@sealant/mend 0.5.0 → 0.6.0

package/README.md

@@ -17,6 +17,58 @@ diffs, reveal whitespace, select line ranges, add line or whole-change comments,
 evidence, and draft a follow-up for the same session. Press `y` to deliver a pending follow-up and
 relaunch that session, or `o` to continue the review in the web app.
 
+## Getting started
+
+Once per machine, in this order:
+
+```sh
+mend login                       # sign in to the server; the token is saved 0600
+mend connect codex               # send this machine's codex (or claude, github) credential
+mend adopt                       # adopt the repository you are standing in
+mend codex "fix the flaky test"  # new session worktree, harness running in it
+mend pair                        # hand a phone the same server
+mend doctor                      # every fact above, on one screen
+```
+
+`mend help` prints the same sequence under `start`, then everything else.
+
+### mend pair
+
+```
+mend pair [--url <base url>]
+```
+
+Asks the server for a pairing code and prints it three ways: a QR of the `mend://pair` deep link,
+the code grouped as `ABCD-EFGH`, and the base URL the device should reach — the machine's tailnet
+address when it has one, otherwise a LAN address (`--url` overrides the choice). Scan it in the Mend
+app, or type the URL and the code in by hand. The code is single use and expires in 10 minutes; the
+device's own token is minted when it claims the code, and can be revoked from the Mend app later.
+The device names itself when it claims the code.
+
+### mend doctor
+
+```
+mend doctor
+```
+
+Reads, and changes nothing: server reachable, token accepted, the Sealant connection, each connected
+account, adopted projects, the `claude` / `codex` / `gh` CLIs on PATH and whether their credentials
+exist on this machine, and the tailnet address. One line per fact — `✓` observed, `○` not set up
+yet, `✗` a blocker — and every line that needs an action ends with the one command that takes it:
+
+```
+✓ server      http://localhost:3105 · mend 0.5.0
+✓ signed in   token accepted
+✓ sealant     connected · http://127.0.0.1:4000
+✓ claude      connected · you@example.com
+○ codex       not connected → mend connect codex
+✓ projects    2 adopted
+○ gh cli      on PATH · no credential here → gh auth login
+○ tailnet     not detected
+```
+
+It exits 1 when a `✗` is printed, so a setup script can gate on it. No request waits longer than 3s.
+
 ## Commands
 
 ```
@@ -29,6 +81,8 @@ mend resume [session-id] [--with h]   rejoin a settled session (state restored;
 mend rejoin [session-id] [--harness h] attach if live, otherwise resume; newest live wins
 mend sessions [--all] [--project p] [--json]
 mend status                           active sessions (alias of mend sessions)
+mend pair [--url <base url>]          pair a phone or a second machine: QR + code + URL
+mend doctor                           read-only checklist of this machine's setup
 ```
 
 ## Signing in

package/dist/doctor.js

@@ -0,0 +1,233 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+/**
+ * `mend doctor`: one read-only pass over everything a first run depends on, printed
+ * as mono status lines (DESIGN.md §4 — a mark plus a word, never a badge). Every
+ * line states what was observed; a line that needs an action ends with the single
+ * command that takes it. Nothing here writes, launches, or repairs anything.
+ *
+ * No request waits longer than 3s: a doctor that hangs is worse than a doctor that
+ * reports "not checked".
