@sealant/mend 0.5.0 → 0.7.1

package/README.md

@@ -17,6 +17,58 @@ diffs, reveal whitespace, select line ranges, add line or whole-change comments,
 evidence, and draft a follow-up for the same session. Press `y` to deliver a pending follow-up and
 relaunch that session, or `o` to continue the review in the web app.
 
+## Getting started
+
+Once per machine, in this order:
+
+```sh
+mend login                       # sign in to the server; the token is saved 0600
+mend connect codex               # send this machine's codex (or claude, github) credential
+mend adopt                       # adopt the repository you are standing in
+mend codex "fix the flaky test"  # new session worktree, harness running in it
+mend pair                        # hand a phone the same server
+mend doctor                      # every fact above, on one screen
+```
+
+`mend help` prints the same sequence under `start`, then everything else.
+
+### mend pair
+
+```
+mend pair [--url <base url>]
+```
+
+Asks the server for a pairing code and prints it three ways: a QR of the `mend://pair` deep link,
+the code grouped as `ABCD-EFGH`, and the base URL the device should reach — the machine's tailnet
+address when it has one, otherwise a LAN address (`--url` overrides the choice). Scan it in the Mend
+app, or type the URL and the code in by hand. The code is single use and expires in 10 minutes; the
+device's own token is minted when it claims the code, and can be revoked from the Mend app later.
+The device names itself when it claims the code.
+
+### mend doctor
+
+```
+mend doctor
+```
+
+Reads, and changes nothing: server reachable, token accepted, the Sealant connection, each connected
+account, adopted projects, the `claude` / `codex` / `gh` CLIs on PATH and whether their credentials
+exist on this machine, and the tailnet address. One line per fact — `✓` observed, `○` not set up
+yet, `✗` a blocker — and every line that needs an action ends with the one command that takes it:
+
+```
+✓ server      http://localhost:3105 · mend 0.5.0
+✓ signed in   token accepted
+✓ sealant     connected · http://127.0.0.1:4000
+✓ claude      connected · you@example.com
+○ codex       not connected → mend connect codex
+✓ projects    2 adopted
+○ gh cli      on PATH · no credential here → gh auth login
+○ tailnet     not detected
+```
+
+It exits 1 when a `✗` is printed, so a setup script can gate on it. No request waits longer than 3s.
+
 ## Commands
 
 ```
@@ -29,6 +81,8 @@ mend resume [session-id] [--with h]   rejoin a settled session (state restored;
 mend rejoin [session-id] [--harness h] attach if live, otherwise resume; newest live wins
 mend sessions [--all] [--project p] [--json]
 mend status                           active sessions (alias of mend sessions)
+mend pair [--url <base url>]          pair a phone or a second machine: QR + code + URL
+mend doctor                           read-only checklist of this machine's setup
 ```
 
 ## Signing in

package/dist/dashboard.js

@@ -261,6 +261,14 @@ const App = ({ ctx, onQuit }) => {
         let outcome;
         try {
             outcome = await ctx.attachTty(session.id, session.harness);
+            if (outcome === "unavailable") {
+                // A live session whose terminal ended (idle: a workspace held open,
+                // no PTY behind it). Enter still means "get me in" — open a fresh
+                // shell in the same workspace and attach to that.
+                const shell = await ctx.api("POST", `/sessions/${session.id}/shell`);
+                process.stdout.write(`no live terminal — opened a shell in the workspace\n\n`);
+                outcome = await ctx.attachTty(session.id, "shell", shell.id);
+            }
         }
         catch (error) {
             say(error instanceof Error ? error.message : String(error));

package/dist/doctor.js

@@ -0,0 +1,233 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+/**
+ * `mend doctor`: one read-only pass over everything a first run depends on, printed
+ * as mono status lines (DESIGN.md §4 — a mark plus a word, never a badge). Every
+ * line states what was observed; a line that needs an action ends with the single
+ * command that takes it. Nothing here writes, launches, or repairs anything.
+ *
+ * No request waits longer than 3s: a doctor that hangs is worse than a doctor that
+ * reports "not checked".
