@sealant/mend 0.4.0 → 0.6.0

package/dist/main.js

@@ -5,10 +5,12 @@ import { createRequire } from "node:module";
 import * as net from "node:net";
 import * as os from "node:os";
 import * as path from "node:path";
+import { doctorCommand } from "./doctor.js";
 import { readSyncFiles, scanDotfileCandidates } from "./dotfiles.js";
 import { formatLoadReport } from "./env.js";
+import { pairCommand, qrCommand } from "./pair.js";
 import { isComposeFile, proposeFromCompose, proposeFromPackageJson, proposeFromWorkspacePackage, renderMendToml, workspaceGlobs, } from "./service-init.js";
-import { CONTINUE_COMMANDS, gitTopLevel, HARNESS_COMMANDS, LIVE_STATUSES, matchProjectByCwd, normalizeProjectName, } from "./shared.js";
+import { agentIsLive, agentOutcome, cwdFacts, gitTopLevel, HARNESS_COMMANDS, LIVE_STATUSES, matchProjectByCwd, normalizeProjectName, parseLaunchArgs, } from "./shared.js";
 // `$XDG_CONFIG_HOME/mend`, default `~/.config/mend`; a pre-XDG `~/.mend` stays authoritative
 // when it is the only one present (mirrors @mend/store's resolver — the CLI stays dependency-light).
 const mendCliHome = () => {
@@ -37,6 +39,14 @@ const fail = (message) => {
     process.stderr.write(`mend: ${message}\n`);
     process.exit(1);
 };
+const parseMendUrl = (value) => {
+    try {
+        return new URL(value);
+    }
+    catch {
+        return fail(`"${value}" is not a valid Mend URL`);
+    }
+};
 const paint = (code) => (text) => process.stdout.isTTY ? `[${code}m${text}` : text;
 const dim = paint("2");
 const green = paint("32");
@@ -110,7 +120,12 @@ const request = async (config, method, route, body) => {
         }
         throw new Error(message);
     }
-    return JSON.parse(text);
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        throw new Error(`${method} ${route} returned invalid JSON from ${config.url}`);
+    }
 };
 /** The same call for one-shot commands: any failure prints and exits. */
 const api = async (config, method, route, body) => {
@@ -121,7 +136,8 @@ const api = async (config, method, route, body) => {
         return fail(error instanceof Error ? error.message : String(error));
     }
 };
-const worktreePathOf = (storePath, worktree) => path.join(path.dirname(storePath), "worktrees", worktree);
+/** The same call bound to one config — the dependency ./pair.ts takes. */
+const boundApi = (config) => (method, route, body) => api(config, method, route, body);
 /** A live elapsed-time spinner around a slow await — provisioning is not a hang. */
 const withSpinner = async (label, work) => {
     if (process.stdout.isTTY !== true)
@@ -187,7 +203,7 @@ const findProject = async (config, explicit, adoptCwd = false) => {
         return named;
     }
     const cwd = process.cwd();
-    const project = matchProjectByCwd(projects, cwd);
+    const project = matchProjectByCwd(projects, cwdFacts(cwd));
     if (project !== undefined)
         return project;
     if (!adoptCwd) {
@@ -207,21 +223,29 @@ const findProject = async (config, explicit, adoptCwd = false) => {
     return adopted;
 };
 const launch = async (config, harness, args) => {
-    const projectFlag = args.indexOf("--project");
-    const explicit = projectFlag !== -1 && args[projectFlag + 1] !== undefined
-        ? String(args[projectFlag + 1])
-        : null;
-    const dashdash = args.indexOf("--");
-    const custom = dashdash !== -1 ? args.slice(dashdash + 1) : [];
-    const argv = harness === "run" ? custom : (HARNESS_COMMANDS[harness] ?? []);
+    const parsed = parseLaunchArgs(args);
+    if (parsed.error !== null)
+        return fail(parsed.error);
+    const structured = parsed.prompt !== null ||
+        parsed.model !== null ||
+        parsed.effort !== null ||
+        parsed.ask ||
+        parsed.fast;
+    if (harness === "run" && structured) {
+        return fail("mend run takes no prompt or harness flags — usage: mend run [--project p] -- <command...>");
+    }
+    const argv = harness === "run" ? parsed.custom : (HARNESS_COMMANDS[harness] ?? []);
     if (argv.length === 0) {
         return fail(harness === "run" ? "usage: mend run -- <command...>" : `unknown harness ${harness}`);
     }
-    const project = await findProject(config, explicit, true);
+    const project = await findProject(config, parsed.project, true);
+    // Say which project the cwd resolved to before anything is created — a
+    // wrong guess should be visible here, not discovered in the tree later.
+    say(`${green("✓")} project ${project.name} ${dim(`· ${project.defaultBranch}${parsed.project === null ? " · from cwd" : ""}`)}`);
     const session = await api(config, "POST", `/projects/${project.id}/sessions`, {
         harness,
         label: null,
-        base: null,
+        base: parsed.base,
     });
     say(`${green("✓")} worktree ${session.worktree} ${dim(`· branch ${session.branch}`)}`);
     say(`${green("✓")} base ${dim(session.baseSha.slice(0, 12))} · session ${dim(session.id.slice(0, 8))}`);
@@ -232,7 +256,18 @@ const launch = async (config, harness, args) => {
     if (harness === "run") {
         return supervisedRun(config, session, argv);
     }
-    await withSpinner("provisioning workspace — a first launch builds the harness image (can take minutes)…", api(config, "POST", `/sessions/${session.id}/launch`, { argv }));
+    // A structured start sends no argv: the server composes the harness flags
+    // (one shared mapping) and names the session from the prompt immediately.
