@otto-code/cli 0.8.12 → 0.8.13

package/dist/cli.js

@@ -1,8 +1,6 @@
 import { Command, Option } from "commander";
 import { createAgentCommand } from "./commands/agent/index.js";
 import { createDaemonCommand } from "./commands/daemon/index.js";
-import { createChatCommand } from "./commands/chat/index.js";
-import { createLoopCommand } from "./commands/loop/index.js";
 import { createPermitCommand } from "./commands/permit/index.js";
 import { createProviderCommand } from "./commands/provider/index.js";
 import { createScheduleCommand } from "./commands/schedule/index.js";
@@ -91,6 +89,7 @@ export function createCli() {
         .option("--force", "Send SIGKILL if graceful stop times out")
         .option("--listen <listen>", "Listen target for restarted daemon (host:port, port, or unix socket)")
         .option("--port <port>", "Port for restarted daemon listen target")
+        .option("--relay", "Enable relay on restarted daemon")
         .option("--no-relay", "Disable relay on restarted daemon")
         .option("--no-mcp", "Disable Agent MCP on restarted daemon")
         .option("--hostnames <hosts>", 'Daemon hostnames (comma-separated, e.g. "myhost,.example.com" or "true" for any)')
@@ -108,13 +107,10 @@ export function createCli() {
     program.addCommand(createDaemonCommand());
     program.addCommand(createHubCommand());
     // Chat commands
-    program.addCommand(createChatCommand());
     // Terminal commands
     program.addCommand(createTerminalCommand());
     // Workspace script commands
     program.addCommand(createScriptCommand());
-    // Loop commands
-    program.addCommand(createLoopCommand());
     // Schedule commands
     program.addCommand(createScheduleCommand());
     program.addCommand(createHeartbeatCommand());

package/dist/commands/daemon/index.js

@@ -33,6 +33,7 @@ export function createDaemonCommand() {
         .option("--force", "Send SIGKILL if graceful stop times out")
         .option("--listen <listen>", "Listen target for restarted daemon (host:port, port, or unix socket)")
         .option("--port <port>", "Port for restarted daemon listen target")
+        .option("--relay", "Enable relay on restarted daemon")
         .option("--no-relay", "Disable relay on restarted daemon")
         .option("--no-mcp", "Disable Agent MCP on restarted daemon")
         .option("--no-inject-mcp", "Disable auto-injecting the Otto MCP into created agents")

package/dist/commands/daemon/local-daemon.js

@@ -31,6 +31,9 @@ function envWithHome(home) {
 }
 function buildRunnerArgs(options) {
     const args = [];
+    if (options.relay === true) {
+        args.push("--relay");
+    }
     if (options.relay === false) {
         args.push("--no-relay");
     }

package/dist/commands/daemon/pair.d.ts

@@ -2,8 +2,34 @@ import { Command } from "commander";
 interface PairOptions {
     home?: string;
     json?: boolean;
+    relay?: boolean;
+}
+export interface PairCommandDependencies {
+    resolveOffer: typeof resolveLocalPairingOffer;
+    confirmRelay: typeof confirmRelayPairing;
+    printDirectGuidance: typeof printDirectConnectionGuidance;
+    isInteractive: () => boolean;
+    output: PairCommandOutput;
+}
+export interface PairCommandOutput {
+    columns: number | undefined;
+    writeStdout(message: string): void;
+    writeStderr(message: string): void;
+    setExitCode(code: number): void;
+    success(message: string): void;
+}
+export interface PairingOffer {
+    relayEnabled: boolean;
+    url: string | null;
+    qr: string | null;
 }
 export declare function pairCommand(): Command;
-export declare function runPairCommand(options: PairOptions): Promise<void>;
+export declare function resolveLocalPairingOffer(options: {
+    ottoHome: string;
+    enableRelay?: boolean;
+}): Promise<PairingOffer>;
+export declare function confirmRelayPairing(): Promise<boolean>;
+export declare function printDirectConnectionGuidance(): void;
+export declare function runPairCommand(options: PairOptions, dependencyOverrides?: Partial<PairCommandDependencies>): Promise<void>;
 export {};
 //# sourceMappingURL=pair.d.ts.map

