@proagentstore/cli 0.4.119 → 0.4.121

package/dist/browser-runner/local-apply/bridge.js

@@ -55,8 +55,14 @@ const PAGINATION_NAME = /^(next|previous|prev|more|load more|show more|see more|
 const STEP_NAME = /^(next|continue|back|previous|add( another)?|upload|attach|browse|choose( a)? file|select( a)? file|remove|edit|expand|collapse|show more)\b/i;
 /** A tick that is a legal or privacy agreement: the owner's call, not the CLI's. */
 const CONSENT_NAME = /\b(agree|consent|terms|privacy|acknowledge|certify|accept|declaration|gdpr)\b/i;
-/** A field that is a credential: a sign-in, never an application answer. */
-const CREDENTIAL_NAME = /password|passcode|one[- ]?time|\botp\b|verification code|security code|2fa|two[- ]factor/i;
+/**
+ * A field that is a credential: a sign-in, never an application answer. It includes the box an emailed or texted
+ * one-time code goes into (#1014) — "Enter the 6-digit code we emailed you", "Sign-in code" — which has no password
+ * field beside it, so the page check never sees a sign-in: the CLI is stopped at the field and the owner takes the
+ * exact session over (#1013). The Runner holds no mailbox access and never reads, asks for or types a code itself.
+ * Ordinary "code" answers (a postcode, a promo or referral code) are not credentials.
+ */
+export const CREDENTIAL_NAME = /password|passcode|one[- ]?time|\botp\b|2fa|two[- ]factor|\b(?:verification|security|sign[- ]?in|log[- ]?in|login|access|authentication|confirmation) code\b|\b\d[- ]?digit code\b|\bcode (?:that )?we (?:sent|emailed|texted)\b|\bcode (?:sent|emailed|texted) to\b/i;
 /** Keys that move between fields without entering or activating anything. */
 const SAFE_KEYS = /^(Tab|Shift\+Tab|Arrow(Up|Down|Left|Right)|Escape|Home|End|PageUp|PageDown)$/;
 /**

package/dist/index.js

@@ -11,7 +11,7 @@ import {
 
 // src/index.ts
 import { createRequire as createRequire3 } from "module";
-import { Command as Command9 } from "commander";
+import { Command as Command10 } from "commander";
 