+ */
+const TIMEOUT_MS = 3_000;
+const MARKS = { ok: "✓", todo: "○", failed: "✗" };
+const LABEL_WIDTH = 11;
+/** One status line. The mark is painted by the caller so the formatter stays testable. */
+export const formatCheck = (check, paint = (_state, mark) => mark) => `${paint(check.state, MARKS[check.state])} ${check.label.padEnd(LABEL_WIDTH)} ${check.detail}${check.fix === null ? "" : ` → ${check.fix}`}`;
+/** A read that never throws and never blocks: the outcome is a value the checklist can print. */
+const getJson = async (config, route) => {
+    try {
+        const response = await fetch(`${config.url}/api${route}`, {
+            headers: config.token === null ? {} : { authorization: `Bearer ${config.token}` },
+            signal: AbortSignal.timeout(TIMEOUT_MS),
+        });
+        if (!response.ok)
+            return { value: null, status: response.status };
+        return { value: (await response.json()), status: response.status };
+    }
+    catch {
+        return { value: null, status: null };
+    }
+};
+/** Where each provider's own CLI writes the credential Mend forwards (mirrors `mend connect`). */
+const LOGIN_COMMANDS = {
+    claude: "claude setup-token",
+    codex: "codex login",
+    github: "gh auth login",
+};
+const HARNESS_CLIS = [
+    { command: "claude", provider: "claude" },
+    { command: "codex", provider: "codex" },
+    { command: "gh", provider: "github" },
+];
+const notChecked = (label) => ({
+    label,
+    state: "todo",
+    detail: "not checked",
+    fix: null,
+});
+const identityOf = (account) => {
+    const meta = account.metadata;
+    for (const key of ["login", "email", "accountEmail", "accountId"]) {
+        const value = meta[key];
+        if (typeof value === "string" && value !== "")
+            return value;
+    }
+    return null;
+};
+/** Every fact the checklist prints, in the order a first run needs them. */
+export const runChecks = async (config, probes) => {
+    const checks = [];
+    const health = await getJson(config, "/health");
+    checks.push(health.value === null
+        ? {
+            label: "server",
+            state: "failed",
+            detail: `cannot reach ${config.url}`,
+            fix: "start the Mend server",
+        }
+        : {
+            label: "server",
+            state: "ok",
+            detail: `${config.url} · mend ${health.value.version}`,
+            fix: null,
+        });
+    // Projects double as the cheapest authenticated read there is: it proves the token
+    // without asking the platform anything.
+    const projects = health.value !== null && config.token !== null
+        ? await getJson(config, "/projects")
+        : null;
+    if (health.value === null)
+        checks.push(notChecked("signed in"));
+    else if (config.token === null) {
+        checks.push({
+            label: "signed in",
+            state: "failed",
+            detail: "no token saved",
+            fix: "mend login",
+        });
+    }
+    else if (projects !== null && projects.value !== null) {
+        checks.push({ label: "signed in", state: "ok", detail: "token accepted", fix: null });
+    }
+    else {
+        const status = projects === null ? null : projects.status;
+        checks.push(status === 401 || status === 403
+            ? { label: "signed in", state: "failed", detail: "token rejected", fix: "mend login" }
+            : {
+                label: "signed in",
+                state: "failed",
+                detail: `GET /projects → ${status ?? "no answer"}`,
+                fix: null,
+            });
+    }
+    const signedIn = projects !== null && projects.value !== null;
+    const connection = signedIn ? await getJson(config, "/sealant/connection") : null;
+    if (connection === null)
+        checks.push(notChecked("sealant"));
+    else if (connection.value === null) {
+        // 404 is a server older than the endpoint: nothing was observed, so nothing is claimed.
+        checks.push(connection.status === 404
+            ? notChecked("sealant")
+            : {
+                label: "sealant",
+                state: "failed",
+                detail: `GET /sealant/connection → ${connection.status ?? "no answer"}`,
+                fix: null,
+            });
+    }
+    else if (connection.value.status === "connected") {
+        checks.push({
+            label: "sealant",
+            state: "ok",
+            detail: `connected · ${connection.value.baseUrl}`,
+            fix: null,
+        });
+    }
+    else {
+        checks.push({
+            label: "sealant",
+            state: "failed",
+            detail: `${connection.value.status} · ${connection.value.detail ?? connection.value.baseUrl}`,
+            fix: null,
+        });
+    }
+    const identity = signedIn ? await getJson(config, "/me/sealant") : null;
+    const platform = identity === null ? null : identity.value;
+    for (const { provider } of HARNESS_CLIS) {
+        if (platform === null) {
+            checks.push(notChecked(provider));
+            continue;
+        }
+        const account = platform.accounts.find((row) => row.provider === provider && row.name === "default") ??
