@resolflow/cli 0.0.0-stage → 0.1.0-beta.0

package/dist/commands.js

@@ -0,0 +1,511 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RefusedError = exports.CODEX_NOT_COUNTED = exports.platformLabel = exports.CLI_VERSION = void 0;
+exports.makeCtx = makeCtx;
+exports.cmdPair = cmdPair;
+exports.describeStore = describeStore;
+exports.promptSecret = promptSecret;
+exports.buildAdapters = buildAdapters;
+exports.dailyBudgetFor = dailyBudgetFor;
+exports.describeAuth = describeAuth;
+exports.cmdStart = cmdStart;
+exports.cmdStatus = cmdStatus;
+exports.cmdModels = cmdModels;
+exports.cmdUnpair = cmdUnpair;
+exports.cmdPause = cmdPause;
+exports.cmdAgents = cmdAgents;
+exports.cmdAgentAuth = cmdAgentAuth;
+exports.cmdAgentKey = cmdAgentKey;
+exports.cmdConfig = cmdConfig;
+const os = __importStar(require("os"));
+const readline = __importStar(require("readline"));
+const api_1 = require("./api");
+const config_1 = require("./config");
+const daemon_1 = require("./daemon");
+const local_model_1 = require("./local-model");
+const local_ui_1 = require("./local-ui");
+const log_1 = require("./log");
+const run_log_1 = require("./run-log");
+const secrets_1 = require("./secrets");
+const tools_1 = require("./agents/tools");
+const auth_1 = require("./agents/auth");
+const coding_agent_1 = require("./adapters/coding-agent");
+const daily_budget_1 = require("./agents/daily-budget");
+const claude_code_1 = require("./adapters/claude-code");
+const codex_1 = require("./adapters/codex");
+const openai_compatible_1 = require("./adapters/openai-compatible");
+const urls_1 = require("./urls");
+const runtime_1 = require("./runtime");
+// eslint-disable-next-line @typescript-eslint/no-var-requires
+exports.CLI_VERSION = require('../package.json').version;
+function makeCtx(opts = {}) {
+    const config = new config_1.ConfigStore();
+    const { store, warning } = (0, secrets_1.chooseSecretStore)(config.dir);
+    return { config, secrets: store, secretWarning: warning, logger: (0, log_1.createLogger)({ verbose: opts.verbose }), out: (l) => process.stdout.write(l + '\n') };
+}
+const platformLabel = () => `${process.platform}-${process.arch}`;
+exports.platformLabel = platformLabel;
+async function prompt(question) {
+    const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
+    try {
+        return await new Promise((resolve) => rl.question(question, (a) => resolve(a.trim())));
+    }
+    finally {
+        rl.close();
+    }
+}
+/** `resolflow pair <code>` / `resolflow login [--pair <code>]` */
+async function cmdPair(ctx, code, opts) {
+    const cfg = ctx.config.load();
+    const apiUrl = (0, urls_1.normaliseApiUrl)(opts.api ?? cfg.apiUrl);
+    const theCode = code || (await prompt('Pairing code (from Resolflow › Agents › Devices): '));
+    if (!theCode)
+        throw new Error('A pairing code is required');
+    const name = (opts.name ?? os.hostname()).slice(0, 60);
+    const res = await (0, api_1.pairDevice)(apiUrl, theCode, { name, platform: (0, exports.platformLabel)(), cliVersion: exports.CLI_VERSION });
+    // Replace an earlier pairing (its token is dropped locally; revoke it in the web app if it still shows)
+    await ctx.secrets.set(res.token);
+    if (ctx.secretWarning)
+        ctx.logger.warn(ctx.secretWarning);
+    ctx.config.save({
+        ...cfg,
+        apiUrl,
+        device: { id: res.deviceId, name: res.name, workspaceId: res.workspaceId, workspaceName: res.workspaceName, pairedAt: new Date().toISOString() },
+    });
+    ctx.out(`Paired "${res.name}" with workspace ${res.workspaceName ?? res.workspaceId}.`);