+    const launchBody = structured
+        ? {
+            ...(parsed.prompt === null ? {} : { prompt: parsed.prompt }),
+            ...(parsed.model === null ? {} : { model: parsed.model }),
+            ...(parsed.effort === null ? {} : { effort: parsed.effort }),
+            ...(parsed.ask ? { permissionMode: "ask" } : {}),
+            ...(parsed.fast ? { speed: "fast" } : {}),
+        }
+        : { argv };
+    await withSpinner("provisioning workspace — a first launch builds the harness image (can take minutes)…", api(config, "POST", `/sessions/${session.id}/launch`, launchBody));
     say(`${green("✓ recording")} · workspace mounts the worktree${detachHint()}`);
     say("");
     await attachOrExit(config, session.id, session.harness);
@@ -250,14 +285,14 @@ const launch = async (config, harness, args) => {
  * resumes).
  */
 const attachTty = async (config, sessionId, harness, from, processId, options) => {
-    const url = new URL(`${config.url}/api/tty`);
+    const url = parseMendUrl(`${config.url}/api/tty`);
     url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
     // Process addressing reaches any PTY in the workspace (a shell); the
     // session form remains the agent's PTY.
-    if (processId !== undefined)
-        url.searchParams.set("process", processId);
-    else
+    if (processId === undefined)
         url.searchParams.set("session", sessionId);
+    else
+        url.searchParams.set("process", processId);
     url.searchParams.set("from", from.toString());
     if (config.token !== null)
         url.searchParams.set("token", config.token);
@@ -411,11 +446,11 @@ const pickSessionInteractively = async (rows) => {
  * picker, and a non-interactive caller never gets a silent guess.
  */
 const resolveLiveSession = async (config, prefix) => {
-    const sessions = await api(config, "GET", "/sessions");
+    const sessions = await api(config, "GET", "/sessions?retained=1");
     if (prefix !== undefined) {
         const matches = sessions.filter((s) => s.id.startsWith(prefix));
         if (matches.length === 0)
-            return fail(`no live session matches "${prefix}"`);
+            return fail(`no live or retained session matches "${prefix}"`);
         const exact = matches[0];
         if (matches.length > 1 || exact === undefined) {
             return fail(`session prefix "${prefix}" is ambiguous — use more of the id`);
@@ -423,11 +458,11 @@ const resolveLiveSession = async (config, prefix) => {
         return exact;
     }
     const projects = await api(config, "GET", "/projects");
-    const project = matchProjectByCwd(projects, process.cwd());
+    const project = matchProjectByCwd(projects, cwdFacts(process.cwd()));
     const candidates = project === undefined ? sessions : sessions.filter((s) => s.projectId === project.id);
     const only = candidates[0];
     if (only === undefined) {
-        return fail("no live session — start one with mend codex|claude|opencode");
+        return fail("no live or retained session — start one with mend codex|claude|opencode");
     }
     if (candidates.length === 1)
         return only;
@@ -464,16 +499,68 @@ const shellCommand = async (config, args) => {
     say(`${green("✓")} shell ended`);
     process.exit(0);
 };
-const serviceUrl = (config, service) => {
-    const host = new URL(config.url).hostname || "localhost";
-    // A UDP Service has no page to open — the endpoint is the whole fact.
-    return service.protocol === "udp"
-        ? `${host}:${service.hostPort ?? "?"} (udp)`
-        : `http://${host}:${service.hostPort ?? "?"}`;
+const flattenService = (view) => {
+    const attempt = view.service.currentAttemptId === null
+        ? null
+        : (view.attempts.find((candidate) => candidate.id === view.service.currentAttemptId) ?? null);
+    const observation = view.currentForward !== null && view.latestObservation?.forwardId === view.currentForward.id
+        ? view.latestObservation
+        : null;
+    const endpoint = view.endpoints.find((candidate) => candidate.scope === "private") ?? view.endpoints[0] ?? null;
+    const browserUrl = view.endpoints.find((candidate) => candidate.browserUrl !== null)?.browserUrl ?? null;
+    return {
+        id: view.service.id,
+        processId: attempt?.id ?? null,
+        sessionId: view.service.sessionId,
+        label: view.service.name,
+        status: observation?.state ?? view.currentForward?.state ?? attempt?.status ?? "stopped",
+        workspacePort: view.service.workspacePort,
+        hostPort: endpoint?.hostPort ?? null,
+        authority: endpoint?.authority ?? null,
+        browserUrl,
+        exposureScope: endpoint?.scope ?? null,
+        mendAuthentication: endpoint?.mendAuthentication ?? null,
+        protocol: view.service.transport,
+        sealantSessionId: attempt?.sealantSessionId ?? null,
+        attemptExitedAt: attempt?.exitedAt ?? null,
+        argv: attempt?.argv ?? [],
+        workspaceExpiresAt: view.workspaceExpiresAt,
+        workspaceTtlRenewedAt: view.workspaceTtlRenewedAt,
+        workspaceTtlRenewalFailedAt: view.workspaceTtlRenewalFailedAt,
+        workspaceTtlRenewalError: view.workspaceTtlRenewalError,
+    };
+};
+const fetchServiceViews = (config, all = false) => api(config, "GET", `/services${all ? "?all=1" : ""}`);
+const fetchServices = async (config, all = false) => (await fetchServiceViews(config, all)).map(flattenService);
+const mutateService = async (config, method, endpointPath, body) => flattenService(await api(config, method, endpointPath, body));
+const serviceUrl = (service) => service.browserUrl ??
