@pablopunk/tau 0.0.0-stage → 0.1.0

package/dist/main-CI9q691u.js

@@ -0,0 +1,1490 @@
+import { $ as routes, B as COMMAND_NOUNS, G as isModelRefNode, H as commandOf, J as LIVE_PATH, K as routeFields, L as isErrorBody, M as decodeServerFrame, N as encodeFrame, U as commands, V as FLOW_COMMANDS, W as flagNameOf, Z as fillPath, a as readRunningInstance, c as lastAssistantText, it as RedeemPairingResponseSchema, l as viewToText, nt as nextViewState, z as AUTO_FIELDS } from "./wait-for-lock-D2V3vuye.js";
+import { a as lifecycleFlagsOf, c as createHubFileStore, i as commandWordOf, l as alreadyLinkedRefusal, n as serverLogOf, o as cliVersion, r as writeStoredPort, s as readOrCreateToken, t as serveInForeground, u as connectRefusal } from "./serve-92lMbcls.js";
+import { a as TemporaryEntryError, i as realContext, r as createServiceManager, t as runServiceCommand } from "./service-command-C7WDeeR2.js";
+import { t as cliEntry } from "./cli-entry-DcDpQ30L.js";
+import { createReadStream, existsSync, readFileSync, statSync, watchFile } from "node:fs";
+import { join } from "node:path";
+import { homedir, hostname } from "node:os";
+import { fileURLToPath } from "node:url";
+import { promisify } from "node:util";
+import { randomUUID } from "node:crypto";
+import { readFile, readdir } from "node:fs/promises";
+import { execFile } from "node:child_process";
+import { Value } from "typebox/value";
+import { createInterface } from "node:readline/promises";
+import QRCode from "qrcode";
+//#region ../protocol/src/live-info.ts
+function docOf(view, kind) {
+	return view.docs[kind];
+}
+function isQueuedMessage(item) {
+	return item.mode === "steer" || item.mode === "followUp";
+}
+function queuedBlocks(item) {
+	const content = item.content;
+	if (typeof content === "string") return content;
+	const blocks = content?.content;
+	if (typeof blocks === "string") return blocks;
+	return Array.isArray(blocks) ? blocks : [];
+}
+function queuedText(item) {
+	const blocks = queuedBlocks(item);
+	if (typeof blocks === "string") return blocks;
+	return blocks.map((block) => block.type === "text" ? block.text : "").join("");
+}
+function queuedImages(item) {
+	const blocks = queuedBlocks(item);
+	if (typeof blocks === "string") return [];
+	return blocks.filter((block) => block.type === "image");
+}
+function queuedOf(item) {
+	return {
+		id: Number(item.id),
+		mode: item.mode,
+		text: queuedText(item),
+		images: queuedImages(item)
+	};
+}
+function retryOf(live) {
+	const generation = live.generation;
+	if (!generation?.retry) return void 0;
+	return {
+		attempt: generation.attempt,
+		...generation.retry
+	};
+}
+function readLive(view) {
+	const live = docOf(view, "pi.live") ?? {};
+	const inbox = docOf(view, "pi.inbox");
+	return {
+		busy: live.run !== void 0,
+		streaming: live.generation?.message,
+		retry: retryOf(live),
+		slots: live.tools ?? [],
+		compacting: (live.compactions?.length ?? 0) > 0,
+		queued: (inbox?.items ?? []).filter(isQueuedMessage).map(queuedOf)
+	};
+}
+/** A failure that ends the command with a message on stderr and an exit code. */
+var CliExit = class extends Error {
+	exitCode;
+	constructor(exitCode, message) {
+		super(message);
+		this.name = "CliExit";
+		this.exitCode = exitCode;
+	}
+};
+const usageError = (message) => new CliExit(2, message);
+const failure = (message) => new CliExit(1, message);
+const NOT_RUNNING_MESSAGE = "tau is not running. Run `tau` to start it.";
+//#endregion
+//#region src/machines/connect-args.ts
+const USAGE = "Usage: tau connect <link | code --hub <url>> [--name <label>] [--yes]";
+function parseConnectArgs(argv) {
+	let target;
+	let hub;
+	let name;
+	let yes = false;
+	for (let index = 0; index < argv.length; index++) {
+		const token = argv[index];
+		const next = argv[index + 1];
+		if (token === "--hub" && next !== void 0) hub = argv[++index];
+		else if (token.startsWith("--hub=")) hub = token.slice(6);
+		else if (token === "--name" && next !== void 0) name = argv[++index];
+		else if (token.startsWith("--name=")) name = token.slice(7);
+		else if (token === "--yes" || token === "-y") yes = true;
+		else if (!token.startsWith("-") && target === void 0) target = token;
+		else throw usageError(`Unknown argument "${token}". ${USAGE}`);
+	}
+	if (target === void 0) throw usageError(USAGE);
+	return {
+		target,
+		...hub !== void 0 && { hub },
+		name: name?.trim() || hostname(),
+		yes
+	};
+}
+//#endregion
+//#region src/machines/connect-io.ts
+async function ask(question) {
+	if (!process.stdin.isTTY) throw usageError("This needs a terminal. Add --yes to skip the question.");
+	const lines = createInterface({
+		input: process.stdin,
+		output: process.stdout
+	});
+	try {
+		return (await lines.question(question)).trim().toLowerCase();
+	} finally {
+		lines.close();
+	}
+}
+const terminalIo = {
+	confirm: async (question) => ["y", "yes"].includes(await ask(`${question} [y/N] `)),
+	async chooseStart() {
+		const answer = await ask("tau is not running here. Start it for this session (s), install it as a service (i), or neither (n)? [s/i/N] ");
+		return answer === "s" ? "serve" : answer === "i" ? "service" : "none";
+	}
+};
+//#endregion
+//#region src/machines/connect-target.ts
+const LOOPBACK = /* @__PURE__ */ new Set([
+	"127.0.0.1",
+	"localhost",
+	"[::1]"
+]);
+/** `https://` always; `http://` only for loopback (the same-Mac test with `--hub http://127.0.0.1:<port>`). */
+function normalizeHubUrl(input) {
+	let url;
+	try {
+		url = new URL(input);
+	} catch {
+		throw usageError(`"${input}" is not a hub URL. Example: https://abc123.opentunnel.xyz`);
+	}
+	const loopback = LOOPBACK.has(url.hostname);
+	if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback)) throw usageError("The hub URL must start with https:// (http:// only for 127.0.0.1 or localhost).");
+	return url.origin;
+}
+/**
+* `tau connect <link>` takes `https://<hostname>/pair#<code>[.<name>]`; `tau connect <short code> --hub <url>`
+* takes the 8-character code. There is no unauthenticated endpoint that returns the hub's name, so it rides in the link.
