@parley-im/parley 0.0.0-stage → 0.1.0

package/dist/api.js

@@ -0,0 +1,180 @@
+import { mediaTypeFor } from "./runner.js";
+import { modelLabel } from "./models.js";
+import { linkFor } from "./state.js";
+import { ownerName } from "./account.js";
+export const MAX_TEXT = 20_000;
+export const MAX_IMAGES = 6;
+const MAX_PENDING = 50;
+// Messages per page when a conversation opens or scrolls back.
+const PAGE = 60;
+// Anti-spam, per session: a burst of 20 messages or uploads, then one every
+// 3 seconds. A person typing never notices; a script hammering the link does.
+const BURST = 20;
+const REFILL_MS = 3_000;
+// A refusal the tester's page shows as it is.
+export class Problem extends Error {
+    status;
+    code;
+    constructor(status, code, message) {
+        super(message);
+        this.status = status;
+        this.code = code;
+    }
+}
+// What every viewer can do with a session, whichever way they're connected.
+export class Conversations {
+    store;
+    runner;
+    config;
+    buckets = new Map();
+    constructor(store, runner, config) {
+        this.store = store;
+        this.runner = runner;
+        this.config = config;
+    }
+    allow(sessionId) {
+        const now = Date.now();
+        const bucket = this.buckets.get(sessionId) ?? { tokens: BURST, at: now };
+        bucket.tokens = Math.min(BURST, bucket.tokens + (now - bucket.at) / REFILL_MS);
+        bucket.at = now;
+        this.buckets.set(sessionId, bucket);
+        if (bucket.tokens < 1)
+            return false;
+        bucket.tokens -= 1;
+        return true;
+    }
+    state(scope) {
+        const session = this.store.session(scope.session.id);
+        const page = this.store.page(session.id, PAGE);
+        // Opening a session on your control panel counts as reading it.
+        if (scope.owner && page.messages.length)
+            this.store.markRead(session.id, page.messages.at(-1).id);
+        // Read together, so following from `seq` can't miss or repeat anything.
+        return {
+            epoch: this.runner.epoch,
+            seq: this.runner.seq,
+            session: scope.owner ? this.ownerView(session) : this.testerView(session),
+            ownerName: ownerName(this.config),
+            repliesLeft: this.runner.repliesLeft(session.id),
+            messages: page.messages.map((m) => this.messageView(m, scope)),
+            more: page.more,
+            live: this.liveView(session.id, scope),
+        };
+    }
+    history(scope, before) {
+        if (!Number.isInteger(before))
+            throw new Problem(400, "invalid", "Which message?");
+        const page = this.store.page(scope.session.id, PAGE, before);
+        return { messages: page.messages.map((m) => this.messageView(m, scope)), more: page.more };
+    }
+    // Everything that can refuse a message, checked before any screenshots
+    // are fetched or saved.
+    check(scope, text, images) {
+        if (scope.owner)
+            throw new Problem(403, "read_only", "Your view is read-only.");
+        const session = this.store.session(scope.session.id);
+        if (session.status !== "open")
+            throw new Problem(410, "ended", "This parley has ended.");
+        if (text.length > MAX_TEXT) {
+            throw new Problem(413, "too_long", `That's ${text.length.toLocaleString()} characters. The limit is ${MAX_TEXT.toLocaleString()}; try splitting it up.`);
+        }
+        if (images > MAX_IMAGES)
+            throw new Problem(400, "too_many_images", `Up to ${MAX_IMAGES} screenshots at a time.`);
+        if (!text && !images)
+            throw new Problem(400, "empty", "Nothing to send.");
+        if (this.runner.repliesLeft(session.id) <= 0) {
+            throw new Problem(409, "out_of_replies", `This session has used all its replies. ${ownerName(this.config) ?? "Whoever sent the link"} can add more.`);
+        }
+        if (this.store.pending(session.id).length >= MAX_PENDING || !this.allow(session.id)) {
+            throw new Problem(429, "slow_down", "That's a lot of messages very fast. Give it a few seconds.");
+        }
+    }
+    // Posts a checked message. `images` are saved uploads belonging to the session.