+ */
+const TIMEOUT_MS = 3_000;
+const MARKS = { ok: "✓", todo: "○", failed: "✗" };
+const LABEL_WIDTH = 11;
+/** One status line. The mark is painted by the caller so the formatter stays testable. */
+export const formatCheck = (check, paint = (_state, mark) => mark) => `${paint(check.state, MARKS[check.state])} ${check.label.padEnd(LABEL_WIDTH)} ${check.detail}${check.fix === null ? "" : ` → ${check.fix}`}`;
+/** A read that never throws and never blocks: the outcome is a value the checklist can print. */
+const getJson = async (config, route) => {
+    try {
+        const response = await fetch(`${config.url}/api${route}`, {
+            headers: config.token === null ? {} : { authorization: `Bearer ${config.token}` },
+            signal: AbortSignal.timeout(TIMEOUT_MS),
+        });
+        if (!response.ok)
+            return { value: null, status: response.status };
+        return { value: (await response.json()), status: response.status };
+    }
+    catch {
+        return { value: null, status: null };
+    }
+};
+/** Where each provider's own CLI writes the credential Mend forwards (mirrors `mend connect`). */
+const LOGIN_COMMANDS = {
+    claude: "claude setup-token",
+    codex: "codex login",
+    github: "gh auth login",
+};
+const HARNESS_CLIS = [
+    { command: "claude", provider: "claude" },
+    { command: "codex", provider: "codex" },
+    { command: "gh", provider: "github" },
+];
+const notChecked = (label) => ({
+    label,
+    state: "todo",
+    detail: "not checked",
+    fix: null,
+});
+const identityOf = (account) => {
+    const meta = account.metadata;
+    for (const key of ["login", "email", "accountEmail", "accountId"]) {
+        const value = meta[key];
+        if (typeof value === "string" && value !== "")
+            return value;
+    }
+    return null;
+};
+/** Every fact the checklist prints, in the order a first run needs them. */
+export const runChecks = async (config, probes) => {
+    const checks = [];
+    const health = await getJson(config, "/health");
+    checks.push(health.value === null
+        ? {
+            label: "server",
+            state: "failed",
+            detail: `cannot reach ${config.url}`,
+            fix: "start the Mend server",
+        }
+        : {
+            label: "server",
+            state: "ok",
+            detail: `${config.url} · mend ${health.value.version}`,
+            fix: null,
+        });
+    // Projects double as the cheapest authenticated read there is: it proves the token
+    // without asking the platform anything.
+    const projects = health.value !== null && config.token !== null
+        ? await getJson(config, "/projects")
+        : null;
+    if (health.value === null)
+        checks.push(notChecked("signed in"));
+    else if (config.token === null) {
+        checks.push({
+            label: "signed in",
+            state: "failed",
+            detail: "no token saved",
+            fix: "mend login",
+        });
+    }
+    else if (projects !== null && projects.value !== null) {
+        checks.push({ label: "signed in", state: "ok", detail: "token accepted", fix: null });
+    }
+    else {
+        const status = projects === null ? null : projects.status;
+        checks.push(status === 401 || status === 403
+            ? { label: "signed in", state: "failed", detail: "token rejected", fix: "mend login" }
+            : {
+                label: "signed in",
+                state: "failed",
+                detail: `GET /projects → ${status ?? "no answer"}`,
+                fix: null,
+            });
+    }
+    const signedIn = projects !== null && projects.value !== null;
+    const connection = signedIn ? await getJson(config, "/sealant/connection") : null;
+    if (connection === null)
+        checks.push(notChecked("sealant"));
+    else if (connection.value === null) {
+        // 404 is a server older than the endpoint: nothing was observed, so nothing is claimed.
+        checks.push(connection.status === 404
+            ? notChecked("sealant")
+            : {
+                label: "sealant",
+                state: "failed",
+                detail: `GET /sealant/connection → ${connection.status ?? "no answer"}`,
+                fix: null,
+            });
+    }
+    else if (connection.value.status === "connected") {
+        checks.push({
+            label: "sealant",
+            state: "ok",
+            detail: `connected · ${connection.value.baseUrl}`,
+            fix: null,
+        });
+    }
+    else {
+        checks.push({
+            label: "sealant",
+            state: "failed",
+            detail: `${connection.value.status} · ${connection.value.detail ?? connection.value.baseUrl}`,
+            fix: null,
+        });
+    }
+    const identity = signedIn ? await getJson(config, "/me/sealant") : null;
+    const platform = identity === null ? null : identity.value;
+    for (const { provider } of HARNESS_CLIS) {
+        if (platform === null) {
+            checks.push(notChecked(provider));
+            continue;
+        }
+        const account = platform.accounts.find((row) => row.provider === provider && row.name === "default") ??