+*/
+function parseConnectTarget(input, hub) {
+	if (!input.includes("/")) {
+		if (hub === void 0) throw usageError("A short code needs the hub: tau connect <code> --hub <url>");
+		return {
+			hubUrl: normalizeHubUrl(hub),
+			code: input.replace(/\s+/g, "")
+		};
+	}
+	normalizeHubUrl(input);
+	const url = new URL(input);
+	const fragment = url.hash.replace(/^#/, "");
+	if (url.pathname !== "/pair" || fragment === "") throw usageError("That is not a link code. Make one in Settings → Machines on the hub.");
+	const dot = fragment.indexOf(".");
+	const code = dot < 0 ? fragment : fragment.slice(0, dot);
+	const name = dot < 0 ? "" : decodeURIComponent(fragment.slice(dot + 1));
+	return {
+		hubUrl: url.origin,
+		code,
+		...name !== "" && { hubName: name }
+	};
+}
+//#endregion
+//#region src/commands/client.ts
+const URL_POLL_MS = 100;
+async function waitForLockUrl(home, env) {
+	const deadline = env.now() + env.startupWaitMs;
+	for (;;) {
+		const info = await readRunningInstance(home);
+		if (!info) throw failure(NOT_RUNNING_MESSAGE);
+		if (info.url) return info.url;
+		if (env.now() >= deadline) throw failure("tau is starting but has not published its URL yet.");
+		await env.sleep(URL_POLL_MS);
+	}
+}
+async function readToken(home) {
+	try {
+		return (await readFile(join(home, "token"), "utf8")).trim();
+	} catch {
+		throw failure(NOT_RUNNING_MESSAGE);
+	}
+}
+/** The lock gives the URL and `<home>/token` the secret. Retries while a live server has no URL yet. */
+async function discoverServer(env) {
+	return {
+		url: await waitForLockUrl(env.home, env),
+		token: await readToken(env.home)
+	};
+}
+const queryString = (query) => {
+	const entries = Object.entries(query ?? {});
+	return entries.length === 0 ? "" : `?${new URLSearchParams(entries).toString()}`;
+};
+async function errorMessageOf$1(response) {
+	const text = await response.text();
+	try {
+		const parsed = JSON.parse(text);
+		if (isErrorBody(parsed)) return `${parsed.error.code}: ${parsed.error.message}`;
+	} catch {}
+	return `HTTP ${response.status}${text ? `: ${text.slice(0, 200)}` : ""}`;
+}
+async function send(server, name, request, env) {
+	const route = routes[name];
+	const target = `${server.url}${fillPath(route.path, request.params)}${queryString(request.query)}`;
+	const hasBody = request.body !== void 0;
+	try {
+		return await env.fetch(target, {
+			method: route.method,
+			headers: {
+				authorization: `Bearer ${server.token}`,
+				...hasBody ? { "content-type": "application/json" } : {}
+			},
+			body: hasBody ? JSON.stringify(request.body) : void 0
+		});
+	} catch {
+		throw failure(NOT_RUNNING_MESSAGE);
+	}
+}
+/** Calls one route. Returns the parsed JSON, or `undefined` for an empty answer. An `AppError` becomes a failure. */
+async function callRoute(server, name, request, env) {
+	const response = await send(server, name, request, env);
+	if (!response.ok) throw failure(await errorMessageOf$1(response));
+	const text = await response.text();
+	return text ? JSON.parse(text) : void 0;
+}
+//#endregion
+//#region src/commands/command-env.ts
+const defaultOpenSocket = (url, headers) => {
+	return new WebSocket(url, { headers });
+};
+const homeOf = (env) => env.TAU_HOME ?? join(homedir(), ".tau");
+function processEnv() {
+	return {
+		home: homeOf(process.env),
+		env: process.env,
+		stdout: (text) => void process.stdout.write(`${text}\n`),
+		stderr: (text) => void process.stderr.write(`${text}\n`),
+		fetch: (input, init) => fetch(input, init),
+		openSocket: defaultOpenSocket,
+		sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+		after: (ms, fn) => {
+			const timer = setTimeout(fn, ms);
+			return () => clearTimeout(timer);
+		},
+		now: Date.now,
+		startupWaitMs: 5e3,
+		pollMs: 2e3,
+		skillPaths: []
+	};
+}
+//#endregion
+//#region src/commands/command-flags.ts
+const WAIT_COMMANDS = ["threads start", "threads send"];
+const COMMON_FLAGS = [
+	{
+		name: "json",
+		kind: "value",
+		valueKind: "output",
+		summary: "Whole request body as JSON (replaces the flags)"
+	},
+	{
+		name: "yes",
+		kind: "boolean",
+		valueKind: "output",
+		summary: "Confirm a destructive command"
+	},
+	{
+		name: "home",
+		kind: "value",
+		valueKind: "output",
+		summary: "Tau data home (default: TAU_HOME or ~/.tau)"
+	}
+];
+const WAIT_FLAGS = [{
+	name: "wait",
+	kind: "boolean",
+	valueKind: "output",
+	summary: "Wait until the thread is done, then print the answer"
+}, {
+	name: "timeout",
+	kind: "value",
+	valueKind: "output",
+	summary: "Seconds to wait (default 600)"
+}];
+const isLiteralBooleanString = (field) => field.node.anyOf?.every((member) => member.const === "true" || member.const === "false") ?? false;
+function valueKindOf(field) {
+	if (isModelRefNode(field.node)) return "model";
+	if (isLiteralBooleanString(field)) return "booleanString";
+	if (field.boolean) return "boolean";
+	const type = field.node.type;
+	return type === "number" || type === "integer" ? "number" : "string";
+}
+const isFlagField = (def, field) => !def.positionals.includes(field.path) && def.fixed?.[field.path] === void 0 && (field.primitive || isModelRefNode(field.node));
+function flagOf(field) {
+	const valueKind = valueKindOf(field);
+	const isBoolean = valueKind === "boolean" || valueKind === "booleanString";
+	return {
+		name: flagNameOf(field.name),
+		kind: isBoolean ? "boolean" : "value",
+		valueKind,
+		field,
+		summary: `${field.required ? "Required. " : ""}${field.source} field ${field.name}`
+	};
+}
+function commandFlags(def) {
+	const fieldFlags = routeFields(def.route).filter((field) => isFlagField(def, field)).map(flagOf);
+	const waitFlags = WAIT_COMMANDS.includes(def.command) ? WAIT_FLAGS : [];
+	return [
+		...fieldFlags,
+		...waitFlags,
+		...COMMON_FLAGS
+	];
+}
+const flagSpecOf = (flags) => Object.fromEntries(flags.map((flag) => [flag.name, flag.kind]));
+//#endregion
+//#region src/commands/scan-args.ts
+const NEGATION = /^no-(.+)$/;
+function booleanNameOf(name, spec) {
+	if (spec[name] === "boolean") return {
+		name,
+		value: true
+	};
+	const negated = NEGATION.exec(name)?.[1];
+	if (negated !== void 0 && spec[negated] === "boolean") return {
+		name: negated,
+		value: false
+	};
+}
+/** `--flag value`, `--flag=value`, `--flag` / `--no-flag` for booleans, `--` ends the flags. */
+function scanArgs(argv, spec) {
+	const positionals = [];
+	const flags = /* @__PURE__ */ new Map();
+	for (let index = 0; index < argv.length; index++) {
+		const token = argv[index];
+		if (token === "--") {
+			positionals.push(...argv.slice(index + 1));
+			break;
+		}
+		if (!token.startsWith("--")) {
+			positionals.push(token);
+			continue;
+		}
+		const [rawName, inline] = splitInline(token.slice(2));
+		const boolean = booleanNameOf(rawName, spec);
+		if (boolean && inline === void 0) {
+			flags.set(boolean.name, boolean.value);
+			continue;
+		}
+		if (spec[rawName] !== "value") throw usageError(`Unknown flag: --${rawName}`);
+		const value = inline ?? argv[++index];
+		if (value === void 0) throw usageError(`Flag --${rawName} needs a value`);
+		flags.set(rawName, value);
+	}
+	return {
+		positionals,
+		flags
+	};
+}
+function splitInline(text) {
+	const at = text.indexOf("=");
+	return at < 0 ? [text, void 0] : [text.slice(0, at), text.slice(at + 1)];