+    ctx.out(`Token stored in: ${describeStore(ctx.secrets)}. Next: ${(0, runtime_1.cliCommand)('start')}`);
+}
+function describeStore(s) {
+    return { keytar: 'OS keychain (keytar)', 'macos-keychain': 'macOS keychain', libsecret: 'Secret Service (libsecret)', file: 'a 0600 file in the config directory' }[s.kind];
+}
+/** Read a secret without echoing it: hidden typing on a terminal, else the whole of stdin (piped). */
+async function promptSecret(question, input = process.stdin) {
+    if (!input.isTTY) {
+        let data = '';
+        for await (const chunk of input)
+            data += chunk;
+        return data.trim();
+    }
+    const rl = readline.createInterface({ input, output: process.stderr, terminal: true });
+    const anyRl = rl;
+    let asked = false;
+    anyRl._writeToOutput = (s) => {
+        if (!asked) {
+            anyRl.output.write(s); // the question itself
+            asked = true;
+        }
+        else if (s.includes('\n') || s.includes('\r'))
+            anyRl.output.write('\n');
+    };
+    try {
+        return await new Promise((resolve) => rl.question(question, (a) => resolve(a.trim())));
+    }
+    finally {
+        rl.close();
+    }
+}
+/**
+ * The adapters `resolflow start` offers: the local model server, plus every coding agent that is ready here — with
+ * its own API key, or (RF-90e75d6d) the person's CLI login when they chose it here. A login-mode tool is reported as
+ * such and gets no job while the administrator's switch (`policy`) is off: the server refuses it, and so does the
+ * adapter.
+ */
+async function buildAdapters(ctx, cfg, endpoint, env = process.env, policy) {
+    const adapters = [new openai_compatible_1.OpenAiCompatibleAdapter(endpoint)];
+    const dailyBudget = dailyBudgetFor(ctx);
+    for (const t of await (0, tools_1.detectTools)(ctx.config.dir, env, cfg)) {
+        if (!t.ready)
+            continue;
+        const opts = { configDir: ctx.config.dir, env, limits: cfg.agentLimits, authMode: t.auth, policy, dailyBudget, warn: (m) => ctx.logger.warn(m) };
+        if (t.def.id === 'claude-code')
+            adapters.push(new claude_code_1.ClaudeCodeAdapter(opts));
+        else if (t.def.id === 'codex')
+            adapters.push(new codex_1.CodexAdapter(opts));
+    }
+    return adapters;
+}
+/** RF-27cf99e3: the daily coding agent budget; its ceiling is read from config.json for every job (no restart). */
+function dailyBudgetFor(ctx, now) {
+    return new daily_budget_1.DailyBudget(ctx.config.dir, { limit: () => (0, daily_budget_1.dailyLimitOf)(ctx.config.load().agentDailyBudgetUsd), now, warn: (m) => ctx.logger.warn(m) });
+}
+exports.CODEX_NOT_COUNTED = 'Claude Code only — Codex reports no cost and is not counted';
+/** `api key` / `CLI login` / `CLI login — not available (disabled by the administrator)` (resolflow agents). */
+function describeAuth(t, policy) {
+    if (t.auth !== 'login' || !(0, auth_1.isLoginTool)(t.def.id))
+        return 'api key';
+    if (policy === 'unknown')
+        return 'CLI login (could not ask Resolflow whether the administrator allows it)';
+    return policy?.[t.def.id] ? 'CLI login' : 'CLI login — not available (disabled by the administrator)';
+}
+/** The administrator's CLI login switch, asked with this device's token: a policy, or why it could not be asked. */
+async function askPolicy(ctx, cfg) {
+    const token = await ctx.secrets.get().catch(() => null);
+    if (!cfg.device || !token)
+        return { unreachable: 'this machine is not paired' };
+    try {
+        const me = await (0, api_1.describeDevice)(cfg.apiUrl, token);
