@songsid/agend 2.3.5-alpha.3 → 2.3.5-alpha.5

package/dist/claude-auth-status.js

@@ -0,0 +1,149 @@
+/**
+ * `claude auth status`, read once and the same way everywhere (the AgEnD host's `authCheck` and CLI sign-in list, the Windows Runtime's
+ * per-profile report and default sign-in): is it signed in, and which account is it, as a MASKED e-mail and a plan.
+ *
+ * The full e-mail never leaves `parseClaudeAuthStatus`: it is masked inside, before anything is returned, stored, logged, shown or sent
+ * (`ab***@example.com`). The same pattern is enforced where a masked value arrives from elsewhere (the server, on a Runtime's report), and a
+ * value that does not match it is a protocol error, never "cleaned up". The domain is sent in full on purpose: it lets an admin tell a work
+ * account from a personal one.
+ *
+ * Built-ins only: it is part of the Runtime bundle (RUNTIME_BUNDLE_MODULES).
+ */
+/** Reported in the Runtime's capabilities. A Runtime without it still works; it just shows no account identity. */
+export const ACCOUNT_IDENTITY_CAPABILITY = "account-identity";
+/** The plans that can be reported. Whatever else the CLI says becomes `unknown`; display names belong to the UI (they are product names, not translated). */
+export const PLANS = Object.freeze(["free", "pro", "max", "team", "enterprise", "unknown"]);
+/**
+ * The mask contract. ASCII only, one or two visible characters, then `***@`, then a dotted ASCII domain of at most 253 characters
+ * (the look-ahead), under a total length cap.
+ */
+const MASKED_EMAIL = /^[A-Za-z0-9._%+-]{1,2}\*\*\*@(?=.{1,253}$)[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)+$/;
+const MAX_MASKED = 260;
+const MAX_EMAIL = 254;
+const ACCOUNT_KEYS = ["maskedEmail", "plan", "apiKey"];
+export function validMaskedEmail(value) { return typeof value === "string" && value.length <= MAX_MASKED && MASKED_EMAIL.test(value); }
+export function validPlan(value) { return typeof value === "string" && PLANS.includes(value); }
+/** Module-private on purpose: the only way to get a masked address is through the parser, so no caller ever holds a raw one. */
+function mask(value) {
+    if (typeof value !== "string")
+        return undefined;
+    const text = value.trim();
+    if (!text || text.length > MAX_EMAIL || !/^[\x21-\x7e]+$/.test(text))
+        return undefined; // printable ASCII, no space: a non-ASCII address sends none
+    const at = text.indexOf("@");
+    if (at < 1 || at !== text.lastIndexOf("@"))
+        return undefined;
+    const local = text.slice(0, at), domain = text.slice(at + 1);
+    const masked = `${local.slice(0, local.length <= 2 ? 1 : 2)}***@${domain}`;
+    // Self-check with the very pattern the server enforces: anything that does not fit it sends no e-mail, never a partial one.
+    return validMaskedEmail(masked) ? masked : undefined;
+}
+/**
+ * The subscription type as Claude names it, trimmed and lower-cased: the one normalization both the plan reported here and the usage
+ * panel's plan label (src/usage/providers.ts) start from.
+ */
+export function normalizeSubscriptionType(value) {
+    if (typeof value !== "string")
+        return undefined;
+    const plan = value.trim().toLowerCase();
+    return plan || undefined;
+}
+function planOf(value) {
+    const type = normalizeSubscriptionType(value);
+    return type === undefined ? undefined : PLANS.includes(type) && type !== "unknown" ? type : "unknown";
+}
+/**
+ * Closed parse of an identity that arrives from elsewhere (a Runtime's report): `maskedEmail` only in its masked form, `plan` only from
+ * the list, `apiKey` only `true`, and nothing else. A violation is an error carrying no value: the rejected text is never echoed.
+ */
+export function parseAccountIdentity(value) {
+    const fail = (field) => { throw new Error(`Invalid account identity: ${field}`); };
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return fail("identity");
+    const input = value;
+    for (const key of Object.keys(input))
+        if (!ACCOUNT_KEYS.includes(key))
+            return fail("unknown field");
+    if (input.maskedEmail !== undefined && !validMaskedEmail(input.maskedEmail))
+        return fail("maskedEmail");
+    if (input.plan !== undefined && !validPlan(input.plan))
+        return fail("plan");
+    if (input.apiKey !== undefined && input.apiKey !== true)
+        return fail("apiKey");
+    if (input.apiKey === true && (input.maskedEmail !== undefined || input.plan !== undefined))
+        return fail("apiKey");
+    return { ...(input.maskedEmail !== undefined ? { maskedEmail: input.maskedEmail } : {}), ...(input.plan !== undefined ? { plan: input.plan } : {}), ...(input.apiKey === true ? { apiKey: true } : {}) };
+}
+/** The identity part of a parse, or undefined when there is none. */
+export function identityOf(status) {
+    const identity = { ...(status.maskedEmail ? { maskedEmail: status.maskedEmail } : {}), ...(status.plan ? { plan: status.plan } : {}), ...(status.apiKey ? { apiKey: true } : {}) };
+    return Object.keys(identity).length ? identity : undefined;
+}
+/**
+ * The JSON objects in a text, in order: a balanced `{ … }` (string-aware, so a brace inside a quoted value does not count) from each `{`. Stdout and
+ * stderr are merged by every caller, so other text, even text with braces in it, can sit around the answer. Bounded: a step budget, so a hostile
+ * or enormous output cannot make this quadratic.
+ */
+function* jsonObjectCandidates(text) {
+    let budget = 262_144;
+    for (let start = text.indexOf("{"); start >= 0 && budget > 0; start = text.indexOf("{", start + 1)) {
+        let depth = 0, inString = false, escaped = false;
+        for (let i = start; i < text.length && budget-- > 0; i++) {
+            const c = text[i];
+            if (inString) {
+                if (escaped)
+                    escaped = false;
+                else if (c === "\\")
+                    escaped = true;
+                else if (c === '"')
+                    inString = false;
+                continue;
+            }
+            if (c === '"')
+                inString = true;
+            else if (c === "{")
+                depth++;
+            else if (c === "}" && --depth === 0) {
+                yield text.slice(start, i + 1);
+                start = i;
+                break;
+            }
+        }
+    }
+}
+/**
+ * Parse the output of `claude auth status` (stdout and stderr may be merged, so the JSON object is looked for among other text, braces included):
+ * the first balanced object that parses and has a boolean `loggedIn` is the answer.
+ * `loggedIn`: the CLI's own boolean, null when there is no readable answer. Only a signed-in answer carries an identity: an account login
+ * has a masked e-mail and a plan; an API key (`authMethod: "api_key"`) is marked as such and has neither.
+ */
+export function parseClaudeAuthStatus(text) {
+    const unreadable = { loggedIn: null };
+    if (typeof text !== "string" || text.length > 64 * 1024)
+        return unreadable;
+    let row, tried = 0;
+    for (const candidate of jsonObjectCandidates(text)) {
+        if (++tried > 32)
+            break;
+        let value;
+        try {
+            value = JSON.parse(candidate);
+        }
+        catch {
+            continue;
+        }
+        if (value && typeof value === "object" && !Array.isArray(value) && typeof value.loggedIn === "boolean") {
+            row = value;
+            break;
+        }
+    }
+    if (!row)
+        return unreadable;
+    if (row.loggedIn !== true)
+        return { loggedIn: false };
+    if (row.authMethod === "api_key")
+        return { loggedIn: true, apiKey: true };
+    const maskedEmail = mask(row.email), plan = planOf(row.subscriptionType);
+    return { loggedIn: true, ...(maskedEmail ? { maskedEmail } : {}), ...(plan ? { plan } : {}) };
+}
+//# sourceMappingURL=claude-auth-status.js.map

