identity WITHOUT revealing the
+// secret (§5.4): agent id, base URL, token presence + a redacted fingerprint, and where the
+// token resolved from (`keychain` / `file` / `env`). Works fully offline. `--check` adds a
+// network probe of the Hub for token validity: exit 0 valid, 3 on 401/403, 5 unreachable (§9).
+import { createHash } from "node:crypto";
+import { CliError, buildOk, serializeEnvelope } from "../envelope.js";
+import { resolveIdentity } from "../auth/resolve-token.js";
+import { sanitizeForTerminal } from "../terminal.js";
+import { flagOn, parseCommandArgs } from "./flags.js";
+import { throwTransportError } from "./http.js";
+/** A redaction-safe fingerprint of a token (§5.4). Real bearer tokens are long + high-entropy,
+ *  so the last 4 chars identify one without revealing it; for an unexpectedly short token we
+ *  fall back to a non-reversible hash prefix so the fingerprint can never be the token itself. */
+export function fingerprintToken(token) {
+    return token.length > 8 ? token.slice(-4) : createHash("sha256").update(token).digest("hex").slice(0, 4);
+}
+/** Default per-request bound for the `--check` probe when no `--timeout`/`MA2H_TIMEOUT_MS` is
+ *  set. §9 promises offline is an explicit state, never a silent hang — a Hub that accepts the
+ *  connection but never responds must still surface a timeout rather than block forever. */
+const DEFAULT_CHECK_TIMEOUT_MS = 10_000;
+/** Probe the Hub for token validity using an endpoint that exists post-#96: an authenticated
+ *  GET of a nonexistent message id. Because the Hub authenticates BEFORE looking the id up, the
+ *  ONLY response that proves the presented bearer authenticated is the expected `404` (agent
+ *  authenticated, message not found). `401`/`403` = invalid/revoked; `5xx` = the Hub errored (no
+ *  validity signal); a transport failure = unreachable/timeout. Any other status (a `2xx`/`3xx`
+ *  from a proxy that ignores `Authorization`, a wrong `--base-url`) is NOT proof of validity and
+ *  is reported as such rather than a false "valid". Side-effect-free — a GET creates nothing. */
+async function checkToken(ctx, token) {
+    if (token === undefined) {
+        throw new CliError("auth", "not authenticated — no stored token to check (run `oh-hai login`).");
+    }
+    const url = `${ctx.config.baseUrl}/v1/messages/oh-hai-whoami-check-nonexistent`;
+    const init = {
+        method: "GET",
+        headers: { Authorization: `Bearer ${token}` },
+        signal: AbortSignal.timeout(ctx.config.timeoutMs ?? DEFAULT_CHECK_TIMEOUT_MS),
+    };
+    let status;
+    try {
+        status = (await ctx.runtime.fetchImpl(url, init)).status;
+    }
+    catch (error) {
+        // A per-request timeout is exit 7 (§7); a DNS/connection failure is exit 5 (§9).
+        throwTransportError(error, ctx.config.baseUrl);
+    }
+    if (status === 401 || status === 403) {
+        throw new CliError("auth", `token is invalid or revoked (Hub returned ${status}).`);
+    }
+    if (status >= 500) {
+        throw new CliError("server", `Hub returned ${status}; token validity could not be confirmed.`);
+    }
+    if (status !== 404) {
+        // Not the expected authenticated-and-not-found response — could be a wrong base URL or a
+        // proxy that never reached the Hub's auth. Don't claim the token is valid.
+        throw new CliError("error", `unexpected Hub response ${status}; could not confirm token validity (check --base-url).`);
+    }
+    // 404 → the bearer authenticated and the probe id doesn't exist: the token is valid.
+}
+export async function whoamiCommand(ctx) {
+    const { values } = parseCommandArgs(ctx.argv, { check: { type: "boolean" } });
+    // Skip opening (and probing) the local store when the CI env token already resolves it (§5.3).
+    const store = ctx.config.tokenSource === "env" ? undefined : await ctx.runtime.openStore();
+    // `resolveIdentity` also DISCOVERS the account when none was configured (the device-code login
+    // path stores under a Hub-chosen agent id) — so display the resolved account, not config.account.
+    const resolved = await resolveIdentity(ctx.config, store);
+    const account = resolved.account;
+    const fingerprint = resolved.token !== undefined ? fingerprintToken(resolved.token) : undefined;
+    // A failing --check throws before any identity is printed (the command result IS the check).
+    if (flagOn(values.check)) {
+        await checkToken(ctx, resolved.token);
+    }
+    if (ctx.json) {
+        const token = { present: resolved.token !== undefined, source: resolved.source };
+        if (fingerprint !== undefined) {
+            token.fingerprint = fingerprint;
+        }
+        ctx.io.log(serializeEnvelope(buildOk("whoami", { agent_id: account, base_url: ctx.config.baseUrl, token })));
+    }
+    else {
+        // Sanitize before terminal output: a DISCOVERED account is the raw agent id the Hub chose at
+        // login time, so a hostile Hub could have stored control characters in it (the raw id is kept
+        // for lookup and the JSON envelope, where JSON.stringify escapes them — §5.4 / login parity).