+    (service.authority === null
+        ? "unbound"
+        : `${service.authority}${service.protocol === "udp" ? " (udp)" : ""}`);
+const serviceExposure = (service) => {
+    if (service.exposureScope === null)
+        return "";
+    if (service.exposureScope === "private") {
+        return "No Mend sign-in protects this port. Anyone who can reach this private address can connect.";
+    }
+    return `Loopback only · Mend auth: ${service.mendAuthentication ?? "unknown"}`;
 };
-const printService = (config, service) => {
+const printWorkspaceTtlFailure = (service) => {
+    if (service.workspaceTtlRenewalError === null)
+        return;
+    say(amber(`  workspace TTL renewal failed · ${service.workspaceTtlRenewalError}`));
+    say(dim(`  last renewed ${service.workspaceTtlRenewedAt ?? "unknown"} · known expiry ${service.workspaceExpiresAt ?? "unknown"} · failed ${service.workspaceTtlRenewalFailedAt ?? "unknown"}`));
+};
+const printServiceEndpoint = (service) => {
+    const exposure = serviceExposure(service);
+    say(`  ${cobalt(serviceUrl(service))}${exposure === "" ? "" : `  ${dim(exposure)}`}`);
+    printWorkspaceTtlFailure(service);
+};
+const printService = (service) => {
     const status = service.status === "reachable" ? green(service.status) : amber(service.status);
-    say(`${(service.label ?? service.id.slice(0, 8)).padEnd(12)}  ${dim(`:${service.workspacePort ?? "?"}${service.protocol === "udp" ? "/udp" : ""} →`)} ${serviceUrl(config, service)}  ${status}  ${dim(service.id.slice(0, 8))}`);
+    const exposure = serviceExposure(service);
+    say(`${(service.label ?? service.id.slice(0, 8)).padEnd(12)}  ${dim(`:${service.workspacePort ?? "?"}${service.protocol === "udp" ? "/udp" : ""} →`)} ${serviceUrl(service)}  ${status}  ${dim(service.id.slice(0, 8))}${exposure === "" ? "" : `  ${dim(exposure)}`}`);
+    printWorkspaceTtlFailure(service);
 };
 /**
  * Adopt an already-listening workspace port as a Service: Mend binds a host
@@ -484,10 +571,18 @@ const serviceAdd = async (config, args) => {
     const nameFlag = args.indexOf("--name");
     const name = nameFlag !== -1 && args[nameFlag + 1] !== undefined ? String(args[nameFlag + 1]) : null;
     const protocol = args.includes("--udp") ? "udp" : "tcp";
+    const http = args.includes("--http");
+    const https = args.includes("--https");
+    if (http && https)
+        return fail("Choose either --http or --https, not both.");
+    const browserScheme = https ? "https" : http ? "http" : null;
+    if (protocol === "udp" && browserScheme !== null) {
+        return fail("UDP Services cannot use --http or --https");
+    }
     const positional = args.filter((a, i) => !a.startsWith("--") && (nameFlag === -1 || i !== nameFlag + 1));
     const portRaw = positional.find((a) => /^\d+$/.test(a));
     if (portRaw === undefined) {
-        return fail("usage: mend service add [session] <port> [--name <n>] [--udp]");
+        return fail("usage: mend service add [session] <port> [--name <n>] [--udp] [--http|--https]");
     }
     const port = Number(portRaw);
     if (!Number.isInteger(port) || port < 1 || port > 65535) {
@@ -495,13 +590,14 @@ const serviceAdd = async (config, args) => {
     }
     const prefix = positional.find((a) => a !== portRaw);
     const session = await resolveLiveSession(config, prefix);
-    const service = await api(config, "POST", `/sessions/${session.id}/services`, {
+    const service = await mutateService(config, "POST", `/sessions/${session.id}/services`, {
         port,
         name,
         protocol,
+        browserScheme,
     });
     say(`${green("✓")} Service ${service.label ?? ""} · ${service.status}`);
-    say(`  ${cobalt(serviceUrl(config, service))}`);
+    printServiceEndpoint(service);
     if (protocol === "udp") {
         say(dim(`  udp — a reply is the only reachability signal; silence just relays`));
     }
@@ -510,19 +606,19 @@ const serviceAdd = async (config, args) => {
     }
 };
 const serviceList = async (config) => {
-    const services = await api(config, "GET", "/services");
+    const services = await fetchServices(config);
     if (services.length === 0) {
         say(dim("no live services — mend service add <port> adopts a listening one"));
         return;
     }
     for (const service of services)
-        printService(config, service);
+        printService(service);
 };
 const serviceStop = async (config, args) => {
     const needle = args.find((a) => !a.startsWith("--"));
     if (needle === undefined)
         return fail("usage: mend service stop <name-or-id-prefix>");
-    const services = await api(config, "GET", "/services");
+    const services = await fetchServices(config);
     const matches = services.filter((service) => service.label === needle || service.id.startsWith(needle));
     if (matches.length === 0)
         return fail(`no live service matches "${needle}"`);
@@ -530,11 +626,11 @@ const serviceStop = async (config, args) => {
     if (matches.length > 1 || match === undefined) {
         return fail(`"${needle}" is ambiguous — use more of the id`);
     }
-    const stoppedService = await api(config, "POST", `/services/${match.id}/stop`);
+    const stoppedService = await mutateService(config, "POST", `/services/${match.id}/stop`);
     say(`${green("✓")} stopped · ${stoppedService.label ?? stoppedService.id.slice(0, 8)}`);
 };
 const findLiveService = async (config, needle) => {
-    const services = await api(config, "GET", "/services");
+    const services = await fetchServices(config);
     const matches = services.filter((service) => service.label === needle || service.id.startsWith(needle));
     if (matches.length === 0)
         return fail(`no live service matches "${needle}"`);
@@ -552,7 +648,7 @@ const findLiveService = async (config, needle) => {
  */
 const serviceRun = async (config, args) => {
     const dashdash = args.indexOf("--");
-    const usage = "usage: mend service run [session] --port <port> [--name <n>] [--udp] -- <command...>\n" +
+    const usage = "usage: mend service run [session] --port <port> [--name <n>] [--udp] [--http|--https] -- <command...>\n" +
         "       mend service run [session] <name>          (a declared recipe)";
     // No explicit command = a DECLARED Service: resolve the name against the
     // session worktree's mend.toml and start (or adopt) its recipe.
@@ -571,27 +667,15 @@ const serviceRun = async (config, args) => {
                 ? `no mend.toml recipes in this worktree — declare [service.${name}] first`
                 : `no recipe named "${name}" — declared: ${known}`);
         }
-        if (recipe.command === null) {
-            // A port-only recipe is an adopt: something else starts the listener.