+            platform.accounts.find((row) => row.provider === provider);
+        if (account === undefined) {
+            checks.push({
+                label: provider,
+                state: "todo",
+                detail: "not connected",
+                fix: `mend connect ${provider}`,
+            });
+            continue;
+        }
+        const who = identityOf(account);
+        checks.push(account.status === "active"
+            ? {
+                label: provider,
+                state: "ok",
+                detail: who === null ? "connected" : `connected · ${who}`,
+                fix: null,
+            }
+            : {
+                label: provider,
+                state: "todo",
+                detail: account.status,
+                fix: `mend connect ${provider}`,
+            });
+    }
+    const adopted = projects === null ? null : projects.value;
+    if (adopted === null)
+        checks.push(notChecked("projects"));
+    else if (adopted.length === 0) {
+        checks.push({ label: "projects", state: "todo", detail: "none adopted", fix: "mend adopt" });
+    }
+    else {
+        checks.push({ label: "projects", state: "ok", detail: `${adopted.length} adopted`, fix: null });
+    }
+    for (const { command, provider } of HARNESS_CLIS) {
+        const label = `${command} cli`;
+        if (!probes.onPath(command)) {
+            checks.push({ label, state: "todo", detail: "not on PATH", fix: null });
+            continue;
+        }
+        const credential = probes.localCredential(provider);
+        checks.push(credential === null
+            ? {
+                label,
+                state: "todo",
+                detail: "on PATH · no credential here",
+                fix: LOGIN_COMMANDS[provider],
+            }
+            : { label, state: "ok", detail: "on PATH · credential present", fix: null });
+    }
+    const machine = signedIn ? await getJson(config, "/machine") : null;
+    const tailnet = machine === null || machine.value === null ? null : machine.value.tailnet;
+    if (tailnet === null)
+        checks.push(notChecked("tailnet"));
+    else if (tailnet.status === "reachable" && tailnet.address !== null) {
+        checks.push({ label: "tailnet", state: "ok", detail: tailnet.address, fix: null });
+    }
+    else {
+        checks.push({ label: "tailnet", state: "todo", detail: "not detected", fix: null });
+    }
+    return checks;
+};
+/** An executable of that name on PATH — the question `command -v` asks, without a subprocess. */
+export const onPath = (command) => {
+    for (const directory of (process.env["PATH"] ?? "").split(path.delimiter)) {
+        if (directory === "")
+            continue;
+        try {
+            fs.accessSync(path.join(directory, command), fs.constants.X_OK);
+            return true;
+        }
+        catch {
+            // keep looking
+        }
+    }
+    return false;
+};
+/** Green observed · amber not started · red a blocker (DESIGN.md §4); plain text on a pipe. */
+const paintMark = (state, mark) => {
+    if (process.stdout.isTTY !== true)
+        return mark;
+    const code = state === "ok" ? "32" : state === "todo" ? "33" : "31";
+    return `[${code}m${mark}`;
+};
+export const doctorCommand = async (config, localCredential) => {
+    const checks = await runChecks(config, { localCredential, onPath });
+    for (const check of checks)
+        process.stdout.write(`${formatCheck(check, paintMark)}\n`);
+    if (checks.some((check) => check.state === "failed"))
+        process.exitCode = 1;
+};

package/dist/main.js

@@ -5,8 +5,10 @@ import { createRequire } from "node:module";
 import * as net from "node:net";
 import * as os from "node:os";
 import * as path from "node:path";
+import { doctorCommand } from "./doctor.js";
 import { readSyncFiles, scanDotfileCandidates } from "./dotfiles.js";
 import { formatLoadReport } from "./env.js";
+import { pairCommand, qrCommand } from "./pair.js";
 import { isComposeFile, proposeFromCompose, proposeFromPackageJson, proposeFromWorkspacePackage, renderMendToml, workspaceGlobs, } from "./service-init.js";
 import { agentIsLive, agentOutcome, cwdFacts, gitTopLevel, HARNESS_COMMANDS, LIVE_STATUSES, matchProjectByCwd, normalizeProjectName, parseLaunchArgs, } from "./shared.js";
 // `$XDG_CONFIG_HOME/mend`, default `~/.config/mend`; a pre-XDG `~/.mend` stays authoritative
@@ -134,6 +136,8 @@ const api = async (config, method, route, body) => {
         return fail(error instanceof Error ? error.message : String(error));
     }
 };
+/** The same call bound to one config — the dependency ./pair.ts takes. */
+const boundApi = (config) => (method, route, body) => api(config, method, route, body);
 /** A live elapsed-time spinner around a slow await — provisioning is not a hang. */
 const withSpinner = async (label, work) => {
     if (process.stdout.isTTY !== true)
@@ -529,17 +533,39 @@ const flattenService = (view) => {
 const fetchServiceViews = (config, all = false) => api(config, "GET", `/services${all ? "?all=1" : ""}`);
 const fetchServices = async (config, all = false) => (await fetchServiceViews(config, all)).map(flattenService);
 const mutateService = async (config, method, endpointPath, body) => flattenService(await api(config, method, endpointPath, body));
+/** Is the configured server this machine? Only then is its bind authority OUR address. */
+const serverIsLocal = (config) => {
+    const host = parseMendUrl(config.url).hostname;
+    return host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]";
+};
 const serviceUrl = (service) => service.browserUrl ??
     (service.authority === null
         ? "unbound"
         : `${service.authority}${service.protocol === "udp" ? " (udp)" : ""}`);
-const serviceExposure = (service) => {
-    if (service.exposureScope === null)
-        return "";
-    if (service.exposureScope === "private") {
-        return "No Mend sign-in protects this port. Anyone who can reach this private address can connect.";
+/**
+ * Where THIS terminal reaches the Service. On a local server the bind
+ * authority is our own address; on a remote one it is an address on the
+ * server's network — the honest client path is the authenticated tunnel.