+        return { policy: (0, auth_1.readPolicy)(me.policy) };
+    }
+    catch (err) {
+        const e = err;
+        return { unreachable: e.status === 401 ? 'this device is revoked or unpaired' : `Resolflow is not reachable (${e.message})` };
+    }
+}
+async function requireToken(ctx, cfg) {
+    const token = await ctx.secrets.get();
+    if (!cfg.device || !token)
+        throw new Error('This machine is not paired. Run: resolflow pair <code>');
+    return token;
+}
+/** `resolflow start` — runs until Ctrl+C. Returns a stop function (tests). */
+async function cmdStart(ctx, opts) {
+    let cfg = ctx.config.load();
+    const token = await requireToken(ctx, cfg);
+    const endpoint = (0, urls_1.normaliseLocalEndpoint)(opts.endpoint ?? cfg.endpoint);
+    const runLog = new run_log_1.RunLog(ctx.config.dir);
+    if (ctx.secretWarning)
+        ctx.logger.warn(ctx.secretWarning);
+    let resolveFatal = () => undefined;
+    const fatal = new Promise((r) => (resolveFatal = r));
+    // RF-90e75d6d: none until the server says (login mode off until then)
+    const policy = { current: null };
+    const adapters = await buildAdapters(ctx, cfg, endpoint, process.env, policy);
+    const loginAdapters = adapters.filter((a) => a.authMode === 'login');
+    const daemon = new daemon_1.Daemon({
+        apiUrl: (0, urls_1.normaliseApiUrl)(cfg.apiUrl),
+        token,
+        endpoint,
+        maxConcurrency: opts.concurrency ? Number(opts.concurrency) : cfg.maxConcurrency,
+        allowBackground: opts.allowBackground ?? cfg.allowBackground,
+        paused: cfg.paused,
+        cliVersion: exports.CLI_VERSION,
+        platform: (0, exports.platformLabel)(),
+        logger: ctx.logger,
+        runLog,
+        adapters,
+        policy,
+        // RF-90e75d6d: a tool on the person's CLI login is not offered while the administrator has it off
+        onPolicy: (p) => {
+            for (const a of loginAdapters) {
+                if (!(0, auth_1.isLoginTool)(a.id))
+                    continue;
+                if (p[a.id])
+                    ctx.logger.info(`${tools_1.AGENT_TOOLS[a.id].label}: CLI login allowed by the Resolflow administrator.`);
+                else
+                    ctx.logger.warn(`${(0, auth_1.notAvailableMessage)(tools_1.AGENT_TOOLS[a.id], a.id)} Resolflow will not send it jobs.`);
+            }
+        },
+        onFatal: (m) => resolveFatal(m),
+    });
+    ctx.logger.info(`Serving local models from ${endpoint} (concurrency ${daemon.status().maxConcurrency})`);
+    const agents = adapters.filter((a) => a.id !== 'openai-compatible');
+    if (agents.length) {
+        ctx.logger.info(`Coding agents offered (Mode A, tools off): ${agents.map((a) => `${a.id} (${a.authMode === 'login' ? 'CLI login' : 'API key'})`).join(', ')}`);
+    }
+    if (loginAdapters.length)
+        ctx.logger.info('CLI login jobs use your own plan and its limits; background runs never use them.');
+    daemon.start();
+    // `resolflow pause|resume|config` edit the config file: pick changes up within 2 s (no local listener needed)
+    let mtime = ctx.config.mtimeMs();
+    const watcher = setInterval(() => {
+        const m = ctx.config.mtimeMs();
+        if (m === mtime)
+            return;
+        mtime = m;
+        cfg = ctx.config.load();
+        const before = daemon.status();
+        daemon.applySettings({ paused: cfg.paused, maxConcurrency: cfg.maxConcurrency, allowBackground: cfg.allowBackground });
+        if (before.paused !== cfg.paused)
+            ctx.logger.info(cfg.paused ? 'Paused: not serving requests' : 'Resumed serving');