package/dist/commands/daemon/pair.js

@@ -1,52 +1,53 @@
+import { confirm, isCancel, log } from "@clack/prompts";
 import { Command } from "commander";
 import chalk from "chalk";
-import { generateLocalPairingOffer, loadConfig, resolveOttoHome } from "@otto-code/server";
+import { generateLocalPairingOffer, getOrCreateServerId, loadConfig, resolveOttoHome, } from "@otto-code/server";
 import { tryConnectToDaemon } from "../../utils/client.js";
-import { resolveLocalDaemonState, resolveTcpHostFromListen } from "./local-daemon.js";
+import { resolveLocalDaemonState } from "./local-daemon.js";
 import { addJsonOption } from "../../utils/command-options.js";
 import { formatPairingInstructions } from "../../output/pairing.js";
 const PAIRING_DAEMON_RPC_TIMEOUT_MS = 1500;
+const RELAY_DOCS_URL = "https://otto-code.me/docs/security";
+function createProcessOutput() {
+    return {
+        columns: process.stdout.columns,
+        writeStdout(message) {
+            process.stdout.write(message);
+        },
+        writeStderr(message) {
+            process.stderr.write(message);
+        },
+        setExitCode(code) {
+            process.exitCode = code;
+        },
+        success(message) {
+            log.success(message);
+        },
+    };
+}
 export function pairCommand() {
     return addJsonOption(new Command("pair").description("Print the daemon pairing QR code and link"))
         .option("--home <path>", "Otto home directory (default: ~/.otto)")
+        .option("--relay", "Enable relay without prompting")
         .action(async (_options, command) => {
         await runPairCommand(command.optsWithGlobals());
     });
 }
-export async function runPairCommand(options) {
-    if (options.home) {
-        process.env.OTTO_HOME = options.home;
+export async function resolveLocalPairingOffer(options) {
+    const state = resolveLocalDaemonState({ home: options.ottoHome });
+    const serverId = getOrCreateServerId(state.home);
+    const daemonOffer = await resolveDaemonPairingOffer(state.listen, serverId, options.enableRelay);
+    if (daemonOffer)
+        return daemonOffer;
+    if (state.running) {
+        throw new Error("The running daemon did not provide a pairing offer. Check daemon connectivity or update the daemon.");
     }
-    const ottoHome = resolveOttoHome();
-    const state = resolveLocalDaemonState({ home: ottoHome });
-    const host = resolveTcpHostFromListen(state.listen);
-    // Try to get the pairing offer from the running daemon first.
-    if (host) {
-        const client = await tryConnectToDaemon({ host, timeout: 1500 });
-        if (client) {
-            const supportsDaemonStatusRpc = client.getLastServerInfoMessage()?.features?.daemonStatusRpc === true;
-            if (supportsDaemonStatusRpc) {
-                try {
-                    const offer = await client.getDaemonPairingOffer({
-                        timeout: PAIRING_DAEMON_RPC_TIMEOUT_MS,
-                    });
-                    await client.close().catch(() => { });
-                    outputPairingResult({ relayEnabled: offer.relayEnabled, url: offer.url, qr: offer.qr ?? null }, options);
-                    return;
-                }
-                catch {
-                    // COMPAT(daemon-rpc-rollout): fall back to CLI-side pairing generation while
-                    // old daemons lack daemonStatusRpc. Remove once the daemon floor is past
-                    // v0.1.76; pairing should come from daemon.get_pairing_offer.
-                }
-            }
-            await client.close().catch(() => { });
-        }
+    const config = loadConfig(options.ottoHome);
+    if (options.enableRelay && !config.relayEnabled) {
+        throw new Error("Start the daemon before enabling relay for pairing.");
     }
-    // Fall back to local pairing offer generation.
-    const config = loadConfig(ottoHome);
-    const pairing = await generateLocalPairingOffer({
-        ottoHome,
+    return generateLocalPairingOffer({
+        ottoHome: options.ottoHome,
         relayEnabled: config.relayEnabled,
         relayEndpoint: config.relayEndpoint,
         relayPublicEndpoint: config.relayPublicEndpoint,
@@ -55,26 +56,112 @@ export async function runPairCommand(options) {
         appBaseUrl: config.appBaseUrl,
         includeQr: true,
     });
-    outputPairingResult(pairing, options);
 }
-function outputPairingResult(pairing, options) {
+async function resolveDaemonPairingOffer(listen, expectedServerId, enableRelay) {
+    const client = await tryConnectToDaemon({
+        host: listen,
+        timeout: PAIRING_DAEMON_RPC_TIMEOUT_MS,
+    });
+    if (!client)
+        return null;
+    try {
+        const serverInfo = client.getLastServerInfoMessage();