+ */
+const printServiceAccess = (config, service) => {
+    const gate = "no Mend sign-in on this port — network reach is the only gate";
+    if (serverIsLocal(config)) {
+        if (service.authority !== null)
+            say(`  ${cobalt(serviceUrl(service))}  ${dim(gate)}`);
+        return;
+    }
+    if (service.protocol === "udp") {
+        // No tunnel for UDP: the server-side listener is the only path.
+        if (service.authority !== null) {
+            say(`  ${cobalt(serviceUrl(service))} ${dim(`on the server's network · ${gate}`)}`);
+        }
+        return;
+    }
+    const local = service.hostPort ?? service.workspacePort;
+    say(`  ${cobalt(`mend service connect ${service.label}`)} ${dim(`→ 127.0.0.1:${local} on this machine, authenticated as you`)}`);
+    if (service.authority !== null) {
+        say(`  ${dim(`server-side listener ${service.authority} · ${gate}`)}`);
     }
-    return `Loopback only · Mend auth: ${service.mendAuthentication ?? "unknown"}`;
 };
 const printWorkspaceTtlFailure = (service) => {
     if (service.workspaceTtlRenewalError === null)
@@ -547,15 +573,17 @@ const printWorkspaceTtlFailure = (service) => {
     say(amber(`  workspace TTL renewal failed · ${service.workspaceTtlRenewalError}`));
     say(dim(`  last renewed ${service.workspaceTtlRenewedAt ?? "unknown"} · known expiry ${service.workspaceExpiresAt ?? "unknown"} · failed ${service.workspaceTtlRenewalFailedAt ?? "unknown"}`));
 };
-const printServiceEndpoint = (service) => {
-    const exposure = serviceExposure(service);
-    say(`  ${cobalt(serviceUrl(service))}${exposure === "" ? "" : `  ${dim(exposure)}`}`);
+const printServiceEndpoint = (config, service) => {
+    printServiceAccess(config, service);
     printWorkspaceTtlFailure(service);
 };
-const printService = (service) => {
+const printService = (config, service) => {
     const status = service.status === "reachable" ? green(service.status) : amber(service.status);
-    const exposure = serviceExposure(service);
-    say(`${(service.label ?? service.id.slice(0, 8)).padEnd(12)}  ${dim(`:${service.workspacePort ?? "?"}${service.protocol === "udp" ? "/udp" : ""} →`)} ${serviceUrl(service)}  ${status}  ${dim(service.id.slice(0, 8))}${exposure === "" ? "" : `  ${dim(exposure)}`}`);
+    const port = `:${service.workspacePort ?? "?"}${service.protocol === "udp" ? "/udp" : ""}`;
+    // Pad around the colored status by its bare length — ANSI codes break padEnd.
+    const statusPad = " ".repeat(Math.max(1, 12 - service.status.length));
+    say(`${(service.label ?? service.id.slice(0, 8)).padEnd(14)} ${status}${statusPad}${dim(port.padEnd(7))} ${dim(service.id.slice(0, 8))}`);
+    printServiceAccess(config, service);
     printWorkspaceTtlFailure(service);
 };
 /**
@@ -593,7 +621,7 @@ const serviceAdd = async (config, args) => {
         browserScheme,
     });
     say(`${green("✓")} Service ${service.label ?? ""} · ${service.status}`);
-    printServiceEndpoint(service);
+    printServiceEndpoint(config, service);
     if (protocol === "udp") {
         say(dim(`  udp — a reply is the only reachability signal; silence just relays`));
     }
@@ -608,7 +636,7 @@ const serviceList = async (config) => {
         return;
     }
     for (const service of services)
-        printService(service);
+        printService(config, service);
 };
 const serviceStop = async (config, args) => {
     const needle = args.find((a) => !a.startsWith("--"));
@@ -671,7 +699,7 @@ const serviceRun = async (config, args) => {
             name: recipe.name,
         }));
         say(`${green("✓")} Service ${service.label ?? ""} · ${service.status}`);
-        printServiceEndpoint(service);
+        printServiceEndpoint(config, service);
         say(dim(`  logs: mend service logs ${service.label ?? service.id.slice(0, 8)}`));
         return;
     }
@@ -705,7 +733,7 @@ const serviceRun = async (config, args) => {
         browserScheme,
     }));
     say(`${green("✓")} Service ${service.label ?? ""} · ${service.status}`);
-    printServiceEndpoint(service);
+    printServiceEndpoint(config, service);
     say(dim(`  logs: mend service logs ${service.label ?? service.id.slice(0, 8)}`));
 };
 /** Read sequence-addressed PTY output without attaching an input-capable terminal. */
@@ -774,7 +802,7 @@ const serviceRestart = async (config, args) => {
     const service = await findLiveService(config, needle);
     const restarted = await withSpinner(`restarting ${service.label ?? service.id.slice(0, 8)}…`, mutateService(config, "POST", `/services/${service.id}/restart`));
     say(`${green("✓")} restarted · ${restarted.status}`);
-    printServiceEndpoint(restarted);
+    printServiceEndpoint(config, restarted);
 };
 /**
  * Scaffold mend.toml from the project's own manifests. Static suggestion,
@@ -852,6 +880,82 @@ const serviceInit = async (args) => {
     fs.writeFileSync(target, toml);
     say(`${green("✓")} wrote ${target} — commit it, then: mend service run ${proposals[0]?.name}`);
 };
+/**
+ * `mend service connect [name…] [--port <n>]`: the location-independent data
+ * plane for Services. The server's own listener binds the SERVER's
+ * interfaces (`MEND_SERVICE_HOSTS`) — exactly right when the server is this
+ * machine, unreachable when it is a Pod or a VPS. This binds each Service's
+ * port on THIS machine's loopback instead and pumps every accepted
+ * connection over one authenticated WebSocket to the server, which dials the
+ * same workspace forward the listener uses. No ports are opened anywhere but
+ * here, and every connection carries the caller's Mend auth.
