@onepointfour-packs/flaredeck-agent 0.1.0

package/dist/main.js

@@ -0,0 +1,764 @@
+#!/usr/bin/env node
+import './env.js';
+import { existsSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { buildOptions, runTask } from './agent.js';
+import { claudeAuth, claudeInstalled, setupToken } from './auth.js';
+import { configOrDefaults, DEFAULTS, forgetConfig, loadConfig, loadMe, saveConfig, saveMe } from './config.js';
+import { startApprovals } from './approvals.js';
+import { flaredeckDecider } from './approval.js';
+import { preflightFlaredeck } from './flaredeck-check.js';
+import { flaredeckProxy } from './flaredeck-proxy.js';
+import { TEAM_TOOL_NAMES } from './team.js';
+import { SCHEDULE_TOOL_NAMES } from './schedules.js';
+import { GIT_TOOL_NAMES } from './github.js';
+import { RUN_TOOL_NAMES } from './runs.js';
+import { askBaseBranch } from './branches.js';
+import { askRepos, checkouts } from './workspace.js';
+import { authorize, freshAccessToken } from './oauth.js';
+import { authorizeGitHub } from './githubauth.js';
+import { loadBaseBranch } from './preflight.js';
+import { serve } from './serve.js';
+import { Flaredeck } from './flaredeck.js';
+import { briefText, intake, intakeText } from './intake.js';
+import { createInterface } from 'node:readline/promises';
+import { loadProviders, saveProviders } from './providers.js';
+import { removeSecret, secretNames, secretsPath, setSecret } from './secrets.js';
+import { loadJam, loginJam } from './jam.js';
+import { denyingDecider, readToolNames, terminalDecider } from './permissions.js';
+const say = (s = '') => process.stdout.write(`${s}\n`);
+// Reads are pre-approved deliberately, so the SDK's "canUseTool will not be invoked" warning is
+// expected for exactly those tools. Swallow it when it names only read tools; let anything else
+// through, because then it would mean a write had been auto-approved and the broker was off.
+//
+// Node prints warnings through its OWN listener, so adding one does not replace it — without
+// this the daemon repeats sixteen tool names on every single turn, which buries the one line
+// that matters. Dropping the default and re-emitting what we do care about is the only way to
+// keep the log readable.
+const defaultWarn = process.listeners('warning');
+process.removeAllListeners('warning');
+process.on('warning', (w) => {
+    if (w.code !== 'CLAUDE_SDK_CAN_USE_TOOL_SHADOWED') {
+        // Anything else still deserves Node's normal treatment.
+        for (const l of defaultWarn)
+            l(w);
+        return;
+    }
+    const shadowed = w.message.match(/mcp__[\w-]+__[\w-]+/g) ?? [];
+    // Pre-approved on purpose: FlareDeck's reads; the team view, which is a read; and the git
+    // tools, which are gated in their own code (the card's branch only, merge behind its own
+    // decider) rather than by the broker. Anything else auto-approved is worth a line.
+    const expected = new Set([
+        ...readToolNames(configOrDefaults().mcpServerName),
+        ...TEAM_TOOL_NAMES,
+        ...GIT_TOOL_NAMES,
+        // Asking for a production run is pre-approved; the run itself waits for a person's Approve.
+        ...RUN_TOOL_NAMES,
+        ...SCHEDULE_TOOL_NAMES,
+    ]);
+    const unexpected = shadowed.filter((t) => !expected.has(t));
+    if (unexpected.length) {
+        process.stderr.write(`⚠ these writes bypass the permission broker: ${unexpected.join(', ')}\n`);
+    }
+});
+const die = (s) => {
+    process.stderr.write(`${s}\n`);
+    process.exit(1);
+};
+/** Who the HARNESS is, read straight out of its own token. No network, no model turn. */
+function identityOf(config) {
+    const tok = config.oauth?.accessToken;
+    if (!tok)
+        return null;
+    try {
+        const part = tok.split('.')[1] ?? '';
+        const claims = JSON.parse(Buffer.from(part, 'base64url').toString('utf8'));
+        return `${claims.name || claims.email || claims.sub} (${claims.tenantId})`;
+    }
+    catch {
+        return null;
+    }
+}
+/** The MCP server's origin — the OAuth issuer too, since it hosts the provider. */
+const mcpOrigin = (config) => new URL(config.mcpUrl).origin;
+const flag = (argv, name) => {
+    const i = argv.indexOf(name);
+    return i >= 0 ? argv[i + 1] : undefined;
+};
+/**
+ * Who answers a permission request.
+ *
+ * With a card to ask on, it goes to FlareDeck and anyone on the board can answer. `--ask` prompts
+ * at the terminal, for trying things by hand. With neither, it refuses — safe, and honest about
+ * there being nobody to ask.
