@scp-dev/cli 0.2.0 → 0.2.1

package/dist/chunk-ZLL5EGI2.js

@@ -0,0 +1,805 @@
+import {
+  SELF,
+  capture,
+  note,
+  parseSeconds
+} from "./chunk-MNTIEWKF.js";
+
+// src/relay.ts
+import { chmodSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "fs";
+import { join as join3, dirname as dirname2 } from "path";
+import { randomUUID } from "crypto";
+import { CLI_NAME as CLI_NAME3 } from "@scp-dev/core";
+
+// src/common.ts
+import { spawn } from "child_process";
+import { closeSync, openSync, statSync, truncateSync } from "fs";
+import { join as join2 } from "path";
+import { CLI_NAME as CLI_NAME2 } from "@scp-dev/core";
+import { connectBroker, privateDir, relayDir as relayDir2 } from "@scp-dev/broker";
+
+// src/identity.ts
+import { existsSync, realpathSync } from "fs";
+import { tmpdir } from "os";
+import { basename, dirname, isAbsolute, join, resolve } from "path";
+import { shortHostname } from "@scp-dev/broker";
+import { LIMITS, validHandle, validHarness } from "@scp-dev/core";
+var SHORT = { "claude-code": "claude" };
+var SHELLS = /* @__PURE__ */ new Set(["sh", "bash", "zsh", "dash", "fish"]);
+var LABEL_KEY = /^[a-z0-9][a-z0-9._-]{0,31}$/;
+function detectHarness(env) {
+  if (env.GROK_SESSION_ID || env.GROK_HOOK_EVENT) return "grok";
+  if (env.MUSE_SESSION_ID) return "muse";
+  if (env.OPENCODE === "1") return "opencode";
+  if (env.ANTIGRAVITY_AGENT === "1" || env.ANTIGRAVITY_CONVERSATION_ID) return "agy";
+  if (env.CLAUDECODE === "1") return "claude-code";
+  if (env.CODEX_THREAD_ID) return "codex";
+  return void 0;
+}
+function normalizeHarness(raw, fallback) {
+  const name = (raw ?? "").toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+/, "").slice(0, 32).replace(/-+$/, "");
+  if (name === "claude") return "claude-code";
+  return validHarness(name) ? name : fallback;
+}
+function hookHarness(argument, env) {
+  if (!argument) return detectHarness(env) ?? "hook";
+  const named = normalizeHarness(argument, "hook");
+  return named === "claude-code" && (env.GROK_SESSION_ID || env.GROK_HOOK_EVENT) ? "grok" : named;
+}
+function resolveHarness(explicit, env, fallback) {
+  const named = explicit ?? env.SCP_HARNESS;
+  return named ? normalizeHarness(named, fallback) : detectHarness(env) ?? normalizeHarness(fallback, "mcp");
+}
+function gitToplevel(cwd) {
+  for (let dir = resolve(cwd); ; dir = dirname(dir)) {
+    if (existsSync(join(dir, ".git"))) return dir;
+    if (dirname(dir) === dir) return void 0;
+  }
+}
+function toHandle(raw) {
+  let handle = raw.toLowerCase().replace(/[^a-z0-9._-]+/g, "-").replace(/^[^a-z0-9]+/, "").slice(0, 63).replace(/[-.]+$/, "");
+  if (!handle) handle = "agent";
+  if (!validHandle(handle)) handle = `${handle.slice(0, 56)}-agent`;
+  return handle;
+}
+function deriveHandle(harness, cwd) {
+  const top = gitToplevel(cwd) ?? resolve(cwd);
+  return toHandle(`${SHORT[harness] ?? harness}-${basename(top) || "root"}`);
+}
+function parseLabels(value) {
+  const labels = {};
+  for (const pair of (value ?? "").split(",")) {
+    const eq = pair.indexOf("=");
+    const key = pair.slice(0, eq).trim();
+    if (eq > 0 && LABEL_KEY.test(key)) labels[key] = pair.slice(eq + 1).trim();
+  }
+  return labels;
+}
+function labelsFor(env, host = shortHostname()) {
+  const labels = parseLabels(env.SCP_LABELS);
+  labels.machine ??= host;
+  return labels;
+}
+function processKey(harnessPid2, startOf = psStart) {
+  const started = startOf(harnessPid2);
+  return started ? `pid:${harnessPid2}:${started}` : `pid:${harnessPid2}`;
+}
+function sessionKey(env, harnessProcess) {
+  return env.SCP_SESSION ? `env:${env.SCP_SESSION}` : harnessProcess;
+}
+function psStart(pid) {
+  try {
+    const started = (capture(["ps", "-o", "lstart=", "-p", String(pid)], { PATH: process.env.PATH ?? "/usr/bin:/bin", LC_ALL: "C" }) ?? "").trim().replace(/\s+/g, "-");