+            platform.accounts.find((row) => row.provider === provider);
+        if (account === undefined) {
+            checks.push({
+                label: provider,
+                state: "todo",
+                detail: "not connected",
+                fix: `mend connect ${provider}`,
+            });
+            continue;
+        }
+        const who = identityOf(account);
+        checks.push(account.status === "active"
+            ? {
+                label: provider,
+                state: "ok",
+                detail: who === null ? "connected" : `connected · ${who}`,
+                fix: null,
+            }
+            : {
+                label: provider,
+                state: "todo",
+                detail: account.status,
+                fix: `mend connect ${provider}`,
+            });
+    }
+    const adopted = projects === null ? null : projects.value;
+    if (adopted === null)
+        checks.push(notChecked("projects"));
+    else if (adopted.length === 0) {
+        checks.push({ label: "projects", state: "todo", detail: "none adopted", fix: "mend adopt" });
+    }
+    else {
+        checks.push({ label: "projects", state: "ok", detail: `${adopted.length} adopted`, fix: null });
+    }
+    for (const { command, provider } of HARNESS_CLIS) {
+        const label = `${command} cli`;
+        if (!probes.onPath(command)) {
+            checks.push({ label, state: "todo", detail: "not on PATH", fix: null });
+            continue;
+        }
+        const credential = probes.localCredential(provider);
+        checks.push(credential === null
+            ? {
+                label,
+                state: "todo",
+                detail: "on PATH · no credential here",
+                fix: LOGIN_COMMANDS[provider],
+            }
+            : { label, state: "ok", detail: "on PATH · credential present", fix: null });
+    }
+    const machine = signedIn ? await getJson(config, "/machine") : null;
+    const tailnet = machine === null || machine.value === null ? null : machine.value.tailnet;
+    if (tailnet === null)
+        checks.push(notChecked("tailnet"));
+    else if (tailnet.status === "reachable" && tailnet.address !== null) {
+        checks.push({ label: "tailnet", state: "ok", detail: tailnet.address, fix: null });
+    }
+    else {
+        checks.push({ label: "tailnet", state: "todo", detail: "not detected", fix: null });
+    }
+    return checks;
+};
+/** An executable of that name on PATH — the question `command -v` asks, without a subprocess. */
+export const onPath = (command) => {
+    for (const directory of (process.env["PATH"] ?? "").split(path.delimiter)) {
+        if (directory === "")
+            continue;
+        try {
+            fs.accessSync(path.join(directory, command), fs.constants.X_OK);
+            return true;
+        }
+        catch {
+            // keep looking
+        }
+    }
+    return false;
+};
+/** Green observed · amber not started · red a blocker (DESIGN.md §4); plain text on a pipe. */
+const paintMark = (state, mark) => {
+    if (process.stdout.isTTY !== true)
+        return mark;
+    const code = state === "ok" ? "32" : state === "todo" ? "33" : "31";
+    return `[${code}m${mark}`;
+};
+export const doctorCommand = async (config, localCredential) => {
+    const checks = await runChecks(config, { localCredential, onPath });
+    for (const check of checks)
+        process.stdout.write(`${formatCheck(check, paintMark)}\n`);
+    if (checks.some((check) => check.state === "failed"))
+        process.exitCode = 1;
+};

package/dist/main.js

@@ -5,8 +5,10 @@ import { createRequire } from "node:module";
 import * as net from "node:net";
 import * as os from "node:os";
 import * as path from "node:path";
+import { doctorCommand } from "./doctor.js";
 import { readSyncFiles, scanDotfileCandidates } from "./dotfiles.js";