+ */
+function deciderFor(argv, config) {
+    if (argv.includes('--ask'))
+        return terminalDecider;
+    const card = flag(argv, '--card');
+    const tenantId = config.oauth ? tenantOf(config) : null;
+    if (card && tenantId && config.oauth) {
+        return flaredeckDecider(new Flaredeck(tenantId, () => harnessToken(config)), card);
+    }
+    return denyingDecider;
+}
+/** The agent's own tenant, read from its token — nothing to configure. */
+function tenantOf(config) {
+    try {
+        const part = config.oauth.accessToken.split('.')[1] ?? '';
+        return JSON.parse(Buffer.from(part, 'base64url').toString('utf8')).tenantId ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+const harnessToken = (config) => freshAccessToken(mcpOrigin(config), config.oauth, (next) => {
+    config.oauth = next;
+    saveConfig(config);
+});
+async function cmdLogin(argv) {
+    if (!(await claudeInstalled())) {
+        die('The Claude CLI is not on PATH. Install it first: npm i -g @anthropic-ai/claude-code');
+    }
+    const repo = flag(argv, '--repo');
+    const tenantId = flag(argv, '--tenant');
+    const apiKey = flag(argv, '--api-key');
+    const config = {
+        ...configOrDefaults(),
+        ...(repo ? { repo: resolve(repo) } : {}),
+        ...(tenantId ? { tenantId } : {}),
+        ...(apiKey ? { apiKey } : {}),
+    };
+    // 1. Who pays for the model.
+    const auth = await claudeAuth();
+    say(`Claude:    ${auth.kind} — ${auth.detail}`);
+    if (auth.kind === 'none') {
+        say('\nNo Claude credentials. Setting up a long-lived subscription token…');
+        await setupToken();
+        // `setup-token` PRINTS the token for you to keep; it does not hand it back to us, and this
+        // harness does not scrape it off the terminal. So ask again rather than assume: if the CLI
+        // still does not know who it is, the token only exists in the scrollback, and saying so now
+        // beats starting an agent that cannot reach the model.
+        const after = await claudeAuth();
+        say(`Claude:    ${after.kind} — ${after.detail}`);
+        if (after.kind === 'none') {
+            say('\nThe token was minted but this machine still cannot use it. Put it in the');
+            say('environment the agent starts in, then run this again:');
+            say('\n  export CLAUDE_CODE_OAUTH_TOKEN=<the sk-ant-oat01-… token printed above>\n');
+            die('Claude credentials are not usable yet.');
+        }
+    }
+    // Signed in, but every turn is billed per token. An agent that works unattended for hours is
+    // the worst possible thing to leave on metered billing, so this is said out loud at setup
+    // rather than discovered on an invoice.
+    if (auth.kind === 'metered') {
+        say('  · This is metered API billing, not a Claude subscription. An agent that runs');
+        say('    unattended will run up a bill — sign in with `claude auth login` on a plan instead.');
+    }
+    if (process.env['ANTHROPIC_API_KEY']) {
+        say('  · ANTHROPIC_API_KEY is set on this box; it is stripped before Claude runs, so this');
+        say('    agent stays on the subscription rather than metered billing.');
+    }
+    // 2. One FlareDeck identity for this machine.
+    //
+    // This used to be two: the Claude CLI held one for the model's tools, the harness held another
+    // for listening. They could drift, and did — the tools acted as one account while the harness
+    // listened as another, which looks like it is working. The harness's token is now handed to
+    // the MCP server directly, so there is one account and nothing to keep in step.
+    // Wrapped at 78 columns by hand, because a terminal over SSH is often 80 wide and a sentence
+    // broken mid-word is harder to read than no sentence at all.
+    const wrap = (text, width = 78) => {
+        const lines = [];
+        let line = '';
+        for (const word of text.split(' ')) {
+            if ((line + ' ' + word).trim().length > width) {
+                lines.push(line);
+                line = word;
+            }
+            else
+                line = (line + ' ' + word).trim();
+        }
+        if (line)
+            lines.push(line);
+        return lines;
+    };
+    const step = (n, title, why) => {
+        say(`\n── ${n} of 3 · ${title} ${'─'.repeat(Math.max(0, 62 - title.length))}`);
+        wrap(why).forEach(say);
+        say('');
+    };
+    if (!config.oauth) {
+        step(1, 'FlareDeck', 'Which agent this machine acts as. Everything it does on the board is done as that account.');
+        config.oauth = await authorize(mcpOrigin(config), say);
+        say('✓ FlareDeck authorised');
+    }
+    else {
+        say('\n✓ FlareDeck: already authorised on this machine');
+    }
+    // 4. GitHub, held by the harness. The agent has publishing tools and no `gh`, so from here
+    // the credential is out of its reach rather than merely off-limits.
+    // A token handed in directly replaces the OAuth login: for an organisation that restricts
+    // OAuth apps and has no owner at hand to approve one, a member's classic personal access
+    // token is not subject to that restriction. Stored the same way; the agent still never sees it.