+    return /^[A-Za-z0-9:-]{1,64}$/.test(started) ? started : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function parsePsCommTable(text) {
+  const table = /* @__PURE__ */ new Map();
+  for (const line of text.split("\n")) {
+    const match = /^\s*(\d+)\s+(\d+)\s+(\S+\s+\S+\s+\S+\s+\S+\s+\S+)\s+(\S.*?)\s*$/.exec(line);
+    if (match) table.set(Number(match[1]), { ppid: Number(match[2]), start: match[3].replace(/\s+/g, "-"), args: match[4] });
+  }
+  return table;
+}
+function readPsTable() {
+  try {
+    const table = capture(["ps", "-ww", "-axo", "pid=,ppid=,lstart=,args="], { PATH: process.env.PATH ?? "/usr/bin:/bin", LC_ALL: "C" });
+    return table === void 0 ? void 0 : parsePsCommTable(table);
+  } catch {
+    return void 0;
+  }
+}
+var PASS_THROUGH = /* @__PURE__ */ new Set([
+  ...SHELLS,
+  "ash",
+  "ksh",
+  "env",
+  "timeout",
+  "nohup",
+  "nice",
+  "time",
+  "stdbuf",
+  "xargs",
+  "script",
+  "caffeinate",
+  "flock",
+  "sandbox-exec",
+  "bwrap",
+  "codex-linux-sandbox",
+  "codex-linux-san"
+]);
+var INTERPRETERS = /* @__PURE__ */ new Set(["node", "nodejs", "bun", "deno", "ruby", "perl"]);
+var RUNNERS = /* @__PURE__ */ new Set(["npm", "pnpm", "yarn"]);
+var FETCHERS = /* @__PURE__ */ new Set(["npx", "bunx", "pnpx", "uvx"]);
+var SCRIPT_RUNNERS = /* @__PURE__ */ new Set(["tsx", "ts-node", "vite-node", "esno"]);
+var INLINE = /* @__PURE__ */ new Set(["-c", "-e", "--eval", "-p", "--print", "-"]);
+var VALUED = /* @__PURE__ */ new Set(["-r", "--require", "--import", "--loader", "--experimental-loader", "-I", "-M", "-W", "-X", "-C", "--conditions", "--preload"]);
+var HARNESSES = /* @__PURE__ */ new Set([
+  "claude",
+  "claude-code",
+  "codex",
+  "opencode",
+  "opencode-ai",
+  "grok",
+  "grok-cli",
+  "muse",
+  "agy",
+  "antigravity",
+  "gemini",
+  "gemini-cli",
+  "pi-coding-agent"
+]);
+var INSTALLED = /(^|\/)(node_modules|site-packages|dist-packages|\.npm|\.bun|\.cache|\.local|\.cargo|\.volta|\.nvm|\.pyenv|\.rbenv|Cellar|Applications)(\/|$)|^\/(opt|usr|Library|nix)\//;
+function command(args) {
+  return basename(args.split(/\s+/)[0].replace(/^-/, "")).toLowerCase();
+}
+var namesHarness = (words) => words.some((word) => !word.startsWith("-") && word.split("/").some((part) => HARNESSES.has(part.toLowerCase().replace(/\..*$/, ""))));
+var roots;
+function workspaceRoots() {
+  if (roots) return roots;
+  const real = (path) => {
+    try {
+      return realpathSync(path);
+    } catch {
+      return path;
+    }
+  };
+  const found = [process.cwd(), tmpdir(), "/tmp", "/private/tmp", "/var/folders", "/private/var/folders"];
+  try {
+    const top = capture(["git", "rev-parse", "--show-toplevel"]);
+    if (top !== void 0) found.push(top.trim());
+  } catch {
+  }
+  roots = [...new Set(found.filter(Boolean).map(real))];
+  return roots;
+}
+function ownScript(operand) {
+  if (operand === void 0 || operand === "-") return true;
+  if (/^[a-z][a-z0-9+.-]*:/i.test(operand) || operand.startsWith("~") || INSTALLED.test(operand)) return false;
+  if (!isAbsolute(operand)) return !operand.split("/").includes("..");
+  let path = operand;
+  try {
+    path = realpathSync(operand);
+  } catch {
+  }
+  if (INSTALLED.test(path)) return false;
+  return workspaceRoots().some((root) => path === root || path.startsWith(`${root}/`));
+}
+function helper(args) {
+  const words = args.split(/\s+/);
+  if (namesHarness(words.slice(1))) return false;
+  const name = command(args);
+  let rest = words.slice(1);
+  if (FETCHERS.has(name)) {
+    while (rest[0]?.startsWith("-")) rest = rest.slice(1);
+    return SCRIPT_RUNNERS.has(rest[0] ?? "") && rest.slice(1).every((word) => word.startsWith("-") || ownScript(word));
+  }
+  if (name === "uv" || RUNNERS.has(name)) {
+    if (rest[0] !== "run") return false;