+    }, 2_000);
+    watcher.unref?.();
+    let ui = null;
+    if (opts.ui) {
+        ui = await (0, local_ui_1.startLocalUi)({
+            status: () => ({ ...daemon.status(), endpoint, apiUrl: cfg.apiUrl, device: cfg.device ?? null, recentRuns: runLog.recent(10) }),
+            setPaused: (paused) => {
+                ctx.config.update({ paused });
+                daemon.applySettings({ paused });
+            },
+        }, { port: opts.uiPort ? Number(opts.uiPort) : undefined });
+        // Printed once, to the terminal only (the token is in the fragment, never sent to a server)
+        ctx.out(`Local status page (this session only): ${ui.url}`);
+    }
+    const stop = async () => {
+        clearInterval(watcher);
+        daemon.stop();
+        await ui?.close();
+    };
+    void fatal.then(async (msg) => {
+        await stop();
+        process.exitCode = 2;
+        ctx.out(`Stopped: ${msg}. If this device was revoked or unpaired, pair it again: resolflow pair <code>`);
+    });
+    return stop;
+}
+/** `resolflow status` */
+async function cmdStatus(ctx) {
+    const cfg = ctx.config.load();
+    ctx.out(`API:            ${cfg.apiUrl}`);
+    ctx.out(`Local endpoint: ${cfg.endpoint}`);
+    ctx.out(`Concurrency:    ${cfg.maxConcurrency}   Background runs: ${cfg.allowBackground ? 'allowed' : 'not allowed'}   ${cfg.paused ? 'PAUSED' : 'serving'}`);
+    ctx.out(`Secrets:        ${describeStore(ctx.secrets)}`);
+    const token = await ctx.secrets.get();
+    if (!cfg.device || !token) {
+        ctx.out('Device:         not paired (resolflow pair <code>)');
+    }
+    else {
+        try {
+            const me = await (0, api_1.describeDevice)(cfg.apiUrl, token);
+            ctx.out(`Device:         ${me.name ?? cfg.device.name} (${me.deviceId}) in ${me.workspaceName ?? me.workspaceId} — ${me.online ? 'online' : `offline (run ${(0, runtime_1.cliCommand)('start')})`}`);
+        }
+        catch (err) {
+            const e = err;
+            ctx.out(`Device:         ${cfg.device.name} (${cfg.device.id}) — ${e.status === 401 ? 'REVOKED or unpaired on the server' : `server not reachable (${e.message})`}`);
+        }
+    }
+    try {
+        const models = await (0, local_model_1.listModels)(cfg.endpoint);
+        ctx.out(`Local models:   ${models.length ? models.join(', ') : '(none)'}`);
+    }
+    catch (err) {
+        ctx.out(`Local models:   unavailable (${err.message})`);
+    }
+    ctx.out(`${dailyBudgetFor(ctx).describe()} (${exports.CODEX_NOT_COUNTED}; resolflow config agent-daily-budget <USD>, 0 = no limit)`);
+    const runs = new run_log_1.RunLog(ctx.config.dir).recent(5);
+    if (runs.length) {
+        ctx.out('Recent runs:');
+        for (const r of runs)
+            ctx.out(`  ${r.at}  ${r.model}  ${r.status}${r.errorKind ? ` (${r.errorKind})` : ''}  ${(r.ms / 1000).toFixed(1)}s`);
+    }
+}
+/** `resolflow models` */
+async function cmdModels(ctx, opts) {
+    const cfg = ctx.config.load();
+    const models = await (0, local_model_1.listModels)((0, urls_1.normaliseLocalEndpoint)(opts.endpoint ?? cfg.endpoint));
+    if (!models.length)
+        ctx.out('No models on the local server. Example: ollama pull qwen3:4b');
+    for (const m of models)
+        ctx.out(m);
+}
+/** `resolflow unpair` — revoke on the server (best effort) and forget locally. */
+async function cmdUnpair(ctx) {
+    const cfg = ctx.config.load();
+    const token = await ctx.secrets.get();
+    if (token) {
+        try {
+            await (0, api_1.unpairDevice)(cfg.apiUrl, token);
+            ctx.out('Device revoked on Resolflow.');