+    const givenToken = flag(argv, '--github-token');
+    if (givenToken) {
+        config.github = { accessToken: givenToken };
+        step(2, 'GitHub', 'Using the token you passed (classic PAT, no expiry handling).');
+        say('✓ GitHub token stored — the OAuth login is not used while this is set');
+    }
+    // --github: redo the GitHub step even though one is stored — for a refresh token that has
+    // lapsed or been revoked, which otherwise only shows up as a failed push hours later.
+    if (argv.includes('--github') && !givenToken)
+        delete config.github;
+    if (!config.github) {
+        step(2, 'GitHub', 'So this machine can push branches and open pull requests. The agent never sees this token.');
+        try {
+            config.github = await authorizeGitHub(say);
+            say('✓ GitHub authorised');
+        }
+        catch (e) {
+            say(`✗ GitHub: ${String(e instanceof Error ? e.message : e)}`);
+            say('  Run login again later to finish this; everything else is saved.');
+        }
+    }
+    else {
+        say('✓ GitHub: already authorised on this machine');
+    }
+    // 5. Which branch this work starts from. Asked once, from the repo's real branches — getting
+    // it wrong is quiet: every card cut from the wrong history, every PR at the wrong target.
+    const declared = loadBaseBranch(config.repo);
+    const hasGit = existsSync(join(config.repo, '.git'));
+    // A folder holding several repos is not "no checkout" — it is this agent's whole scope. The
+    // directory is the declaration (see workspace.ts), so there is nothing to ask and nothing to
+    // save: each card names its repository, and each repo answers for its own base branch.
+    const found = hasGit ? [] : await checkouts(config.repo);
+    if (found.length > 1) {
+        step(3, 'Repositories', `This folder holds ${found.length} repositories. Tick the ones this agent may work in — each card's Component says which one a card is for, and each repo answers for its own base branch, so there is no branch to choose here.`);
+        const picked = await askRepos(config.repo, say, config.repos);
+        if (picked) {
+            if (picked.length)
+                config.repos = picked;
+            else
+                delete config.repos;
+        }
+    }
+    else if (found.length === 1) {
+        step(3, 'Repositories', `One repository in this folder: ${found[0].name}.`);
+    }
+    else if (!hasGit) {
+        step(3, 'Branch', 'No git repository here and none in this folder, so this agent will have no checkout — right for a lead, wrong for a worker.');
+    }
+    else if (declared) {
+        step(3, 'Branch', `This repo declares its base branch (${declared}), so there is nothing to choose.`);
+    }
+    else if (!config.baseBranch) {
+        step(3, 'Branch', 'Where new work is cut from and merged back into. Cards in a production-fix environment use the board\'s fix branch instead.');
+        const picked = await askBaseBranch(config.repo, say);
+        if (picked)
+            config.baseBranch = picked;
+    }
+    else {
+        step(3, 'Branch', `Already chosen on this machine: ${config.baseBranch}.`);
+    }
+    /**
+     * The key behind the command guard. Asked here rather than left to `providers`, because the
+     * guard is not optional any more: without a key every risky command interrupts a person, and
+     * someone who has just set this machine up is exactly who should be told that now rather than
+     * discovering it the first time an agent wants to run a migration at 2am.
+     *
+     * Machine-wide, not saved in this agent's config — a key is a billing relationship, and a
+     * config file copied to another box should carry no third-party credential.
+     */
+    const providers = loadProviders();
+    if (!providers.openrouter?.apiKey) {
+        step(4, 'Command guard', 'An OpenRouter key lets Jev judge risky shell commands — it refuses the irreversible ones and lets the rest run, for a fraction of a cent each. WITHOUT one the guard still runs, but every risky command stops and asks you in person. Get one at https://openrouter.ai/keys. Enter to skip.');
+        if (process.stdin.isTTY) {
+            const rl = createInterface({ input: process.stdin, output: process.stdout });
+            try {
+                const entered = (await rl.question('OpenRouter key (sk-or-…), or Enter to skip: ')).trim();
+                if (entered) {
+                    saveProviders({ ...providers, openrouter: { apiKey: entered } });
+                    say('✓ Saved — the guard will judge commands instead of interrupting you');
+                }
+                else {
+                    say('  Skipped. Risky commands will ask you each time; add one later with: flaredeck-agent providers --openrouter <key>');
+                }
+            }
+            finally {
+                rl.close();
+            }
+        }
+    }
+    else {
+        step(4, 'Command guard', 'On, with an OpenRouter key already set on this machine.');
+    }
+    const path = saveConfig(config);
+    const who = identityOf(config) ?? 'unknown';
+    say('\n── Done ' + '─'.repeat(63));
+    say(`  Agent      ${who}`);
+    const inScope = hasGit ? [] : await checkouts(config.repo, config.repos);
+    say(`  Repo       ${config.repo}${hasGit ? '' : inScope.length ? `   (${inScope.length} of ${found.length} repositories)` : '   (no checkout)'}`);
+    if (inScope.length)
+        say(`  Works in   ${inScope.map((c) => c.name).join(', ')}`);
+    say(`  Branch     ${declared ?? config.baseBranch ?? (hasGit ? 'not set' : inScope.length ? "each repo's own" : 'n/a')}`);
+    say(`  Guard      ${loadProviders().openrouter?.apiKey ? 'Jev judges risky commands' : 'on, but every risky command will ask you (no OpenRouter key)'}`);
+    say(`  Approvals  via FlareDeck, as ${who}`);
+    say(`  Saved      ${path}`);
+    say('');
+    say('Start it with:  flaredeck-agent        Check it with:  flaredeck-agent whoami');
+}
+/** What a token says about who holds it. */
+function claimsOf(accessToken) {
+    try {
+        const part = accessToken.split('.')[1] ?? '';
+        return JSON.parse(Buffer.from(part, 'base64url').toString('utf8'));
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * A person signing in, as opposed to a machine being given an agent. The same OAuth flow —
+ * sign in as yourself and do NOT connect as an agent — stored apart from every repo's agent
+ * config, because it is the account that answers for them.