 // src/commands/check.ts
 import { existsSync, readFileSync } from "fs";
@@ -541,44 +541,44 @@ function stringList(value) {
   if (!Array.isArray(value)) return [];
   return value.filter((n) => typeof n === "string" && n.trim().length > 0).map((n) => n.trim());
 }
-function withName(identity, name) {
+function withName(identity2, name) {
   const current = name.trim();
-  const prev = identity?.names ?? [];
+  const prev = identity2?.names ?? [];
   const names = current ? [current, ...prev.filter((n) => n !== current)] : [...prev];
-  return { id: identity?.id ?? "", names: names.slice(0, MAX_NAMES), declined: identity?.declined ?? [] };
+  return { id: identity2?.id ?? "", names: names.slice(0, MAX_NAMES), declined: identity2?.declined ?? [] };
 }
-function withClaimedNames(identity, claimed) {
+function withClaimedNames(identity2, claimed) {
   const add = claimed.map((n) => n.trim()).filter(Boolean);
-  const ordered = [identity.names[0], ...add, ...identity.names.slice(1)].filter((n) => !!n);
+  const ordered = [identity2.names[0], ...add, ...identity2.names.slice(1)].filter((n) => !!n);
   const names = [];
   for (const n of ordered) if (!names.includes(n)) names.push(n);
   return {
-    id: identity.id,
+    id: identity2.id,
     names: names.slice(0, MAX_NAMES),
-    declined: (identity.declined ?? []).filter((n) => !add.includes(n))
+    declined: (identity2.declined ?? []).filter((n) => !add.includes(n))
   };
 }
-function withUnclaimedName(identity, name) {
+function withUnclaimedName(identity2, name) {
   const unclaim = name.trim();
-  if (!unclaim) return identity;
-  const names = identity.names.filter((n) => n !== unclaim);
-  const declined = [...identity.declined ?? []];
+  if (!unclaim) return identity2;
+  const names = identity2.names.filter((n) => n !== unclaim);
+  const declined = [...identity2.declined ?? []];
   if (!declined.includes(unclaim)) declined.push(unclaim);
-  return { id: identity.id, names, declined: declined.slice(-MAX_DECLINED) };
+  return { id: identity2.id, names, declined: declined.slice(-MAX_DECLINED) };
 }
-function withDeclinedNames(identity, declined) {
-  const out = [...identity.declined ?? []];
+function withDeclinedNames(identity2, declined) {
+  const out = [...identity2.declined ?? []];
   for (const raw of declined) {
     const name = raw.trim();
-    if (!name || out.includes(name) || identity.names.includes(name)) continue;
+    if (!name || out.includes(name) || identity2.names.includes(name)) continue;
     out.push(name);
   }
-  return { id: identity.id, names: identity.names, declined: out.slice(-MAX_DECLINED) };
+  return { id: identity2.id, names: identity2.names, declined: out.slice(-MAX_DECLINED) };
 }
-function saveMachineIdentity(identity) {
+function saveMachineIdentity(identity2) {
   try {
     mkdirSync3(CONFIG_DIR2, { recursive: true });
-    writeFileSync3(MACHINE_FILE, JSON.stringify(identity, null, 2));
+    writeFileSync3(MACHINE_FILE, JSON.stringify(identity2, null, 2));
     return true;
   } catch {
     return false;
@@ -630,9 +630,9 @@ function parseNodesResponse(data) {
   }
   return out;
 }
-function claimCandidates(nodes, identity) {
-  const mine = new Set(identity.names);
-  const declined = new Set(identity.declined ?? []);
+function claimCandidates(nodes, identity2) {
+  const mine = new Set(identity2.names);
+  const declined = new Set(identity2.declined ?? []);
   const seen = /* @__PURE__ */ new Set();
   const out = [];
   for (const n of nodes) {
@@ -647,14 +647,14 @@ function claimCandidates(nodes, identity) {
   }
   return out.sort((a, b) => stampMs(b.lastSeenAt) - stampMs(a.lastSeenAt));
 }
-function resolveClaimByName(requested, nodes, identity) {
