@raidiant/notifai 10.1.1 → 10.1.2

package/src/codex-wake.ts

@@ -1,301 +0,0 @@
-import { spawn } from 'node:child_process'
-import { closeSync, constants, existsSync, openSync } from 'node:fs'
-import path from 'node:path'
-import { configHome } from './install-hooks.js'
-import {
-  hookContinuationRoute,
-  type ContinuationEvent,
-  type DeliveryOutcome,
-  type EscalationDeliveryRoute,
-} from './hooks.js'
-
-/** Codex's per-thread writer lock directory, relative to `$CODEX_HOME`. */
-export const CODEX_THREAD_LOCK_DIR = 'thread-writer-locks'
-
-/**
- * BSD `open(2)` lock flags. Node does not surface them in `fs.constants`, and
- * they are the only way to take a non-blocking `flock` from Node without a
- * native addon: the kernel takes the lock at open and drops it at close.
- */
-const O_EXLOCK = 0x20
-const O_NONBLOCK = 0x4
-
-/** Platforms whose `open(2)` implements `O_EXLOCK`. Everything else fails closed. */
-const LOCK_PROBE_PLATFORMS: ReadonlySet<string> = new Set(['darwin', 'freebsd', 'openbsd'])
-
-/** Codex thread ids are UUIDs, and the lock file is named by the exact id. */
-const THREAD_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i
-
-export type CodexWakeObservation =
-  /** A live writer owns this thread. Resuming it would create a divergent ghost. */
-  | { state: 'live' }
-  /** No process holds the thread's writer lock; a cold resume can own it. */
-  | { state: 'stopped' }
-  | { state: 'unknown'; reason: string }
-
-export interface CodexWakeAdapters {
-  /** Non-blocking writer-lock probe. Never holds the lock beyond the probe. */
-  probeThreadWriter(lockPath: string): CodexWakeObservation
-  /** Is the harness process that will read this hook's stdout still running? */
-  sourceAlive(pid: number): boolean
-  resume(threadId: string, cwd: string, context: string): Promise<void>
-}
-
-/**
- * The one cross-process oracle for "who owns this Codex thread".
- *
- * Codex's thread store takes a non-blocking `flock(LOCK_EX)` on a zero-byte
- * file per thread and holds it for as long as that process owns the thread —
- * verified against both a hosted app-server thread sitting idle and an
- * in-process `codex exec` run (2026-08-12). Because the kernel holds it, a
- * crash, SIGKILL, or reboot releases it instantly, and the leftover file proves
- * nothing: only the lock does. Codex fails closed itself with `-32600` when a
- * second writer contends, but that is the backstop; this is the gate.
- */
-export function observeCodexThread(
-  threadId: string,
-  env: NodeJS.ProcessEnv,
-  adapters: Pick<CodexWakeAdapters, 'probeThreadWriter'>,
-): CodexWakeObservation {
-  if (!THREAD_ID.test(threadId)) {
-    return { state: 'unknown', reason: 'the Codex session id is not a thread id' }
-  }
-  try {
-    return adapters.probeThreadWriter(codexThreadLockPath(threadId, env))
-  } catch (err) {
-    return {
-      state: 'unknown',
-      reason: `Codex thread-writer lock probe failed: ${err instanceof Error ? err.message : String(err)}`,
-    }
-  }
-}
-
-export function codexThreadLockPath(threadId: string, env: NodeJS.ProcessEnv): string {
-  return path.join(codexThreadLockDirectory(env), `${threadId}.lock`)
-}
-
-export function codexThreadLockDirectory(env: NodeJS.ProcessEnv): string {
-  return path.join(configHome(env, 'CODEX_HOME', '.codex'), CODEX_THREAD_LOCK_DIR)
-}
-
-export type CodexResumeReadiness =
-  | { state: 'ready'; lockDirectory: string }
-  | { state: 'unavailable'; reason: string }
-
-/**
- * Whether a Codex thread whose Stop hook has already returned could still be
- * cold-resumed, decided without taking any lock or spawning anything.