+ */
+async function cmdLoginMe() {
+    const config = configOrDefaults();
+    say('Sign in as YOURSELF — not as an agent. This login answers agents\' requests; it never works cards.\n');
+    const tokens = await authorize(mcpOrigin(config), say);
+    const c = claimsOf(tokens.accessToken);
+    const path = saveMe(tokens);
+    say(`\nSigned in as ${c.name || c.email || 'you'} (${c.tenantId ?? 'tenant unknown'}). Kept at ${path}.`);
+    say('Run `flaredeck-agent approvals` to see what agents are waiting on.');
+}
+/** The person's client from `login --me`, or null when nobody has signed in here. */
+/**
+ * Which workspace the person answers in. Their token names their PRIMARY workspace, which may
+ * not be the one the agents on this machine work in — so the agent's own tenant wins when there
+ * is one, and the server accepts the person's token for any workspace they belong to.
+ */
+function meTenant(config, me) {
+    return (config.oauth ? tenantOf(config) : null) ?? claimsOf(me.accessToken).tenantId ?? null;
+}
+function meClient(config) {
+    const stored = loadMe();
+    if (!stored)
+        return null;
+    let me = stored;
+    const tenantId = meTenant(config, me);
+    if (!tenantId)
+        return null;
+    return new Flaredeck(tenantId, () => freshAccessToken(mcpOrigin(config), me, (next) => {
+        me = next;
+        saveMe(next);
+    }));
+}
+async function cmdApprovals(argv) {
+    const stored = loadMe();
+    if (!stored) {
+        die('Answering needs a person\'s login, and there is none on this machine yet. Run: flaredeck-agent login --me');
+        return;
+    }
+    let me = stored;
+    const c = claimsOf(me.accessToken);
+    // The workspace: --tenant, else the agent set up in this directory, else the login's own.
+    const config = configOrDefaults();
+    const tenantId = flag(argv, '--tenant') ?? meTenant(config, me);
+    if (!tenantId) {
+        die('That login has no workspace on it. Run from an agent\'s repo, or pass --tenant <id>.');
+        return;
+    }
+    const deck = new Flaredeck(tenantId, () => freshAccessToken(mcpOrigin(config), me, (next) => {
+        me = next;
+        saveMe(next);
+    }));
+    await startApprovals(deck, `${c.name || c.email || 'you'} in ${tenantId}`);
+}
+/** Jam, for intake only: the harness reads recordings; the agent never gets a Jam tool. */
+async function cmdLoginJam() {
+    say('Sign in to Jam in the workspace whose recordings end up on your cards.');
+    say('The harness reads them during intake — transcript, console errors, failed requests — and hands the agent text.\n');
+    const path = await loginJam(say);
+    say(`\nJam connected. Kept at ${path}. Agents pick it up on their next card; no restart needed.`);
+    say('Try it: flaredeck-agent intake <a card with a jam.dev link>');
+}
+/**
+ * Keys for the optional classifiers, once per machine. Given as flags so nothing is typed into a
+ * prompt that might be echoed; absent flags leave what is stored, and `--clear` forgets all.