+    if (name === "uv") {
+      rest = rest.slice(1);
+      while (rest[0]?.startsWith("-")) rest = rest.slice(1);
+      if (rest[0] === void 0) return true;
+      const inner = rest.join(" ");
+      return /^python[0-9.]*$/.test(command(inner)) || INTERPRETERS.has(command(inner)) ? helper(inner) : ownScript(rest[0]);
+    }
+    return true;
+  }
+  if (!INTERPRETERS.has(name) && !/^python[0-9.]*$/.test(name)) return false;
+  if (name === "bun" && rest[0] === "x") return false;
+  if ((name === "bun" || name === "deno") && rest[0] === "run") {
+    rest = rest.slice(1);
+    if (name === "deno") while (rest[0]?.startsWith("-")) rest = rest.slice(1);
+    const target = rest.find((word) => !word.startsWith("-"));
+    if (target !== void 0 && !/[/.]/.test(target)) return false;
+  }
+  for (let i = 0; i < rest.length; i++) {
+    const word = rest[i];
+    if (word === "-m") return false;
+    if (INLINE.has(word)) return true;
+    if (VALUED.has(word)) {
+      if (!ownScript(rest[++i])) return false;
+      continue;
+    }
+    if (!word.startsWith("-")) return ownScript(word);
+  }
+  return true;
+}
+function harnessLineage(pid, table = readPsTable()) {
+  const keys = lineage(pid, table);
+  let first = -1;
+  for (let i = 0, at = pid; i < keys.length; i++, at = table.get(at).ppid) {
+    const args = table.get(at).args;
+    if (PASS_THROUGH.has(command(args))) continue;
+    if (!helper(args)) return keys.slice(0, i + 1);
+    if (first < 0) first = i;
+  }
+  return first < 0 ? [] : keys;
+}
+var INITS = /* @__PURE__ */ new Set(["init", "systemd", "launchd"]);
+function hiddenHarness(pid, table = readPsTable()) {
+  if (!table || harnessLineage(pid, table).length) return false;
+  const seen = /* @__PURE__ */ new Set();
+  let at = pid;
+  while (at > 1 && !seen.has(at)) {
+    seen.add(at);
+    const entry = table.get(at);
+    if (!entry) return false;
+    at = entry.ppid;
+  }
+  const init = table.get(1);
+  return at === 1 && init !== void 0 && !INITS.has(command(init.args));
+}
+function lineage(harnessPid2, table = readPsTable()) {
+  const keys = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (let pid = harnessPid2; pid > 1 && keys.length < LIMITS.lineageMax && !seen.has(pid); ) {
+    const entry = table?.get(pid);
+    if (!entry) break;
+    seen.add(pid);
+    keys.push(/^[A-Za-z0-9:-]{1,64}$/.test(entry.start) ? `pid:${pid}:${entry.start}` : `pid:${pid}`);
+    pid = entry.ppid;
+  }
+  return keys;
+}
+function spawnerKey(pid = process.pid, table = readPsTable()) {
+  const key = lineage(pid, table)[0];
+  return key?.startsWith(`pid:${pid}:`) ? key : void 0;
+}
+function psParent(pid) {
+  const match = /^\s*(\d+)\s+(.+?)\s*$/.exec(capture(["ps", "-o", "ppid=,comm=", "-p", String(pid)], { PATH: process.env.PATH ?? "/usr/bin:/bin" }) ?? "");
+  return match ? { ppid: Number(match[1]), comm: match[2] } : void 0;
+}
+function harnessPid(ppid = process.ppid, parentOf = psParent) {
+  const parent = parentOf(ppid);
+  if (parent && parent.ppid > 1 && SHELLS.has(basename(parent.comm.replace(/^-/, "")))) return parent.ppid;
+  return ppid;
+}
+function hookHarnessPid(env, harness, ppid = process.ppid, parentOf = psParent) {
+  const named = harness === "claude-code" ? env.CLAUDE_PID : harness === "opencode" ? env.OPENCODE_PID : void 0;
+  const pid = Number(named);
+  if (Number.isInteger(pid) && pid > 1) return pid;
+  return harnessPid(ppid, parentOf);
+}
+function relayIdentity(input) {
+  const harness = resolveHarness(input.harness, input.env, input.fallbackHarness);
+  const cwd = isAbsolute(input.cwd) ? input.cwd : resolve(input.cwd);
+  const handle = input.as ?? input.env.SCP_NAME ?? deriveHandle(harness, cwd);
+  const pid = input.harnessPid(harness);
+  const harnessProcess = processKey(pid, input.startOf);
+  const keys = input.lineageOf ? input.lineageOf(pid) : lineage(pid);