+        if (serverInfo?.serverId.trim() !== expectedServerId) {
+            throw new Error("The reachable daemon belongs to a different Otto home. Check --home or the daemon listen configuration.");
+        }
+        if (serverInfo?.features?.daemonStatusRpc !== true) {
+            throw new Error("Update the Otto daemon before pairing from this command.");
+        }
+        let offer = await client.getDaemonPairingOffer({
+            timeout: PAIRING_DAEMON_RPC_TIMEOUT_MS,
+        });
+        if (!offer.relayEnabled && enableRelay) {
+            if (serverInfo.features.relayConfig !== true) {
+                throw new Error("Update the Otto daemon before enabling relay from this command.");
+            }
+            await client.patchDaemonConfig({ relay: { enabled: true } });
+            offer = await client.getDaemonPairingOffer({
+                timeout: PAIRING_DAEMON_RPC_TIMEOUT_MS,
+            });
+        }
+        return {
+            relayEnabled: offer.relayEnabled,
+            url: offer.url || null,
+            qr: offer.qr ?? null,
+        };
+    }
+    finally {
+        await client.close().catch(() => undefined);
+    }
+}
+export async function confirmRelayPairing() {
+    log.message("Your connection is end-to-end encrypted. Otto cannot read your code or messages.");
+    log.message(`Learn how it works: ${RELAY_DOCS_URL}`);
+    const answer = await confirm({
+        message: "Enable relay to pair a device?",
+        initialValue: false,
+    });
+    return !isCancel(answer) && answer;
+}
+export function printDirectConnectionGuidance() {
+    console.log("Daemon is running with relay off.");
+    console.log("To connect another device directly, use the daemon's TCP address over your LAN, Tailscale, or another VPN.");
+    console.log(`Learn more: ${RELAY_DOCS_URL}#direct-connections`);
+}
+export async function runPairCommand(options, dependencyOverrides = {}) {
+    if (options.home)
+        process.env.OTTO_HOME = options.home;
+    const dependencies = {
+        resolveOffer: resolveLocalPairingOffer,
+        confirmRelay: confirmRelayPairing,
+        printDirectGuidance: printDirectConnectionGuidance,
+        isInteractive: () => Boolean(process.stdin.isTTY && process.stdout.isTTY),
+        output: createProcessOutput(),
+        ...dependencyOverrides,
+    };
+    const ottoHome = resolveOttoHome();
+    let pairing = await dependencies.resolveOffer({
+        ottoHome,
+        enableRelay: options.relay === true,
+    });
+    const canPrompt = dependencies.isInteractive() && options.json !== true;
+    if (!pairing.relayEnabled && canPrompt) {
+        const shouldEnable = await dependencies.confirmRelay();
+        if (!shouldEnable) {
+            dependencies.printDirectGuidance();
+            dependencies.output.writeStderr(`${chalk.yellow("No pairing QR was created.")}\n`);
+            dependencies.output.setExitCode(1);
+            return;
+        }
+        pairing = await dependencies.resolveOffer({ ottoHome, enableRelay: true });
+        dependencies.output.success("Relay enabled");
+    }
+    outputPairingResult(pairing, options, dependencies.output);
+}
+function outputPairingResult(pairing, options, output) {
     if (!pairing.relayEnabled || !pairing.url) {
-        console.error(chalk.red("Relay pairing is disabled for this daemon config."));
-        console.error(chalk.yellow("Enable relay and run this command again."));
-        process.exit(1);
+        if (options.json) {
+            output.writeStderr(`${JSON.stringify({
+                code: "RELAY_DISABLED",
+                message: "Relay pairing is disabled for this daemon.",
+                action: "Run otto daemon pair --relay --json to enable it explicitly.",
+            })}\n`);
+        }
+        else {
+            output.writeStderr(`${chalk.red("Relay pairing is disabled for this daemon.")}\n`);
+            output.writeStderr(`${chalk.yellow("Run otto daemon pair --relay to enable it.")}\n`);
+        }
+        output.setExitCode(1);
+        return;
     }
     if (options.json) {
-        process.stdout.write(`${JSON.stringify({
-            relayEnabled: pairing.relayEnabled,
-            url: pairing.url,
-            qr: pairing.qr,
-        }, null, 2)}\n`);
+        output.writeStdout(`${JSON.stringify({ relayEnabled: pairing.relayEnabled, url: pairing.url, qr: pairing.qr }, null, 2)}\n`);
         return;
     }
-    process.stdout.write(formatPairingInstructions({
+    output.writeStdout(formatPairingInstructions({
         url: pairing.url,
         qr: pairing.qr,
-        columns: process.stdout.columns,
+        columns: output.columns,
     }));
 }
 //# sourceMappingURL=pair.js.map