+ */
+async function cmdProviders(argv) {
+    const current = loadProviders();
+    if (argv.includes('--clear')) {
+        saveProviders({});
+        say('Forgot all provider keys on this machine.');
+        return;
+    }
+    const openrouter = flag(argv, '--openrouter');
+    const gemini = flag(argv, '--gemini');
+    const geminiModel = flag(argv, '--gemini-model');
+    const brief = flag(argv, '--brief');
+    if (brief && brief !== 'haiku' && brief !== 'gemini') {
+        die('--brief must be haiku or gemini');
+        return;
+    }
+    const next = {
+        ...current,
+        ...(openrouter ? { openrouter: { apiKey: openrouter } } : {}),
+        ...(gemini || geminiModel
+            ? { gemini: { apiKey: gemini ?? current.gemini?.apiKey ?? '', ...((geminiModel ?? current.gemini?.model) ? { model: geminiModel ?? current.gemini?.model } : {}) } }
+            : {}),
+        ...(brief ? { brief: brief } : {}),
+    };
+    if (next.gemini && !next.gemini.apiKey)
+        delete next.gemini;
+    if (next.brief === 'gemini' && !next.gemini) {
+        die('--brief gemini needs a Gemini key: add --gemini <key> (from aistudio.google.com/apikey)');
+        return;
+    }
+    const path = saveProviders(next);
+    say(`OpenRouter (Jev): ${next.openrouter ? `set (…${next.openrouter.apiKey.slice(-4)})` : 'not set'}`);
+    say(`Gemini:           ${next.gemini ? `set (…${next.gemini.apiKey.slice(-4)}) · ${next.gemini.model ?? 'gemini-3.5-flash-lite'}` : 'not set'}`);
+    say(`Brief written by: ${next.brief ?? 'haiku'}${next.brief ? '' : ' (default; --brief gemini to switch)'}`);
+    say(`Stored in ${path} (0600). Agents pick this up on their next card; no restart needed.`);
+    if (!openrouter && !gemini)
+        say('\nSet one with: flaredeck-agent providers --openrouter sk-or-…   (an OpenRouter key serves Jev)');
+}
+/** The intake step on its own, printed: what the agent would be handed and what it would run on. */
+async function cmdIntake(argv) {
+    const card = argv.find((a) => !a.startsWith('--'));
+    if (!card) {
+        die('Which card? flaredeck-agent intake KD-1234');
+        return;
+    }
+    const config = loadConfig() ?? die('Not set up yet in this directory — run: flaredeck-agent login');
+    const tenantId = tenantOf(config);
+    if (!tenantId || !config.oauth) {
+        die('This agent has no FlareDeck login yet — run: flaredeck-agent login');
+        return;
+    }
+    const deck = new Flaredeck(tenantId, () => harnessToken(config));
+    const providers = loadProviders();
+    say(`Jev: ${providers.openrouter ? 'on' : 'off (flaredeck-agent providers --openrouter <key>)'} · Gemini: ${providers.gemini ? `on (${providers.gemini.model ?? 'gemini-3.5-flash-lite'})` : 'off (flaredeck-agent providers --gemini <key>)'} · brief by ${providers.brief ?? 'haiku'} · Jam: ${loadJam() ? 'on' : 'off (flaredeck-agent login --jam)'}\n`);
+    const out = await intake(deck, card, (t) => say(`· ${t}`), true, config.repo);
+    if (!out) {
+        die('Intake produced nothing — see above.');
+        return;
+    }
+    say(`· ${out.summary}`);
+    if (out.blocked) {
+        say(`\nBLOCKED — the agent would not start this card. It would flag needs-human with:\n  Cannot start: ${out.blocked}`);
+        return;
+    }
+    say(`· digest ≈ ${Math.round(out.digest.length / 4)} tokens`);
+    if (out.jev) {
+        say('\nJev:');
+        say(`  complexity   ${out.jev.complexity} (score ${out.jev.score.toFixed(2)}, confidence ${Math.round(out.jev.confidence * 100)}%)`);
+        say(`  prod data    ${Math.round(out.jev.production_data * 100)}%`);
+        say(`  settled      ${Math.round(out.jev.settled * 100)}%  (already done or waiting on a person)`);
+        say(`  kind         ${out.jev.kind} (${Math.round(out.jev.kind_confidence * 100)}%)`);
+        say(`  cost         $${out.jev.cost_usd.toFixed(6)} for ${out.jev.input_tokens} input tokens · ${out.jev.model}`);
+    }
+    say(`\n[what the agent is handed — brief by ${out.briefBy ?? 'nobody'}]` + intakeText(out));
+    if (out.other?.brief && out.other.by !== out.briefBy)
+        say(`\n[for comparison — brief by ${out.other.by}, ${out.other.secs}s]` + briefText(out.other.brief, out.digest.length));
+    say(`\nWould run on: ${out.model ?? 'the SDK default'} (chosen by ${out.routedBy})`);
+}
+async function cmdRun(prompt, argv) {
+    const config = loadConfig() ?? die('Not set up yet — run: flaredeck-agent login');
+    const card = flag(argv, '--card');
+    if (card && !(config.tenantId && config.apiKey)) {
+        die('--card needs the harness\'s own FlareDeck credentials: flaredeck-agent login --tenant <id> --api-key <key>');
+    }
+    if (card)
+        say(`· approvals go to card ${card}`);
+    // Same path as the daemon: discover FlareDeck first, serve its tools from in here. A one-off
+    // run that cannot reach FlareDeck says so and stops, rather than answering without it.