+  return {
+    handle,
+    harness,
+    cwd,
+    session: sessionKey(input.env, harnessProcess),
+    process: harnessProcess,
+    labels: labelsFor(input.env),
+    ...input.env.SCP_PARENT ? { parent: input.env.SCP_PARENT } : {},
+    ...keys.length ? { lineage: keys } : {},
+    ...input.env.SCP_GRANT ? { grant: input.env.SCP_GRANT } : {}
+  };
+}
+
+// src/session.ts
+import { CLI_NAME } from "@scp-dev/core";
+import { readSessionMarker, relayDir } from "@scp-dev/broker";
+function membership(env, session) {
+  const marker = readSessionMarker(relayDir(env), session);
+  if (marker?.joined === false) return { dark: `this session left the relay; ${CLI_NAME} join (or relay_join) joins it again` };
+  if (!marker?.joined && joinMode(env) === "manual") return { dark: `this session has not joined the relay; ${CLI_NAME} join <name> (or relay_join) joins it` };
+  return marker?.handle ? { handle: marker.handle } : {};
+}
+
+// src/common.ts
+var RelayUsage = class extends Error {
+};
+var OPTIONS = {
+  cloud: { type: "boolean" },
+  machine: { type: "string" },
+  token: { type: "string" },
+  label: { type: "string" },
+  "no-browser": { type: "boolean" },
+  json: { type: "boolean" },
+  channels: { type: "boolean" },
+  write: { type: "boolean" },
+  print: { type: "boolean" },
+  "block-stop-on-unread": { type: "boolean" },
+  "push-wait": { type: "string" },
+  all: { type: "boolean" },
+  as: { type: "string" },
+  harness: { type: "string" },
+  wait: { type: "string" },
+  ack: { type: "boolean" },
+  keep: { type: "boolean" },
+  "reply-to": { type: "string" },
+  "require-reply": { type: "boolean" },
+  thread: { type: "string" },
+  private: { type: "boolean" },
+  attach: { type: "string", multiple: true },
+  tool: { type: "string" },
+  summary: { type: "string" },
+  since: { type: "string" },
+  limit: { type: "string" },
+  idle: { type: "string" },
+  policy: { type: "string" },
+  human: { type: "boolean" },
+  help: { type: "boolean", short: "h" },
+  scope: { type: "string" },
+  tree: { type: "boolean" },
+  roots: { type: "boolean" },
+  contacts: { type: "boolean" },
+  activity: { type: "boolean" },
+  in: { type: "string" },
+  out: { type: "string" },
+  allow: { type: "string", multiple: true },
+  rules: { type: "string" },
+  group: { type: "string" },
+  under: { type: "string" },
+  ttl: { type: "string" },
+  labels: { type: "string" },
+  "handback-bytes": { type: "string" },
+  "no-push": { type: "boolean" },
+  bg: { type: "boolean" },
+  fg: { type: "boolean" },
+  name: { type: "string" },
+  title: { type: "string" },
+  judge: { type: "boolean" },
+  redacted: { type: "boolean" },
+  reason: { type: "string" },
+  turns: { type: "string" },
+  full: { type: "boolean" },
+  who: { type: "boolean" },
+  peek: { type: "string" },
+  endpoint: { type: "string" },
+  live: { type: "boolean" }
+};
+var SPAWN_OPTIONS = [
+  "as",
+  "harness",
+  "human",
+  "name",
+  "title",
+  "scope",
+  "rules",
+  "in",
+  "out",
+  "allow",
+  "group",
+  "under",
+  "ttl",
+  "labels",
+  "peek",
+  "handback-bytes",
+  "no-push",
+  "bg",
+  "fg"
+];
+var OBSERVE = /* @__PURE__ */ new Set([
+  "list",
+  "status",
+  "watch",
+  "log",
+  "policy",
+  "machines",
+  "rules",
+  "group",
+  "admin",
+  "spawn-env",
+  "spawn",
+  "why",
+  "peek",
+  "set-peek"
+]);
+var CLOUD_OBSERVE = /* @__PURE__ */ new Set(["list", "status", "watch", "log", "machines"]);
+var GRANT_TOKEN = /^krt_[0-9a-f]{64}$/;
+var DAEMON_ENV = [
+  "PATH",
+  "LANG",
+  "LC_ALL",
+  "LC_CTYPE",
+  "TZ",
+  "TMPDIR",
+  "USER",
+  "LOGNAME",
+  "SCP_IDLE",
+  "HOME",
+  "XDG_CONFIG_HOME",
+  "SCP_TOKEN",
+  "SCP_RELAY",
+  "SCP_MACHINE"
+];
+var LOG_MAX_BYTES = 1024 * 1024;
+function startDaemon(dir) {
+  privateDir(dir);