+        ctx.io.log(`agent:    ${account !== undefined ? sanitizeForTerminal(account) : "(none — set --account/--agent or MA2H_AGENT_ID)"}`);
+        ctx.io.log(`base url: ${ctx.config.baseUrl}`);
+        ctx.io.log(resolved.token !== undefined
+            ? `token:    present (…${fingerprint}) [${resolved.source}]`
+            : "token:    absent");
+    }
+}
+//# sourceMappingURL=whoami.js.map

package/dist/commands/whoami.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"whoami.js","sourceRoot":"","sources":["../../src/commands/whoami.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAC7F,4FAA4F;AAC5F,2FAA2F;AAC3F,+FAA+F;AAE/F,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAErD,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAEhD;;kGAEkG;AAClG,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC3G,CAAC;AAED;;4FAE4F;AAC5F,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAExC;;;;;;iGAMiG;AACjG,KAAK,UAAU,UAAU,CAAC,GAAmB,EAAE,KAAyB;IACtE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,QAAQ,CAAC,MAAM,EAAE,oEAAoE,CAAC,CAAC;IACnG,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,8CAA8C,CAAC;IAChF,MAAM,IAAI,GAAG;QACX,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;QAC7C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,wBAAwB,CAAC;KAC9E,CAAC;IAEF,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;IAC3D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,iFAAiF;QACjF,mBAAmB,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACjD,CAAC;IAED,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACrC,MAAM,IAAI,QAAQ,CAAC,MAAM,EAAE,6CAA6C,MAAM,IAAI,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;QAClB,MAAM,IAAI,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,MAAM,0CAA0C,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,yFAAyF;QACzF,2EAA2E;QAC3E,MAAM,IAAI,QAAQ,CAChB,OAAO,EACP,2BAA2B,MAAM,wDAAwD,CAC1F,CAAC;IACJ,CAAC;IACD,qFAAqF;AACvF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAmB;IACrD,MAAM,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IAC9E,+FAA+F;IAC/F,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;IAC3F,+FAA+F;IAC/F,kGAAkG;IAClG,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;IACjC,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEhG,6FAA6F;IAC7F,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC;IAED,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACb,MAAM,KAAK,GAA4B,EAAE,OAAO,EAAE,QAAQ,CAAC,KAAK,KAAK,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC1G,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,KAAK,CAAC,WAAW,GAAG,WAAW,CAAC;QAClC,CAAC;QACD,GAAG,CAAC,EAAE,CAAC,GAAG,CACR,iBAAiB,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CACjG,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,6FAA6F;QAC7F,8FAA8F;QAC9F,8FAA8F;QAC9F,GAAG,CAAC,EAAE,CAAC,GAAG,CACR,aAAa,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,iDAAiD,EAAE,CACxH,CAAC;QACF,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,aAAa,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9C,GAAG,CAAC,EAAE,CAAC,GAAG,CACR,QAAQ,CAAC,KAAK,KAAK,SAAS;YAC1B,CAAC,CAAC,uBAAuB,WAAW,MAAM,QAAQ,CAAC,MAAM,GAAG;YAC5D,CAAC,CAAC,kBAAkB,CACvB,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/config-file.d.ts

@@ -0,0 +1,38 @@
+import type { ProjectConfig, UserConfig } from "./config.js";
+/** A parsed scalar from the flat dialect: string, integer, or boolean. */
+type TomlValue = string | number | boolean;
+/**
+ * Injectable filesystem/environment seam so the loaders are unit-testable against an in-memory map
+ * with zero disk access. `readFile` returns undefined for a missing or unreadable file (ENOENT etc.).
+ */
+export interface ConfigFileIo {
+    readFile(path: string): string | undefined;
+    homedir: string;
+    cwd: string;
+    xdgConfigHome: string | undefined;
+}
+/** The two parsed config objects `resolveConfig` consumes; either may be absent. */
+export interface LoadedConfigFiles {
+    userConfig: UserConfig | undefined;
+    projectConfig: ProjectConfig | undefined;
+}
+/**
+ * Parse the minimal config dialect: flat `key = value` lines plus an optional `[oh-hai]` section.
+ * Values are quoted strings (single/double), integers (optional sign + `_` separators), or booleans.
+ * `#` starts a comment. Keys are collected from the top level (before any section header) and from an
+ * `[oh-hai]` section; keys under any other section are ignored. Unparseable lines are skipped so a
+ * malformed file degrades gracefully — this function never throws.
+ */
+export declare function parseToml(text: string): Record<string, TomlValue>;
+/** Load `~/.config/oh-hai/config.toml` ($XDG_CONFIG_HOME honored). Undefined when the file is absent. */
+export declare function loadUserConfig(io: ConfigFileIo): UserConfig | undefined;
+/**
+ * Discover the per-project config by walking up from cwd for a `.oh-hai/config.toml`; the nearest
+ * ancestor wins. Undefined when none is found up to the filesystem root.
+ */
+export declare function loadProjectConfig(io: ConfigFileIo): ProjectConfig | undefined;
+/** Load both config files (user-global + per-project) for `resolveConfig`. */
+export declare function loadConfigFiles(io: ConfigFileIo): LoadedConfigFiles;
+/** Production `ConfigFileIo` backed by the real filesystem, home dir, cwd, and environment. */
+export declare function nodeConfigFileIo(): ConfigFileIo;
+export {};