-            const service = await api(config, "POST", `/sessions/${session.id}/services`, {
-                port: recipe.port,
-                name: recipe.name,
-                protocol: recipe.protocol,
-            });
-            say(`${green("✓")} Service ${service.label ?? ""} · ${service.status}`);
-            say(`  ${cobalt(serviceUrl(config, service))}`);
-            return;
-        }
-        const service = await withSpinner(recipe.protocol === "udp"
-            ? `starting ${recipe.name} (udp :${recipe.port})…`
-            : `starting ${recipe.name} — waiting for :${recipe.port} to answer…`, api(config, "POST", `/sessions/${session.id}/services/run`, {
-            argv: ["sh", "-c", recipe.command],
-            port: recipe.port,
+        const service = await withSpinner(recipe.command === null
+            ? `adopting ${recipe.name} on :${recipe.port}…`
+            : recipe.protocol === "udp"
+                ? `starting ${recipe.name} (udp :${recipe.port})…`
+                : `starting ${recipe.name} — waiting for :${recipe.port} to answer…`, mutateService(config, "POST", `/sessions/${session.id}/services/recipe`, {
             name: recipe.name,
-            protocol: recipe.protocol,
         }));
         say(`${green("✓")} Service ${service.label ?? ""} · ${service.status}`);
-        say(`  ${cobalt(serviceUrl(config, service))}`);
+        printServiceEndpoint(service);
         say(dim(`  logs: mend service logs ${service.label ?? service.id.slice(0, 8)}`));
         return;
     }
@@ -600,74 +684,101 @@ const serviceRun = async (config, args) => {
         return fail(usage);
     const head = args.slice(0, dashdash);
     const portFlag = head.indexOf("--port");
-    const port = portFlag !== -1 ? Number(head[portFlag + 1]) : Number.NaN;
+    const port = portFlag === -1 ? Number.NaN : Number(head[portFlag + 1]);
     if (!Number.isInteger(port) || port < 1 || port > 65535)
         return fail(usage);
     const nameFlag = head.indexOf("--name");
     const name = nameFlag !== -1 && head[nameFlag + 1] !== undefined ? String(head[nameFlag + 1]) : null;
     const protocol = head.includes("--udp") ? "udp" : "tcp";
+    const http = head.includes("--http");
+    const https = head.includes("--https");
+    if (http && https)
+        return fail(usage);
+    const browserScheme = https ? "https" : http ? "http" : null;
+    if (protocol === "udp" && browserScheme !== null)
+        return fail(usage);
     const prefix = head.find((a, i) => !a.startsWith("--") && i !== portFlag + 1 && i !== nameFlag + 1);
     const session = await resolveLiveSession(config, prefix);
     const service = await withSpinner(protocol === "udp"
         ? `starting ${name ?? argv[0]} (udp :${port})…`
-        : `starting ${name ?? argv[0]} — waiting for :${port} to answer…`, api(config, "POST", `/sessions/${session.id}/services/run`, {
+        : `starting ${name ?? argv[0]} — waiting for :${port} to answer…`, mutateService(config, "POST", `/sessions/${session.id}/services/run`, {
         argv,
         port,
         name,
         protocol,
+        browserScheme,
     }));
     say(`${green("✓")} Service ${service.label ?? ""} · ${service.status}`);
-    say(`  ${cobalt(serviceUrl(config, service))}`);
+    printServiceEndpoint(service);
     say(dim(`  logs: mend service logs ${service.label ?? service.id.slice(0, 8)}`));
 };
-/**
- * Watch a supervised Service's output: record replay, then live tail. A DEAD
- * Service still answers — its record outlives the process — printed once
- * instead of followed.
- */
+/** Read sequence-addressed PTY output without attaching an input-capable terminal. */
 const serviceLogs = async (config, args) => {
-    const needle = args.find((a) => !a.startsWith("--"));
-    if (needle === undefined)
-        return fail("usage: mend service logs <name-or-id-prefix>");
-    const everything = await api(config, "GET", "/services?all=1");
-    const matches = everything.filter((service) => service.label === needle || service.id.startsWith(needle));
+    const fromFlag = args.indexOf("--from");
+    const from = fromFlag === -1 ? "0" : args[fromFlag + 1];
+    const needle = args.find((argument, index) => !argument.startsWith("--") && index !== fromFlag + 1);
+    if (needle === undefined || from === undefined || !/^(0|[1-9]\d*)$/.test(from)) {
+        return fail("usage: mend service logs <name-or-id-prefix> [--from <decimal-sequence>]");
+    }
+    const everything = await fetchServiceViews(config, true);
+    const matches = everything.filter((view) => view.service.name === needle ||
+        view.service.id.startsWith(needle) ||
+        view.attempts.some((attempt) => attempt.id.startsWith(needle)));
     if (matches.length === 0)
         return fail(`no service matches "${needle}"`);
-    // Prefer the live one; otherwise the newest ended one (list is newest-first).
-    const service = matches.find((m) => m.status !== "exited" && m.status !== "stopped") ?? matches[0];
-    if (service === undefined)
+    const view = matches.find((candidate) => {
+        const current = candidate.service.currentAttemptId === null
+            ? null
+            : candidate.attempts.find((attempt) => attempt.id === candidate.service.currentAttemptId);
+        return current !== null && current !== undefined && current.exitedAt === null;
+    }) ?? matches[0];
+    if (view === undefined)
         return fail(`no service matches "${needle}"`);
-    if (service.sealantSessionId === null) {
+    const currentAttempt = view.service.currentAttemptId === null
+        ? null
+        : (view.attempts.find((candidate) => candidate.id === view.service.currentAttemptId) ?? null);
+    const attempt = view.attempts.find((candidate) => candidate.id.startsWith(needle)) ??
+        currentAttempt ??
+        view.attempts.findLast((candidate) => candidate.sealantSessionId !== null) ??
+        null;
+    if (attempt?.sealantSessionId === null || attempt === null) {
         return fail(`"${needle}" is an adopted port — no process of Mend's, no logs. mend service run supervises.`);
     }
-    if (service.status === "exited" || service.status === "stopped") {
-        // Post-mortem: print the record, don't attach.