- *
- * Two things have to hold: this platform must implement the non-blocking
- * `flock` the probe is built on, and `$CODEX_HOME` must actually have a
- * thread-writer-lock directory — its absence is not evidence that a thread is
- * unowned, so the gate fails closed and the answer waits for the next turn.
- * Neither affects the ordinary path, where the hook's own stdout continues the
- * held turn.
- */
-export function inspectCodexResume(
-  env: NodeJS.ProcessEnv,
-  options: { platform: NodeJS.Platform; directoryExists: (directory: string) => boolean },
-): CodexResumeReadiness {
-  const lockDirectory = codexThreadLockDirectory(env)
-  if (!LOCK_PROBE_PLATFORMS.has(options.platform)) {
-    return {
-      state: 'unavailable',
-      reason: `no non-blocking thread-writer lock probe exists on ${options.platform}`,
-    }
-  }
-  if (!options.directoryExists(lockDirectory)) {
-    return {
-      state: 'unavailable',
-      reason: `no thread-writer-lock directory at ${lockDirectory}, so no thread can be proven unowned`,
-    }
-  }
-  return { state: 'ready', lockDirectory }
-}
-
-/**
- * Codex's answer-delivery route: the blocking Stop hook, then nothing else.
- *
- * The default is the hook continuation itself. While the Codex process that
- * invoked this hook is alive it is reading this process's stdout, and
- * `{"decision":"block"}` there creates a real new user turn — no launch
- * ownership, no control plane, no probe required. That path must never depend
- * on the lock probe: printing to a dead pipe cannot ghost-write anything, so
- * an unreadable `$CODEX_HOME` is not a reason to withhold a continuation.
- *
- * Only when that process is gone does the answer need another last meter, and
- * then exactly one is safe: a cold `codex exec resume` of a thread no live
- * writer owns. Anything else — a live writer, an unprobeable platform, a thread
- * id we cannot name — is journaled and replayed at the session's next Stop.
- * That accepted gap is the honest floor of the Codex adapter: a session that
- * went idle after its Stop returned, which Notifai did not launch, cannot be
- * woken in place.
- */
-export function codexWakeRoute(options: {
-  threadId: string
-  cwd: string
-  sourcePid: number
-  env?: NodeJS.ProcessEnv
-  adapters?: CodexWakeAdapters
-  /** False for a detached recovery owner whose stdout no harness will read. */
-  continuationActive?: boolean
-}): EscalationDeliveryRoute {
-  const env = options.env ?? process.env
-  const adapters = options.adapters ?? systemCodexWakeAdapters(env)
-  const continuation = hookContinuationRoute()
-  return {
-    kind: 'hook-continuation',
-    async deliver(event: ContinuationEvent): Promise<DeliveryOutcome> {
-      if (options.continuationActive !== false && adapters.sourceAlive(options.sourcePid)) {
-        return continuation.deliver(event)
-      }
-
-      // Probe immediately before the spawn, twice, and never trust the earlier
-      // answer: ownership is a kernel fact that can change between two syscalls,
-      // and resuming a thread someone else owns is the disqualifying failure.
-      const observed = observeCodexThread(options.threadId, env, adapters)
-      const held = holdForNextTurn(observed)
-      if (held !== null) return held
-      const confirmed = observeCodexThread(options.threadId, env, adapters)
-      const raced = holdForNextTurn(confirmed)
-      if (raced !== null) return raced
-
-      if (!event.commitDelivery()) return cancelledDelivery()
-      await adapters.resume(options.threadId, options.cwd, event.context)
-      return {
-        notes: ['cold-resumed the stopped Codex thread with its accepted answer'],
-        log: { route: 'cold-resume', stage: 'delivered' },
-        // The resume ran: the thread holds the answer, and no later hook of this
-        // session will report on a turn that started elsewhere.