+function resolveClaimByName(requested, nodes, identity2) {
   const byName = new Map(nodes.map((n) => [n.node, n]));
   const claim = [];
   const problems = [];
   for (const raw of requested) {
     const name = raw.trim();
     if (!name || claim.includes(name)) continue;
-    if (identity.names.includes(name)) {
+    if (identity2.names.includes(name)) {
       problems.push(`${name}: this machine already claims that name.`);
       continue;
     }
@@ -741,11 +741,11 @@ async function maybeClaimMachineNames(opts) {
     suppressed: !!env.PAGS_NO_PROMPT
   });
   if (skip) return { prompted: false, reason: skip };
-  const identity = loadMachineIdentity();
-  if (!identity.id) return { prompted: false, reason: "no-identity" };
+  const identity2 = loadMachineIdentity();
+  if (!identity2.id) return { prompted: false, reason: "no-identity" };
   const nodes = await fetchNodeSummaries(opts);
   if (!nodes) return { prompted: false, reason: "unavailable" };
-  const candidates = claimCandidates(nodes, identity);
+  const candidates = claimCandidates(nodes, identity2);
   if (!candidates.length) return { prompted: false, reason: "nothing-unclaimed" };
   const nowMs = opts.now ?? Date.now();
   writeLine("");
@@ -771,14 +771,14 @@ async function maybeClaimMachineNames(opts) {
   }
   const names = candidates.map((c2) => c2.node);
   if (selection.kind !== "pick") {
-    saveMachineIdentity(withDeclinedNames(identity, names));
+    saveMachineIdentity(withDeclinedNames(identity2, names));
     writeLine(`  Skipped \u2014 these names will not be offered again (${machineFilePath()}).`);
     writeLine("");
     return { prompted: true, reason: "declined", claimed: [], declined: names };
   }
   const claimed = selection.indices.map((i) => names[i]);
   const rest = names.filter((n) => !claimed.includes(n));
-  saveMachineIdentity(withDeclinedNames(withClaimedNames(identity, claimed), rest));
+  saveMachineIdentity(withDeclinedNames(withClaimedNames(identity2, claimed), rest));
   writeLine(`  Claiming ${claimed.join(", ")} \u2014 merged on the next register.`);
   writeLine("");
   return { prompted: true, reason: "claimed", claimed, declined: rest };
@@ -899,15 +899,15 @@ async function loadNodes(token) {
 var listCommand = new Command4("list").description("List the machines ProAgentStore has seen on this account").action(async () => {
   const session = requireSession();
   const nodes = await loadNodes(session.token);
-  const identity = loadMachineIdentity();
+  const identity2 = loadMachineIdentity();
   writeLine("");
-  writeLine(`  This machine: ${identity.names[0] ?? "unknown"}  ${identity.id ? `(id ${identity.id})` : "(no id \u2014 check that ~/.config/proagentstore/ is writable)"}`);
-  if (identity.names.length > 1) writeLine(`  Also claims: ${identity.names.slice(1).join(", ")}`);
+  writeLine(`  This machine: ${identity2.names[0] ?? "unknown"}  ${identity2.id ? `(id ${identity2.id})` : "(no id \u2014 check that ~/.config/proagentstore/ is writable)"}`);
+  if (identity2.names.length > 1) writeLine(`  Also claims: ${identity2.names.slice(1).join(", ")}`);
   writeLine("");
   if (!nodes.length) writeLine("  No machines registered yet \u2014 run `pags up`.");
   const now = Date.now();
   for (const n of nodes) {
-    const owner = n.machineId ? n.machineId === identity.id ? "this machine" : "claimed" : "unclaimed";
+    const owner = n.machineId ? n.machineId === identity2.id ? "this machine" : "claimed" : "unclaimed";
     writeLine(`  ${n.node}`);
     writeLine(`      ${describeCandidate(n, now)} \xB7 ${n.connected ? "connected" : "offline"} \xB7 ${owner}`);
   }