+  const logFile = join2(dir, "broker.log");
+  if ((statSync(logFile, { throwIfNoEntry: false })?.size ?? 0) > LOG_MAX_BYTES) truncateSync(logFile, 0);
+  const log = openSync(logFile, "a", 384);
+  try {
+    const env = { SCP_DIR: dir };
+    for (const key of DAEMON_ENV) if (process.env[key] !== void 0) env[key] = process.env[key];
+    const child = spawn(SELF[0], [...SELF.slice(1), "daemon"], {
+      detached: true,
+      stdio: ["ignore", log, log],
+      env,
+      cwd: dir
+    });
+    child.unref();
+  } finally {
+    closeSync(log);
+  }
+}
+function terminalAttached(streams, bodyFromStdin) {
+  if (streams.stdin.isTTY === true) return true;
+  return !bodyFromStdin && (streams.stdout.isTTY === true || streams.stderr.isTTY === true);
+}
+function localHandle(raw) {
+  const handle = raw.startsWith("me/") ? raw.slice(3) : raw;
+  if (!handle) throw new RelayUsage("--as me/ names your own human inbox: use --human");
+  if (handle.includes("/")) throw new RelayUsage(`--as names a local handle, not ${JSON.stringify(raw)}`);
+  return handle;
+}
+function walkNow() {
+  const table = readPsTable();
+  return { keys: lineage(process.ppid, table), self: harnessLineage(process.ppid, table) };
+}
+async function open(verb, values, cwd, bodyFromStdin, walk) {
+  const named = values.as ?? process.env.SCP_NAME;
+  const tty = terminalAttached(process, bodyFromStdin);
+  if (named && values.human) throw new RelayUsage("--human and --as (or $SCP_NAME) name two identities; pick one");
+  const grant = process.env.SCP_GRANT || void 0;
+  const cloud = values.cloud || process.env.SCP_TRANSPORT === "cloud" || verb === "machines";
+  if (grant !== void 0) {
+    if (!GRANT_TOKEN.test(grant)) {
+      throw new RelayUsage(
+        `$SCP_GRANT is not one spawn-env grant: pass spawn-env's lines as separate words: env $(${CLI_NAME2} spawn-env ...) cmd; in zsh env \${=G} cmd`
+      );
+    }
+    if (values.human) throw new RelayUsage("--human and $SCP_GRANT name two identities: unset the grant to act as me/");
+    if (cloud) throw new RelayUsage("a spawn-env grant is for this machine's relay broker, not the cloud transport");
+  }
+  if (cloud) {
+    if (!named && !values.human && !tty && !OBSERVE.has(verb)) {
+      throw new RelayUsage(
+        `${CLI_NAME2} ${verb} needs an identity: --as HANDLE (or $SCP_NAME) for an agent, or --human for your own inbox me/ (no terminal is attached, so me/ is not assumed)`
+      );
+    }
+    const { machineName, openCloud } = await import("./remote-2OWBWLJH.js");
+    const handle2 = named ? localHandle(named) : void 0;
+    const claim = handle2 ? {
+      handle: handle2,
+      harness: values.harness ?? process.env.SCP_HARNESS ?? "cli",
+      cwd,
+      ...process.env.SCP_PARENT ? { parent: process.env.SCP_PARENT } : {},
+      labels: labelsFor(process.env, machineName(values.machine))
+    } : void 0;
+    const observe = !handle2 && !values.human && CLOUD_OBSERVE.has(verb);
+    return {
+      ...await openCloud({
+        ...values.machine !== void 0 ? { machine: values.machine } : {},
+        ...handle2 ? { handle: handle2 } : {},
+        ...claim ? { claim } : {},
+        tty,
+        observe
+      }),
+      broker: null,
+      bound: handle2 ? "as" : observe ? null : "human"
+    };
+  }
+  if (values.machine !== void 0) throw new RelayUsage("--machine names the machine of the cloud transport: add --cloud");
+  const { keys, self } = walk ?? walkNow();
+  const joined = !values.as && named && self.length ? membership(process.env, sessionKey(process.env, self.at(-1))) : {};
+  const handle = "handle" in joined && joined.handle ? joined.handle : named ? localHandle(named) : void 0;
+  const harnessPid2 = self.length ? Number(/^pid:(\d+)/.exec(self.at(-1))?.[1]) : void 0;
+  const lineageClaim = keys.length ? { lineage: keys } : {};