-        acknowledgement: 'delivered',
-      }
-    },
-  }
-}
-
-function cancelledDelivery(): DeliveryOutcome {
-  return {
-    notes: ['the Agent Session ended before answer delivery; stopping this observer'],
-    log: { route: 'hold-for-next-turn', stage: 'queued', reason: 'session-ended' },
-    acknowledgement: 'held',
-  }
-}
-
-/** The journal, with the exact reason the thread could not be resumed. */
-function holdForNextTurn(observation: CodexWakeObservation): DeliveryOutcome | null {
-  if (observation.state === 'stopped') return null
-  const reason =
-    observation.state === 'live'
-      ? 'a live writer owns the Codex thread and this hook can no longer continue it'
-      : observation.reason
-  return {
-    notes: [`holding the accepted answer for the next turn: ${reason}`],
-    log: { route: 'hold-for-next-turn', stage: 'queued', reason },
-    acknowledgement: 'held',
-  }
-}
-
-/**
- * Take and release the writer lock in one open/close pair.
- *
- * The probe momentarily owns the lock when it is free, so it is held for
- * microseconds and never across a spawn — a probe racing a legitimate resume
- * must not be what makes that resume fail.
- */
-function probeThreadWriterLock(lockPath: string): CodexWakeObservation {
-  if (!LOCK_PROBE_PLATFORMS.has(process.platform)) {
-    return {
-      state: 'unknown',
-      reason: `no non-blocking thread-writer lock probe exists on ${process.platform}`,
-    }
-  }
-  const directory = path.dirname(lockPath)
-  if (!existsSync(directory)) {
-    // No lock directory means this is not a Codex home that has ever opened a
-    // thread, so its silence is not evidence that nothing owns this one.
-    return { state: 'unknown', reason: `no Codex thread-writer lock directory at ${directory}` }
-  }
-  let handle: number
-  try {
-    handle = openSync(lockPath, constants.O_RDONLY | O_EXLOCK | O_NONBLOCK)
-  } catch (err) {
-    const code = (err as NodeJS.ErrnoException).code
-    if (code === 'EAGAIN' || code === 'EWOULDBLOCK') return { state: 'live' }
-    // Codex unlinks the lock file when its writer drops cleanly, so a missing
-    // file inside a real lock directory means the thread has no owner.
-    if (code === 'ENOENT') return { state: 'stopped' }
-    return {
-      state: 'unknown',
-      reason: `Codex thread-writer lock probe failed: ${err instanceof Error ? err.message : String(err)}`,
-    }
-  }
-  closeSync(handle)
-  return { state: 'stopped' }
-}
-
-function runCodex(
-  args: string[],
-  options: { cwd: string; env: NodeJS.ProcessEnv },
-): Promise<string> {
-  return new Promise((resolve, reject) => {
-    const child = spawn('codex', args, {
-      cwd: options.cwd,
-      env: options.env,
-      stdio: ['ignore', 'pipe', 'pipe'],
-    })
-    const stdout: Buffer[] = []
-    const stderr: Buffer[] = []
-    child.stdout?.on('data', (chunk: Buffer | string) => stdout.push(Buffer.from(chunk)))
-    child.stderr?.on('data', (chunk: Buffer | string) => stderr.push(Buffer.from(chunk)))
-    child.once('error', reject)
-    child.once('exit', (code, signal) => {
-      if (code === 0) {
-        resolve(Buffer.concat(stdout).toString())
-        return
-      }
-      reject(
-        new Error(
-          `codex ${args[0] ?? ''} exited ${code === null ? `on ${String(signal)}` : String(code)}: ${Buffer.concat(stderr).toString().trim()}`,
-        ),
-      )
-    })
-  })
-}
-
-/**
- * The resumed process must not inherit the ended session's identity, or it
- * reports itself as that thread to every hook it fires. `CODEX_HOME` is the one
- * exception: it names the thread store the resume has to open.