+        }
+        catch (err) {
+            ctx.out(`Could not revoke on the server (${err.message}); revoke it in Agents › Devices.`);
+        }
+    }
+    await ctx.secrets.delete();
+    const { device: _gone, ...rest } = cfg;
+    ctx.config.save({ ...rest });
+    ctx.out('Pairing removed from this machine.');
+}
+/** `resolflow pause` / `resolflow resume` — the kill switch; a running daemon applies it within 2 s. */
+function cmdPause(ctx, paused) {
+    ctx.config.update({ paused });
+    ctx.out(paused ? 'Paused: this device will not serve requests (resolflow resume to undo).' : 'Resumed.');
+}
+/** `resolflow agents` — local coding agents: installed, version, API key configured (never the key), auth, offered. */
+async function cmdAgents(ctx, env = process.env) {
+    const cfg = ctx.config.load();
+    const limits = { ...coding_agent_1.DEFAULT_AGENT_LIMITS, ...(cfg.agentLimits ?? {}) };
+    const tools = await (0, tools_1.detectTools)(ctx.config.dir, env, cfg);
+    // The administrator's switch is asked only when a tool is on a CLI login
+    const asked = tools.some((t) => t.auth === 'login') ? await askPolicy(ctx, cfg) : null;
+    const policy = asked ? ('policy' in asked ? asked.policy : 'unknown') : null;
+    for (const t of tools) {
+        const loginOff = t.auth === 'login' && policy !== 'unknown' && !(policy && (0, auth_1.isLoginTool)(t.def.id) && policy[t.def.id]);
+        const state = !t.def.supported
+            ? t.def.note ?? 'not supported yet'
+            : t.needsOptIn
+                ? `not offered — ${t.def.optInNote ?? `set ${t.def.optInEnv}=1 to offer it`}`
+                : t.ready && loginOff
+                    ? 'not available: CLI login is disabled by the administrator (Resolflow sends it no jobs)'
+                    : t.ready
+                        ? 'ready (offered to Resolflow by resolflow start)'
+                        : !t.bin
+                            ? 'not installed'
+                            : 'needs an API key';
+        ctx.out(`${t.def.label} [${t.def.id}]`);
+        ctx.out(`  installed: ${t.bin ? `${t.bin}${t.version ? ` (${t.version})` : ''}` : 'no'}`);
+        if (t.def.supported)
+            ctx.out(`  Auth:      ${describeAuth(t, policy)}`);
+        ctx.out(`  API key:   ${(0, tools_1.describeKeySource)(t.key)}${t.key.source === 'none' && t.def.supported && t.auth !== 'login' ? ` — resolflow config agent-key ${t.def.id} (or set ${t.def.keyEnv.join(' / ')})` : ''}`);
+        ctx.out(`  status:    ${state}`);
+    }
+    ctx.out(`Job caps on this device: ${limits.maxTurns} turns, ${limits.maxBudgetUsd} USD, ${Math.round(limits.timeoutMs / 60_000)} min (resolflow config agent-turns|agent-budget|agent-timeout)`);
+    ctx.out(`${dailyBudgetFor(ctx).describe()} (${exports.CODEX_NOT_COUNTED}; resolflow config agent-daily-budget <USD>, 0 = no limit)`);
+    ctx.out('API keys and CLI logins stay on this machine; Resolflow never receives them. A CLI login is used only if you chose it (resolflow config agent-auth).');
+}
+/** Exit code 2 (refused, nothing saved): `resolflow config agent-auth … login` while the administrator has it off. */
+class RefusedError extends Error {
+    exitCode = 2;
+}
+exports.RefusedError = RefusedError;
+/**
+ * `resolflow config agent-auth <claude|codex> <api_key|login>` (RF-90e75d6d) — how a coding agent authenticates on
+ * THIS machine. login: asks Resolflow whether the administrator allows it (refused and not saved when off; saved with
+ * a warning only when Resolflow cannot be asked), shows the terms summary and needs a typed `yes`.