+    post(scope, text, images) {
+        const session = this.store.session(scope.session.id);
+        const message = this.runner.submit(session, text || "(screenshot)", images.filter((name) => ownsUpload(session, name)));
+        return { message: this.messageView(message, scope) };
+    }
+    // A live event as this viewer should see it, or null if it's not for them.
+    eventView(event, scope) {
+        // Testers get the conversation, not the agent's lookups.
+        if (!scope.owner && event.type === "activity")
+            return null;
+        if (event.type === "message")
+            return { ...event, message: this.messageView(event.message, scope) };
+        if (event.type === "turn" && event.live && !scope.owner)
+            return { ...event, live: { ...event.live, activity: null } };
+        return event;
+    }
+    liveView(sessionId, scope) {
+        const live = this.runner.live.get(sessionId);
+        if (!live)
+            return null;
+        return scope.owner ? live : { ...live, activity: null };
+    }
+    // What a tester may know about their session, shown under the info button.
+    testerView(s) {
+        return {
+            project: s.project_name,
+            tester: s.tester,
+            agent: s.agent,
+            model: modelLabel(this.store.latestModel(s.id) ?? s.model ?? (s.agent === "codex" ? this.config.codex.model : this.config.claude.model)),
+            replyLimit: s.reply_limit,
+        };
+    }
+    ownerView(s) {
+        return {
+            id: s.id,
+            project: s.project_name,
+            projectDir: s.project_dir,
+            tester: s.tester,
+            brief: s.brief,
+            agent: s.agent,
+            model: modelLabel(this.store.latestModel(s.id) ?? s.model),
+            agentSessionId: s.agent_session_id,
+            status: s.status,
+            replyLimit: s.reply_limit,
+            repliesLeft: this.runner.repliesLeft(s.id),
+            busy: this.runner.live.has(s.id),
+            createdAt: s.created_at,
+            updatedAt: s.updated_at,
+            endedAt: s.ended_at,
+            link: linkFor(s, this.config),
+            stats: this.store.stats(s.id),
+        };
+    }
+    // Your view also gets what each reply looked at, which model wrote it, on
+    // which login, and what it would have cost at API prices.
+    messageView(m, scope) {
+        const view = {
+            id: m.id,
+            role: m.role,
+            body: m.body,
+            images: scope.images === "url"
+                ? m.images.map((name) => `${scope.base}/uploads/${name}`)
+                : m.images.map((name) => ({ id: blobIdOf(name), type: mediaTypeFor(name) })),
+            createdAt: m.created_at,
+        };
+        if (!scope.owner || m.role !== "agent" || !m.turn_id)
+            return view;
+        const turn = this.store.turn(m.turn_id);
+        if (!turn)
+            return view;
+        const usage = turn.usage ?? {};
+        return {
+            ...view,
+            turn: {
+                activity: turn.activity,
+                model: usage.model ?? null,
+                auth: usage.auth ?? null,
+                costUsd: usage.cost_usd ?? null,
+                seconds: turn.ended_at ? Math.round((Date.parse(turn.ended_at) - Date.parse(turn.started_at)) / 1000) : null,
+            },
+        };
+    }
+}
+// Saved screenshots are named "<session id>-<blob id>.<ext>".
+export function ownsUpload(session, name) {
+    return /^[A-Za-z0-9_.-]+$/.test(name) && name.startsWith(`${session.id}-`) && !!mediaTypeFor(name);
+}
+const blobIdOf = (name) => name.slice(name.indexOf("-") + 1).replace(/\.[a-z]+$/, "");

package/dist/charter.js

@@ -0,0 +1,57 @@
+import { existsSync, readFileSync, realpathSync } from "node:fs";
+import { join } from "node:path";
+import { ownerName } from "./account.js";
+// The interviewer's standing instructions. Appended to Claude's system prompt
+// and passed to Codex as developer instructions, so they outrank anything the
+// tester types.
+export function charter(session, config) {
+    const owner = ownerName(config) ?? "the developer";
+    return `# Feedback session
+
+You are running a feedback session for ${session.project_name}, the project in your working directory. ${owner} built it and set up this session so ${session.tester}, a trusted tester, can tell you what they think. You are talking with ${session.tester} through a private web chat. Everything said here is saved for ${owner} to read.