- */
-function coldResumeEnvironment(env: NodeJS.ProcessEnv): NodeJS.ProcessEnv {
-  const next = { ...env }
-  for (const key of Object.keys(next)) {
-    if (key.startsWith('CODEX_') && key !== 'CODEX_HOME') delete next[key]
-  }
-  return next
-}
-
-export function systemCodexWakeAdapters(
-  env: NodeJS.ProcessEnv = process.env,
-): CodexWakeAdapters {
-  return {
-    probeThreadWriter: probeThreadWriterLock,
-    sourceAlive(pid) {
-      if (!Number.isInteger(pid) || pid <= 1) return false
-      try {
-        process.kill(pid, 0)
-        return true
-      } catch (err) {
-        // Signalling a process we may not touch still proves it exists.
-        return (err as NodeJS.ErrnoException).code === 'EPERM'
-      }
-    },
-    async resume(threadId, cwd, context) {
-      if (!existsSync(cwd)) throw new Error(`Codex thread cwd no longer exists: ${cwd}`)
-      await runCodex(['exec', 'resume', threadId, context], {
-        cwd,
-        env: coldResumeEnvironment(env),
-      })
-    },
-  }
-}

package/src/command-session.ts

@@ -1,38 +0,0 @@
-import type { CommandDeps } from './commands-core.js'
-import { resolveActiveHarness } from './commands-harness-context.js'
-import { findOwningSession, readProjectSession } from './hooks.js'
-
-export interface ResolvedCommandSession {
-  sessionId: string
-  source: 'exact-harness' | 'stable-id' | 'project-pointer'
-}
-
-/**
- * Resolve only Question Routing lifecycle ownership.
- *
- * Exact harness identity wins across checkouts. A stable question/request id
- * wins next. The cwd pointer remains a compatibility fallback for shells that
- * genuinely have no exact harness identity; it never owns Project or config
- * scope, which stay with the command's invocation directory.
- */
-export function resolveCommandSession(
-  deps: CommandDeps,
-  stableId?: string,
-): ResolvedCommandSession | null {
-  if (stableId !== undefined) {
-    const owner = findOwningSession(stableId, deps.env)
-    if (owner.ambiguous) return null
-    if (owner.sessionId !== null) return { sessionId: owner.sessionId, source: 'stable-id' }
-  }
-  const now = (deps.now ?? Date.now)()
-  const resolution = resolveActiveHarness(deps.env, deps.cwd, now)
-  if (resolution.contested.length > 0) return null
-  if (
-    resolution.active?.sessionId !== undefined &&
-    resolution.contested.length === 0
-  ) {
-    return { sessionId: resolution.active.sessionId, source: 'exact-harness' }
-  }
-  const pointer = readProjectSession(deps.cwd, deps.env, now)
-  return pointer === null ? null : { sessionId: pointer, source: 'project-pointer' }
-}

package/src/commands-agent-sessions.ts

@@ -1,72 +0,0 @@
-import { resolveActiveHarness } from './commands-harness-context.js'
-import {
-  authedClient,
-  EXIT,
-  loadLoggedConfig,
-  reportError,
-  type CommandDeps,
-} from './commands-core.js'
-import {
-  normalizeExplicitSessionLabel,
-  renameStoredSessionLabel,
-} from './session-labels.js'
-
-export interface AgentSessionRenameFlags {
-  json?: boolean
-}
-
-/** Rename only the exact harness-owned Agent Session running this command. */
-export async function agentSessionRenameCommand(
-  deps: CommandDeps,
-  label: string,
-  flags: AgentSessionRenameFlags = {},
-): Promise<number> {
-  const now = deps.now?.() ?? Date.now()
-  const resolution = resolveActiveHarness(deps.env, deps.cwd, now)
-  const active = resolution.active
-  if (resolution.contested.length > 0 || active?.sessionId === undefined) {
-    deps.io.err(
-      'No exact active Agent Session can be proven here. Run this command inside the Agent Session you intend to rename.',
-    )
-    return EXIT.usage
-  }
-
-  const normalized = normalizeExplicitSessionLabel({
-    env: deps.env,
-    sessionId: active.sessionId,
-    label,
-  })
-  if (!normalized.ok) {
-    deps.io.err(normalized.error)
-    return EXIT.usage
-  }
-
-  const config = loadLoggedConfig(deps, { cwd: deps.cwd, env: deps.env })
-  const auth = authedClient(deps, config)
-  if (!auth) return EXIT.auth