@@ -918,19 +918,19 @@ var listCommand = new Command4("list").description("List the machines ProAgentSt
 });
 var claimCommand = new Command4("claim").description("Record that a machine name on this account is THIS machine").argument("<name...>", "Node name(s) to claim, as shown by `pags machines list`").action(async (names) => {
   const session = requireSession();
-  const identity = loadMachineIdentity();
-  if (!identity.id) {
+  const identity2 = loadMachineIdentity();
+  if (!identity2.id) {
     writeError("This machine has no id \u2014 `~/.config/proagentstore/` is not writable, so a claim could not be sent.");
     process.exit(1);
   }
   const nodes = await loadNodes(session.token);
-  const { claim, problems } = resolveClaimByName(names, nodes, identity);
+  const { claim, problems } = resolveClaimByName(names, nodes, identity2);
   for (const p of problems) writeError(`  \u2717 ${p}`);
   if (!claim.length) {
     writeError("  Nothing claimed.");
     process.exit(problems.length ? 1 : 0);
   }
-  if (!saveMachineIdentity(withClaimedNames(identity, claim))) {
+  if (!saveMachineIdentity(withClaimedNames(identity2, claim))) {
     writeError(`  \u2717 Could not write ${machineFilePath()} \u2014 nothing claimed.`);
     process.exit(1);
   }
@@ -938,8 +938,8 @@ var claimCommand = new Command4("claim").description("Record that a machine name
 });
 var unclaimCommand = new Command4("unclaim").description("Remove a mistaken machine name claim from this machine (#467)").argument("<name...>", "Node name(s) to un-claim, as shown by `pags machines list`").action(async (names) => {
   const session = requireSession();
-  const identity = loadMachineIdentity();
-  if (!identity.id) {
+  const identity2 = loadMachineIdentity();
+  if (!identity2.id) {
     writeError("This machine has no id \u2014 `~/.config/proagentstore/` is not writable, so the claim record cannot be found.");
     process.exit(1);
   }
@@ -947,12 +947,12 @@ var unclaimCommand = new Command4("unclaim").description("Remove a mistaken mach
   for (const raw of names) {
     const name = raw.trim();
     if (!name) continue;
-    if (name === identity.names[0]) {
+    if (name === identity2.names[0]) {
       writeError(`  \u2717 ${name}: this is the machine's CURRENT hostname. You cannot un-claim the name it is actively registering under \u2014 stop \`pags up\` and rename the machine first.`);
       anyFailed = true;
       continue;
     }
-    if (!identity.names.includes(name)) {
+    if (!identity2.names.includes(name)) {
       writeError(`  \u2717 ${name}: this machine does not claim that name.`);
       anyFailed = true;
       continue;
@@ -962,7 +962,7 @@ var unclaimCommand = new Command4("unclaim").description("Remove a mistaken mach
         "DELETE",
         `/v1/terminals/nodes/${apiPathSegment(name)}/claim`,
         { pagsToken: session.token, apiBase: pagsApiBase() },
-        { machineId: identity.id }
+        { machineId: identity2.id }
       );
     } catch (e) {
       const msg = e instanceof Error ? e.message : String(e);
@@ -970,7 +970,7 @@ var unclaimCommand = new Command4("unclaim").description("Remove a mistaken mach
       anyFailed = true;
       continue;
     }
-    const updated = withUnclaimedName(identity, name);
+    const updated = withUnclaimedName(identity2, name);
     if (!saveMachineIdentity(updated)) {
       writeError(`  \u2717 Server un-claimed ${name} but could not update ${machineFilePath()} \u2014 the next \`pags up\` may re-stamp it. Edit that file by hand and remove "${name}" from the names array.`);
       anyFailed = true;
@@ -1006,12 +1006,84 @@ var mcpCommand = new Command5("mcp").description("Run a local stdio proxy for th
   await runMcpProxy(opts, args);
 });
 