+    let flaredeck;
+    if (config.oauth) {
+        const check = await preflightFlaredeck(config.mcpUrl, await harnessToken(config));
+        if (!check.ok) {
+            die(check.reason);
+            throw new Error(check.reason);
+        }
+        flaredeck = flaredeckProxy(config.mcpServerName, config.mcpUrl, () => harnessToken(config), check.discovered, (w) => say(`⚠ ${w}`));
+    }
+    const options = buildOptions(config, deciderFor(argv, config), {}, undefined, undefined, config.oauth ? await harnessToken(config) : undefined, undefined, flaredeck);
+    for await (const event of runTask(prompt, options)) {
+        if (event.kind === 'ready') {
+            // 'none' = no API key in use, i.e. the subscription. Anything else means this session
+            // would be billed per token, so stop rather than quietly run up a bill overnight.
+            if (event.apiKeySource !== 'none' && event.apiKeySource !== 'unknown') {
+                die(`Refusing to run: Claude is using ${event.apiKeySource}, not the subscription.`);
+            }
+            if (event.permissionMode !== 'auto') {
+                die(`Refusing to run: asked for auto mode, got "${event.permissionMode}". ` +
+                    `A session that cannot use auto mode falls back to prompting, and there is nobody here to answer.`);
+            }
+            const bad = event.mcp.filter((s) => s.status === 'failed' || s.status === 'needs-auth');
+            for (const s of bad) {
+                // Worth shouting about: the agent would otherwise carry on with no Flaredeck tools and
+                // look perfectly healthy from the outside.
+                say(`⚠ MCP server "${s.name}" is ${s.status}. Re-run: claude mcp login ${s.name} --no-browser`);
+            }
+            if (event.tools.length === 0) {
+                // A session with no Flaredeck tools can still edit code and look fine, but it cannot read
+                // the card it was sent to work on. Silent is the worst way for that to go wrong.
+                say('⚠ no FlareDeck tools in this session — run: flaredeck-agent login --repo <this repo>');
+            }
+            say(`· ${event.permissionMode} mode · ${event.tools.length} Flaredeck tools`);
+        }
+        else if (event.kind === 'todo') {
+            say(`  ☐ ${event.text}`);
+        }
+        else if (event.kind === 'tool') {
+            say(`· ${event.name}`);
+        }
+        else if (event.kind === 'text') {
+            say(event.text);
+        }
+        else if (event.kind === 'done') {
+            if (!event.ok)
+                die('\nThe task did not finish cleanly.');
+        }
+    }
+}
+/**
+ * The whole point of this program: stay up and work what FlareDeck sends. So running it with no
+ * arguments does that, in the repo you are standing in — the way `claude` starts Claude Code
+ * rather than printing a menu. Anything not set up yet is set up first, rather than being
+ * reported as an error for you to go and fix.
+ */
+/**
+ * Credentials the agent may use and never see.
+ *
+ * Typed HERE, in this process, with the terminal's echo off — not into the agent's pane, where it
+ * would be in the transcript, on disk and in every request that followed. The agent is told only
+ * the NAME, and writes `{{secret:NAME}}` where the value belongs.
+ */
+async function cmdSecret(argv) {
+    const [action, name] = argv.filter((a) => !a.startsWith('--'));
+    if (!action || action === 'list') {
+        const names = secretNames();
+        say(names.length ? `Secrets on this machine:\n${names.map((n) => `  ${n}`).join('\n')}` : 'No secrets on this machine yet.');
+        say(`\nStored in ${secretsPath()} (0600). An agent writes {{secret:NAME}} and never sees the value.`);
+        return;
+    }
+    if (action === 'rm' || action === 'remove') {
+        if (!name) {
+            die('Usage: flaredeck-agent secret rm <NAME>');
+            return;
+        }
+        say(removeSecret(name) ? `Removed ${name}.` : `There is no secret called ${name}.`);
+        return;
+    }
+    if (action !== 'add' && action !== 'set')
+        die('Usage: flaredeck-agent secret [list | add <NAME> | rm <NAME>]');
+    if (!name) {
+        die('Usage: flaredeck-agent secret add <NAME>   (e.g. STRIPE_KEY)');
+        return;
+    }
+    // Piped input is for scripts and for a value too long to type; otherwise ask with echo off so
+    // it is not left on screen, in scrollback, or in the shell history of whoever is watching.
+    const piped = !process.stdin.isTTY ? await readAll(process.stdin) : null;
+    const value = piped !== null ? piped.trim() : await askHidden(`Value for ${name} (not shown): `);
+    try {
+        setSecret(name, value);
+    }
+    catch (e) {
+        die(e instanceof Error ? e.message : String(e));
+    }
+    say(`Saved ${name}. Agents on this machine can use it as {{secret:${name}}} — they cannot read it.`);
+}
+/** Read a line with the terminal's echo off, so the value never appears on screen. */
+async function askHidden(prompt) {
+    process.stdout.write(prompt);
+    const stdin = process.stdin;
+    const wasRaw = stdin.isRaw ?? false;
+    stdin.setRawMode?.(true);
+    stdin.resume();
+    let out = '';
+    try {
+        for await (const chunk of stdin) {
+            const text = String(chunk);
+            // Ctrl-C and Ctrl-D must still get out of here rather than being typed into the value.