 import { formatLoadReport } from "./env.js";
+import { pairCommand, qrCommand } from "./pair.js";
 import { isComposeFile, proposeFromCompose, proposeFromPackageJson, proposeFromWorkspacePackage, renderMendToml, workspaceGlobs, } from "./service-init.js";
 import { agentIsLive, agentOutcome, cwdFacts, gitTopLevel, HARNESS_COMMANDS, LIVE_STATUSES, matchProjectByCwd, normalizeProjectName, parseLaunchArgs, } from "./shared.js";
 // `$XDG_CONFIG_HOME/mend`, default `~/.config/mend`; a pre-XDG `~/.mend` stays authoritative
@@ -134,6 +136,8 @@ const api = async (config, method, route, body) => {
         return fail(error instanceof Error ? error.message : String(error));
     }
 };
+/** The same call bound to one config — the dependency ./pair.ts takes. */
+const boundApi = (config) => (method, route, body) => api(config, method, route, body);
 /** A live elapsed-time spinner around a slow await — provisioning is not a hang. */
 const withSpinner = async (label, work) => {
     if (process.stdout.isTTY !== true)
@@ -877,6 +881,92 @@ const serviceCommand = async (config, args) => {
             return serviceRun(config, [verb, ...rest]);
     }
 };
+const isProvider = (value) => value === "claude" || value === "codex" || value === "github";
+const readIfExists = (file) => (fs.existsSync(file) ? fs.readFileSync(file, "utf8") : null);
+/** The credential as THIS machine holds it — the same files the agent CLIs wrote at login. */
+const localCredential = (provider) => {
+    const home = os.homedir();
+    switch (provider) {
+        case "codex":
+            return readIfExists(path.join(process.env["CODEX_HOME"] ?? path.join(home, ".codex"), "auth.json"));
+        case "claude":
+            return readIfExists(path.join(process.env["CLAUDE_CONFIG_DIR"] ?? path.join(home, ".claude"), ".credentials.json"));
+        case "github": {
+            const result = spawnSync("gh", ["auth", "token"], { encoding: "utf8" });
+            const token = result.status === 0 ? result.stdout.trim() : "";
+            return token === "" ? null : token;
+        }
+    }
+};
+const accountLine = (account) => {
+    const meta = account.metadata;
+    const pick = (key) => (typeof meta[key] === "string" ? String(meta[key]) : null);
+    const identity = pick("login") ?? pick("email") ?? pick("accountEmail") ?? pick("accountId");
+    const suffix = pick("tokenSuffix");
+    const facts = [
+        account.status === "active" ? "connected" : account.status,
+        identity,
+        suffix === null ? null : `…${suffix}`,
+        `since ${account.connectedAt.slice(0, 10)}`,
+    ].filter((fact) => fact !== null);
+    return `${account.provider.padEnd(8)} ${facts.join(" · ")}`;
+};
+/**
+ * `mend accounts`: the signed-in user's own connected accounts on the platform — each person's
+ * subscriptions, under their own Sealant user (docs/SEALANT-IDENTITY.md).
+ */
+const accountsCommand = async (config) => {
+    const identity = await api(config, "GET", "/me/sealant");
+    process.stdout.write(`platform user ${identity.sealantUserId}\n`);
+    const providers = ["claude", "codex", "github"];
+    for (const provider of providers) {
+        const account = identity.accounts.find((row) => row.provider === provider && row.name === "default") ??
+            identity.accounts.find((row) => row.provider === provider);
+        process.stdout.write(`  ${account === undefined ? `${provider.padEnd(8)} not connected` : accountLine(account)}\n`);
+    }
+};
+/**
+ * `mend connect claude|codex|github [--from-stdin] [--remove]`: send THIS machine's credential
+ * for the provider to the platform under your own user. The file the provider's CLI wrote at
+ * login is read verbatim (codex: ~/.codex/auth.json; claude: ~/.claude/.credentials.json;
+ * github: `gh auth token`); `--from-stdin` takes a pasted token or file instead. Mend forwards
+ * it once and stores nothing.