+// src/commands/remote-auth.ts
+import { Command as Command6 } from "commander";
+import { hostname as hostname3 } from "os";
+var CONSOLE = "https://proagentstore.online/console";
+var FIELDS = ["request_id", "agent", "machine", "resource", "scopes", "approval_url", "expires_at"];
+var SECRET_KEY = /verifier|proof|private|secret|token|password|credential|ciphertext|session|cookie|^code$/i;
+var REMOTE_AUTH_STATES = ["pending", "approving", "approved_awaiting_machine", "consumed", "connected", "denied", "expired", "cancelled", "failed"];
+function keysOf(v, out = []) {
+  if (v && typeof v === "object") {
+    for (const [k, x] of Object.entries(v)) {
+      out.push(k);
+      keysOf(x, out);
+    }
+  }
+  return out;
+}
+function buildRelayBody(input, identity2) {
+  if (!input || typeof input !== "object" || Array.isArray(input)) return { ok: false, error: "Expected the request as a JSON object on stdin." };
+  const secret = keysOf(input).filter((k) => SECRET_KEY.test(k));
+  if (secret.length) return { ok: false, error: `Refused: the request carries ${[...new Set(secret)].join(", ")}. Keep proofs, verifiers, keys and tokens on this machine \u2014 relay only the public request details.` };
+  const src = input;
+  const body = {};
+  for (const f of FIELDS) if (f in src) body[f] = src[f];
+  body.relayed_by = { node: identity2.node, machine_id: identity2.id || null };
+  return { ok: true, body };
+}
+function identity() {
+  const id = loadMachineIdentity();
+  return { id: id.id, node: id.names[0] ?? hostname3() };
+}
+async function readStdin() {
+  const chunks = [];
+  for await (const c2 of process.stdin) chunks.push(c2);
+  return Buffer.concat(chunks).toString("utf8");
+}
+var relayCommand = new Command6("relay").description("Relay a PAS sign-in request's public details (JSON on stdin) so the owner gets a push for it").action(async () => {
+  let input;
+  try {
+    input = JSON.parse(await readStdin());
+  } catch {
+    writeError("Expected the request as JSON on stdin.");
+    process.exit(2);
+  }
+  const built = buildRelayBody(input, identity());
+  if (!built.ok) {
+    writeError(built.error);
+    process.exit(2);
+  }
+  try {
+    const res = await requestPags("POST", "/v1/remote-auth/requests", {}, built.body);
+    writeLine(JSON.stringify({ id: res.request.id, url: `${CONSOLE}/remote-auth/${res.request.id}`, state: res.request.state, duplicate: res.duplicate }));
+  } catch (e) {
+    writeError(e instanceof Error ? e.message : String(e));
+    process.exit(1);
+  }
+});
+var stateCommand = new Command6("state").description("Report the PAS broker state this machine observed for a relayed request").argument("<id>", "The id `pags remote-auth relay` returned (rar_\u2026)").argument("<state>", REMOTE_AUTH_STATES.join(" | ")).action(async (id, state) => {
+  if (!REMOTE_AUTH_STATES.includes(state)) {
+    writeError(`state must be one of: ${REMOTE_AUTH_STATES.join(", ")}`);
+    process.exit(2);
+  }
+  const me = identity();
+  try {
+    const res = await requestPags("POST", `/v1/remote-auth/requests/${apiPathSegment(id)}/state`, {}, { state, relayed_by: { node: me.node, machine_id: me.id || null } });
+    writeLine(JSON.stringify({ id: res.request.id, state: res.request.state, changed: res.changed }));
+  } catch (e) {
+    writeError(e instanceof Error ? e.message : String(e));
+    process.exit(1);
+  }
+});
+var remoteAuthCommand = new Command6("remote-auth").description("Relay a ProAppStore remote MCP sign-in request to your phone (used by the PAS companion client)").addCommand(relayCommand).addCommand(stateCommand);
+
 // src/commands/publish.ts
 import { execFileSync } from "child_process";
 import { existsSync as existsSync5, readFileSync as readFileSync4 } from "fs";
 import { join as join5, resolve as resolve3 } from "path";
-import { Command as Command6 } from "commander";
-var publishCommand = new Command6("publish").description("Publish an agent to ProAgentStore").option("-d, --dir <path>", "Agent directory", ".").action(async (opts) => {
+import { Command as Command7 } from "commander";
+var publishCommand = new Command7("publish").description("Publish an agent to ProAgentStore").option("-d, --dir <path>", "Agent directory", ".").action(async (opts) => {
   const dir = resolve3(opts.dir);
   const manifestPath = join5(dir, "agent.json");
   if (!existsSync5(manifestPath)) {
@@ -1103,7 +1175,7 @@ var publishCommand = new Command6("publish").description("Publish an agent to Pr
 // src/commands/runner/command.ts
 import { spawn as spawn4 } from "child_process";
 import { randomUUID as randomUUID3 } from "crypto";
-import { Command as Command7 } from "commander";
+import { Command as Command8 } from "commander";
 