+            if (text.includes('\u0003')) {
+                process.stdout.write('\n');
+                process.exit(130);
+            }
+            if (text.includes('\u0004') && !out) {
+                process.stdout.write('\n');
+                process.exit(130);
+            }
+            if (text.includes('\r') || text.includes('\n')) {
+                out += text.split(/[\r\n]/)[0] ?? '';
+                break;
+            }
+            if (text === '\u007f') {
+                out = out.slice(0, -1);
+                continue;
+            }
+            out += text;
+        }
+    }
+    finally {
+        stdin.setRawMode?.(wasRaw);
+        stdin.pause();
+        process.stdout.write('\n');
+    }
+    return out;
+}
+async function readAll(stream) {
+    let out = '';
+    for await (const chunk of stream)
+        out += String(chunk);
+    return out;
+}
+async function cmdServe(argv) {
+    const repo = resolve(flag(argv, '--repo') ?? process.cwd());
+    let config = { ...configOrDefaults(), repo };
+    // Which model answers. `--agy` is the short way to try Gemini on one run; `--engine <name>` is
+    // the explicit one. Set on the environment rather than on the config so it applies to THIS run
+    // and nothing is left behind in a file for the next one to inherit silently — the repo's own
+    // `engine:` stays the default, which is what you come back to.
+    const engine = argv.includes('--agy') ? 'antigravity' : flag(argv, '--engine');
+    if (engine)
+        process.env['FLAREDECK_AGENT_ENGINE'] = engine;
+    const usingClaude = (engine ?? config.engine ?? 'claude') === 'claude';
+    // Resolved here rather than on the first card: an agent that starts, listens, takes a card and
+    // only then finds it has no model is worse than one that refuses to start. It ASKS for nothing
+    // — a key already in the providers file, or the gcloud login this machine already has, and it
+    // only complains when neither exists.
+    if (!usingClaude) {
+        try {
+            const { geminiEnv } = await import('./engine-antigravity.js');
+            geminiEnv();
+        }
+        catch (e) {
+            die(e instanceof Error ? e.message : String(e));
+        }
+    }
+    // Only a genuine absence of credentials triggers setup. It used to be any answer other than
+    // 'subscription', which meant a flaky probe sent a working machine back through login on every
+    // start — see claudeAuth().
+    // Claude's own login is only needed by the Claude engine. A machine running Gemini should not be
+    // sent through it — it has nothing to sign into.
+    if ((usingClaude && (await claudeAuth()).kind === 'none') || !config.oauth) {
+        say('Not set up in this repo yet — doing that first.\n');
+        await cmdLogin([...argv, '--repo', repo]);
+        config = loadConfig() ?? config;
+    }
+    if (config.repo !== repo) {
+        // Standing somewhere else is a decision, not a mistake, but it must be visible: an agent
+        // silently working a different checkout than the one you are looking at is a bad hour.
+        say(`· working ${repo} (config had ${config.repo})`);
+        config = { ...config, repo };
+    }
+    if (!config.oauth) {
+        die('This machine is not authorised yet. Run: flaredeck-agent login');
+    }
+    // A function, not a value: the access token lasts an hour and the daemon runs for weeks, so
+    // it is refreshed on use and the new refresh token written back — the provider re-issues it
+    // each time, and dropping that would silently end the agent's life in thirty days.
+    const auth = () => freshAccessToken(mcpOrigin(config), config.oauth, (next) => {
+        config.oauth = next;
+        saveConfig(config);
+    });
+    const tenantId = tenantOf(config);
+    // A person logged in here can answer the agent's requests from its pane. Optional: without it
+    // the pane still shows the request and says where else it can be answered.
+    const me = meClient(config);
+    return serve({
+        config,
+        agent: identityOf(config) ?? 'flaredeck-agent',
+        auth,
+        baseUrl: config.agentServiceUrl ?? DEFAULTS.agentServiceUrl,
+        decider: deciderFor(argv, config),
+        // The harness's own client, for what the model's tools must not do for themselves — posting
+        // an approval request and reading the answer.
+        ...(tenantId ? { deck: new Flaredeck(tenantId, auth) } : {}),
+        ...(me ? { me } : {}),
+        say,
+    });
+}
+async function main() {
+    const [, , first, ...rest] = process.argv;
+    // No arguments, or straight into flags: serve. A bare `flaredeck-agent` is the normal case.