+ */
+const serviceConnect = async (config, args) => {
+    const portFlag = args.indexOf("--port");
+    const portOverride = portFlag === -1 ? null : Number(args[portFlag + 1]);
+    if (portOverride !== null && !Number.isInteger(portOverride)) {
+        return fail("--port takes a port number");
+    }
+    const names = args.filter((a, i) => !a.startsWith("--") && i !== portFlag + 1);
+    const live = (await fetchServices(config)).filter((s) => s.protocol === "tcp");
+    const picked = names.length === 0
+        ? live
+        : live.filter((s) => names.some((n) => s.label === n || s.id.startsWith(n)));
+    if (picked.length === 0) {
+        return fail(names.length === 0
+            ? "no live TCP services — mend service run starts one"
+            : `no live TCP service matches "${names.join('", "')}"`);
+    }
+    if (portOverride !== null && picked.length !== 1) {
+        return fail("--port applies to exactly one service — name it");
+    }
+    const tunnelUrl = (serviceId) => {
+        const url = parseMendUrl(`${config.url}/api/service-tunnel`);
+        url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
+        url.searchParams.set("service", serviceId);
+        if (config.token !== null)
+            url.searchParams.set("token", config.token);
+        return url;
+    };
+    for (const service of picked) {
+        const port = portOverride ?? service.hostPort ?? service.workspacePort;
+        const server = net.createServer((socket) => {
+            // Hold local bytes until the tunnel is open; loopback buffers are tiny.
+            socket.pause();
+            const ws = new WebSocket(tunnelUrl(service.id));
+            ws.binaryType = "arraybuffer";
+            ws.addEventListener("open", () => socket.resume(), { once: true });
+            ws.addEventListener("message", (event) => {
+                if (typeof event.data === "string")
+                    return; // no text frames come down
+                socket.write(Buffer.from(event.data));
+            });
+            ws.addEventListener("close", () => socket.end(), { once: true });
+            ws.addEventListener("error", () => socket.destroy(), { once: true });
+            // Copy per chunk: the WS client wants an ArrayBuffer-backed view, and
+            // Buffer pools share their backing store.
+            socket.on("data", (chunk) => ws.send(new Uint8Array(chunk)));
+            socket.on("end", () => {
+                if (ws.readyState === WebSocket.OPEN)
+                    ws.send(JSON.stringify({ t: "eof" }));
+            });
+            socket.on("close", () => ws.close());
+            socket.on("error", () => ws.close());
+        });
+        await new Promise((resolve, reject) => {
+            server.once("error", (error) => {
+                reject(new Error(error.code === "EADDRINUSE"
+                    ? `127.0.0.1:${port} is already in use here — pick one with: mend service connect ${service.label} --port <n>`
+                    : error.message));
+            });
+            server.listen(port, "127.0.0.1", () => resolve());
+        }).catch((error) => fail(error.message));
+        say(`${green("●")} ${service.label} → 127.0.0.1:${port} ${dim(`(tunnel to ${config.url})`)}`);
+    }
+    say(dim("  connections are authenticated as you · Ctrl-C stops"));
+    // The listeners keep the process alive until the user stops it.