package/dist/commands/daemon/start.js

@@ -9,6 +9,7 @@ export function startCommand() {
         .option("--port <port>", "Port to listen on (default: 6868)")
         .option("--home <path>", "Otto home directory (default: ~/.otto)")
         .option("--foreground", "Run in foreground (don't daemonize)")
+        .option("--relay", "Enable relay connection")
         .option("--no-relay", "Disable relay connection")
         .option("--relay-use-tls", "Use wss:// for the relay connection and pairing offers")
         .option("--no-mcp", "Disable the Agent MCP HTTP endpoint")

package/dist/commands/daemon/status.d.ts

@@ -4,6 +4,17 @@ interface StatusRow {
     key: string;
     value: string;
 }
+interface RelayStatusConfig {
+    enabled: boolean;
+    endpoint: string;
+    publicEndpoint: string;
+    useTls: boolean;
+    publicUseTls: boolean;
+}
+export declare function selectRelayStatus(input: {
+    persisted: RelayStatusConfig;
+    live?: RelayStatusConfig;
+}): string;
 export type StatusResult = ListResult<StatusRow>;
 export declare function runStatusCommand(options: CommandOptions, _command: Command): Promise<StatusResult>;
 export {};

package/dist/commands/daemon/status.js

@@ -1,7 +1,7 @@
 import { createRequire } from "node:module";
 import { getOrCreateServerId, findExecutable, execCommand } from "@otto-code/server";
 import { connectToDaemon } from "../../utils/client.js";
-import { resolveLocalDaemonState, resolveTcpHostFromListen } from "./local-daemon.js";
+import { resolveLocalDaemonState } from "./local-daemon.js";
 import { resolveNodePathFromPid } from "./runtime-toolchain.js";
 const DAEMON_STATUS_PROBE_TIMEOUT_MS = 1500;
 const require = createRequire(import.meta.url);
@@ -203,12 +203,19 @@ async function probeDaemonOverWebsocket(args) {
             version: p.available ? null : (p.error ?? null),
             source: "daemon",
         }));
+        const relayStatus = statusPayload.relay == null
+            ? undefined
+            : selectRelayStatus({
+                persisted: relayConfigFromLocalState(state),
+                live: statusPayload.relay,
+            });
         if (!state.running) {
             return {
                 connectedDaemon: "reachable",
                 daemonVersion: statusPayload.version ?? daemonVersion,
                 daemonNodeOverride: statusPayload.nodePath,
                 daemonProviders,
+                relayStatus,
                 note: state.pidInfo
                     ? `Connected daemon is reachable at ${host} even though local daemon PID ${state.pidInfo.pid} is stale`
                     : `Connected daemon is reachable at ${host} but no local daemon PID file was found`,
@@ -219,6 +226,7 @@ async function probeDaemonOverWebsocket(args) {
             daemonVersion: statusPayload.version ?? daemonVersion,
             daemonNodeOverride: statusPayload.nodePath,
             daemonProviders,
+            relayStatus,
         };
     }
     catch {
@@ -242,6 +250,7 @@ function applyProbeToStatus(input) {
         daemonNode: probe.daemonNodeOverride ?? input.daemonNode,
         daemonVersion: probe.daemonVersion !== undefined ? probe.daemonVersion : input.daemonVersion,
         daemonProviders: probe.daemonProviders ?? input.daemonProviders,
+        relayStatus: probe.relayStatus ?? input.relayStatus,
         note: probe.note ? appendNote(input.note, probe.note) : input.note,
     };
 }
@@ -264,16 +273,26 @@ async function resolveDaemonNodeLabel(state) {
     const fromPid = await resolveNodePathFromPid(state.pidInfo.pid);
     return fromPid.nodePath ?? `unknown (${fromPid.error ?? "could not resolve from PID"})`;
 }
-function formatRelayStatus(state) {
-    if (!state.relayEnabled)
+function relayConfigFromLocalState(state) {
+    return {