+    const known = ['login', 'logout', 'whoami', 'start', 'serve', 'run', 'approvals', 'providers', 'secret', 'intake', 'help'];
+    // A bare invocation serves. Anything unrecognised must NOT: `--help` quietly starting a daemon
+    // is how someone ends up with an agent running that they meant to ask a question of.
+    const help = ['--help', '-h', 'help', '--version', '-v'];
+    // Flags that may come FIRST, because they are options to the bare serve: `flaredeck-agent --agy`
+    // has to work without typing `serve`. Named one by one rather than accepting any leading flag —
+    // a mistyped `--agi` must still be refused, for the reason directly above.
+    const serveFlags = ['--agy', '--engine', '--repo'];
+    const command = !first ? 'serve'
+        : help.includes(first) ? 'help'
+            : known.includes(first) ? first
+                : serveFlags.includes(first) ? 'serve'
+                    : 'unknown';
+    if (command === 'unknown')
+        die(`Not a command: ${first}\nRun \`flaredeck-agent help\` to see what is.`);
+    const argv = first && known.includes(first) ? rest : process.argv.slice(2);
+    if (command === 'login')
+        return argv.includes('--jam') ? cmdLoginJam() : argv.includes('--me') ? cmdLoginMe() : cmdLogin(argv);
+    if (command === 'approvals')
+        return cmdApprovals(argv);
+    if (command === 'providers')
+        return cmdProviders(argv);
+    if (command === 'secret')
+        return cmdSecret(argv);
+    if (command === 'intake')
+        return cmdIntake(argv);
+    if (command === 'logout') {
+        const repo = resolve(flag(argv, '--repo') ?? process.cwd());
+        const config = loadConfig(repo);
+        say(forgetConfig(repo)
+            ? `Forgot the agent for ${repo}. Run login to set one up again.`
+            : `No agent was set up for ${repo}.`);
+        return;
+    }
+    if (command === 'whoami') {
+        const auth = await claudeAuth();
+        say(`Claude: ${auth.kind} — ${auth.detail}\n`);
+        return cmdRun('Call hello-authenticated and tell me, in one line, which account I am acting as.', argv);
+    }
+    // What an agent does when it wakes up with no instruction: find out who it is and what is
+    // waiting for it. The same thing the always-on daemon will do on every FlareDeck event.
+    if (command === 'start') {
+        return cmdRun('Get your bearings, then stop and report — do not start any of the work yet.\n\n' +
+            '1. Call hello-authenticated so you know which account you are.\n' +
+            '2. Call get-outstanding to find the cards assigned to you that are not done.\n' +
+            '3. Put one todo on your list per card, in the order you would tackle them.\n' +
+            '4. Tell me, in a few lines: who you are, how many cards are waiting, and which you would ' +
+            'pick up first and why.', argv);
+    }
+    if (command === 'serve')
+        return cmdServe(argv);
+    if (command === 'run') {
+        const prompt = argv.filter((a) => !a.startsWith('--')).join(' ');
+        if (!prompt)
+            die('Usage: flaredeck-agent run "<what to do>" [--ask]');
+        return cmdRun(prompt, argv);
+    }
+    say('flaredeck-agent — a FlareDeck agent on this machine\n');
+    say('  (no arguments)          Stay up and work what FlareDeck sends, in this repo (Claude)');
+    say('  --agy                   The same, with Gemini answering instead of Claude');
+    say('                          (--engine <claude|antigravity> for the long form)');
+    say('  login [--repo <path>] [--tenant <id>] [--api-key <key>]');
+    say('                          Authenticate with Claude and FlareDeck (once per machine)');
+    say('  login --me              Sign in as YOURSELF, to answer agents\' requests from here');
+    say('  approvals [--tenant <id>]  Every request agents are waiting on; approve or deny from the keyboard');
+    say('  providers [--openrouter <key>] [--gemini <key>] [--brief haiku|gemini]  Keys for the optional small models intake may use (machine-wide)');
+    say('  intake <card>              Dry-run the intake step on a card: digest size, the brief, Jev beside it, the model it would pick');
+    say('  login --jam                Connect Jam so intake can read recordings linked on cards (transcript, console, failed requests)');
+    say('  login --github-token <pat> Use a classic personal access token for pushes instead of the OAuth login (orgs that restrict OAuth apps)');
+    say('  login --github             Redo only the GitHub login on this machine (lapsed or revoked refresh token)');
+    say('  logout [--repo <path>]  Forget this repo\'s agent, so you can log in as another');
+    say('  whoami                  Show which Claude auth and which FlareDeck account is in use');
+    say('  start [--card <code>]   Find out who you are and what work is waiting');
+    say('  run "<task>" [options]  Run one task');
+    say('      --card <code>       Ask for approval on this card; anyone on the board can answer');
+    say('      --ask               Prompt at the terminal instead (hand-testing)');
+}
+main().catch((e) => die(String(e instanceof Error ? e.message : e)));
+//# sourceMappingURL=main.js.map