+    await new Promise(() => { });
+};
 const serviceCommand = async (config, args) => {
     const [verb, ...rest] = args;
     switch (verb) {
@@ -861,6 +965,8 @@ const serviceCommand = async (config, args) => {
             return serviceAdd(config, rest);
         case "init":
             return serviceInit(rest);
+        case "connect":
+            return serviceConnect(config, rest);
         case "list":
         case undefined:
             return serviceList(config);
@@ -877,6 +983,92 @@ const serviceCommand = async (config, args) => {
             return serviceRun(config, [verb, ...rest]);
     }
 };
+const isProvider = (value) => value === "claude" || value === "codex" || value === "github";
+const readIfExists = (file) => (fs.existsSync(file) ? fs.readFileSync(file, "utf8") : null);
+/** The credential as THIS machine holds it — the same files the agent CLIs wrote at login. */
+const localCredential = (provider) => {
+    const home = os.homedir();
+    switch (provider) {
+        case "codex":
+            return readIfExists(path.join(process.env["CODEX_HOME"] ?? path.join(home, ".codex"), "auth.json"));
+        case "claude":
+            return readIfExists(path.join(process.env["CLAUDE_CONFIG_DIR"] ?? path.join(home, ".claude"), ".credentials.json"));
+        case "github": {
+            const result = spawnSync("gh", ["auth", "token"], { encoding: "utf8" });
+            const token = result.status === 0 ? result.stdout.trim() : "";
+            return token === "" ? null : token;
+        }
+    }
+};
+const accountLine = (account) => {
+    const meta = account.metadata;
+    const pick = (key) => (typeof meta[key] === "string" ? String(meta[key]) : null);
+    const identity = pick("login") ?? pick("email") ?? pick("accountEmail") ?? pick("accountId");
+    const suffix = pick("tokenSuffix");
+    const facts = [
+        account.status === "active" ? "connected" : account.status,
+        identity,
+        suffix === null ? null : `…${suffix}`,
+        `since ${account.connectedAt.slice(0, 10)}`,
+    ].filter((fact) => fact !== null);
+    return `${account.provider.padEnd(8)} ${facts.join(" · ")}`;
+};
+/**
+ * `mend accounts`: the signed-in user's own connected accounts on the platform — each person's
+ * subscriptions, under their own Sealant user (docs/SEALANT-IDENTITY.md).
+ */
+const accountsCommand = async (config) => {
+    const identity = await api(config, "GET", "/me/sealant");
+    process.stdout.write(`platform user ${identity.sealantUserId}\n`);
+    const providers = ["claude", "codex", "github"];
+    for (const provider of providers) {
+        const account = identity.accounts.find((row) => row.provider === provider && row.name === "default") ??
+            identity.accounts.find((row) => row.provider === provider);
+        process.stdout.write(`  ${account === undefined ? `${provider.padEnd(8)} not connected` : accountLine(account)}\n`);
+    }
+};
+/**
+ * `mend connect claude|codex|github [--from-stdin] [--remove]`: send THIS machine's credential
+ * for the provider to the platform under your own user. The file the provider's CLI wrote at
+ * login is read verbatim (codex: ~/.codex/auth.json; claude: ~/.claude/.credentials.json;
+ * github: `gh auth token`); `--from-stdin` takes a pasted token or file instead. Mend forwards
+ * it once and stores nothing.
+ */
+const connectCommand = async (config, args) => {
+    const [providerArg, ...flags] = args;
+    if (!isProvider(providerArg)) {
+        return fail("usage: mend connect claude|codex|github [--from-stdin] [--remove]");
+    }
+    const provider = providerArg;
+    if (flags.includes("--remove")) {
+        const identity = await api(config, "GET", "/me/sealant");
+        const account = identity.accounts.find((row) => row.provider === provider);
+        if (account === undefined)
+            return fail(`${provider}: nothing connected`);
+        await api(config, "DELETE", `/me/sealant/accounts/${account.id}`);
+        process.stdout.write(`${provider}: disconnected\n`);
+        return;
+    }
+    let secret;
+    if (flags.includes("--from-stdin")) {
+        secret = fs.readFileSync(0, "utf8").trim();
+        if (secret === "")
+            return fail("nothing on stdin");
+    }
+    else {
+        secret = localCredential(provider);
+        if (secret === null) {
+            const where = provider === "github"
+                ? "`gh auth login` first, or pipe a token: gh auth token | mend connect github --from-stdin"
+                : provider === "codex"
+                    ? "`codex login` first, or: mend connect codex --from-stdin < auth.json"
+                    : "`claude setup-token` then: mend connect claude --from-stdin";
+            return fail(`${provider}: no credential on this machine — ${where}`);
+        }
+    }
+    const account = await withSpinner(`connecting ${provider}`, api(config, "POST", "/me/sealant/accounts", { provider, secret }));
+    process.stdout.write(`${accountLine(account)}\n`);
+};
 // ─── login: obtain and save the bearer token ────────────────────────────────
 const takeFlagValue = (args, flag) => {
     const at = args.indexOf(flag);
@@ -1333,6 +1525,9 @@ _mend() {
     'attach:reattach to a running session' 'shell:open a shell in a live session workspace'
     'service:reachable ports — add, list, stop'
     'keys:the machine Mend deploy key — init, show, share'
+    'accounts:your connected accounts on the platform'
+    'pair:pair a phone or a second machine' 'doctor:read-only checklist of this setup'
+    'connect:send this machine'"'"'s claude/codex/github credential to the platform'
     'continue:resume with the pending follow-up' 'resume:rejoin a settled session'
     'rejoin:attach if live, otherwise resume'
     'projects:adopted projects' 'sessions:sessions with review facts' 'status:active sessions'
@@ -1355,7 +1550,7 @@ _mend "$@"
 const BASH_COMPLETIONS = `_mend() {
   local cur=\${COMP_WORDS[COMP_CWORD]}
   if [ "$COMP_CWORD" -eq 1 ]; then