+
+How to run it:
+- Hear them out. Let them brain dump. Ask one short follow-up at a time to get specifics: what they were trying to do, what they expected, what actually happened, where it happened, and how much it mattered to them.
+- Answer their questions about the project honestly. Read the code in this folder to check how something works or whether a behavior is intended, then explain it the way someone using the product would understand it: what it does and why, not where it lives. Most testers don't know or care about the code, so don't mention files, line numbers, functions or other internals unless they ask about the code. If they do ask, sharing details is fine.
+- Capture their perspective faithfully. Do not argue, defend the design, or talk them out of a reaction. If something is a known limitation, say so plainly.
+- Do not promise fixes, features, or dates. Say you will pass it along to ${owner}.
+- You are read-only. You can read files but cannot edit them or run anything. If they ask you to fix or change something, explain that this session is for collecting feedback and that you will make sure ${owner} sees it.
+- Keep replies short and conversational, like a good interviewer: a sentence or two plus at most one question. They are often on a phone. Light formatting only. Never use em dashes.
+- Don't narrate what you're doing ("let me check the code", "looking at the file now"). Look things up quietly and just answer.
+- They may paste screenshots. Look at them closely and refer to what you see.
+- When they seem finished, briefly play back the main points you heard so they can correct anything, then thank them.
+
+## Brief from ${owner}
+
+${session.brief.trim()}
+
+${projectNotes(session.project_dir)}## Your opening
+
+The chat opened with this greeting from you, already shown to ${session.tester}:
+
+${session.greeting.trim()}
+`;
+}
+const NOTES_LIMIT = 20_000;
+// Claude's restricted mode skips CLAUDE.md, so the project's own notes for
+// agents are passed along here instead.
+function projectNotes(dir) {
+    const seen = new Set();
+    const parts = [];
+    for (const name of ["CLAUDE.md", "AGENTS.md"]) {
+        const file = join(dir, name);
+        if (!existsSync(file))
+            continue;
+        const real = realpathSync(file);
+        if (seen.has(real))
+            continue;
+        seen.add(real);
+        let text = readFileSync(real, "utf8").trim();
+        if (!text)
+            continue;
+        if (text.length > NOTES_LIMIT)
+            text = text.slice(0, NOTES_LIMIT) + "\n\n(truncated)";
+        parts.push(`## Project notes from ${name}\n\nWritten for agents working on this project. Use them as background; your job here is the feedback session.\n\n${text}\n\n`);
+    }
+    return parts.join("");
+}

package/dist/cli.js

@@ -0,0 +1,272 @@
+import { parseArgs } from "node:util";
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { execFileSync, spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import { loadConfig, paths, cleanEnv } from "./config.js";
+import { Store } from "./db.js";
+import { ensureServer, stopServer } from "./daemon.js";
+import { readState, linkFor, dashboardUrl, isServerUp } from "./state.js";
+import { transcript, summaryLine } from "./transcript.js";
+import { startSession, endSession, deleteSession, setReplyLimit } from "./control.js";
+import { login, readCredentials, clearCredentials, relay as registry } from "./account.js";
+const HELP = `parley: someone chats with a read-only Claude or Codex running in this project, on this
+computer, and you get everything they said. Good for feedback from testers, or any interview.
+
+If you're an agent and the user asks for "a parley" (or to get someone's take on this project):
+
+  1. From the project folder, make one and give the user the printed link to send:
+       parley new --tester "Sam" --brief-file - <<'BRIEF'
+       What this is and how they'll try it, what the user most wants to learn, known issues to
+       skip. Written to the interviewer, in the terms a user sees (no file paths).
+       BRIEF
+     Pass --agent codex if you're Codex. Keep the whole link; the part after # is its key.
+  2. See what's come in:  parley list        Read it:  parley show ID --new
+  3. When the user's done with it:  parley end ID
+
+With the parley MCP tools (create_session, list_sessions, get_transcript, end_session, ...),
+use those instead; they do the same.