+        enabled: state.relayEnabled,
+        endpoint: state.relayEndpoint,
+        publicEndpoint: state.relayEndpoint,
+        useTls: state.relayUseTls,
+        publicUseTls: state.relayPublicUseTls,
+    };
+}
+export function selectRelayStatus(input) {
+    const relay = input.live ?? input.persisted;
+    if (!relay.enabled)
         return "disabled";
-    const scheme = state.relayPublicUseTls ? "wss" : "ws";
-    return `${scheme}://${state.relayEndpoint}`;
+    const scheme = relay.publicUseTls ? "wss" : "ws";
+    return `${scheme}://${relay.publicEndpoint}`;
 }
 export async function runStatusCommand(options, _command) {
     const home = typeof options.home === "string" ? options.home : undefined;
     const state = resolveLocalDaemonState({ home });
-    const host = resolveTcpHostFromListen(state.listen);
+    const daemonTarget = state.listen.trim();
     const owner = resolveOwnerLabel(state.pidInfo?.uid, state.pidInfo?.hostname);
     let daemonNode = await resolveDaemonNodeLabel(state);
     const cliNode = process.execPath;
@@ -281,26 +300,32 @@ export async function runStatusCommand(options, _command) {
     let connectedDaemon = "not_probed";
     let daemonVersion = null;
     let daemonProviders;
+    let relayStatus = selectRelayStatus({ persisted: relayConfigFromLocalState(state) });
     let note;
     if (!state.running && state.stalePidFile && state.pidInfo) {
         localDaemon = "stale_pid";
         note = `Stale PID file found for PID ${state.pidInfo.pid}`;
     }
-    if (host) {
-        const probe = await probeDaemonOverWebsocket({ host, state });
-        ({ connectedDaemon, localDaemon, daemonNode, daemonVersion, daemonProviders, note } =
-            applyProbeToStatus({
-                probe,
-                connectedDaemon,
-                localDaemon,
-                daemonNode,
-                daemonVersion,
-                daemonProviders,
-                note,
-            }));
-    }
-    else {
-        note = appendNote(note, "Daemon is configured for unix socket listen; API probe skipped");
+    if (daemonTarget) {
+        const probe = await probeDaemonOverWebsocket({ host: daemonTarget, state });
+        ({
+            connectedDaemon,
+            localDaemon,
+            daemonNode,
+            daemonVersion,
+            daemonProviders,
+            relayStatus,
+            note,
+        } = applyProbeToStatus({
+            probe,
+            connectedDaemon,
+            localDaemon,
+            daemonNode,
+            daemonVersion,
+            daemonProviders,
+            relayStatus,
+            note,
+        }));
     }
     const cliVersion = resolveCliVersion();
     const serverIdResult = resolveServerIdSafely(state.home);
@@ -315,7 +340,7 @@ export async function runStatusCommand(options, _command) {
         connectedDaemon,
         home: state.home,
         listen: state.listen,
-        relay: formatRelayStatus(state),
+        relay: relayStatus,
         hostname: state.pidInfo?.hostname ?? null,
         pid: state.pidInfo?.pid ?? null,
         startedAt: state.pidInfo?.startedAt ?? null,

package/dist/commands/hub/authority.d.ts

@@ -0,0 +1,17 @@
+import type { HubCredentialStore } from "./credentials.js";
+export interface HubAuthorityOptions {
+    origin?: string;
+    apiKey?: string;
+}
+interface ResolveHubInput {
+    options: HubAuthorityOptions;
+    env: Readonly<Record<string, string | undefined>>;
+    credentials: HubCredentialStore;
+}
+export declare const DEFAULT_HUB_ORIGIN = "https://hub.otto-code.me";
+export declare function resolveHubOrigin(input: ResolveHubInput): string;
+export declare function resolveHubCredential(input: ResolveHubInput & {
+    origin: string;
+}): string;
+export {};
+//# sourceMappingURL=authority.d.ts.map