+}
+const NONE = "none";
+function parseModelRef(raw) {
+	const slash = raw.indexOf("/");
+	if (slash <= 0 || slash === raw.length - 1) throw usageError(`Expected provider/modelId, got: ${raw}`);
+	return {
+		provider: raw.slice(0, slash),
+		modelId: raw.slice(slash + 1)
+	};
+}
+function coerce(raw, kind, nullable) {
+	if (raw === NONE && nullable) return null;
+	if (typeof raw === "boolean") return kind === "booleanString" ? String(raw) : raw;
+	if (kind === "model") return parseModelRef(raw);
+	if (kind === "number") {
+		const value = Number(raw);
+		if (Number.isNaN(value)) throw usageError(`Expected a number, got: ${raw}`);
+		return value;
+	}
+	return raw;
+}
+function setPath(target, path, value) {
+	target[path.slice(path.indexOf(".") + 1)] = value;
+}
+function fieldAt(def, path) {
+	return routeFields(def.route).find((field) => field.path === path);
+}
+function targetOf(sources, path) {
+	if (path.startsWith("params.")) return sources.params;
+	return path.startsWith("query.") ? sources.query : sources.body;
+}
+function assignPositionals(def, values, sources) {
+	if (values.length < def.positionals.length) {
+		const missing = def.positionals.slice(values.length).map((path) => `<${path.split(".").pop()}>`);
+		throw usageError(`Missing ${missing.join(" ")}. Usage: tau ${def.command} ${usageOf(def)}`);
+	}
+	if (values.length > def.positionals.length) throw usageError(`Unexpected argument: ${values[def.positionals.length]}`);
+	let wholeBody;
+	def.positionals.forEach((path, index) => {
+		const raw = values[index];
+		if (path === "body") {
+			wholeBody = parseModelRef(raw);
+			return;
+		}
+		const field = fieldAt(def, path);
+		const kind = def.modelRefs?.includes(path) ? "model" : field ? valueKindOf(field) : "string";
+		setPath(targetOf(sources, path), path, coerce(raw, kind, field?.nullable ?? false));
+	});
+	return wholeBody;
+}
+function assignFlags(flags, given, sources) {
+	for (const flag of flags) {
+		const raw = given.get(flag.name);
+		if (raw === void 0 || !flag.field || flag.valueKind === "output") continue;
+		setPath(targetOf(sources, flag.field.path), flag.field.path, coerce(raw, flag.valueKind, flag.field.nullable));
+	}
+}
+function applyFixed(def, sources) {
+	for (const [path, value] of Object.entries(def.fixed ?? {})) setPath(targetOf(sources, path), path, value);
+}
+function defaultRequiredBooleans(def, sources) {
+	for (const field of routeFields(def.route)) {
+		const target = targetOf(sources, field.path);
+		if (field.source === "body" && field.required && field.boolean && target[field.name] === void 0) target[field.name] = false;
+	}
+}
+function fillAutoFields(def, body) {
+	for (const field of routeFields(def.route)) if (field.source === "body" && AUTO_FIELDS.includes(field.name) && body[field.name] === void 0) body[field.name] = randomUUID();
+}
+/** `tau mcp save docs --json '{…}'`: the body repeats the `name` the positional already gave. */
+function fillFromParams(def, params, body) {
+	const bodyNames = routeFields(def.route).filter((field) => field.source === "body").map((field) => field.name);
+	for (const [name, value] of Object.entries(params)) if (bodyNames.includes(name) && body[name] === void 0) body[name] = value;
+}
+function parseJsonBody(raw) {
+	try {
+		const value = JSON.parse(raw);
+		if (typeof value === "object" && value !== null && !Array.isArray(value)) return value;
+	} catch {}
+	throw usageError("--json needs a JSON object");
+}
+function checkSchema(schema, value, label) {
+	if (!schema) return;
+	const first = Array.from(Value.Errors(schema, value))[0];
+	if (!first) return;
+	const where = first.instancePath ? `${label}${first.instancePath.replaceAll("/", ".")}` : label;
+	throw usageError(`Invalid ${where}: ${first.message}`);
+}
+function validate(def, input) {
+	const route = routes[def.route];
+	checkSchema(route.params, input.params, "params");
+	checkSchema(route.query, input.query, "query");
+	checkSchema(route.body, input.body, "body");
+}
+function parseTimeout(raw) {
+	if (raw === void 0) return 600;
+	const seconds = Number(raw);
+	if (typeof raw === "boolean" || !(seconds > 0)) throw usageError("--timeout needs a number of seconds");
+	return seconds;
+}
+function bodyOf(def, sources, whole, json) {
+	if (!(routes[def.route].body !== void 0)) return void 0;
+	if (typeof json === "string") {
+		const body = parseJsonBody(json);
+		fillAutoFields(def, body);
+		fillFromParams(def, sources.params, body);
+		return body;
+	}
+	if (def.json) throw usageError(`tau ${def.command} needs --json '<body>'`);
+	if (whole !== void 0) return whole;
+	fillAutoFields(def, sources.body);
+	return sources.body;
+}
+const stringsOf = (record) => Object.fromEntries(Object.entries(record).map(([key, value]) => [key, String(value)]));
+/** Usage text for the positionals, for example `<id> <text>`. */
+function usageOf(def) {
+	return def.positionals.map((path) => `<${path === "body" ? "model" : path.split(".").pop()}>`).join(" ");
+}
+function findCommand(noun, verb) {
+	const def = verb === void 0 ? void 0 : commandOf(`${noun} ${verb}`);
+	if (def) return def;
+	const known = commands.filter((entry) => entry.command.startsWith(`${noun} `)).map((entry) => entry.command.slice(noun.length + 1));
+	throw usageError(`Unknown command: ${noun} ${verb ?? ""}. Try: ${known.join(", ")}`);
+}
+/** Argv after the verb, the table and the schemas give the route input. Throws a usage error. */
+function parseCommand(def, argv) {
+	const flags = commandFlags(def);
+	const { positionals, flags: given } = scanArgs(argv, flagSpecOf(flags));
+	const sources = {
+		params: {},
+		query: {},
+		body: {}
+	};
+	const whole = assignPositionals(def, positionals, sources);
+	assignFlags(flags, given, sources);
+	applyFixed(def, sources);
+	defaultRequiredBooleans(def, sources);
+	const input = {
+		params: stringsOf(sources.params),
+		query: stringsOf(sources.query),
+		body: bodyOf(def, sources, whole, given.get("json"))
+	};
+	validate(def, input);
+	return {
+		def,
+		input,
+		yes: given.get("yes") === true,
+		wait: given.get("wait") === true,
+		timeoutSeconds: parseTimeout(given.get("timeout")),
+		home: typeof given.get("home") === "string" ? given.get("home") : void 0
+	};
+}
+//#endregion
+//#region src/commands/help.ts
+const THREAD_EXTRAS = ["  wait <id>       Wait until the thread is done, then print the answer (--timeout <s>)", "  read <id>       Print the thread as text (--last <n>)"];
+const LIFECYCLE = [
+	"  start, stop, restart, status, open, logs, service   Run and manage the server",
+	"  serve           Run the server in the foreground",
+	"  skill           Print the tau skill for agents"
+];
+const pad = (text) => text.padEnd(26);
+function rootHelp() {
+	return [
+		"tau: chat with a coding agent from the browser, and control it from the shell.",
+		"",
+		"Usage: tau <command> [args]   (no command starts the server and opens the browser)",
+		"",
+		"Server:",
+		...LIFECYCLE,
+		"",
+		"API commands (output is JSON):",
+		...COMMAND_NOUNS.map((noun) => `  ${noun}`),
+		...FLOW_COMMANDS.map((word) => `  ${word}`),
+		"",
+		"Run `tau <noun> --help` for the commands of a noun, `tau <noun> <verb> --help` for one command."