+
+Commands
+  parley new --tester NAME (--brief TEXT | --brief-file FILE|-)   Make a session here; prints its link
+        [--dir PATH] [--greeting TEXT] [--agent claude|codex] [--model MODEL] [--replies N]
+  parley list [--ended | --all] [--dir PATH]   Sessions, with new-message counts and replies used
+  parley show ID [--new]                       Transcript as Markdown; --new for what's unread
+  parley limit ID N                            Let a session give N replies in total
+  parley end ID                                Kill its link for good; the transcript stays
+  parley delete ID                             Erase it, screenshots included
+  parley login | logout | whoami               Link this computer to parley.im, or unlink it
+  parley start | stop | status                 The background server (holds the parley.im connection)
+  parley panel                                 Open the control panel (localhost)
+  parley install                               Add the parley MCP server to Claude Code and Codex
+  parley serve | mcp                           Run the server in the foreground | MCP over stdio
+
+Data and settings live in ${paths.home}.`;
+const CLI_PATH = fileURLToPath(import.meta.url);
+async function main() {
+    const [command, ...rest] = process.argv.slice(2);
+    const config = loadConfig();
+    switch (command) {
+        case "serve": {
+            const { serve } = await import("./server.js");
+            return serve();
+        }
+        case "mcp": {
+            const { runMcp } = await import("./mcp.js");
+            return runMcp();
+        }
+        case "start": {
+            const state = await ensureServer(config);
+            if (!state)
+                fail(`The server didn't come up. See ${paths.log}`);
+            console.log(`Running. Control panel: ${dashboardUrl(config)}`);
+            await printRelay(config);
+            return;
+        }
+        case "login": {
+            const creds = await login(config, (code, url) => {
+                console.log(`To link this computer, open ${url}\nand check it shows the code ${code}.`);
+                openInBrowser(url);
+            }).catch((error) => fail(error.message));
+            console.log(`Linked as ${creds.account.email}. Links you make now go through ${config.relayUrl}.`);
+            if (await isServerUp(config))
+                await fetch(`http://localhost:${config.dashboardPort}/api/relay/restart`, { method: "POST" });
+            else
+                await ensureServer(config);
+            return;
+        }
+        case "logout": {
+            const creds = readCredentials(config);
+            if (!creds)
+                return console.log("This computer isn't signed in.");
+            await registry.unlink(creds).catch(() => { });
+            clearCredentials();
+            if (await isServerUp(config))
+                await fetch(`http://localhost:${config.dashboardPort}/api/relay/restart`, { method: "POST" });
+            console.log(`Unlinked from ${creds.account.email}. Existing parley.im links stop working until you sign in again.`);
+            return;
+        }
+        case "whoami": {
+            const creds = readCredentials(config);
+            console.log(creds ? `${creds.account.email} on ${creds.relayUrl} (this computer: ${creds.device.name})` : "Not signed in. Run parley login.");
+            return;
+        }
+        case "stop": {
+            console.log((await stopServer()) ? "Stopped." : "Not running.");
+            return;
+        }
+        case "status": {
+            const up = await isServerUp(config);
+            const state = readState();
+            if (!up)
+                return console.log("Not running. `parley start` brings it up.");
+            console.log(`Running (pid ${state?.pid}) since ${state?.startedAt}`);
+            console.log(`Control panel: ${dashboardUrl(config)}`);
+            await printRelay(config);
+            return;
+        }
+        case "new": {
+            const { values } = parseArgs({
+                args: rest,
+                options: {
+                    dir: { type: "string" },
+                    tester: { type: "string" },
+                    brief: { type: "string" },
+                    "brief-file": { type: "string" },
+                    greeting: { type: "string" },
+                    agent: { type: "string" },
+                    model: { type: "string" },
+                    replies: { type: "string" },
+                },
+            });
+            // "-" reads the brief from stdin, so a long one can come in a heredoc.