+  const dir = relayDir2();
+  const client = await connectBroker(dir, () => startDaemon(dir));
+  try {
+    let bound;
+    let hello;
+    if (handle) {
+      bound = "as";
+      hello = await client.hello({
+        claim: {
+          handle,
+          exact: true,
+          harness: values.harness ?? process.env.SCP_HARNESS ?? "cli",
+          cwd,
+          ...process.env.SCP_PARENT ? { parent: process.env.SCP_PARENT } : {},
+          labels: labelsFor(process.env),
+          ...lineageClaim,
+          ...grant ? { grant } : {}
+        },
+        ...self.length ? { self } : {},
+        brief: true
+      });
+    } else if (grant) {
+      hello = await client.hello({ observe: true, ...lineageClaim, ...self.length ? { self } : {}, grant, cwd, brief: true });
+      if (!hello.grant_bound) throw new RelayUsage(`the running ${CLI_NAME2} broker does not check spawn-env grants: let it exit (it stops when idle) and retry`);
+      bound = "lineage";
+    } else if (values.human || tty) {
+      hello = await client.hello({ human: true, tty, cwd, brief: true, ...lineageClaim });
+      bound = hello.endpoint?.kind === "human" ? "human" : "lineage";
+    } else {
+      hello = await client.hello({ observe: true, ...lineageClaim, ...self.length ? { self } : {}, cwd, brief: true });
+      bound = hello.endpoint ? "lineage" : null;
+      if (!hello.endpoint && !OBSERVE.has(verb)) {
+        if (hiddenHarness(process.ppid, readPsTable()))
+          throw new RelayUsage(`${CLI_NAME2} ${verb}: sandbox pid namespace: this shell cannot see its harness; use the scp MCP tools`);
+        throw new RelayUsage(
+          `${CLI_NAME2} ${verb}: no relay agent runs this shell's harness process (${harnessPid2 ? `pid ${harnessPid2}` : "none found"}); ${CLI_NAME2} join <name> puts this session on the relay, or pass --as HANDLE or --human (no terminal is attached, so me/ is not assumed)`
+        );
+      }
+    }
+    return { client, me: hello.endpoint, broker: hello.broker, where: brokerLine(hello.broker), bound, harnessPid: harnessPid2 };
+  } catch (error) {
+    client.close();
+    throw error;
+  }
+}
+function localClient(client, broker, verb) {
+  if (!broker) throw new RelayUsage(`${CLI_NAME2} ${verb} is the local broker's; it has no --cloud form`);
+  return client;
+}
+function brokerLine(broker) {
+  const policy = broker.policy.state === "open" ? `no policy at ${broker.policy.file}, open` : broker.policy.state === "loaded" ? `policy ${broker.policy.file}` : `policy ${broker.policy.file} unusable, sends refused`;
+  return `broker ${broker.socket} (pid ${broker.pid}); ${policy}`;
+}
+function selectorList(value) {
+  if (value === void 0 || typeof value === "boolean") return void 0;
+  return (Array.isArray(value) ? value : [value]).flatMap((v) => v.split(",")).map((v) => v.trim()).filter(Boolean);
+}
+var PRESETS = /* @__PURE__ */ new Set(["open", "tree", "parent", "none"]);
+function preset(value) {
+  if (value === void 0) return void 0;
+  if (typeof value !== "string" || !PRESETS.has(value)) throw new RelayUsage("--scope takes open, tree, parent or none");
+  return value;
+}
+function peekGrant(value) {
+  if (value === void 0) return {};
+  if (value !== "local") throw new RelayUsage(`--peek takes local (peekable on this machine from its start), not ${JSON.stringify(value)}`);
+  return { peek: "local" };
+}
+function grantParams(values) {
+  const rules = selectorList(values.rules);
+  if (rules && values.scope !== void 0) throw new RelayUsage("--rules and --scope both set a preset; pick one");
+  const allow = [...rules ?? [], ...selectorList(values.allow) ?? []];
+  const scope = rules ? "none" : preset(values.scope);
+  const groups = selectorList(values.group);
+  const incoming = selectorList(values.in);
+  const outgoing = selectorList(values.out);
+  return {