+	].join("\n");
+}
+function nounHelp(noun) {
+	const lines = commands.filter((entry) => entry.command.startsWith(`${noun} `)).map((entry) => `  ${pad(`${entry.command.slice(noun.length + 1)} ${usageOf(entry)}`)}${entry.summary}`);
+	const extras = noun === "threads" ? THREAD_EXTRAS : [];
+	return [
+		`tau ${noun} <command>`,
+		"",
+		...lines,
+		...extras
+	].join("\n");
+}
+function commandHelp(command) {
+	const def = commandOf(command);
+	if (!def) throw usageError(`Unknown command: ${command}`);
+	const flags = commandFlags(def).map((flag) => {
+		const value = flag.kind === "value" ? " <value>" : "";
+		return `  ${pad(`--${flag.name}${value}`)}${flag.summary}`;
+	});
+	const destructive = def.destructive ? ["", "Destructive: needs --yes."] : [];
+	return [
+		`tau ${def.command} ${usageOf(def)}`,
+		def.summary,
+		"",
+		"Flags:",
+		...flags,
+		...destructive
+	].join("\n");
+}
+/** Nouns, the commands of a noun, or one command's positionals and flags. */
+function helpText(noun, verb) {
+	if (noun === void 0) return rootHelp();
+	if (!COMMAND_NOUNS.includes(noun)) throw usageError(`Unknown command: ${noun}`);
+	if (verb === void 0) return nounHelp(noun);
+	if (noun === "threads" && (verb === "wait" || verb === "read")) return nounHelp(noun);
+	return commandHelp(`${noun} ${verb}`);
+}
+/** `tau help [noun [verb]]` and `tau --help`. */
+async function runHelp(argv) {
+	const words = argv.filter((word) => !word.startsWith("-"));
+	console.log(helpText(words[0], words[1]));
+}
+//#endregion
+//#region src/commands/own-thread.ts
+const GUARDED_COMMANDS = ["threads delete", "threads archive"];
+function lineageOf(all, ownId) {
+	const lineage = /* @__PURE__ */ new Set();
+	let current = ownId;
+	while (current && !lineage.has(current)) {
+		lineage.add(current);
+		current = all.find((item) => item.id === current)?.parentId;
+	}
+	return lineage;
+}
+/** An agent must not delete or archive the thread it runs in, or a thread above it. */
+async function assertNotOwnLineage(server, env, command, threadId) {
+	const ownId = env.env.TAU_THREAD_ID;
+	if (!ownId) return;
+	if (lineageOf(await callRoute(server, "listAllConversations", {}, env), ownId).has(threadId)) throw failure(`Refusing \`tau ${command}\`: ${threadId} is your own thread or one of its parents.`);
+}
+//#endregion
+//#region src/commands/live.ts
+const websocketUrlOf = (server) => `${server.url.replace(/^http/, "ws")}${LIVE_PATH}`;
+var NodeLiveClient = class {
+	socket;
+	views = /* @__PURE__ */ new Map();
+	frameListeners = [];
+	closeListeners = [];
+	pending = [];
+	open = false;
+	constructor(server, env) {
+		this.socket = env.openSocket(websocketUrlOf(server), { authorization: `Bearer ${server.token}` });
+		this.socket.onopen = () => {
+			this.open = true;
+			for (const frame of this.pending.splice(0)) this.socket.send(frame);
+		};
+		this.socket.onmessage = (event) => this.receive(String(event.data));
+		this.socket.onclose = () => {
+			for (const listener of this.closeListeners) listener();
+		};
+		this.socket.onerror = () => void 0;
+	}
+	receive(raw) {
+		const frame = decodeServerFrame(raw);
+		if (!frame) return;
+		if (frame.type === "ops") try {
+			this.views.set(frame.conversationId, nextViewState(this.views.get(frame.conversationId), frame.ops));
+		} catch {
+			return;
+		}
+		for (const listener of this.frameListeners) listener();
+	}
+	subscribe(conversationId) {
+		const frame = encodeFrame({
+			type: "subscribe",
+			conversationId
+		});
+		if (this.open) this.socket.send(frame);
+		else this.pending.push(frame);
+	}
+	view(conversationId) {
+		return this.views.get(conversationId);
+	}
+	onFrame(listener) {
+		this.frameListeners.push(listener);
+	}
+	onClose(listener) {
+		this.closeListeners.push(listener);
+	}
+	close() {
+		this.socket.close();
+	}
+};
+/** A Node WebSocket client for `subscribe`, `ops` and `changed` frames, with Bearer auth on upgrade. */
+const connectLive = (server, env) => new NodeLiveClient(server, env);
+//#endregion
+//#region src/commands/read.ts
+const READ_TIMEOUT_MS = 1e4;
+/** The first view frame of a thread, as text. `last` keeps the final N messages. */
+function readThread(server, env, conversationId, last) {
+	const live = connectLive(server, env);
+	live.subscribe(conversationId);
+	return new Promise((resolve, reject) => {
+		const cancel = env.after(READ_TIMEOUT_MS, () => end(() => reject(failure("Timed out reading the thread."))));
+		const end = (settle) => {
+			cancel();
+			live.close();
+			settle();
+		};
+		live.onClose(() => end(() => reject(failure("Lost the connection to tau."))));
+		live.onFrame(() => {
+			const view = live.view(conversationId);
+			if (view === void 0) return;
+			if (view === null) return end(() => reject(failure(`not_found: Unknown conversation: ${conversationId}`)));
+			end(() => resolve(viewToText(view, { last })));
+		});
+	});
+}
+//#endregion
+//#region src/commands/wait.ts
+const descendantsOf = (all, id) => {
+	const children = all.filter((item) => item.parentId === id);
+	return [...children, ...children.flatMap((child) => descendantsOf(all, child.id))];
+};
+const runEndedAfter = (summary, endedAfter) => {
+	if (endedAfter === void 0) return true;
+	if (summary.lastRunEndedAt === null) return false;
+	return endedAfter === null || summary.lastRunEndedAt > endedAfter;
+};
+function errorMessageOf(view) {
+	for (const entry of [...view.entries].reverse()) {
+		const message = entry.model?.[0];
+		if (message?.role === "assistant" && message.errorMessage) return message.errorMessage;
+	}
+	return "the thread ended in error";
+}
+/** The 4-condition rule: idle, a run ended after R0, an empty queue, and no running child. */
+function assessThread(all, conversationId, view, endedAfter) {
+	const summary = all.find((item) => item.id === conversationId);
+	if (!summary) throw failure(`not_found: Unknown conversation: ${conversationId}`);
+	if (summary.status === "error" && runEndedAfter(summary, endedAfter)) return {
+		state: "error",
+		message: errorMessageOf(view)
+	};
+	const idle = summary.status === "idle";
+	const live = readLive(view);
+	const queueEmpty = live.queued.length === 0;
+	const viewCaughtUp = !live.busy;
+	const childRunning = descendantsOf(all, conversationId).some((child) => child.agentStatus === "running");
+	return idle && runEndedAfter(summary, endedAfter) && queueEmpty && viewCaughtUp && !childRunning ? {
+		state: "done",
+		answer: lastAssistantText(view)
+	} : { state: "waiting" };
+}
+const listAll = async (server, env) => await callRoute(server, "listAllConversations", {}, env);
+/** Resolves with the last assistant answer. Exits 1 on an error thread, 3 on timeout. */
+function waitForThread(server, env, request) {
+	const live = connectLive(server, env);
+	live.subscribe(request.conversationId);
+	return new Promise((resolve, reject) => {
+		let finished = false;
+		let evaluating = false;
+		let again = false;
+		const cancels = [];
+		const finish = (settle) => {
+			if (finished) return;
+			finished = true;
+			for (const cancel of cancels) cancel();
+			live.close();
+			settle();
+		};
+		const check = async () => {
+			const view = live.view(request.conversationId);
+			if (view === void 0) return;
+			if (view === null) throw failure(`not_found: Unknown conversation: ${request.conversationId}`);
+			const result = assessThread(await listAll(server, env), request.conversationId, view, request.endedAfter);
+			if (result.state === "done") finish(() => resolve(result.answer));