+            const file = values["brief-file"];
+            const brief = file ? readFileSync(file === "-" ? 0 : file, "utf8") : values.brief;
+            if (!values.tester || !brief)
+                fail("Need --tester and --brief (or --brief-file).");
+            if (values.agent && values.agent !== "claude" && values.agent !== "codex")
+                fail("--agent is claude or codex.");
+            const store = new Store();
+            const made = await startSession(store, config, {
+                projectDir: resolve(values.dir ?? process.cwd()),
+                tester: values.tester,
+                brief,
+                greeting: values.greeting,
+                agent: values.agent ?? "claude",
+                model: values.model,
+                replyLimit: values.replies ? Number(values.replies) : null,
+            }).catch((error) => fail(error.message));
+            const { session } = made;
+            console.log(`Session ${session.id} for ${session.tester} in ${session.project_dir}`);
+            console.log(`Link: ${linkFor(session, config)}`);
+            console.log(`Replies allowed: ${session.reply_limit}`);
+            console.log(`Watch: ${dashboardUrl(config, session)}`);
+            if (!readCredentials(config))
+                console.log("\nNot signed in, so this link only works on this computer. Run parley login to share links.");
+            else if (!made.shared)
+                console.log(`\nparley.im didn't take the session yet; it will once the connection is back (see ${paths.log}).`);
+            return;
+        }
+        case "list": {
+            const { values } = parseArgs({
+                args: rest,
+                options: { dir: { type: "string" }, ended: { type: "boolean" }, all: { type: "boolean" } },
+            });
+            const store = new Store();
+            const status = values.all ? undefined : values.ended ? "ended" : "open";
+            const sessions = store.sessions({ projectDir: values.dir ? resolve(values.dir) : undefined, status });
+            if (status !== "ended" && !(await isServerUp(config)))
+                console.log("(server not running, links are down)\n");
+            const none = status ? `No ${status} sessions.` : "No sessions yet.";
+            console.log(sessions.map((s) => summaryLine(store, s, linkFor(s, config))).join("\n\n") || none);
+            return;
+        }
+        case "show": {
+            const { values, positionals } = parseArgs({ args: rest, allowPositionals: true, options: { new: { type: "boolean" } } });
+            const store = new Store();
+            const session = store.session(positionals[0] ?? "");
+            if (!session)
+                fail(`No session ${positionals[0] ?? ""}`);
+            console.log(transcript(store, session, linkFor(session, config), { onlyNew: values.new ?? false }));
+            return;
+        }
+        case "limit": {
+            const [id, value] = rest;
+            const store = new Store();
+            const session = id && store.session(id);
+            if (!session)
+                fail(`No session ${id ?? ""}`);
+            try {
+                await setReplyLimit(config, store, session.id, Number(value));
+            }
+            catch (error) {
+                fail(error.message);
+            }
+            console.log(`${session.id} may now give ${value} replies in total; ${store.repliesUsed(session.id)} used so far.`);
+            return;
+        }
+        case "end":
+        case "delete": {
+            const id = rest[0];
+            const store = new Store();
+            const session = id && store.session(id);
+            if (!session)
+                fail(`No session ${id ?? ""}`);
+            if (command === "end") {
+                if (session.status !== "open")
+                    return console.log(`${session.id} had already ended.`);
+                await endSession(config, store, session.id);
+                console.log(`Ended ${session.id} (${session.tester} on ${session.project_name}). Its link no longer works.`);
+            }
+            else {
+                await deleteSession(config, store, session.id);
+                console.log(`Deleted ${session.id} (${session.tester} on ${session.project_name}) and its screenshots.`);
+            }
+            return;
+        }
+        case "panel": {