-    COMPREPLY=( $(compgen -W "adopt codex claude opencode run attach shell service keys continue resume rejoin projects sessions status ui help" -- "$cur") )
+    COMPREPLY=( $(compgen -W "adopt codex claude opencode run attach shell service keys pair doctor continue resume rejoin projects sessions status ui help" -- "$cur") )
     return
   fi
   case \${COMP_WORDS[1]} in
@@ -1769,17 +1964,34 @@ const dashboard = async (config) => {
         config,
         cwd: process.cwd(),
         api: (method, route, body) => request(config, method, route, body),
-        attachTty: (sessionId, harness) => attachTty(config, sessionId, harness, 0n),
+        attachTty: (sessionId, harness, processId) => attachTty(config, sessionId, harness, 0n, processId),
     });
 };
 // ─── entry ──────────────────────────────────────────────────────────────────
 const HELP = `mend — the agent workbench
 
-  mend                                  the dashboard: every project and session, live
+start
+  mend login [--url <server>]           sign in with email + password; saves the token (0600)
+  mend connect <provider> [--from-stdin] [--remove]
+                                        send THIS machine's claude/codex/github credential to the
+                                        platform under your own user (reads the file the provider's
+                                        CLI wrote at login; --from-stdin pastes one instead)
   mend adopt [source] [--name <name>] [--auth ambient|mend-key|bridge]
                                         adopt a repository into the store (default: cwd; any git
                                         URL — GitHub, GitLab, self-hosted, ssh://, a local path)
-  mend login [--url <server>]           sign in with email + password; saves the token (0600)
+  mend codex|claude|opencode ["prompt"] [--model <id>] [--effort low|medium|high|xhigh|max]
+                             [--base <ref>] [--ask] [--fast]
+                                        new session worktree + launch the harness in it; a quoted
+                                        prompt becomes its first message (and names the session),
+                                        --ask restores the harness's permission prompts, --fast
+                                        requests priority processing (codex service tier)
+  mend pair [--url <base url>]          pair a phone or a second machine: prints a QR, the code, and
+                                        the URL to reach this server (one device, once, 10 minutes)
+  mend doctor                           read-only checklist of this machine's setup — one line per
+                                        fact, each unfinished one ending in the command that fixes it
+
+everything else
+  mend                                  the dashboard: every project and session, live
   mend logout                           forget the saved token
   mend keys init                        generate the machine's Mend deploy key (ed25519)
   mend keys show                        print the public key — add it as a deploy key on your git host
@@ -1787,16 +1999,11 @@ const HELP = `mend — the agent workbench
                                         secret-shaped names → secrets; --secret sends all (or the
                                         named ones, e.g. DATABASE_URL) to secrets
   mend env show                         what the project store holds — names only, never values
+  mend accounts                         your connected accounts on the platform (claude, codex, github)
   mend dotfiles                         your dotfiles on the server: repo + synced home files
   mend dotfiles sync [--all | paths…]   capture config files from THIS machine into your store
   mend keys share                       relay THIS machine's ssh-agent to the server (bridge mode:
                                         hardware keys sign here; Ctrl-C stops sharing)
-  mend codex|claude|opencode ["prompt"] [--model <id>] [--effort low|medium|high|xhigh|max]
-                             [--base <ref>] [--ask] [--fast]
-                                        new session worktree + launch the harness in it; a quoted
-                                        prompt becomes its first message (and names the session),
-                                        --ask restores the harness's permission prompts, --fast
-                                        requests priority processing (codex service tier)
   mend run -- <command...>              same, with an arbitrary command
   mend attach <session-id-prefix>       reattach this terminal to a running session
   mend shell [session-id-prefix]        open a shell in a live session's workspace
@@ -1807,6 +2014,9 @@ const HELP = `mend — the agent workbench
   mend service init [--yes]             scaffold mend.toml from package.json + compose ports
   mend service add [session] <port> [--name <n>] [--udp]
                                         adopt a listening workspace port — reachable on this machine
+  mend service connect [name…] [--port <p>]
+                                        bring live Services to THIS machine's loopback — each
+                                        connection tunnels through the server, authenticated as you
   mend service list                     every live service and its observed state
   mend service logs <name-or-id>        follow a supervised service's output (replay, then live)
   mend service restart <name-or-id>     re-run its recorded command — same URL
@@ -1849,6 +2059,17 @@ const main = async () => {
             return keysCommand(config, rest);
         case "dotfiles":
             return dotfilesCommand(config, rest);
+        case "accounts":
+            return accountsCommand(config);
+        case "connect":
+            return connectCommand(config, rest);
+        case "pair":
+            return pairCommand(rest, boundApi(config));
+        // Deliberately absent from HELP: the installer renders its own QR through this.