+			if (result.state === "error") finish(() => reject(failure(result.message)));
+		};
+		const evaluate = async () => {
+			if (finished) return;
+			if (evaluating) {
+				again = true;
+				return;
+			}
+			evaluating = true;
+			try {
+				do {
+					again = false;
+					await check();
+				} while (again && !finished);
+			} catch (error) {
+				finish(() => reject(error));
+			}
+			evaluating = false;
+		};
+		const poll = () => {
+			cancels.push(env.after(env.pollMs, () => {
+				evaluate();
+				if (!finished) poll();
+			}));
+		};
+		live.onFrame(() => void evaluate());
+		live.onClose(() => finish(() => reject(failure("Lost the connection to tau."))));
+		cancels.push(env.after(request.timeoutSeconds * 1e3, () => finish(() => reject(new CliExit(3, `Timed out after ${request.timeoutSeconds}s`)))));
+		poll();
+	});
+}
+/** `lastRunEndedAt` of a thread now (R0), or `null` when it has never run. */
+async function runEndedAtOf(server, env, conversationId) {
+	const found = (await listAll(server, env)).find((item) => item.id === conversationId);
+	if (!found) throw failure(`not_found: Unknown conversation: ${conversationId}`);
+	return found.lastRunEndedAt;
+}
+//#endregion
+//#region src/commands/thread-extras.ts
+const EXTRA_THREAD_VERBS = ["wait", "read"];
+function positiveNumber(raw, flag) {
+	if (raw === void 0) return void 0;
+	const value = Number(raw);
+	if (typeof raw === "boolean" || !(value > 0)) throw usageError(`--${flag} needs a positive number`);
+	return value;
+}
+function threadIdOf(verb, positionals) {
+	if (positionals.length !== 1) throw usageError(`Usage: tau threads ${verb} <id>`);
+	return positionals[0];
+}
+/** `tau threads wait <id> [--timeout s]` and `tau threads read <id> [--last N]`. They are not routes. */
+async function runThreadExtra(verb, argv, env) {
+	const { positionals, flags } = scanArgs(argv, verb === "wait" ? {
+		timeout: "value",
+		home: "value"
+	} : {
+		last: "value",
+		home: "value"
+	});
+	const id = threadIdOf(verb, positionals);
+	const home = flags.get("home");
+	const scoped = typeof home === "string" ? {
+		...env,
+		home
+	} : env;
+	const server = await discoverServer(scoped);
+	if (verb === "read") {
+		const last = positiveNumber(flags.get("last"), "last");
+		env.stdout(await readThread(server, scoped, id, last));
+		return;
+	}
+	const timeoutSeconds = positiveNumber(flags.get("timeout"), "timeout") ?? 600;
+	env.stdout(await waitForThread(server, scoped, {
+		conversationId: id,
+		endedAfter: void 0,
+		timeoutSeconds
+	}));
+}
+//#endregion
+//#region src/commands/run-command.ts
+const wantsHelp$2 = (argv) => argv.includes("--help") || argv.includes("-h");
+const printJson = (env, result) => env.stdout(JSON.stringify(result === void 0 ? { ok: true } : result, null, 2));
+async function guardDestructive(server, env, parsed) {
+	const id = parsed.input.params.id;
+	if (id !== void 0 && GUARDED_COMMANDS.includes(parsed.def.command)) await assertNotOwnLineage(server, env, parsed.def.command, id);
+}
+async function runWithWait(server, env, parsed) {
+	const isStart = parsed.def.command === "threads start";
+	const knownId = parsed.input.params.id;
+	const endedAfter = parsed.wait && !isStart && knownId !== void 0 ? await runEndedAtOf(server, env, knownId) : null;
+	const result = await callRoute(server, parsed.def.route, parsed.input, env);
+	printJson(env, result);
+	if (!parsed.wait) return;
+	const answer = await waitForThread(server, env, {
+		conversationId: knownId ?? result.id,
+		endedAfter,
+		timeoutSeconds: parsed.timeoutSeconds
+	});
+	env.stdout(`\n${answer}`);
+}
+/** Runs one API command and throws `CliExit` on any failure. Testable with an injected env. */
+async function executeApiCommand(noun, argv, env) {
+	const verb = argv[0]?.startsWith("-") ? void 0 : argv[0];
+	if (verb === void 0 || wantsHelp$2(argv)) return env.stdout(helpText(noun, verb));
+	if (noun === "threads" && EXTRA_THREAD_VERBS.includes(verb)) return runThreadExtra(verb, argv.slice(1), env);
+	const parsed = parseCommand(findCommand(noun, verb), argv.slice(1));
+	if (parsed.def.destructive && !parsed.yes) throw usageError(`tau ${parsed.def.command} is destructive. Add --yes to confirm.`);
+	const scoped = parsed.home === void 0 ? env : {
+		...env,
+		home: parsed.home
+	};
+	const server = await discoverServer(scoped);
+	await guardDestructive(server, scoped, parsed);
+	await runWithWait(server, scoped, parsed);
+}
+/** `--home` may come before the verb (`tau --home X threads list`); it is lifted out of argv. */
+function takeHomeFlag(argv) {
+	const rest = [];
+	let home;
+	for (let index = 0; index < argv.length; index++) {
+		const token = argv[index];
+		if (token === "--") {
+			rest.push(...argv.slice(index));
+			break;
+		}
+		if (token === "--home" && argv[index + 1] !== void 0) home = argv[++index];
+		else if (token.startsWith("--home=")) home = token.slice(7);
+		else rest.push(token);
+	}
+	return {
+		home,
+		rest
+	};
+}
+/** The `tau <noun> …` entry point. `argv` starts after the noun. */
+async function runApiCommand(noun, argv) {
+	const env = processEnv();
+	try {
+		const { home, rest } = takeHomeFlag(argv);
+		await executeApiCommand(noun, rest, home === void 0 ? env : {
+			...env,
+			home
+		});
+	} catch (error) {
+		if (!(error instanceof CliExit)) throw error;
+		env.stderr(error.message);
+		process.exitCode = error.exitCode;
+	}
+}
+//#endregion
+//#region src/commands/connect-command.ts
+const REDEEM_PATH = "/api/pair/redeem";
+async function runningServer(env) {
+	try {
+		return await discoverServer(env);
+	} catch {
+		return;
+	}
+}
+async function linkedMachineCount(server, env) {
+	if (server) return (await callRoute(server, "listMachines", {}, env)).length;
+	try {
+		return (await readdir(join(env.home, "machines"))).length;
+	} catch {
+		return 0;
+	}
+}
+async function redeem(hubUrl, code, deviceName, env) {
+	let response;
+	try {
+		response = await env.fetch(`${hubUrl}${REDEEM_PATH}`, {
+			method: "POST",
+			headers: {
+				"content-type": "application/json",
+				origin: hubUrl
+			},
+			body: JSON.stringify({
+				code,
+				deviceName
+			})
+		});
+	} catch {
+		throw failure(`Could not reach the hub at ${hubUrl}. Is it running and online?`);
+	}
+	if (!response.ok) throw failure(response.status === 429 ? "Too many tries. Wait a few minutes and make a new code on the hub." : "The hub did not accept that code. It may have expired: make a new one in Settings → Machines.");
+	const body = await response.json().catch(() => void 0);
+	if (!Value.Check(RedeemPairingResponseSchema, body) || body.secret === void 0) throw failure("The hub answered without a machine secret. Make a new link code (kind: machine).");
+	return body.secret;
+}
+async function startAfterLink(choice, env) {
+	if (choice === "serve") {
+		const { serveInForeground } = await import("./serve-BcVZj5e2.js");
+		env.stdout("Starting tau for this session. Press Ctrl+C to stop.");
+		await serveInForeground([
+			"--no-open",
+			"--home",
+			env.home
+		]);
+	} else if (choice === "service") {
+		const { runServiceCommand } = await import("./service-command-BVr33vlP.js");
+		await runServiceCommand([
+			"install",
+			"--home",
+			env.home
+		]);
+	} else env.stdout("Run `tau` (or `tau service install`) to bring this machine online.");
+}
+/**
+* `tau connect <link | code --hub <url>> [--name <label>] [--yes]`: redeem a link code on a hub and keep its
+* machine secret in `hub.json`. A running server picks the file up on its own.