+            await ensureServer(config);
+            openInBrowser(dashboardUrl(config));
+            return;
+        }
+        case "install":
+            return install(config);
+        case undefined:
+        case "help":
+        case "--help":
+        case "-h":
+            console.log(HELP);
+            return;
+        default:
+            fail(`Unknown command: ${command}\n\n${HELP}`);
+    }
+}
+function install(config) {
+    const launch = [process.execPath, "--no-warnings", CLI_PATH, "mcp"];
+    const env = cleanEnv();
+    const run = (bin, args) => {
+        try {
+            execFileSync(bin, args, { env, stdio: "pipe" });
+            return true;
+        }
+        catch {
+            return false;
+        }
+    };
+    if (config.claude.bin.startsWith("/")) {
+        run(config.claude.bin, ["mcp", "remove", "--scope", "user", "parley"]);
+        const ok = run(config.claude.bin, ["mcp", "add", "--scope", "user", "parley", "--", ...launch]);
+        console.log(ok ? "Claude Code: added the parley MCP server (user scope)." : "Claude Code: couldn't add the MCP server.");
+    }
+    else
+        console.log("Claude Code: not found, skipped.");
+    if (config.codex.bin.startsWith("/")) {
+        run(config.codex.bin, ["mcp", "remove", "parley"]);
+        const ok = run(config.codex.bin, ["mcp", "add", "parley", "--", ...launch]);
+        console.log(ok ? "Codex: added the parley MCP server." : "Codex: couldn't add the MCP server.");
+    }
+    else
+        console.log("Codex: not found, skipped.");
+    console.log(`\nStart a new Claude or Codex session in any project and ask it to make a parley for someone.`);
+}
+async function printRelay(config) {
+    const creds = readCredentials(config);
+    if (!creds)
+        return console.log("Not signed in: links only work on this computer. Run parley login to share them.");
+    try {
+        const panel = (await (await fetch(`http://localhost:${config.dashboardPort}/api/panel`)).json());
+        const relay = panel.relay;
+        console.log(relay.state === "connected" ? `Connected to ${relay.relayUrl} as ${relay.email}.` : `${relay.relayUrl}: ${relay.state}${relay.error ? ` (${relay.error})` : ""}`);
+    }
+    catch {
+        console.log(`Signed in as ${creds.account.email}.`);
+    }
+}
+function openInBrowser(url) {
+    spawnSync(process.platform === "darwin" ? "open" : "xdg-open", [url], { stdio: "ignore" });
+}
+function fail(message) {
+    console.error(message);
+    process.exit(1);
+}
+main().catch((error) => fail(String(error?.stack ?? error)));

package/dist/config.js

@@ -0,0 +1,97 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync, accessSync, constants } from "node:fs";
+import { homedir } from "node:os";
+import { join, delimiter } from "node:path";
+export const HOME = process.env.PARLEY_HOME ?? join(homedir(), ".parley");
+export const paths = {
+    home: HOME,
+    config: join(HOME, "config.json"),
+    db: join(HOME, "parley.db"),
+    state: join(HOME, "server.json"),
+    log: join(HOME, "server.log"),
+    uploads: join(HOME, "uploads"),
+    // Your computer's link to a parley.im account, from `parley login`.
+    credentials: join(HOME, "credentials.json"),
+};
+const defaults = {
+    relayUrl: "https://parley.im",
+    port: 4747,
+    dashboardPort: 4748,
+    ownerName: null,
+    replyLimit: 100,
+    claude: { bin: "claude", model: null, effort: null },
+    codex: { bin: "codex", model: null, effort: null },
+};
+export function ensureHome() {
+    mkdirSync(paths.uploads, { recursive: true });
+}
+export function loadConfig() {
+    ensureHome();
+    let stored = {};
+    if (existsSync(paths.config))
+        stored = JSON.parse(readFileSync(paths.config, "utf8"));
+    // Only known settings carry over, so retired ones drop out of the file.
+    const pick = (key) => (stored[key] === undefined ? defaults[key] : stored[key]);
+    const config = {
+        relayUrl: pick("relayUrl").replace(/\/+$/, ""),
+        port: pick("port"),
+        dashboardPort: pick("dashboardPort"),
+        ownerName: pick("ownerName"),
+        replyLimit: pick("replyLimit"),
+        claude: { ...defaults.claude, ...stored.claude },
+        codex: { ...defaults.codex, ...stored.codex },
+    };
+    // The server is often started from inside an MCP server with a thin PATH,
+    // so binaries are pinned to absolute paths the first time they are found.