 // src/commands/runner/process.ts
 import { spawn as spawn2 } from "child_process";
@@ -1209,7 +1281,7 @@ async function waitForLocalRunner(opts, timeoutMs = 15e3) {
 }
 
 // src/commands/runner/relay.ts
-import { hostname as hostname3 } from "os";
+import { hostname as hostname4 } from "os";
 
 // src/commands/runner/resources.ts
 import { mkdirSync as mkdirSync4, readFileSync as readFileSync5, statfsSync, writeFileSync as writeFileSync4 } from "fs";
@@ -2276,7 +2348,7 @@ async function connectViaRelay(instanceIds, localUrl, runnerToken, opts, force =
   const apiBase = pagsApiBase(opts.apiBase).replace(/^http/, "ws");
   const pagsToken = clean(opts.pagsToken) || clean(process.env.PAGS_TOKEN) || clean(loadSession()?.token);
   if (!pagsToken) throw new Error("PAGS token required for WebSocket relay");
-  const runnerNode = hostname3();
+  const runnerNode = hostname4();
   const machine = loadMachineIdentity(runnerNode);
   const autoUpdateKey = machine.id ? autoUpdatePolicyKey(machine.id) : "";
   const cell = new PolicyCell(autoUpdateKey ? loadAutoUpdatePolicy(autoUpdateKey) ?? { autoUpdate: false } : { autoUpdate: false }, (p) => saveAutoUpdatePolicy(autoUpdateKey, p), !!autoUpdateKey);
@@ -2536,7 +2608,7 @@ async function connectViaRelay(instanceIds, localUrl, runnerToken, opts, force =
   writeLine(startup.state === "ok" ? `Runtime registered with PAGS \u2713 (${startup.agents} agents)` : `Runtime registration incomplete: ${startup.agents} agents \u2014 retried on each relay (re)connect${watchInstances ? " and every 20s while this runs" : ""}.`);
   writeLine("");
   writeLine("\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550");
-  writeLine(`  \u2705 CONNECTED \u2014 WebSocket relay \xB7 ${hostname3()}`);
+  writeLine(`  \u2705 CONNECTED \u2014 WebSocket relay \xB7 ${hostname4()}`);
   writeLine(`  Agents:   ${instanceIds.length} instance${instanceIds.length === 1 ? "" : "s"}`);
   writeLine("  No cloudflared needed. Ctrl+C to disconnect.");
   writeLine("\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550");
@@ -2659,7 +2731,7 @@ async function readSessionResources(localUrl, runnerToken) {
 }
 var RTT_PROBE_PREFIX = "rtt:";
 var RTT_ECHO_PREFIX = "rtt-echo:";
-function openRelaySocket(instanceId, wsBase, mintToken, localUrl, runnerToken, force = false, onConflict, onOpen, onControl, runnerNode = hostname3(), beginMutation = () => () => void 0) {
+function openRelaySocket(instanceId, wsBase, mintToken, localUrl, runnerToken, force = false, onConflict, onOpen, onControl, runnerNode = hostname4(), beginMutation = () => () => void 0) {
   let backoffMs = 1e3;
   let reconnecting = false;
   let closed = false;
@@ -2831,12 +2903,12 @@ function openRelaySocket(instanceId, wsBase, mintToken, localUrl, runnerToken, f
 }
 
 // src/commands/runner/command.ts
-import { hostname as hostname4 } from "os";
+import { hostname as hostname5 } from "os";
 function collectCapability(value, previous = []) {
   return [...previous, value];
 }
 function createRunnerCommand() {
-  const command = new Command7("runner").description(
+  const command = new Command8("runner").description(
     "Manage the local ProAgentStore browser runtime for ProAgentStore agents"
   );
   command.command("start").description("Start the local ProAgentStore browser runtime in the foreground").option("--host <host>", "Host to bind", "127.0.0.1").option("--port <port>", "Port to bind (default: first free port from 49171)").option("--data-dir <path>", "Runner data directory").option("--token <token>", "Require this bearer token").option("--instance-id <id>", "Bind runner requests to a PAGS instance id").option("--headless", "Run Playwright headless").action(async (opts) => {
@@ -2849,7 +2921,7 @@ function createRunnerCommand() {
     const lockAccount = clean(process.env.PAGS_LOCK_ACCOUNT) || "";
     let lockHeld = null;
     if (lockAccount) {
-      const taken = await acquireLock({ account: lockAccount, node: hostname4(), machineId: loadMachineIdentity().id || null, version: CLI_VERSION, port: Number(port), runnerToken });
+      const taken = await acquireLock({ account: lockAccount, node: hostname5(), machineId: loadMachineIdentity().id || null, version: CLI_VERSION, port: Number(port), runnerToken });
       if (!taken.ok) {
         for (const line of taken.lock ? holderMessage(taken.lock, taken.verdict) : ["Another `pags up` holds this machine for this account."]) writeError(line);
         process.exit(1);
@@ -3024,12 +3096,12 @@ var runnerCommand = createRunnerCommand();
 
 // src/commands/up.ts
 import { createRequire as createRequire2 } from "module";
-import { Command as Command8 } from "commander";
-import { hostname as hostname6 } from "os";
+import { Command as Command9 } from "commander";
+import { hostname as hostname7 } from "os";
 