+        case "qr":
+            return qrCommand(rest);
+        case "doctor":
+            return doctorCommand(config, localCredential);
         case "env":
             return envCommand(config, rest);
         case "completions":

package/dist/pair.js

@@ -0,0 +1,83 @@
+const paint = (code) => (text) => process.stdout.isTTY === true ? `[${code}m${text}` : text;
+const dim = paint("2");
+const green = paint("32");
+const say = (line) => process.stdout.write(`${line}\n`);
+const fail = (message) => {
+    process.stderr.write(`mend: ${message}\n`);
+    process.exit(1);
+};
+const takeFlagValue = (args, flag) => {
+    const at = args.indexOf(flag);
+    return at !== -1 && args[at + 1] !== undefined ? String(args[at + 1]) : null;
+};
+/**
+ * The code as a human reads it aloud: 8 Crockford characters in two groups. The
+ * server compares case-insensitively with dashes stripped, so the dash is purely
+ * for the eye and either form can be typed back.
+ */
+export const groupCode = (code) => {
+    const bare = code.replace(/[^0-9a-z]/gi, "").toUpperCase();
+    return bare.length <= 4 ? bare : `${bare.slice(0, 4)}-${bare.slice(4)}`;
+};
+/** The scanned string. The device reads the base URL and the code out of it, nothing else. */
+export const pairingLink = (url, code) => `mend://pair?u=${encodeURIComponent(url)}&c=${code}`;
+/**
+ * Tailscale hands every node an IPv4 in the CGNAT range 100.64.0.0/10 — the same
+ * observation packages/api/src/machine.ts makes. A tailnet URL is preferred because
+ * it keeps working when the phone leaves the LAN.
+ */
+const isTailnetUrl = (value) => {
+    let host;
+    try {
+        host = new URL(value).hostname;
+    }
+    catch {
+        return false;
+    }
+    const parts = host.split(".").map(Number);
+    const [first, second] = parts;
+    if (parts.length !== 4 || first === undefined || second === undefined)
+        return false;
+    return first === 100 && second >= 64 && second <= 127;
+};
+/** `--url` wins; otherwise the tailnet address, otherwise the first candidate the server offered. */
+export const chooseUrl = (urls, override) => override ?? urls.find(isTailnetUrl) ?? urls[0] ?? null;
+/** Whole minutes left, floored at 0; null when the server sent a date this CLI cannot read. */
+export const minutesUntil = (expiresAt, now = Date.now()) => {
+    const at = Date.parse(expiresAt);
+    if (Number.isNaN(at))
+        return null;
+    return Math.max(0, Math.round((at - now) / 60_000));
+};
+/** The QR as block characters. Deliberately not gated on isTTY — a piped QR still scans. */
+export const renderQr = async (text) => {
+    const { toString: toQrString } = await import("qrcode");
+    const options = { type: "terminal", small: true };
+    return (await toQrString(text, options)).trimEnd();
+};
+/**
+ * `mend pair [--url <base url>]`: mint a pairing code and show it. The device names
+ * itself when it claims the code, so this side sends nothing but the request.
+ */
+export const pairCommand = async (args, api) => {
+    const pairing = await api("POST", "/me/devices/pairings");
+    const url = chooseUrl(pairing.urls, takeFlagValue(args, "--url"));
+    if (url === null) {
+        return fail("no LAN or tailnet address to hand the device — pass one: mend pair --url http://<host>:<port>");
+    }
+    const minutes = minutesUntil(pairing.expiresAt);
+    say(await renderQr(pairingLink(url, pairing.code)));
+    say(`${green("✓")} pairing code ${groupCode(pairing.code)}`);
+    say(`  ${dim("url")}     ${url}`);
+    say(`  ${dim("expires")} ${minutes === null ? pairing.expiresAt : `in ${minutes} min`} ${dim("· one device, once")}`);
+    say("");
+    say(dim("  scan it in the Mend app, or enter the url and the code there by hand"));
+    say(dim("  the app is apps/mobile — build it yourself; it is not published yet"));
+};
+/** `mend qr <text>`: print a terminal QR of anything. Hidden from help; the installer uses it. */
+export const qrCommand = async (args) => {
+    const text = args.join(" ").trim();
+    if (text === "")
+        return fail("usage: mend qr <text>");
+    say(await renderQr(text));
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sealant/mend",
-  "version": "0.5.0",
+  "version": "0.7.1",
   "description": "The mend CLI: adopt a repository into Mend's store, launch your coding agent in a recorded session worktree, detach and reattach from any terminal",
   "keywords": [
     "claude-code",
@@ -32,11 +32,13 @@
     "@opentui/core": "^0.5.1",
     "@opentui/react": "^0.5.1",
     "@tanstack/react-query": "^5.101.4",
+    "qrcode": "^1.5.4",
     "react": "19.2.3"
   },
   "devDependencies": {
     "@effect/vitest": "4.0.0-beta.98",
     "@types/node": "^22.10.2",
+    "@types/qrcode": "^1.5.5",
     "@types/react": "^19.2.0",
     "typescript": "^5.7.2",
     "vitest": "^3.0.5",