-  try {
-    const renamed = await auth.client.putAgentSessionLabel({
-      session_id: active.sessionId,
-      label: normalized.label,
-    })
-    const local = renameStoredSessionLabel({
-      env: deps.env,
-      sessionId: active.sessionId,
-      label: renamed.label,
-      harness: active.harness,
-      now,
-    })
-    if (!local.ok) {
-      deps.io.err(local.error)
-      return EXIT.failed
-    }
-    deps.io.out(
-      flags.json
-        ? JSON.stringify(renamed)
-        : `Agent Session renamed to "${renamed.label}" across your Notifai account.`,
-    )
-    return EXIT.ok
-  } catch (err) {
-    return reportError(deps, err, { operation: 'agent_session_rename' })
-  }
-}

package/src/commands-auth.ts

@@ -1,238 +0,0 @@
-import { type AccountAccessResponse } from '@raidiant/notifai-protocol'
-import { sha256Hex } from '@raidiant/notifai-protocol/node'
-import { randomBytes } from 'node:crypto'
-import os from 'node:os'
-import { NetworkError } from './client.js'
-import { type FlagOverrides } from './config.js'
-import { checkApproveUrl } from './url-policy.js'
-import {
-  EXIT,
-  SETUP_COMMAND,
-  authedClient,
-  loadLoggedConfig,
-  makeClient,
-  reportError,
-  type CommandDeps,
-} from './commands-core.js'
-import { setupAccessUrl } from './setup-destinations.js'
-import type { ReadinessState } from './readiness.js'
-
-// ---------------------------------------------------------------------------
-// login / logout / auth status
-// ---------------------------------------------------------------------------
-
-/**
- * Keep the one-time confirmation secret out of the HTTP request that opens
- * the dashboard. URL fragments are browser-local and are not sent by GET,
- * prefetchers, referrers, or link scanners.
- */
-export function pairingApprovalUrl(approveUrl: string, confirmationSecret: string): string {
-  const url = new URL(approveUrl)
-  url.hash = new URLSearchParams({ confirmation_secret: confirmationSecret }).toString()
-  return url.toString()
-}
-
-/**
- * Why a sign-in stopped, in the shape the close line renders.
- *
- * Without it, `init` fell back to the state it had before the attempt — "this
- * machine is not paired … run `notifai init`" — so the last thing a User read
- * contradicted the correct line three lines above it and pointed back at the
- * command that had just failed, for a reason it never mentioned.
- *
- * Passing one also transfers the errand: whoever takes the blocker prints the
- * close, so this command stops after naming what stopped. A sign-in run on its
- * own has no such caller and states the errand itself.
- */
-export type LoginBlockedSink = (blocker: ReadinessState) => void
-
-export async function loginCommand(
-  deps: CommandDeps,
-  flags: { name?: string; baseUrl?: string; open?: boolean },
-  onBlocked?: LoginBlockedSink,
-): Promise<number> {
-  const config = loadLoggedConfig(deps, { cwd: deps.cwd, env: deps.env, flags: { base_url: flags.baseUrl } as FlagOverrides })
-  const baseUrl = config.base_url.value
-  const machineName = flags.name ?? os.hostname()
-  const secret = randomBytes(32).toString('base64url')
-  const pollVerifier = randomBytes(24).toString('base64url')
-  const confirmationSecret = randomBytes(32).toString('base64url')
-  const client = makeClient(deps, baseUrl, null)
-
-  let begin
-  try {
-    begin = await client.beginPairing({
-      machine_name: machineName,
-      credential_hash: sha256Hex(secret),
-      poll_verifier_hash: sha256Hex(pollVerifier),
-      confirmation_hash: sha256Hex(confirmationSecret),
-    })
-  } catch (err) {
-    return reportError(deps, err)
-  }
-  const approveUrl = pairingApprovalUrl(begin.approve_url, confirmationSecret)
-
-  // The approval URL is the server's choice, and this machine is about to put
-  // it in front of the user's browser. A compromised or misconfigured service
-  // must not be able to aim that anywhere it likes, so the pairing stops here
-  // rather than showing a link the user would reasonably trust.