+*/
+async function executeConnect(argv, env, io = terminalIo) {
+	const args = parseConnectArgs(argv);
+	const target = parseConnectTarget(args.target, args.hub);
+	const hubFile = createHubFileStore(env.home);
+	const refusal = alreadyLinkedRefusal(await hubFile.read() !== void 0);
+	if (refusal) throw usageError(refusal);
+	const server = await runningServer(env);
+	const loop = connectRefusal(await linkedMachineCount(server, env));
+	if (loop) throw usageError(loop);
+	const hubName = target.hubName ?? new URL(target.hubUrl).host;
+	if (!args.yes && !await io.confirm(`Link this machine to ${hubName} (${target.hubUrl})?`)) throw new CliExit(1, "Not linked.");
+	const machineSecret = await redeem(target.hubUrl, target.code, args.name, env);
+	await hubFile.write({
+		hubUrl: target.hubUrl,
+		machineSecret,
+		name: hubName,
+		machineName: args.name
+	});
+	env.stdout(`Linked to ${hubName} as "${args.name}".`);
+	if (server) return env.stdout("The running tau connects within a few seconds.");
+	await startAfterLink(args.yes ? "none" : await io.chooseStart(), env);
+}
+/** `tau disconnect`: tells the running server (it closes the link and forgets the hub), then removes `hub.json`. */
+async function executeDisconnect(argv, env) {
+	if (argv.length > 0) throw usageError("Usage: tau disconnect");
+	const hubFile = createHubFileStore(env.home);
+	const file = await hubFile.read();
+	const server = await runningServer(env);
+	if (!file && !server) return env.stdout("This tau is not linked to a hub.");
+	if (server) {
+		if ((await callRoute(server, "getHubLink", {}, env)).state !== "none") await callRoute(server, "disconnectHub", {}, env);
+	}
+	await hubFile.delete();
+	if (!file) return env.stdout("This tau is not linked to a hub.");
+	env.stdout(`Disconnected from ${file.name}. Remove this machine in the hub's Settings → Machines to revoke it there.`);
+}
+function runner(execute) {
+	return async (argv) => {
+		const env = processEnv();
+		try {
+			const { home, rest } = takeHomeFlag(argv);
+			await execute(rest, home === void 0 ? env : {
+				...env,
+				home
+			});
+		} catch (error) {
+			if (!(error instanceof CliExit)) throw error;
+			env.stderr(error.message);
+			process.exitCode = error.exitCode;
+		}
+	};
+}
+const runConnect = runner(executeConnect);
+const runDisconnect = runner(executeDisconnect);
+//#endregion
+//#region src/commands/pair-flow.ts
+const REMOTE_WAIT_MS = 72e4;
+const LINK_POLL_MS = 2e3;
+const REMOTE_POLL_MS = 3e3;
+const PROGRESS_EVERY_MS = 15e3;
+const FULL_POWER_WARNING = "A linked device gets full power over this computer: agents, terminals and your files. Share this only with yourself.";
+function parsePairArgs(argv) {
+	let name;
+	for (let index = 0; index < argv.length; index++) {
+		const token = argv[index];
+		if (token === "--name" && argv[index + 1] !== void 0) name = argv[++index];
+		else if (token.startsWith("--name=")) name = token.slice(7);
+		else throw usageError(`Unknown argument "${token}". Usage: tau pair [--name <label>]`);
+	}
+	return { name: name?.trim() || hostname() };
+}
+const groupShortCode = (code) => code.match(/.{1,4}/g)?.join(" ") ?? code;
+const remoteOf = (server, env) => callRoute(server, "getRemoteStatus", {}, env);
+async function waitUntilOnline(server, env, first) {
+	const deadline = env.now() + REMOTE_WAIT_MS;
+	let status = first;
+	let lastProgress = env.now();
+	let lastMessage = null;
+	while (status.state !== "online") {
+		if (status.state === "error" || status.state === "off") throw new CliExit(1, `Remote access did not start: ${status.message ?? status.state}`);
+		if (env.now() >= deadline) throw new CliExit(3, "Remote access is still starting. It keeps going in the server: run `tau pair` again in a few minutes.");
+		if (status.message && status.message !== lastMessage) {
+			lastMessage = status.message;
+			env.stdout(status.message);
+		} else if (env.now() - lastProgress >= PROGRESS_EVERY_MS) {
+			lastProgress = env.now();
+			env.stdout(`Still ${status.state}… (this takes a few minutes)`);
+		}
+		await env.sleep(REMOTE_POLL_MS);
+		status = await remoteOf(server, env);
+	}
+	return status;
+}
+/** Turns remote on when needed and waits until the tunnel is online. */
+async function ensureRemoteOnline(server, env) {
+	let status = await remoteOf(server, env);
+	if (status.state === "online") return;
+	if (status.state === "off") {
+		env.stdout("Remote access is off. Turning it on: the first time takes a few minutes, please wait.");
+		status = await callRoute(server, "enableRemote", {}, env);
+	} else env.stdout("Remote access is starting: this takes a few minutes.");
+	await waitUntilOnline(server, env, status);
+}
+async function printPairing(env, pairing, link) {
+	const qr = await QRCode.toString(link, {
+		type: "terminal",
+		small: true
+	});
+	env.stdout(`\n${qr}`);
+	env.stdout(`Open this link on the device:\n  ${link}\n`);
+	env.stdout(`Or open the same site and type this code:  ${groupShortCode(pairing.shortCode)}\n`);
+	env.stdout(FULL_POWER_WARNING);
+	const minutes = Math.max(1, Math.round((pairing.expiresAt - env.now()) / 6e4));
+	env.stdout(`The code works once and expires in ${minutes} minutes. Waiting for the device… (Ctrl+C to stop)`);
+}
+const listDevices = (server, env) => callRoute(server, "listDevices", {}, env);
+async function waitForLinkedDevice(server, env, knownIds, expiresAt) {
+	while (env.now() < expiresAt) {
+		await env.sleep(LINK_POLL_MS);
+		const fresh = (await listDevices(server, env)).find((device) => !knownIds.has(device.id));
+		if (fresh) return env.stdout(`Linked: ${fresh.name}`);
+	}
+	throw new CliExit(3, "The code expired before a device linked. Run `tau pair` again for a new one.");
+}
+async function runPairFlow(argv, env) {
+	const { name } = parsePairArgs(argv);
+	const server = await discoverServer(env);
+	await ensureRemoteOnline(server, env);
+	const known = new Set((await listDevices(server, env)).map((device) => device.id));
+	const pairing = await callRoute(server, "mintPairing", { query: {
+		kind: "device",
+		name
+	} }, env);
+	if (pairing.link === null) throw new CliExit(1, "Remote access has no URL yet. Try again in a moment.");
+	await printPairing(env, pairing, pairing.link);
+	await waitForLinkedDevice(server, env, known, pairing.expiresAt);
+}
+//#endregion
+//#region src/commands/pair-command.ts
+const wantsHelp$1 = (argv) => argv.includes("--help") || argv.includes("-h");
+/** `tau pair new …` and help stay with the generic command table. */
+const isTableVerb = (argv) => argv[0] === "new" || wantsHelp$1(argv);
+/** `tau pair [--name <label>]`: link a phone or browser with a link, a short code and a QR. */
+async function executePair(argv, env) {
+	if (isTableVerb(argv)) return executeApiCommand("pair", argv, env);
+	await runPairFlow(argv, env);
+}
+async function runPair(argv) {
+	const env = processEnv();
+	try {
+		const { home, rest } = takeHomeFlag(argv);