package/dist/commands/hub/authority.js

@@ -0,0 +1,18 @@
+import { HubCommandError } from "./error.js";
+import { normalizeHubOrigin } from "./origin.js";
+export const DEFAULT_HUB_ORIGIN = "https://hub.otto-code.me";
+export function resolveHubOrigin(input) {
+    const configuredOrigin = input.options.origin ?? input.env.OTTO_HUB_URL;
+    const selectedOrigin = configuredOrigin ?? input.credentials.active()?.origin ?? DEFAULT_HUB_ORIGIN;
+    return normalizeHubOrigin(selectedOrigin);
+}
+export function resolveHubCredential(input) {
+    const explicitCredential = input.options.apiKey ?? input.env.OTTO_HUB_API_KEY;
+    if (explicitCredential !== undefined)
+        return explicitCredential;
+    const stored = input.credentials.get(input.origin);
+    if (stored !== null)
+        return stored.credential;
+    throw new HubCommandError("HUB_API_KEY_REQUIRED", `No stored Hub login matches ${input.origin}. Run \`otto hub login ${input.origin}\`, pass --api-key <secret>, or set OTTO_HUB_API_KEY.`);
+}
+//# sourceMappingURL=authority.js.map

package/dist/commands/hub/connect.d.ts

@@ -0,0 +1,21 @@
+import type { Command } from "commander";
+import type { HubHttpClient } from "./hub-client/index.js";
+import type { HubCredentialStore } from "./credentials.js";
+import type { HubDaemonConnection } from "./daemon-client.js";
+import { type HubReporter } from "./reporter.js";
+interface HubConnectOptions {
+    apiKey?: string;
+    host?: string;
+    json?: boolean;
+}
+interface HubConnectDependencies {
+    env: Readonly<Record<string, string | undefined>>;
+    credentials: HubCredentialStore;
+    hub: Pick<HubHttpClient, "issueEnrollmentToken">;
+    daemon: HubDaemonConnection;
+    reporter: HubReporter;
+}
+export declare function runHubConnect(originInput: string | undefined, options: HubConnectOptions, dependencies: HubConnectDependencies): Promise<import("../../output/types.js").ListResult<import("./status-output.js").HubRow>>;
+export declare function addHubConnectCommand(parent: Command, dependencies: HubConnectDependencies): void;
+export {};
+//# sourceMappingURL=connect.d.ts.map

package/dist/commands/hub/connect.js

@@ -0,0 +1,34 @@
+import { withOutput } from "../../output/index.js";
+import { addJsonAndDaemonHostOptions } from "../../utils/command-options.js";
+import { resolveHubCredential, resolveHubOrigin } from "./authority.js";
+import { withHubDaemon } from "./daemon-client.js";
+import { hubStatusResult } from "./status-output.js";
+import { reportHubProgress } from "./reporter.js";
+import { addHubResolutionHelp } from "./help.js";
+export async function runHubConnect(originInput, options, dependencies) {
+    const resolution = {
+        options: { origin: originInput, apiKey: options.apiKey },
+        env: dependencies.env,
+        credentials: dependencies.credentials,
+    };
+    const origin = resolveHubOrigin(resolution);
+    reportHubProgress(dependencies.reporter, options, `Connecting this daemon to ${origin}`);
+    const credential = resolveHubCredential({ ...resolution, origin });
+    const token = await dependencies.hub.issueEnrollmentToken(origin, credential);
+    return withHubDaemon(dependencies.daemon, options.host, async (daemon) => {
+        const response = await daemon.connectHub(origin, token);
+        return hubStatusResult(response.status);
+    });
+}
+export function addHubConnectCommand(parent, dependencies) {
+    addJsonAndDaemonHostOptions(addHubResolutionHelp(parent
+        .command("connect")
+        .description("Enroll this daemon with a Paseo Hub")
+        .argument("[origin]", "Paseo Hub origin")
+        .option("--api-key <secret>", "Organization API key"))).action(withOutput(async (...args) => {
+        const origin = args[0];
+        const options = args.at(-2);
+        return runHubConnect(origin, options, dependencies);
+    }));
+}
+//# sourceMappingURL=connect.js.map

package/dist/commands/hub/credentials.d.ts

@@ -0,0 +1,21 @@
+export interface StoredHubCredential {
+    origin: string;
+    credential: string;
+}
+export interface HubCredentialStore {
+    active(): StoredHubCredential | null;
+    get(origin: string): StoredHubCredential | null;
+    save(credential: StoredHubCredential): void;
+    logoutActive(): StoredHubCredential | null;
+}
+export declare class PrivateHubCredentialStore implements HubCredentialStore {
+    private readonly filePath;
+    constructor(env?: Readonly<Record<string, string | undefined>>);
+    active(): StoredHubCredential | null;
+    get(origin: string): StoredHubCredential | null;
+    save(credential: StoredHubCredential): void;
+    logoutActive(): StoredHubCredential | null;
+    private read;
+    private write;
+}
+//# sourceMappingURL=credentials.d.ts.map