+    ...values.name ? { name: values.name } : {},
+    ...values.title !== void 0 ? { title: values.title } : {},
+    ...values.under ? { under: values.under } : {},
+    ...scope ? { scope } : {},
+    ...incoming ? { in: incoming } : {},
+    ...outgoing ? { out: outgoing } : {},
+    ...allow.length ? { allow } : {},
+    ...groups?.length ? { groups } : {},
+    ...values.ttl !== void 0 ? { ttl_s: ttlSeconds(values.ttl) } : {},
+    ...values["no-push"] === true ? { no_push: true } : {},
+    ...peekGrant(values.peek)
+  };
+}
+function ttlSeconds(text) {
+  try {
+    return parseSeconds(text, "--ttl");
+  } catch (error) {
+    throw new RelayUsage(error instanceof Error ? error.message : String(error));
+  }
+}
+var pad = (n) => String(n).padStart(2, "0");
+function time(iso) {
+  const at = new Date(iso);
+  return Number.isNaN(at.getTime()) ? iso : `${pad(at.getHours())}:${pad(at.getMinutes())}:${pad(at.getSeconds())}`;
+}
+function stamp(iso) {
+  const at = new Date(iso);
+  return Number.isNaN(at.getTime()) ? iso : `${at.getFullYear()}-${pad(at.getMonth() + 1)}-${pad(at.getDate())} ${time(iso)}`;
+}
+var CHANNELS_ENV = "SCP_CHANNELS";
+
+// src/relay.ts
+var DEFAULT_RELAY = "https://app.scp.dev";
+function configDir(env = process.env) {
+  const base = env.XDG_CONFIG_HOME || (env.HOME ? join3(env.HOME, ".config") : void 0);
+  if (!base) throw new RelayUsage("neither XDG_CONFIG_HOME nor HOME is set, so there is no place for the relay configuration");
+  return join3(base, "scp");
+}
+function checkRelayUrl(text, what = "relay URL") {
+  let url;
+  try {
+    url = new URL(text);
+  } catch {
+    throw new RelayUsage(`${what} must be an absolute https URL (http is allowed only for localhost)`);
+  }
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname)) || url.username || url.password) {
+    throw new RelayUsage(`${what} must be an absolute https URL without credentials (http is allowed only for localhost)`);
+  }
+  return url.origin;
+}
+function readObject(path) {
+  let text;
+  try {
+    text = readFileSync(path, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") return void 0;
+    throw new RelayUsage(`could not read ${path}`);
+  }
+  try {
+    const value = JSON.parse(text);
+    if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error();
+    return value;
+  } catch {
+    throw new RelayUsage(`${path} must contain a JSON object`);
+  }
+}
+function writePrivateJson(path, value) {
+  const dir = dirname2(path);
+  mkdirSync(dir, { recursive: true, mode: 448 });
+  chmodSync(dir, 448);
+  const temp = join3(dir, `.${randomUUID()}.tmp`);
+  try {
+    writeFileSync(temp, `${JSON.stringify(value, null, 2)}
+`, { mode: 384, flag: "wx" });
+    chmodSync(temp, 384);
+    renameSync(temp, path);
+  } finally {
+    rmSync(temp, { force: true });
+  }
+}
+function activeRelay(env = process.env) {
+  if (env.SCP_RELAY !== void 0) return { url: checkRelayUrl(env.SCP_RELAY, "$SCP_RELAY"), source: "SCP_RELAY" };
+  const path = join3(configDir(env), "config.json");
+  const config = readObject(path);
+  if (config?.relay !== void 0) {
+    if (typeof config.relay !== "string") throw new RelayUsage(`relay in ${path} must be a URL`);
+    return { url: checkRelayUrl(config.relay, `relay in ${path}`), source: "config" };
+  }
+  return { url: DEFAULT_RELAY, source: "default" };
+}
+function joinMode(env = process.env) {
+  try {
+    return readObject(join3(configDir(env), "config.json"))?.join === "manual" ? "manual" : "auto";
+  } catch {
+    return "auto";
+  }
+}
+function setJoinMode(env, mode) {
+  const path = join3(configDir(env), "config.json");
+  writePrivateJson(path, { ...readObject(path), join: mode });
+}
+function readCredentials(env = process.env) {
+  const path = join3(configDir(env), "credentials.json");