+ */
+const connectCommand = async (config, args) => {
+    const [providerArg, ...flags] = args;
+    if (!isProvider(providerArg)) {
+        return fail("usage: mend connect claude|codex|github [--from-stdin] [--remove]");
+    }
+    const provider = providerArg;
+    if (flags.includes("--remove")) {
+        const identity = await api(config, "GET", "/me/sealant");
+        const account = identity.accounts.find((row) => row.provider === provider);
+        if (account === undefined)
+            return fail(`${provider}: nothing connected`);
+        await api(config, "DELETE", `/me/sealant/accounts/${account.id}`);
+        process.stdout.write(`${provider}: disconnected\n`);
+        return;
+    }
+    let secret;
+    if (flags.includes("--from-stdin")) {
+        secret = fs.readFileSync(0, "utf8").trim();
+        if (secret === "")
+            return fail("nothing on stdin");
+    }
+    else {
+        secret = localCredential(provider);
+        if (secret === null) {
+            const where = provider === "github"
+                ? "`gh auth login` first, or pipe a token: gh auth token | mend connect github --from-stdin"
+                : provider === "codex"
+                    ? "`codex login` first, or: mend connect codex --from-stdin < auth.json"
+                    : "`claude setup-token` then: mend connect claude --from-stdin";
+            return fail(`${provider}: no credential on this machine — ${where}`);
+        }
+    }
+    const account = await withSpinner(`connecting ${provider}`, api(config, "POST", "/me/sealant/accounts", { provider, secret }));
+    process.stdout.write(`${accountLine(account)}\n`);
+};
 // ─── login: obtain and save the bearer token ────────────────────────────────
 const takeFlagValue = (args, flag) => {
     const at = args.indexOf(flag);
@@ -1333,6 +1423,9 @@ _mend() {
     'attach:reattach to a running session' 'shell:open a shell in a live session workspace'
     'service:reachable ports — add, list, stop'
     'keys:the machine Mend deploy key — init, show, share'
+    'accounts:your connected accounts on the platform'
+    'pair:pair a phone or a second machine' 'doctor:read-only checklist of this setup'
+    'connect:send this machine'"'"'s claude/codex/github credential to the platform'
     'continue:resume with the pending follow-up' 'resume:rejoin a settled session'
     'rejoin:attach if live, otherwise resume'
     'projects:adopted projects' 'sessions:sessions with review facts' 'status:active sessions'
@@ -1355,7 +1448,7 @@ _mend "$@"
 const BASH_COMPLETIONS = `_mend() {
   local cur=\${COMP_WORDS[COMP_CWORD]}
   if [ "$COMP_CWORD" -eq 1 ]; then
-    COMPREPLY=( $(compgen -W "adopt codex claude opencode run attach shell service keys continue resume rejoin projects sessions status ui help" -- "$cur") )
+    COMPREPLY=( $(compgen -W "adopt codex claude opencode run attach shell service keys pair doctor continue resume rejoin projects sessions status ui help" -- "$cur") )
     return
   fi
   case \${COMP_WORDS[1]} in
@@ -1775,11 +1868,28 @@ const dashboard = async (config) => {
 // ─── entry ──────────────────────────────────────────────────────────────────
 const HELP = `mend — the agent workbench
 
-  mend                                  the dashboard: every project and session, live
+start
+  mend login [--url <server>]           sign in with email + password; saves the token (0600)
+  mend connect <provider> [--from-stdin] [--remove]
+                                        send THIS machine's claude/codex/github credential to the
+                                        platform under your own user (reads the file the provider's
+                                        CLI wrote at login; --from-stdin pastes one instead)
   mend adopt [source] [--name <name>] [--auth ambient|mend-key|bridge]
                                         adopt a repository into the store (default: cwd; any git
                                         URL — GitHub, GitLab, self-hosted, ssh://, a local path)
-  mend login [--url <server>]           sign in with email + password; saves the token (0600)
+  mend codex|claude|opencode ["prompt"] [--model <id>] [--effort low|medium|high|xhigh|max]
+                             [--base <ref>] [--ask] [--fast]