-        const output = await api(config, "GET", `/processes/${service.id}/output`);
-        say(dim(`${service.label ?? service.id.slice(0, 8)} · ${service.status} — recorded output:`));
-        say("");
-        process.stdout.write(output.text.endsWith("\n") ? output.text : `${output.text}\n`);
-        process.exit(0);
-    }
-    say(dim(`following ${service.label ?? service.id.slice(0, 8)} — Ctrl+C detaches, the service keeps running`));
+    const label = view.service.name;
+    say(dim(attempt.exitedAt === null
+        ? `following ${label} from sequence ${from} — Ctrl+C detaches, the Service keeps running`
+        : `${label} · ${attempt.status} — recorded output from sequence ${from}`));
     say("");
-    const outcome = await attachTty(config, service.sessionId, "service", 0n, service.id, {
-        readOnly: true,
-    });
-    if (outcome === "unavailable") {
-        return fail(`tty attach unavailable: could not connect to ${config.url}`);
+    let cursor = from;
+    let telemetryReported = false;
+    for (;;) {
+        const page = await api(config, "GET", `/processes/${attempt.id}/logs?from=${encodeURIComponent(cursor)}&limit=256`);
+        if (!telemetryReported) {
+            say(dim(`telemetry loss: ${page.telemetryLoss} · ${page.telemetryNote}`));
+            telemetryReported = true;
+        }
+        for (const chunk of page.chunks) {
+            process.stdout.write(Buffer.from(chunk.dataBase64, "base64"));
+        }
+        const advanced = page.nextFrom !== cursor;
+        cursor = page.nextFrom;
+        const ended = page.status === "exited" || page.status === "failed";
+        if (ended && !advanced)
+            break;
+        if (!advanced)
+            await new Promise((resolve) => setTimeout(resolve, 250));
     }
     say("");
-    say(dim("stream ended"));
-    process.exit(0);
+    say(dim(`stream ended · next sequence ${cursor}`));
 };
 const serviceRestart = async (config, args) => {
     const needle = args.find((a) => !a.startsWith("--"));
     if (needle === undefined)
         return fail("usage: mend service restart <name-or-id-prefix>");
     const service = await findLiveService(config, needle);
-    const restarted = await withSpinner(`restarting ${service.label ?? service.id.slice(0, 8)}…`, api(config, "POST", `/services/${service.id}/restart`));
+    const restarted = await withSpinner(`restarting ${service.label ?? service.id.slice(0, 8)}…`, mutateService(config, "POST", `/services/${service.id}/restart`));
     say(`${green("✓")} restarted · ${restarted.status}`);
-    say(`  ${cobalt(serviceUrl(config, restarted))}`);
+    printServiceEndpoint(restarted);
 };
 /**
  * Scaffold mend.toml from the project's own manifests. Static suggestion,
@@ -770,6 +881,92 @@ const serviceCommand = async (config, args) => {
             return serviceRun(config, [verb, ...rest]);
     }
 };
+const isProvider = (value) => value === "claude" || value === "codex" || value === "github";
+const readIfExists = (file) => (fs.existsSync(file) ? fs.readFileSync(file, "utf8") : null);
+/** The credential as THIS machine holds it — the same files the agent CLIs wrote at login. */
+const localCredential = (provider) => {
+    const home = os.homedir();
+    switch (provider) {
+        case "codex":
+            return readIfExists(path.join(process.env["CODEX_HOME"] ?? path.join(home, ".codex"), "auth.json"));
+        case "claude":
+            return readIfExists(path.join(process.env["CLAUDE_CONFIG_DIR"] ?? path.join(home, ".claude"), ".credentials.json"));
+        case "github": {
+            const result = spawnSync("gh", ["auth", "token"], { encoding: "utf8" });
+            const token = result.status === 0 ? result.stdout.trim() : "";
+            return token === "" ? null : token;
+        }
+    }
+};
+const accountLine = (account) => {
+    const meta = account.metadata;
+    const pick = (key) => (typeof meta[key] === "string" ? String(meta[key]) : null);
+    const identity = pick("login") ?? pick("email") ?? pick("accountEmail") ?? pick("accountId");
+    const suffix = pick("tokenSuffix");
+    const facts = [
+        account.status === "active" ? "connected" : account.status,
+        identity,
+        suffix === null ? null : `…${suffix}`,
+        `since ${account.connectedAt.slice(0, 10)}`,
+    ].filter((fact) => fact !== null);
+    return `${account.provider.padEnd(8)} ${facts.join(" · ")}`;
+};
+/**
+ * `mend accounts`: the signed-in user's own connected accounts on the platform — each person's
+ * subscriptions, under their own Sealant user (docs/SEALANT-IDENTITY.md).
+ */
+const accountsCommand = async (config) => {
+    const identity = await api(config, "GET", "/me/sealant");
+    process.stdout.write(`platform user ${identity.sealantUserId}\n`);
+    const providers = ["claude", "codex", "github"];
+    for (const provider of providers) {
+        const account = identity.accounts.find((row) => row.provider === provider && row.name === "default") ??
+            identity.accounts.find((row) => row.provider === provider);
+        process.stdout.write(`  ${account === undefined ? `${provider.padEnd(8)} not connected` : accountLine(account)}\n`);
+    }
+};
+/**
+ * `mend connect claude|codex|github [--from-stdin] [--remove]`: send THIS machine's credential
+ * for the provider to the platform under your own user. The file the provider's CLI wrote at
+ * login is read verbatim (codex: ~/.codex/auth.json; claude: ~/.claude/.credentials.json;
+ * github: `gh auth token`); `--from-stdin` takes a pasted token or file instead. Mend forwards
+ * it once and stores nothing.