 // src/tui.ts
 import chalk from "chalk";
-import { hostname as hostname5 } from "os";
+import { hostname as hostname6 } from "os";
 import readline from "readline";
 var ACCENT = "#7c3aed";
 var c = chalk.hex(ACCENT);
@@ -3082,7 +3154,7 @@ function printStatus(state) {
   clearScreen();
   printLogo(state.version);
   const connected = state.runner === "online" && state.tunnel === "online" && state.registration === "registered";
-  console.log(pad + d("Signed in as ") + w(state.user) + d("  \xB7  agent: ") + w(state.activeInstance) + d("  \xB7  node: ") + w(hostname5()));
+  console.log(pad + d("Signed in as ") + w(state.user) + d("  \xB7  agent: ") + w(state.activeInstance) + d("  \xB7  node: ") + w(hostname6()));
   console.log("");
   const row = (kind, s, override) => {
     const { icon, label, note } = describe(kind, s);
@@ -3290,7 +3362,7 @@ async function replaceHolder(lock, opts = {}, deps = {}) {
 // src/commands/up.ts
 var API_BASE3 = "https://api.proagentstore.online";
 var CLI_VERSION2 = createRequire2(import.meta.url)("../package.json").version;
-var upCommand = new Command8("up").description("Start the browser runner for all your agent instances").option("--headless", "Run browser in headless mode").option("--instance <id>", "Connect to a specific instance only").option("--force", "Take over from another connected machine").option("--replace", "Stop the `pags up` already running here for this account, then take over").option("--now", "With --replace: stop it even though work is running on it (that work is lost)").action(async (opts) => {
+var upCommand = new Command9("up").description("Start the browser runner for all your agent instances").option("--headless", "Run browser in headless mode").option("--instance <id>", "Connect to a specific instance only").option("--force", "Take over from another connected machine").option("--replace", "Stop the `pags up` already running here for this account, then take over").option("--now", "With --replace: stop it even though work is running on it (that work is lost)").action(async (opts) => {
   const session = requireSession();
   const state = {
     user: session.user.login,
@@ -3345,7 +3417,7 @@ var upCommand = new Command8("up").description("Start the browser runner for all
     headless: opts.headless
   }).catch(() => void 0);
   if (!opts.instance) {
-    const split = partitionByPin(instances, hostname6(), loadMachineIdentity(hostname6()).names);
+    const split = partitionByPin(instances, hostname7(), loadMachineIdentity(hostname7()).names);
     instances = split.here;
     elsewhere = split.elsewhere;
   }
@@ -3528,7 +3600,7 @@ var upCommand = new Command8("up").description("Start the browser runner for all
     }
   }
 });
-var downCommand = new Command8("down").description("Stop the browser runner and disconnect").option("--now", "Stop it even though work is running on it (that work is lost)").action(async (opts) => {
+var downCommand = new Command9("down").description("Stop the browser runner and disconnect").option("--now", "Stop it even though work is running on it (that work is lost)").action(async (opts) => {
   clearScreen();
   printLogo(CLI_VERSION2);
   const session = requireSession();
@@ -3553,7 +3625,7 @@ var downCommand = new Command8("down").description("Stop the browser runner and
 // src/index.ts
 var require2 = createRequire3(import.meta.url);
 var { version } = require2("../package.json");
-var program = new Command9();
+var program = new Command10();
 program.name("pags").description(
   "ProAgentStore CLI \u2014 create and publish server-powered AI agents"
 ).version(version);
@@ -3568,6 +3640,7 @@ program.addCommand(publishCommand);
 program.addCommand(runnerCommand);
 program.addCommand(machinesCommand);
 program.addCommand(mcpCommand);
+program.addCommand(remoteAuthCommand);
 try {
   await program.parseAsync();
 } catch (error) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@proagentstore/cli",
-  "version": "0.4.119",
+  "version": "0.4.121",
   "description": "CLI for creating, publishing, and running ProAgentStore agents",
   "license": "MIT",
   "type": "module",