+ */
+async function cmdAgentAuth(ctx, tool, mode, ask = (q) => prompt(q)) {
+    const raw = (tool ?? '').trim().toLowerCase();
+    if (raw === 'gemini' || raw === 'antigravity' || raw === 'agy')
+        throw new RefusedError(auth_1.GEMINI_LOGIN_MESSAGE);
+    const id = (0, tools_1.toolIdOf)(raw);
+    if (!id || !(0, auth_1.isLoginTool)(id) || (mode !== 'api_key' && mode !== 'login'))
+        throw new Error('Usage: resolflow config agent-auth <claude|codex> <api_key|login>');
+    const def = tools_1.AGENT_TOOLS[id];
+    const cfg = ctx.config.load();
+    if (mode === 'api_key') {
+        ctx.config.update({ agentAuth: { ...(cfg.agentAuth ?? {}), [id]: 'api_key' } });
+        ctx.out(`${def.label} uses an API key on this machine (resolflow config agent-key ${auth_1.TOOL_ARG[id]}). Restart ${(0, runtime_1.cliCommand)('start')} to apply.`);
+        return;
+    }
+    const asked = await askPolicy(ctx, cfg);
+    if ('policy' in asked && !asked.policy[id])
+        throw new RefusedError((0, auth_1.notAvailableMessage)(def, id));
+    for (const line of (0, auth_1.loginTermsText)(def, id))
+        ctx.out(line);
+    const answer = (await ask('Type yes to use your CLI login for this tool: ')).trim().toLowerCase();
+    if (answer !== 'yes') {
+        ctx.out('Not changed.');
+        return;
+    }
+    const now = new Date().toISOString();
+    ctx.config.update({
+        agentAuth: { ...(cfg.agentAuth ?? {}), [id]: 'login' },
+        agentAuthTerms: { ...(cfg.agentAuthTerms ?? {}), [id]: { version: auth_1.LOGIN_TERMS_VERSION, acceptedAt: now } },
+    });
+    ctx.out(`${def.label} will use your CLI login on this machine. Restart ${(0, runtime_1.cliCommand)('start')} to apply.`);
+    if ('unreachable' in asked)
+        ctx.logger.warn(`Could not ask Resolflow (${asked.unreachable}): the CLI login will not be used until the administrator enables it.`);
+    if (id === 'codex' && process.env[tools_1.CODEX_OPT_IN_ENV] !== '1')
+        ctx.logger.warn(`Codex is offered only with ${tools_1.CODEX_OPT_IN_ENV}=1 set for resolflow start.`);
+}
+/** `resolflow config agent-key <tool> [--delete]` — store a coding agent's API key in the OS keychain (prompted). */
+async function cmdAgentKey(ctx, tool, opts, readSecret = (q) => promptSecret(q)) {
+    const id = (0, tools_1.toolIdOf)(tool ?? '');
+    if (!id)
+        throw new Error('Usage: resolflow config agent-key <claude|codex> [--delete]');
+    const def = tools_1.AGENT_TOOLS[id];
+    if (!def.supported)
+        throw new Error(`${def.label} is ${def.note ?? 'not supported yet'}`);
+    const { store, warning } = (0, secrets_1.chooseSecretStore)(ctx.config.dir, process.env, (0, secrets_1.agentKeyEntry)(ctx.config.dir, id));
+    if (opts.delete) {
+        await store.delete();
+        ctx.out(`${def.label} API key removed from ${describeStore(store)}.`);
+        return;
+    }
+    const key = await readSecret(`${def.label} API key (input hidden): `);
+    const problem = (0, tools_1.validateApiKeyShape)(key);
+    if (problem)
+        throw new Error(problem);
+    await store.set(key.trim());
+    if (warning)
+        ctx.logger.warn(warning);
+    ctx.out(`${def.label} API key stored in ${describeStore(store)}. It is used only on this machine. Restart ${(0, runtime_1.cliCommand)('start')} to offer it.`);
+}
+/** `resolflow config [key] [value]` — endpoint, concurrency, background, api, agent caps. */
+function cmdConfig(ctx, key, value) {
+    const cfg = ctx.config.load();
+    if (!key) {
+        const { device, ...shown } = cfg;
+        ctx.out(JSON.stringify({ ...shown, device: device ? { id: device.id, name: device.name, workspace: device.workspaceName ?? device.workspaceId } : null }, null, 2));
+        ctx.out(`(config file: ${ctx.config.file})`);
+        return;
+    }
+    if (value === undefined)
+        throw new Error('Usage: resolflow config <endpoint|concurrency|background|api|agent-turns|agent-budget|agent-timeout|agent-daily-budget> <value>');
+    switch (key) {
+        case 'endpoint':
+            ctx.config.update({ endpoint: (0, urls_1.normaliseLocalEndpoint)(value) });
+            break;
+        case 'concurrency': {
+            const n = Number(value);
+            if (!Number.isInteger(n) || n < 1 || n > 4)