+		await executePair(rest, home === void 0 ? env : {
+			...env,
+			home
+		});
+	} catch (error) {
+		if (!(error instanceof CliExit)) throw error;
+		env.stderr(error.message);
+		process.exitCode = error.exitCode;
+	}
+}
+//#endregion
+//#region src/commands/skill.ts
+const here = (relative) => fileURLToPath(new URL(relative, import.meta.url));
+/** Built package (`dist/skills/builtin/tau` next to `dist/bin.js`), then the core source tree. */
+const SKILL_PATHS = [
+	here("./skills/builtin/tau/SKILL.md"),
+	here("../../core/src/skills/builtin/tau/SKILL.md"),
+	here("../../../core/src/skills/builtin/tau/SKILL.md")
+];
+const MISSING_MESSAGE = "The tau skill is not bundled in this build. Run `tau --help`: output is JSON, and `--wait` replaces polling.";
+async function firstReadable(paths) {
+	for (const path of paths) try {
+		return await readFile(path, "utf8");
+	} catch {}
+}
+async function printSkill(env) {
+	const paths = env.skillPaths.length > 0 ? env.skillPaths : SKILL_PATHS;
+	env.stdout(await firstReadable(paths) ?? MISSING_MESSAGE);
+}
+/** `tau skill`: print the bundled SKILL.md. */
+async function runSkill(_argv) {
+	await printSkill(processEnv());
+}
+//#endregion
+//#region src/lifecycle/status-extras.ts
+const NO_EXTRAS = {
+	uptimeSeconds: null,
+	lastExit: null,
+	tunnel: null
+};
+const execFileAsync = promisify(execFile);
+/** `[[dd-]hh:]mm:ss` as printed by `ps -o etime=`. */
+function parseElapsed(text) {
+	const match = /^(?:(?:(\d+)-)?(\d+):)?(\d+):(\d+)$/.exec(text.trim());
+	if (!match) return null;
+	const [, days, hours, minutes, seconds] = match.map((part) => Number(part ?? 0));
+	return ((days ?? 0) * 24 + (hours ?? 0)) * 3600 + (minutes ?? 0) * 60 + (seconds ?? 0);
+}
+async function uptimeOf(pid) {
+	try {
+		const { stdout } = await execFileAsync("ps", [
+			"-o",
+			"etime=",
+			"-p",
+			String(pid)
+		]);
+		return parseElapsed(stdout);
+	} catch {
+		return null;
+	}
+}
+/** Missing or corrupt files give `null`. */
+async function readLastExit(home) {
+	try {
+		const value = JSON.parse(await readFile(join(home, "last-exit.json"), "utf8"));
+		if (typeof value.reason !== "string" || typeof value.at !== "number") return null;
+		return {
+			reason: value.reason,
+			at: value.at,
+			...value.detail ? { detail: String(value.detail) } : {}
+		};
+	} catch {
+		return null;
+	}
+}
+async function readTunnel(home, instance) {
+	if (!instance?.url) return null;
+	try {
+		const token = (await readFile(join(home, "token"), "utf8")).trim();
+		const response = await fetch(`${instance.url}/api/remote`, {
+			headers: { authorization: `Bearer ${token}` },
+			signal: AbortSignal.timeout(2e3)
+		});
+		if (!response.ok) return null;
+		const { state, url, message } = await response.json();
+		return {
+			state,
+			url,
+			message
+		};
+	} catch {
+		return null;
+	}
+}
+async function realExtras(home, instance) {
+	const [uptimeSeconds, lastExit, tunnel] = await Promise.all([
+		instance ? uptimeOf(instance.pid) : null,
+		readLastExit(home),
+		readTunnel(home, instance)
+	]);
+	return {
+		uptimeSeconds,
+		lastExit,
+		tunnel
+	};
+}
+function formatDuration(totalSeconds) {
+	const days = Math.floor(totalSeconds / 86400);
+	const hours = Math.floor(totalSeconds % 86400 / 3600);
+	const minutes = Math.floor(totalSeconds % 3600 / 60);
+	if (days > 0) return `${days}d ${hours}h`;
+	if (hours > 0) return `${hours}h ${minutes}m`;
+	return minutes > 0 ? `${minutes}m ${totalSeconds % 60}s` : `${totalSeconds}s`;
+}
+function renderExtras(extras) {
+	const { uptimeSeconds, lastExit, tunnel } = extras;
+	const exit = lastExit ? `${lastExit.reason}${lastExit.detail ? ` (${lastExit.detail})` : ""} at ${new Date(lastExit.at).toISOString()}` : "-";
+	const tunnelText = tunnel ? `${tunnel.state}${tunnel.url ? ` ${tunnel.url}` : ""}` : "-";
+	return [
+		`uptime: ${uptimeSeconds === null ? "-" : formatDuration(uptimeSeconds)}`,
+		`last exit: ${exit}`,
+		`tunnel: ${tunnelText}`
+	];
+}
+//#endregion
+//#region src/lifecycle/deps.ts
+const withToken = (origin, token) => `${origin}/?token=${encodeURIComponent(token)}`;
+const managerOf = (deps, home) => createServiceManager(deps.context, deps.cli(), home);
+const NOT_RUNNING = "tau is not running. Run `tau` to start it.";
+async function realLifecycleDeps() {
+	const { waitForUrl } = await import("./wait-for-lock-BMk6v3J5.js");
+	const { existsSync } = await import("node:fs");
+	return {
+		context: realContext(),
+		cli: () => cliEntry(),
+		version: cliVersion,
+		readInstance: readRunningInstance,
+		waitForInstanceUrl: (home) => waitForUrl(home),
+		readToken: readOrCreateToken,
+		openBrowser: async (url) => {
+			const { default: open } = await import("open");
+			await open(url);
+		},
+		out: (message) => console.log(message),
+		fileExists: existsSync,
+		extras: realExtras
+	};
+}
+//#endregion
+//#region src/lifecycle/open.ts
+/** Opens the browser on a running server; returns the URL it opened. */
+async function openRunning(deps, home) {
+	const instance = await deps.waitForInstanceUrl(home);
+	if (!instance?.url) throw new Error(NOT_RUNNING);
+	const url = withToken(instance.url, await deps.readToken(home));
+	try {
+		await deps.openBrowser(url);
+	} catch (error) {
+		deps.out(`Could not open the browser (${error instanceof Error ? error.message : error}). Open ${url}`);
+	}
+	return url;
+}
+async function runOpenWith(deps, argv) {
+	const { home } = lifecycleFlagsOf(argv, deps.context);
+	if (!await deps.readInstance(home)) throw new Error(NOT_RUNNING);
+	await openRunning(deps, home);
+}
+/** `tau open`. */
+async function runOpen(argv) {
+	await runOpenWith(await realLifecycleDeps(), argv);
+}
+//#endregion
+//#region src/lifecycle/start.ts
+/** Starts the service of this home (a detached process when it has none), waits for the URL, prints it. */
+async function startAndWait(deps, home) {
+	if (!await deps.readInstance(home)) await managerOf(deps, home).start();
+	const instance = await deps.waitForInstanceUrl(home);
+	if (!instance?.url) throw new Error("tau did not start. Run `tau logs` to see why.");
+	return instance.url;
+}
+/** A detached server reads `TAU_FAUX`; the service definition never carries `--faux`. */
+function forwardFauxToServer(deps, argv) {
+	if (argv.includes("--faux")) deps.context.env.TAU_FAUX = "1";
+}
+async function runStartWith(deps, argv) {
+	forwardFauxToServer(deps, argv);
+	const flags = lifecycleFlagsOf(argv, deps.context);
+	if (flags.explicitPort !== void 0) writeStoredPort(flags.home, flags.explicitPort);
+	const url = await startAndWait(deps, flags.home);
+	deps.out(`tau is running: ${url}`);
+	if (flags.open) await openRunning(deps, flags.home);
+}
+/** `tau start [--port --home --no-open]`. */
+async function runStart(argv) {
+	await runStartWith(await realLifecycleDeps(), argv);
+}
+//#endregion
+//#region src/lifecycle/bare.ts