+  const entries = readObject(path) ?? {};
+  for (const entry of Object.values(entries)) {
+    if (!entry || typeof entry !== "object" || typeof entry.token !== "string" || !entry.token.trim() || typeof entry.saved_at !== "string") {
+      throw new RelayUsage(`${path} contains an invalid credential`);
+    }
+  }
+  return entries;
+}
+function saveCredential(env, origin, credential) {
+  const url = checkRelayUrl(origin);
+  writePrivateJson(join3(configDir(env), "credentials.json"), { ...readCredentials(env), [url]: { ...credential, saved_at: (/* @__PURE__ */ new Date()).toISOString() } });
+}
+function removeCredential(env, origin) {
+  const entries = readCredentials(env);
+  const url = checkRelayUrl(origin);
+  if (!Object.hasOwn(entries, url)) return false;
+  delete entries[url];
+  writePrivateJson(join3(configDir(env), "credentials.json"), entries);
+  return true;
+}
+function relayCredential(env, origin) {
+  const token = env.SCP_TOKEN?.trim();
+  if (token) return { token, source: "SCP_TOKEN", problem: null };
+  const stored = readCredentials(env)[checkRelayUrl(origin)];
+  if (stored) return { token: stored.token, source: "credentials", problem: null };
+  return { token: null, source: null, problem: `no login for ${origin}: run ${CLI_NAME3} login, or set SCP_TOKEN` };
+}
+function relayVerb(positionals, asJson, env = process.env) {
+  const [action, text] = positionals;
+  if (action === "use" && text !== void 0 && positionals.length === 2) {
+    const url = checkRelayUrl(text);
+    writePrivateJson(join3(configDir(env), "config.json"), { ...readObject(join3(configDir(env), "config.json")), relay: url });
+    if (asJson) console.log(JSON.stringify({ url }));
+    else console.log(`saved relay ${url}`);
+    if (env.SCP_RELAY !== void 0) note("$SCP_RELAY still selects the active relay");
+    return 0;
+  }
+  if (action === "show" && positionals.length === 1) {
+    const relay = activeRelay(env);
+    const credential = relayCredential(env, relay.url);
+    const result = { ...relay, credential: credential.token ? "found" : "missing", credential_source: credential.source };
+    if (asJson) console.log(JSON.stringify(result));
+    else console.log(`${relay.url} (${relay.source}); credential ${result.credential}${credential.source ? ` (${credential.source})` : ""}`);
+    return 0;
+  }
+  throw new RelayUsage(`${CLI_NAME3} relay takes use <url> or show`);
+}
+async function loginMain(positionals, values) {
+  if (positionals.length) throw new RelayUsage(`${CLI_NAME3} login takes only flags`);
+  return (await import("./login-UB72MU7W.js")).login(values);
+}
+function logoutMain(positionals, asJson, env = process.env) {
+  if (positionals.length) throw new RelayUsage(`${CLI_NAME3} logout takes no arguments`);
+  const { url } = activeRelay(env);
+  const removed = removeCredential(env, url);
+  if (asJson) console.log(JSON.stringify({ url, removed, env_token: !!env.SCP_TOKEN?.trim() }));
+  else console.log(removed ? `logged out of ${url}` : `no stored login for ${url}`);
+  if (env.SCP_TOKEN?.trim()) note("$SCP_TOKEN still applies");
+  return 0;
+}
+
+export {
+  shortHostname,
+  detectHarness,
+  normalizeHarness,
+  hookHarness,
+  gitToplevel,
+  deriveHandle,
+  processKey,
+  sessionKey,
+  psStart,
+  readPsTable,
+  spawnerKey,
+  psParent,
+  harnessPid,
+  hookHarnessPid,
+  relayIdentity,
+  DEFAULT_RELAY,
+  configDir,
+  checkRelayUrl,
+  writePrivateJson,
+  activeRelay,
+  joinMode,
+  setJoinMode,
+  readCredentials,
+  saveCredential,
+  removeCredential,
+  relayCredential,
+  relayVerb,
+  loginMain,
+  logoutMain,
+  membership,
+  RelayUsage,
+  OPTIONS,
+  SPAWN_OPTIONS,
+  startDaemon,
+  localHandle,
+  walkNow,
+  open,
+  localClient,
+  brokerLine,
+  selectorList,
+  preset,
+  peekGrant,
+  grantParams,
+  time,
+  stamp,
+  CHANNELS_ENV
+};