+ */
+const connectCommand = async (config, args) => {
+    const [providerArg, ...flags] = args;
+    if (!isProvider(providerArg)) {
+        return fail("usage: mend connect claude|codex|github [--from-stdin] [--remove]");
+    }
+    const provider = providerArg;
+    if (flags.includes("--remove")) {
+        const identity = await api(config, "GET", "/me/sealant");
+        const account = identity.accounts.find((row) => row.provider === provider);
+        if (account === undefined)
+            return fail(`${provider}: nothing connected`);
+        await api(config, "DELETE", `/me/sealant/accounts/${account.id}`);
+        process.stdout.write(`${provider}: disconnected\n`);
+        return;
+    }
+    let secret;
+    if (flags.includes("--from-stdin")) {
+        secret = fs.readFileSync(0, "utf8").trim();
+        if (secret === "")
+            return fail("nothing on stdin");
+    }
+    else {
+        secret = localCredential(provider);
+        if (secret === null) {
+            const where = provider === "github"
+                ? "`gh auth login` first, or pipe a token: gh auth token | mend connect github --from-stdin"
+                : provider === "codex"
+                    ? "`codex login` first, or: mend connect codex --from-stdin < auth.json"
+                    : "`claude setup-token` then: mend connect claude --from-stdin";
+            return fail(`${provider}: no credential on this machine — ${where}`);
+        }
+    }
+    const account = await withSpinner(`connecting ${provider}`, api(config, "POST", "/me/sealant/accounts", { provider, secret }));
+    process.stdout.write(`${accountLine(account)}\n`);
+};
 // ─── login: obtain and save the bearer token ────────────────────────────────
 const takeFlagValue = (args, flag) => {
     const at = args.indexOf(flag);
@@ -910,7 +1107,7 @@ const keysShare = async (config) => {
     if (agentSock === undefined || agentSock === "") {
         return fail("SSH_AUTH_SOCK is not set — start (or plug in) your ssh-agent first");
     }
-    const url = new URL(`${config.url}/api/keys/bridge/ws`);
+    const url = parseMendUrl(`${config.url}/api/keys/bridge/ws`);
     url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
     url.searchParams.set("host", os.hostname());
     if (config.token !== null)
@@ -1102,7 +1299,7 @@ const envLoad = async (config, args) => {
     // `--secret` alone sends everything to Secrets; `--secret A,B` only those names (for the
     // ordinary-looking ones that embed credentials, like DATABASE_URL). Routing is by NAME.
     const secretFlag = args.indexOf("--secret");
-    const secretArg = secretFlag !== -1 ? args[secretFlag + 1] : undefined;
+    const secretArg = secretFlag === -1 ? undefined : args[secretFlag + 1];
     const secretNames = secretArg !== undefined &&
         !secretArg.startsWith("--") &&
         !secretArg.includes("/") &&
@@ -1226,6 +1423,9 @@ _mend() {
     'attach:reattach to a running session' 'shell:open a shell in a live session workspace'
     'service:reachable ports — add, list, stop'
     'keys:the machine Mend deploy key — init, show, share'
+    'accounts:your connected accounts on the platform'
+    'pair:pair a phone or a second machine' 'doctor:read-only checklist of this setup'
+    'connect:send this machine'"'"'s claude/codex/github credential to the platform'
     'continue:resume with the pending follow-up' 'resume:rejoin a settled session'
     'rejoin:attach if live, otherwise resume'
     'projects:adopted projects' 'sessions:sessions with review facts' 'status:active sessions'
@@ -1248,7 +1448,7 @@ _mend "$@"
 const BASH_COMPLETIONS = `_mend() {
   local cur=\${COMP_WORDS[COMP_CWORD]}
   if [ "$COMP_CWORD" -eq 1 ]; then
-    COMPREPLY=( $(compgen -W "adopt codex claude opencode run attach shell service keys continue resume rejoin projects sessions status ui help" -- "$cur") )
+    COMPREPLY=( $(compgen -W "adopt codex claude opencode run attach shell service keys pair doctor continue resume rejoin projects sessions status ui help" -- "$cur") )
     return
   fi
   case \${COMP_WORDS[1]} in
@@ -1318,9 +1518,14 @@ const supervisedRun = async (config, session, argv) => {
             }
             if (event.type === "session") {
                 const detail = await api(config, "GET", `/sessions/${session.id}`);
-                if (["completed", "failed", "stopped"].includes(detail.session.status)) {
-                    settled = detail.session.status;
-                }
+                // The agent's own end settles the wait: the session fold may read `idle` while a
+                // shell still holds the workspace.
+                const ended = agentOutcome(detail.currentAgent) ??
+                    (["completed", "failed", "stopped"].includes(detail.session.status)
+                        ? detail.session.status
+                        : null);
+                if (ended !== null)
+                    settled = ended;
             }
         }
     }
@@ -1332,19 +1537,14 @@ const supervisedRun = async (config, session, argv) => {
 };
 /**
  * The second half of the review loop (plan §7.3): find the session with a
- * pending follow-up, deliver it (which reopens the session), and relaunch the
- * harness in the same worktree with the instruction as its prompt.
+ * pending follow-up and retry the one server-owned delivery operation. The
+ * server persists intent, launches, correlates membership, and finalizes.
  */
 const continueSession = async (config, args) => {
     const explicitSession = args.find((a) => !a.startsWith("--")) ?? null;
     let sessionId = explicitSession;
     let followUp = null;
-    if (sessionId !== null) {
-        followUp = await api(config, "GET", `/sessions/${sessionId}/follow-up`);
-        if (followUp === null)
-            return fail(`session ${sessionId} has no pending follow-up`);
-    }
-    else {
+    if (sessionId === null) {
         // Search the cwd's project, newest sessions first.