-  const approvable = checkApproveUrl(begin.approve_url, baseUrl, config.approve_origins.value)
-  if (!approvable.ok) {
-    deps.io.err(`Pairing stopped: ${approvable.reason}`)
-    deps.io.err(
-      'next: If you self-host with the dashboard on its own origin, allow it with ' +
-        '`notifai config set approve_origins <origin>` and run `notifai login` again.',
-    )
-    return EXIT.auth
-  }
-
-  const interactive = deps.io.interactive === true
-  if (interactive) {
-    await deps.io.intro?.('Notifai sign in')
-    await deps.io.note?.(`Code: ${begin.code}\n${approveUrl}`, 'Approve this machine')
-  } else {
-    deps.io.out(`Pairing code: ${begin.code}`)
-    deps.io.out(`Approve this machine at: ${approveUrl}`)
-    deps.io.out('Waiting for approval…')
-  }
-  if (flags.open !== false) deps.io.openUrl(approveUrl)
-
-  const expiresAt = new Date(begin.expires_at).getTime()
-  const intervalMs = Math.max(begin.poll_interval_seconds, 1) * 1000
-  const now = deps.now ?? Date.now
-  const sleep = deps.sleep ?? ((milliseconds: number) => new Promise<void>((resolve) => setTimeout(resolve, milliseconds)))
-  const approvalWaitMessage = (): string => {
-    const remainingSec = Math.max(0, Math.ceil((expiresAt - now()) / 1000))
-    const minutes = Math.floor(remainingSec / 60)
-    const seconds = remainingSec % 60
-    const remaining =
-      minutes > 0 ? `${minutes}m ${seconds.toString().padStart(2, '0')}s` : `${seconds}s`
-    return `Waiting for approval… code ${begin.code} · ${remaining} left`
-  }
-  const spinner = interactive ? await deps.io.spinner?.(approvalWaitMessage()) : null
-  while (now() < expiresAt) {
-    await sleep(intervalMs)
-    let poll
-    try {
-      poll = await client.pollPairing(begin.pairing_id, pollVerifier)
-    } catch (err) {
-      if (err instanceof NetworkError) {
-        spinner?.message(`Connection lost — retrying… code ${begin.code}`)
-        continue
-      }
-      spinner?.error('Pairing failed')
-      return reportError(deps, err)
-    }
-    if (poll.status === 'approved' && poll.machine_id) {
-      deps.store.save({ machineId: poll.machine_id, secret, baseUrl, machineName })
-      if (interactive) {
-        spinner?.stop(`Machine "${machineName}" approved`)
-        await deps.io.outro?.(`Credential stored in ${deps.store.describe()}`)
-      } else {
-        deps.io.out(`Machine "${machineName}" approved. Credential stored in ${deps.store.describe()}.`)
-      }
-      return EXIT.ok
-    }
-    if (poll.status === 'denied') {
-      spinner?.error('Pairing denied')
-      deps.io.err('Pairing was denied from the dashboard.')
-      return EXIT.auth
-    }
-    // Proof-gated: the server never returns this from lookup. Stop now rather
-    // than waiting out a TTL no approval can arrive within.