+                                        new session worktree + launch the harness in it; a quoted
+                                        prompt becomes its first message (and names the session),
+                                        --ask restores the harness's permission prompts, --fast
+                                        requests priority processing (codex service tier)
+  mend pair [--url <base url>]          pair a phone or a second machine: prints a QR, the code, and
+                                        the URL to reach this server (one device, once, 10 minutes)
+  mend doctor                           read-only checklist of this machine's setup — one line per
+                                        fact, each unfinished one ending in the command that fixes it
+
+everything else
+  mend                                  the dashboard: every project and session, live
   mend logout                           forget the saved token
   mend keys init                        generate the machine's Mend deploy key (ed25519)
   mend keys show                        print the public key — add it as a deploy key on your git host
@@ -1787,16 +1897,11 @@ const HELP = `mend — the agent workbench
                                         secret-shaped names → secrets; --secret sends all (or the
                                         named ones, e.g. DATABASE_URL) to secrets
   mend env show                         what the project store holds — names only, never values
+  mend accounts                         your connected accounts on the platform (claude, codex, github)
   mend dotfiles                         your dotfiles on the server: repo + synced home files
   mend dotfiles sync [--all | paths…]   capture config files from THIS machine into your store
   mend keys share                       relay THIS machine's ssh-agent to the server (bridge mode:
                                         hardware keys sign here; Ctrl-C stops sharing)
-  mend codex|claude|opencode ["prompt"] [--model <id>] [--effort low|medium|high|xhigh|max]
-                             [--base <ref>] [--ask] [--fast]
-                                        new session worktree + launch the harness in it; a quoted
-                                        prompt becomes its first message (and names the session),
-                                        --ask restores the harness's permission prompts, --fast
-                                        requests priority processing (codex service tier)
   mend run -- <command...>              same, with an arbitrary command
   mend attach <session-id-prefix>       reattach this terminal to a running session
   mend shell [session-id-prefix]        open a shell in a live session's workspace
@@ -1849,6 +1954,17 @@ const main = async () => {
             return keysCommand(config, rest);
         case "dotfiles":
             return dotfilesCommand(config, rest);
+        case "accounts":
+            return accountsCommand(config);
+        case "connect":
+            return connectCommand(config, rest);
+        case "pair":
+            return pairCommand(rest, boundApi(config));
+        // Deliberately absent from HELP: the installer renders its own QR through this.
+        case "qr":
+            return qrCommand(rest);
+        case "doctor":
+            return doctorCommand(config, localCredential);
         case "env":
             return envCommand(config, rest);
         case "completions":

package/dist/pair.js

@@ -0,0 +1,83 @@
+const paint = (code) => (text) => process.stdout.isTTY === true ? `[${code}m${text}` : text;
+const dim = paint("2");
+const green = paint("32");
+const say = (line) => process.stdout.write(`${line}\n`);
+const fail = (message) => {
+    process.stderr.write(`mend: ${message}\n`);
+    process.exit(1);
+};
+const takeFlagValue = (args, flag) => {
+    const at = args.indexOf(flag);
+    return at !== -1 && args[at + 1] !== undefined ? String(args[at + 1]) : null;
+};
+/**
+ * The code as a human reads it aloud: 8 Crockford characters in two groups. The
+ * server compares case-insensitively with dashes stripped, so the dash is purely
+ * for the eye and either form can be typed back.