         const project = await findProject(config, null);
         const detail = await api(config, "GET", `/projects/${project.id}`);
@@ -1360,42 +1560,52 @@ const continueSession = async (config, args) => {
             return fail("no session with a pending follow-up — send one from the review first");
         }
     }
+    else {
+        followUp = await api(config, "GET", `/sessions/${sessionId}/follow-up`);
+        if (followUp === null)
+            return fail(`session ${sessionId} has no pending follow-up`);
+    }
     const detail = await api(config, "GET", `/sessions/${sessionId}`);
     const session = detail.session;
-    const projects = await api(config, "GET", "/projects");
-    const project = projects.find((p) => p.id === session.projectId);
-    if (project === undefined)
-        return fail(`project ${session.projectId} not found`);
-    const worktree = worktreePathOf(project.storePath, session.worktree);
-    const build = CONTINUE_COMMANDS[session.harness];
     say(`${green("✓")} follow-up for session ${dim(session.id.slice(0, 8))} · ${session.branch}`);
     say(dim("  instruction:"));
     for (const line of followUp.instruction.split("\n").slice(0, 6))
         say(dim(`  │ ${line}`));
     if (followUp.instruction.split("\n").length > 6)
         say(dim("  │ …"));
-    if (build === undefined) {
-        say("");
-        say(`${amber("  cannot relaunch")} ${dim(`— harness "${session.harness}" has no known resume command.`)}`);
-        say(dim(`  run it yourself in ${worktree}; the follow-up stays pending.`));
-        process.exit(1);
+    if (followUp.reviewSliceId === null ||
+        followUp.checkpointAId === null ||
+        followUp.checkpointBId === null ||
+        followUp.diffDigest === null ||
+        followUp.idempotencyKey === null) {
+        return fail("legacy follow-up — recreate it from a pinned Review before delivery");
+    }
+    const delivered = await withSpinner("delivering persisted Review bundle — retries reconcile one process…", api(config, "POST", `/sessions/${session.id}/follow-up/deliver`, {
+        reviewSliceId: followUp.reviewSliceId,
+        checkpointAId: followUp.checkpointAId,
+        checkpointBId: followUp.checkpointBId,
+        diffDigest: followUp.diffDigest,
+        commentIds: followUp.commentIds,
+        instruction: followUp.instruction,
+        idempotencyKey: followUp.idempotencyKey,
+    }));
+    if (delivered.status === "pending") {
+        return fail("the session is active — the follow-up remains pending");
     }
-    await api(config, "POST", `/sessions/${session.id}/follow-up/deliver`);
-    say(`${green("✓")} delivered · session reopened`);
+    if (delivered.status === "delivery_failed") {
+        return fail(delivered.deliveryError ?? "delivery failed before process membership finalized");
+    }
+    say(`${green("✓ recording")} · delivered to run ${delivered.deliverySealantRunId ?? "unknown"}${detachHint()}`);
     say(`${cobalt("  watch")} · ${config.url}/sessions/${session.id}`);
-    // Relaunch SUPERVISED, exactly like a fresh `mend <harness>`: a new
-    // workspace mounts the SAME worktree, the platform PTY runs the harness
-    // with the instruction as its opening prompt, and the record continues —
-    // the web session page shows the live terminal throughout.
-    const argv = build(followUp.instruction);
-    await withSpinner("provisioning workspace — the resumed run records like any other…", api(config, "POST", `/sessions/${session.id}/launch`, { argv }));
-    say(`${green("✓ recording")} · workspace mounts the worktree${detachHint()}`);
     say("");
     await attachOrExit(config, session.id, session.harness);
     exitAfterSessionEnd(config, session.id);
 };
 // ─── resume: rejoin a session — same worktree, restored harness state ───────
 const ACTIVE_STATUSES = LIVE_STATUSES;
+/** Whether a listed session's AGENT is live — the annotation carries its current agent process. */
+const agentLiveIn = (detail, session) => agentIsLive(session, detail.annotations.find((annotation) => annotation.sessionId === session.id)?.currentAgent ??
+    null);
 /**
  * Sessions are continuous work, not runs: `mend resume` rejoins one on a
  * fresh workspace — saved harness state restored, a claude resume is native
@@ -1408,15 +1618,15 @@ const resumeCommand = async (config, args) => {
     const prefix = args.find((a, i) => !a.startsWith("--") && i !== withFlag + 1);
     const project = await findProject(config, null);
     const detail = await api(config, "GET", `/projects/${project.id}`);
-    const match = prefix !== undefined
-        ? detail.sessions.find((s) => s.id.startsWith(prefix))
-        : detail.sessions.find((s) => !ACTIVE_STATUSES.has(s.status));
+    const match = prefix === undefined
+        ? detail.sessions.find((s) => !agentLiveIn(detail, s))
+        : detail.sessions.find((s) => s.id.startsWith(prefix));
     if (match === undefined) {
-        return fail(prefix !== undefined
-            ? `no session matches "${prefix}"`
-            : "no settled session to resume — mend status lists sessions");
+        return fail(prefix === undefined
+            ? "no settled session to resume — mend status lists sessions"
+            : `no session matches "${prefix}"`);
     }
-    if (ACTIVE_STATUSES.has(match.status)) {
+    if (agentLiveIn(detail, match)) {
         return fail(`session ${match.id.slice(0, 8)} is live — attach: mend attach ${match.id.slice(0, 8)}`);
     }
     say(`${green("✓")} resuming ${match.harness} · ${dim(match.id.slice(0, 8))}${withHarness === null ? "" : ` ${dim("as")} ${withHarness}`}`);
@@ -1441,7 +1651,7 @@ const resumeForRejoin = async (config, sessionId, label) => {
     }
     catch (error) {
         const refreshed = await api(config, "GET", `/sessions/${sessionId}`);
-        if (ACTIVE_STATUSES.has(refreshed.session.status))
+        if (agentIsLive(refreshed.session, refreshed.currentAgent))
             return false;
         return fail(error instanceof Error ? error.message : String(error));
     }
@@ -1457,7 +1667,7 @@ const rejoinCommand = async (config, args) => {
     const eligible = detail.sessions
         .filter((session) => harness === null || session.harness === harness)
         .toSorted((left, right) => right.createdAt.localeCompare(left.createdAt));
-    const newest = eligible.find((session) => ACTIVE_STATUSES.has(session.status)) ?? eligible[0];
+    const newest = eligible.find((session) => agentLiveIn(detail, session)) ?? eligible[0];
     const matches = prefix === undefined
         ? newest === undefined
             ? []
@@ -1475,10 +1685,11 @@ const rejoinCommand = async (config, args) => {
     const session = matches[0];