+    let changed = !existsSync(paths.config) || Object.keys(stored).some((key) => !(key in defaults));
+    for (const [get, set] of [
+        [() => config.claude.bin, (v) => (config.claude.bin = v)],
+        [() => config.codex.bin, (v) => (config.codex.bin = v)],
+    ]) {
+        const current = get();
+        if (current.startsWith("/"))
+            continue;
+        const found = findBin(current);
+        if (found) {
+            set(found);
+            changed = true;
+        }
+    }
+    if (changed)
+        saveConfig(config);
+    return config;
+}
+export function saveConfig(config) {
+    ensureHome();
+    writeFileSync(paths.config, JSON.stringify(config, null, 2) + "\n");
+}
+export function findBin(name) {
+    const dirs = [
+        ...(process.env.PATH ?? "").split(delimiter),
+        join(homedir(), ".local/bin"),
+        "/opt/homebrew/bin",
+        "/usr/local/bin",
+    ];
+    for (const dir of dirs) {
+        if (!dir)
+            continue;
+        const candidate = join(dir, name);
+        try {
+            accessSync(candidate, constants.X_OK);
+            return candidate;
+        }
+        catch { }
+    }
+    return null;
+}
+// Agents run as you, on your own subscription. Anything inherited from a
+// host session (Claude Code's own env, API keys, proxies) is dropped so the
+// CLIs fall back to your normal login.
+export function cleanEnv() {
+    const env = {};
+    for (const [key, value] of Object.entries(process.env)) {
+        if (/^(CLAUDE|ANTHROPIC_|MCP_)/.test(key))
+            continue;
+        env[key] = value;
+    }
+    return env;
+}

package/dist/control.js

@@ -0,0 +1,72 @@
+import { existsSync, statSync } from "node:fs";
+import { isAbsolute, resolve } from "node:path";
+import { isServerUp } from "./state.js";
+import { readCredentials, relay as registry } from "./account.js";
+import { ensureServer } from "./daemon.js";
+// The one way sessions get made, from the CLI, MCP tools or your control panel.
+export function createSession(store, config, input) {
+    if (!isAbsolute(input.projectDir))
+        throw new Error(`Use the full path of the project folder, not ${input.projectDir}.`);
+    const projectDir = resolve(input.projectDir);
+    if (!existsSync(projectDir) || !statSync(projectDir).isDirectory())
+        throw new Error(`Not a folder: ${projectDir}`);
+    const tester = input.tester.trim();
+    const brief = input.brief.trim();
+    if (!tester)
+        throw new Error("Say who the session is for.");
+    if (!brief)
+        throw new Error("Write a brief for the interviewer.");
+    const replyLimit = input.replyLimit ?? config.replyLimit;
+    if (!Number.isInteger(replyLimit) || replyLimit < 1)
+        throw new Error("The reply limit has to be a whole number above zero.");
+    return store.createSession({ ...input, projectDir, tester, brief, replyLimit });
+}
+// Changes go through the server when it's running, so a reply in progress
+// stops, any open tester page updates at once, and parley.im hears about it.
+async function viaServer(config, path, body) {
+    const res = await fetch(`http://localhost:${config.dashboardPort}${path}`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify(body ?? {}),
+    });
+    const json = (await res.json().catch(() => ({})));
+    if (!res.ok)
+        throw new Error(json.message ?? `The server refused (${res.status}).`);
+    return json;
+}
+// Makes a session and shares it on parley.im, starting the server if needed
+// (it holds the connection the session's link depends on).
+export async function startSession(store, config, input) {
+    if (await ensureServer(config)) {
+        const made = await viaServer(config, "/api/sessions", input);
+        return { session: store.session(made.id), shared: made.shared, serverUp: true };
+    }
+    const session = createSession(store, config, input);
+    return { session, shared: false, serverUp: false };
+}
+export async function endSession(config, store, id) {
+    if (await isServerUp(config))
+        return viaServer(config, `/api/sessions/${id}/end`);
+    const session = store.session(id);
+    store.end(id);
+    await tellRelay(config, session, "end");
+}
+export async function deleteSession(config, store, id) {
+    if (await isServerUp(config))
+        return viaServer(config, `/api/sessions/${id}/delete`);
+    const session = store.session(id);
+    store.deleteSession(id);
+    await tellRelay(config, session, "remove");
+}
+async function tellRelay(config, session, what) {
+    const creds = readCredentials(config);
+    if (creds && session)
+        await registry[what](creds, session).catch(() => { });
+}
+export async function setReplyLimit(config, store, id, limit) {
+    if (!Number.isInteger(limit) || limit < 1)
+        throw new Error("The reply limit has to be a whole number above zero.");
+    if (await isServerUp(config))
+        return viaServer(config, `/api/sessions/${id}/limit`, { limit });
+    store.setReplyLimit(id, limit);
+}