-    if (poll.status === 'no_active_plan') {
-      // The server owns which access errand is current — requesting it today,
-      // choosing a plan after cutover — so its line wins whenever it sends one.
-      const next = poll.next_action ?? `Open ${setupAccessUrl(baseUrl)} to set up access, then retry.`
-      // Ends the wait, like its three siblings above and below; the wall
-      // itself belongs to the line under it, which said the same sentence a
-      // second time when this one tried to say it first.
-      spinner?.error('Pairing stopped')
-      // One wall, said once. When a caller takes the blocker it closes the
-      // visit on this exact errand, so repeating the destination here — and
-      // naming `init` as the way past a wall no command of theirs can open —
-      // would leave the User three phrasings of one step to choose between.
-      if (onBlocked === undefined) {
-        deps.io.err('This account has no active plan or temporary Alpha access.')
-        deps.io.err(`next: ${next}`)
-        deps.io.err(`After access is granted, run \`${SETUP_COMMAND}\` again.`)
-      }
-      onBlocked?.({
-        id: 'auth',
-        title: 'Access',
-        status: 'gap',
-        detail: 'this account does not have access to Notifai yet',
-        remedy: { by: 'user-elsewhere', summary: next },
-      })
-      return EXIT.auth
-    }
-    if (poll.status === 'expired') break
-    spinner?.message(approvalWaitMessage())
-  }
-  spinner?.error('Pairing expired')
-  deps.io.err(`Pairing expired before it was approved. Run \`${SETUP_COMMAND}\` again.`)
-  return EXIT.auth
-}
-
-export function logoutCommand(deps: CommandDeps): number {
-  deps.store.clear()
-  deps.io.out('Machine credential removed. Revoke it in the dashboard too if the machine is untrusted.')
-  return EXIT.ok
-}
-
-export function authStatusCommand(deps: CommandDeps, flags: { json?: boolean }): number {
-  const credential = deps.store.load()
-  if (flags.json) {
-    deps.io.out(
-      JSON.stringify(
-        credential
-          ? {
-              signed_in: true,
-              machine_id: credential.machineId,
-              machine_name: credential.machineName,
-              base_url: credential.baseUrl,
-              store: deps.store.describe(),
-            }
-          : { signed_in: false },
-        null,
-        2,
-      ),
-    )
-    return credential ? EXIT.ok : EXIT.auth
-  }
-  if (!credential) {
-    deps.io.err(`Not signed in. Run \`${SETUP_COMMAND}\`; it will coordinate machine login and device setup.`)
-    return EXIT.auth
-  }
-  deps.io.out(`Signed in as machine "${credential.machineName}" (${credential.machineId})`)
-  deps.io.out(`Server: ${credential.baseUrl}`)
-  deps.io.out(`Credential store: ${deps.store.describe()}`)
-  return EXIT.ok
-}
-
-/** Show the server's account access decision without attempting a product mutation. */
-export async function accessStatusCommand(
-  deps: CommandDeps,
-  flags: { json?: boolean },
-): Promise<number> {
-  const config = loadLoggedConfig(deps, { cwd: deps.cwd, env: deps.env })
-  const authed = authedClient(deps, config)
-  if (!authed) return EXIT.auth
-  try {
-    const access: AccountAccessResponse = await authed.client.accessStatus()
-    if (flags.json) {
-      deps.io.out(JSON.stringify(access, null, 2))
-      return access.status === 'active' ? EXIT.ok : EXIT.failed
-    }
-    if (access.status === 'no_active_plan') {
-      deps.io.out('This account does not have access to Notifai yet.')
-      deps.io.out(`next: Open ${setupAccessUrl(authed.baseUrl)} to set up access, then retry.`)
-      return EXIT.failed
-    }
-    const expiry = access.expires_at ? ` until ${access.expires_at}` : ''
-    deps.io.out(`Access active (${access.reason})${expiry}`)
-    return EXIT.ok
-  } catch (err) {
-    return reportError(deps, err)
-  }
-}