+                throw new Error('concurrency must be 1-4');
+            ctx.config.update({ maxConcurrency: n });
+            break;
+        }
+        case 'background':
+            if (!['on', 'off'].includes(value))
+                throw new Error('background must be on or off');
+            ctx.config.update({ allowBackground: value === 'on' });
+            break;
+        case 'api':
+            if (cfg.device)
+                throw new Error('Unpair first: the pairing belongs to the current API');
+            ctx.config.update({ apiUrl: (0, urls_1.normaliseApiUrl)(value) });
+            break;
+        case 'agent-turns': {
+            const n = Number(value);
+            if (!Number.isInteger(n) || n < 1 || n > 20)
+                throw new Error('agent-turns must be 1-20');
+            ctx.config.update({ agentLimits: { ...(cfg.agentLimits ?? {}), maxTurns: n } });
+            break;
+        }
+        case 'agent-budget': {
+            const n = Number(value);
+            if (!Number.isFinite(n) || n < 0.01 || n > 50)
+                throw new Error('agent-budget must be 0.01-50 (USD per job)');
+            ctx.config.update({ agentLimits: { ...(cfg.agentLimits ?? {}), maxBudgetUsd: n } });
+            break;
+        }
+        case 'agent-timeout': {
+            const n = Number(value);
+            if (!Number.isFinite(n) || n < 1 || n > 30)
+                throw new Error('agent-timeout must be 1-30 (minutes per job)');
+            ctx.config.update({ agentLimits: { ...(cfg.agentLimits ?? {}), timeoutMs: Math.round(n * 60_000) } });
+            break;
+        }
+        case 'agent-daily-budget': {
+            const n = value.trim() === '' ? NaN : Number(value);
+            if (!Number.isFinite(n) || n < 0 || n > 10_000)
+                throw new Error('agent-daily-budget must be 0-10000 (USD per local day; 0 = no limit)');
+            ctx.config.update({ agentDailyBudgetUsd: Math.round(n * 100) / 100 });
+            break;
+        }
+        default:
+            throw new Error(`Unknown setting "${key}"`);
+    }
+    ctx.out(`${key} updated.`);
+}

package/dist/config.js

@@ -0,0 +1,104 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ConfigStore = exports.DEFAULT_CONFIG = void 0;
+exports.configDir = configDir;
+exports.ensurePrivateDir = ensurePrivateDir;
+exports.writePrivateFile = writePrivateFile;
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const urls_1 = require("./urls");
+exports.DEFAULT_CONFIG = {
+    apiUrl: urls_1.DEFAULT_API_URL,
+    endpoint: urls_1.DEFAULT_LOCAL_ENDPOINT,
+    maxConcurrency: 1,
+    allowBackground: false,
+    paused: false,
+};
+function configDir(env = process.env) {
+    if (env.RESOLFLOW_CONFIG_DIR)
+        return path.resolve(env.RESOLFLOW_CONFIG_DIR);
+    const base = env.XDG_CONFIG_HOME ? path.resolve(env.XDG_CONFIG_HOME) : path.join(os.homedir(), '.config');
+    return path.join(base, 'resolflow');
+}
+function ensurePrivateDir(dir) {
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    if (process.platform !== 'win32')
+        fs.chmodSync(dir, 0o700);
+}
+/** Write a file readable by this user only (atomic rename; 0600). */
+function writePrivateFile(file, content) {
+    ensurePrivateDir(path.dirname(file));
+    const tmp = `${file}.${process.pid}.${Date.now()}.tmp`;
+    fs.writeFileSync(tmp, content, { mode: 0o600 });
+    if (process.platform !== 'win32')
+        fs.chmodSync(tmp, 0o600);
+    fs.renameSync(tmp, file);
+}
+class ConfigStore {
+    dir;
+    file;
+    constructor(dir = configDir()) {
+        this.dir = dir;
+        this.file = path.join(dir, 'config.json');
+    }
+    load() {
+        try {
+            const raw = JSON.parse(fs.readFileSync(this.file, 'utf8'));
+            return { ...exports.DEFAULT_CONFIG, ...raw };
+        }
+        catch {
+            return { ...exports.DEFAULT_CONFIG };
+        }
+    }
+    save(cfg) {
+        writePrivateFile(this.file, JSON.stringify(cfg, null, 2) + '\n');
+    }
+    update(patch) {
+        const next = { ...this.load(), ...patch };
+        this.save(next);
+        return next;
+    }
+    mtimeMs() {
+        try {
+            return fs.statSync(this.file).mtimeMs;
+        }
+        catch {
+            return 0;
+        }
+    }
+}
+exports.ConfigStore = ConfigStore;