     if (session === undefined)
         return fail("session selection failed");
-    say(`${green("✓")} rejoining ${session.harness} · ${dim(session.id.slice(0, 8))} · ${ACTIVE_STATUSES.has(session.status) ? "already live" : "restoring"}`);
+    const alreadyLive = agentLiveIn(detail, session);
+    say(`${green("✓")} rejoining ${session.harness} · ${dim(session.id.slice(0, 8))} · ${alreadyLive ? "already live" : "restoring"}`);
     say(`${cobalt("  watch")} · ${config.url}/sessions/${session.id}`);
     let restored = false;
-    if (!ACTIVE_STATUSES.has(session.status)) {
+    if (!alreadyLive) {
         restored = await resumeForRejoin(config, session.id, "resuming — a fresh workspace restores the saved session state…");
     }
     say(restored
@@ -1488,7 +1699,7 @@ const rejoinCommand = async (config, args) => {
     let outcome = await attachTty(config, session.id, session.harness, 0n);
     if (outcome === "unavailable") {
         const refreshed = await api(config, "GET", `/sessions/${session.id}`);
-        if (!ACTIVE_STATUSES.has(refreshed.session.status)) {
+        if (!agentIsLive(refreshed.session, refreshed.currentAgent)) {
             await resumeForRejoin(config, session.id, "session settled while attaching — restoring it once…");
         }
         outcome = await attachTty(config, session.id, session.harness, 0n);
@@ -1512,11 +1723,16 @@ const projectsCommand = async (config) => {
     }
     const nameWidth = Math.max(...projects.map((p) => p.name.length));
     const branchWidth = Math.max(...projects.map((p) => p.defaultBranch.length));
+    // The cwd's project is marked — the same resolution mend claude|shell use.
+    const here = matchProjectByCwd(projects, cwdFacts(process.cwd()));
     for (const project of projects) {
         const live = liveByProject.get(project.id) ?? 0;
         const liveLabel = live > 0 ? green(`${live} live`) : dim("—");
-        say(`${project.name.padEnd(nameWidth)}  ${dim(project.defaultBranch.padEnd(branchWidth))}  ${liveLabel}  ${dim(project.storePath)}`);
+        const marker = project.id === here?.id ? cobalt("▸ ") : "  ";
+        say(`${marker}${project.name.padEnd(nameWidth)}  ${dim(project.defaultBranch.padEnd(branchWidth))}  ${liveLabel}  ${dim(project.storePath)}`);
     }
+    if (here !== undefined)
+        say(dim(`  ▸ ${here.name} is the cwd's project`));
 };
 const printSessionRow = (row) => {
     const { session, annotation } = row;
@@ -1652,11 +1868,28 @@ const dashboard = async (config) => {
 // ─── entry ──────────────────────────────────────────────────────────────────
 const HELP = `mend — the agent workbench
 
-  mend                                  the dashboard: every project and session, live
+start
+  mend login [--url <server>]           sign in with email + password; saves the token (0600)
+  mend connect <provider> [--from-stdin] [--remove]
+                                        send THIS machine's claude/codex/github credential to the
+                                        platform under your own user (reads the file the provider's
+                                        CLI wrote at login; --from-stdin pastes one instead)
   mend adopt [source] [--name <name>] [--auth ambient|mend-key|bridge]
                                         adopt a repository into the store (default: cwd; any git
                                         URL — GitHub, GitLab, self-hosted, ssh://, a local path)
-  mend login [--url <server>]           sign in with email + password; saves the token (0600)
+  mend codex|claude|opencode ["prompt"] [--model <id>] [--effort low|medium|high|xhigh|max]
+                             [--base <ref>] [--ask] [--fast]
+                                        new session worktree + launch the harness in it; a quoted
+                                        prompt becomes its first message (and names the session),
+                                        --ask restores the harness's permission prompts, --fast
+                                        requests priority processing (codex service tier)
+  mend pair [--url <base url>]          pair a phone or a second machine: prints a QR, the code, and
+                                        the URL to reach this server (one device, once, 10 minutes)
+  mend doctor                           read-only checklist of this machine's setup — one line per
+                                        fact, each unfinished one ending in the command that fixes it
+
+everything else
+  mend                                  the dashboard: every project and session, live
   mend logout                           forget the saved token
   mend keys init                        generate the machine's Mend deploy key (ed25519)
   mend keys show                        print the public key — add it as a deploy key on your git host
@@ -1664,11 +1897,11 @@ const HELP = `mend — the agent workbench
                                         secret-shaped names → secrets; --secret sends all (or the
                                         named ones, e.g. DATABASE_URL) to secrets
   mend env show                         what the project store holds — names only, never values
+  mend accounts                         your connected accounts on the platform (claude, codex, github)
   mend dotfiles                         your dotfiles on the server: repo + synced home files
   mend dotfiles sync [--all | paths…]   capture config files from THIS machine into your store
   mend keys share                       relay THIS machine's ssh-agent to the server (bridge mode:
                                         hardware keys sign here; Ctrl-C stops sharing)
-  mend codex|claude|opencode            new session worktree + launch the harness in it
   mend run -- <command...>              same, with an arbitrary command
   mend attach <session-id-prefix>       reattach this terminal to a running session
   mend shell [session-id-prefix]        open a shell in a live session's workspace
@@ -1721,6 +1954,17 @@ const main = async () => {
             return keysCommand(config, rest);
         case "dotfiles":
             return dotfilesCommand(config, rest);
+        case "accounts":
+            return accountsCommand(config);
+        case "connect":
+            return connectCommand(config, rest);
+        case "pair":
+            return pairCommand(rest, boundApi(config));
+        // Deliberately absent from HELP: the installer renders its own QR through this.
+        case "qr":
+            return qrCommand(rest);
+        case "doctor":
+            return doctorCommand(config, localCredential);
         case "env":
             return envCommand(config, rest);
         case "completions":