+ */
+export const groupCode = (code) => {
+    const bare = code.replace(/[^0-9a-z]/gi, "").toUpperCase();
+    return bare.length <= 4 ? bare : `${bare.slice(0, 4)}-${bare.slice(4)}`;
+};
+/** The scanned string. The device reads the base URL and the code out of it, nothing else. */
+export const pairingLink = (url, code) => `mend://pair?u=${encodeURIComponent(url)}&c=${code}`;
+/**
+ * Tailscale hands every node an IPv4 in the CGNAT range 100.64.0.0/10 — the same
+ * observation packages/api/src/machine.ts makes. A tailnet URL is preferred because
+ * it keeps working when the phone leaves the LAN.
+ */
+const isTailnetUrl = (value) => {
+    let host;
+    try {
+        host = new URL(value).hostname;
+    }
+    catch {
+        return false;
+    }
+    const parts = host.split(".").map(Number);
+    const [first, second] = parts;
+    if (parts.length !== 4 || first === undefined || second === undefined)
+        return false;
+    return first === 100 && second >= 64 && second <= 127;
+};
+/** `--url` wins; otherwise the tailnet address, otherwise the first candidate the server offered. */
+export const chooseUrl = (urls, override) => override ?? urls.find(isTailnetUrl) ?? urls[0] ?? null;
+/** Whole minutes left, floored at 0; null when the server sent a date this CLI cannot read. */
+export const minutesUntil = (expiresAt, now = Date.now()) => {
+    const at = Date.parse(expiresAt);
+    if (Number.isNaN(at))
+        return null;
+    return Math.max(0, Math.round((at - now) / 60_000));
+};
+/** The QR as block characters. Deliberately not gated on isTTY — a piped QR still scans. */
+export const renderQr = async (text) => {
+    const { toString: toQrString } = await import("qrcode");
+    const options = { type: "terminal", small: true };
+    return (await toQrString(text, options)).trimEnd();
+};
+/**
+ * `mend pair [--url <base url>]`: mint a pairing code and show it. The device names
+ * itself when it claims the code, so this side sends nothing but the request.
+ */
+export const pairCommand = async (args, api) => {
+    const pairing = await api("POST", "/me/devices/pairings");
+    const url = chooseUrl(pairing.urls, takeFlagValue(args, "--url"));
+    if (url === null) {
+        return fail("no LAN or tailnet address to hand the device — pass one: mend pair --url http://<host>:<port>");
+    }
+    const minutes = minutesUntil(pairing.expiresAt);
+    say(await renderQr(pairingLink(url, pairing.code)));
+    say(`${green("✓")} pairing code ${groupCode(pairing.code)}`);
+    say(`  ${dim("url")}     ${url}`);
+    say(`  ${dim("expires")} ${minutes === null ? pairing.expiresAt : `in ${minutes} min`} ${dim("· one device, once")}`);
+    say("");
+    say(dim("  scan it in the Mend app, or enter the url and the code there by hand"));
+    say(dim("  the app is apps/mobile — build it yourself; it is not published yet"));
+};
+/** `mend qr <text>`: print a terminal QR of anything. Hidden from help; the installer uses it. */
+export const qrCommand = async (args) => {
+    const text = args.join(" ").trim();
+    if (text === "")
+        return fail("usage: mend qr <text>");
+    say(await renderQr(text));
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sealant/mend",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "The mend CLI: adopt a repository into Mend's store, launch your coding agent in a recorded session worktree, detach and reattach from any terminal",
   "keywords": [
     "claude-code",
@@ -32,11 +32,13 @@
     "@opentui/core": "^0.5.1",
     "@opentui/react": "^0.5.1",
     "@tanstack/react-query": "^5.101.4",
+    "qrcode": "^1.5.4",
     "react": "19.2.3"
   },
   "devDependencies": {
     "@effect/vitest": "4.0.0-beta.98",
     "@types/node": "^22.10.2",
+    "@types/qrcode": "^1.5.5",
     "@types/react": "^19.2.0",
     "typescript": "^5.7.2",
     "vitest": "^3.0.5",