+/** Bare `tau`: install when missing, repair when stale, start when stopped, open the browser. */
+async function runBareWith(deps, argv, serveInForeground) {
+	const flags = lifecycleFlagsOf(argv, deps.context);
+	if (flags.explicitPort !== void 0) writeStoredPort(flags.home, flags.explicitPort);
+	const manager = managerOf(deps, flags.home);
+	if (!await manager.installed() || await manager.needsRepair()) try {
+		for (const warning of await manager.install()) deps.out(`warning: ${warning}`);
+	} catch (error) {
+		if (!(error instanceof TemporaryEntryError)) throw error;
+		deps.out(`warning: ${error.message} Serving in the foreground instead.`);
+		return serveInForeground(argv);
+	}
+	const url = await startAndWait(deps, flags.home);
+	deps.out(`tau is running: ${url}`);
+	if (flags.open) await openRunning(deps, flags.home);
+}
+async function runBare(argv, serveInForeground) {
+	await runBareWith(await realLifecycleDeps(), argv, serveInForeground);
+}
+//#endregion
+//#region src/lifecycle/logs.ts
+const TAIL_LINES = 200;
+const lastLinesOf = (text, count) => text.trimEnd().split("\n").slice(-count).join("\n");
+function follow(file, from, write) {
+	let position = from;
+	watchFile(file, { interval: 500 }, (current) => {
+		if (current.size < position) position = 0;
+		if (current.size === position) return;
+		createReadStream(file, {
+			start: position,
+			end: current.size - 1,
+			encoding: "utf8"
+		}).on("data", (chunk) => write(String(chunk)));
+		position = current.size;
+	});
+}
+/** `tau logs [-f]`: the last lines of `<home>/logs/server.log`, then new ones with `-f`. */
+async function runLogs(argv, write = (text) => process.stdout.write(text)) {
+	const flags = lifecycleFlagsOf(argv, realContext());
+	const file = serverLogOf(flags.home);
+	if (!existsSync(file)) throw new Error(`No log yet: ${file}`);
+	write(`${lastLinesOf(readFileSync(file, "utf8"), TAIL_LINES)}\n`);
+	if (!flags.follow) return;
+	follow(file, statSync(file).size, write);
+	await new Promise(() => void 0);
+}
+//#endregion
+//#region src/lifecycle/restart.ts
+/** Repairs a stale service, copies PATH again, and restarts. */
+async function runRestartWith(deps, argv) {
+	const flags = lifecycleFlagsOf(argv, deps.context);
+	if (flags.explicitPort !== void 0) writeStoredPort(flags.home, flags.explicitPort);
+	const manager = managerOf(deps, flags.home);
+	if (await manager.needsRepair()) deps.out("Repairing the service.");
+	await manager.restart();
+	const instance = await deps.waitForInstanceUrl(flags.home);
+	deps.out(instance?.url ? `tau is running: ${instance.url}` : "tau restarted.");
+}
+/** `tau restart`. */
+async function runRestart(argv) {
+	await runRestartWith(await realLifecycleDeps(), argv);
+}
+//#endregion
+//#region src/lifecycle/status.ts
+async function gatherStatus(deps, home) {
+	const manager = managerOf(deps, home);
+	const [installed, state, instance] = await Promise.all([
+		manager.installed(),
+		manager.state(),
+		deps.readInstance(home)
+	]);
+	const extras = await deps.extras?.(home, instance) ?? NO_EXTRAS;
+	const recorded = manager.recorded();
+	const nodeMissing = installed && recorded !== void 0 && !deps.fileExists(recorded.node);
+	const cliVersion = deps.version();
+	const managedPid = state.pid;
+	const isService = state.active && (managedPid === void 0 || managedPid === instance?.pid);
+	const warnings = [];
+	if (instance?.version !== void 0 && instance.version !== cliVersion) warnings.push(`Running version ${instance.version} is not ${cliVersion}: run \`tau restart\`.`);
+	if (nodeMissing) warnings.push("node missing: run `tau` to repair the service.");
+	return {
+		installed,
+		running: instance ? isService ? "service" : "foreground" : false,
+		pid: instance?.pid ?? null,
+		url: instance?.url ?? null,
+		version: instance?.version ?? null,
+		cliVersion,
+		home,
+		node: recorded?.node ?? null,
+		nodeMissing,
+		warnings,
+		...extras
+	};
+}
+function renderStatus(report) {
+	return [
+		`tau: ${report.running ? `running (${report.running})` : "not running"}`,
+		`installed: ${report.installed ? "yes" : "no"}`,
+		`pid: ${report.pid ?? "-"}`,
+		`url: ${report.url ?? "-"}`,
+		`version: ${report.version ?? "-"}`,
+		`home: ${report.home}`,
+		`node: ${report.node ?? "-"}${report.nodeMissing ? " (missing)" : ""}`,
+		...renderExtras(report),
+		...report.warnings.map((warning) => `warning: ${warning}`)
+	].join("\n");
+}
+/** `tau status [--json]`. */
+async function runStatusWith(deps, argv) {
+	const flags = lifecycleFlagsOf(argv, deps.context);
+	const report = await gatherStatus(deps, flags.home);
+	deps.out(flags.json ? JSON.stringify(report) : renderStatus(report));
+}
+async function runStatus(argv) {
+	await runStatusWith(await realLifecycleDeps(), argv);
+}
+//#endregion
+//#region src/lifecycle/stop.ts
+async function runStopWith(deps, argv) {
+	const { home } = lifecycleFlagsOf(argv, deps.context);
+	const status = await gatherStatus(deps, home);
+	if (status.running === "foreground") {
+		deps.out(`tau runs in the foreground (pid ${status.pid}). Stop it with Ctrl-C.`);
+		return;
+	}
+	await managerOf(deps, home).stop();
+	deps.out("tau stopped.");
+}
+/** `tau stop`: the service stays stopped until `tau start` or the next login. */
+async function runStop(argv) {
+	await runStopWith(await realLifecycleDeps(), argv);
+}
+//#endregion
+//#region src/main.ts
+const apiCommandHandlers = Object.fromEntries(COMMAND_NOUNS.map((noun) => [noun, (argv) => runApiCommand(noun, argv)]));
+/** The one dispatch table: command word to handler. */
+const commandTable = {
+	serve: serveInForeground,
+	start: runStart,
+	stop: runStop,
+	restart: runRestart,
+	status: runStatus,
+	open: runOpen,
+	logs: runLogs,
+	service: runServiceCommand,
+	skill: runSkill,
+	help: runHelp,
+	...apiCommandHandlers,
+	pair: runPair,
+	connect: runConnect,
+	disconnect: runDisconnect
+};
+const bareHandler = (argv) => runBare(argv, serveInForeground);
+const wantsHelp = (argv) => argv.includes("--help") || argv.includes("-h");
+var UnknownCommandError = class extends Error {
+	constructor(word) {
+		super(`Unknown command: ${word}. Run \`tau --help\`.`);
+		this.name = "UnknownCommandError";
+	}
+};
+/** Picks the handler and the argv it receives. */
+function resolveCommand(argv, table = commandTable, bare = bareHandler) {
+	const { word, rest } = commandWordOf(argv);
+	if (word === void 0) return wantsHelp(argv) ? {
+		handler: table.help ?? bare,
+		argv
+	} : {
+		handler: bare,
+		argv
+	};
+	const handler = table[word];
+	if (!handler) throw new UnknownCommandError(word);
+	return {
+		handler,
+		argv: rest
+	};
+}
+const wantsVersion = (argv) => argv.length === 1 && (argv[0] === "--version" || argv[0] === "-v");
+async function main(argv) {
+	if (wantsVersion(argv)) {
+		console.log(cliVersion());
+		return;
+	}
+	const { handler, argv: rest } = resolveCommand(argv);
+	await handler(rest);
+}
+//#endregion
+export { main };