package/dist/claude-auth-status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-auth-status.js","sourceRoot":"","sources":["../src/claude-auth-status.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,mHAAmH;AACnH,MAAM,CAAC,MAAM,2BAA2B,GAAG,kBAAkB,CAAC;AAC9D,6JAA6J;AAC7J,MAAM,CAAC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,CAAU,CAAC,CAAC;AAcrG;;;GAGG;AACH,MAAM,YAAY,GAAG,4EAA4E,CAAC;AAClG,MAAM,UAAU,GAAG,GAAG,CAAC;AACvB,MAAM,SAAS,GAAG,GAAG,CAAC;AACtB,MAAM,YAAY,GAAG,CAAC,aAAa,EAAE,MAAM,EAAE,QAAQ,CAAU,CAAC;AAEhE,MAAM,UAAU,gBAAgB,CAAC,KAAc,IAAqB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,IAAI,UAAU,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACjK,MAAM,UAAU,SAAS,CAAC,KAAc,IAAmB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAK,KAA2B,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAE9I,gIAAgI;AAChI,SAAS,IAAI,CAAC,KAAc;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC1B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,SAAS,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC,CAAU,4DAA4D;IAC7J,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,MAAM,EAAE,CAAC;IAC3E,4HAA4H;IAC5H,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AACD;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACxC,OAAO,IAAI,IAAI,SAAS,CAAC;AAC3B,CAAC;AACD,SAAS,MAAM,CAAC,KAAc;IAC5B,MAAM,IAAI,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC;IAC9C,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAE,KAA2B,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAY,CAAC,CAAC,CAAC,SAAS,CAAC;AACvI,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,MAAM,IAAI,GAAG,CAAC,KAAa,EAAS,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,6BAA6B,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAClG,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC;IACzF,MAAM,KAAK,GAAG,KAAgC,CAAC;IAC/C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,IAAI,CAAE,YAAkC,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC,eAAe,CAAC,CAAC;IAC3H,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC,aAAa,CAAC,CAAC;IACxG,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5E,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC/E,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC;IAClH,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACtO,CAAC;AACD,qEAAqE;AACrE,MAAM,UAAU,UAAU,CAAC,MAAwB;IACjD,MAAM,QAAQ,GAAoB,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC7M,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7D,CAAC;AAED;;;;GAIG;AACH,QAAQ,CAAC,CAAC,oBAAoB,CAAC,IAAY;IACzC,IAAI,MAAM,GAAG,OAAO,CAAC;IACrB,KAAK,IAAI,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;QACnG,IAAI,KAAK,GAAG,CAAC,EAAE,QAAQ,GAAG,KAAK,EAAE,OAAO,GAAG,KAAK,CAAC;QACjD,KAAK,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YACzD,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,IAAI,QAAQ,EAAE,CAAC;gBAAC,IAAI,OAAO;oBAAE,OAAO,GAAG,KAAK,CAAC;qBAAM,IAAI,CAAC,KAAK,IAAI;oBAAE,OAAO,GAAG,IAAI,CAAC;qBAAM,IAAI,CAAC,KAAK,GAAG;oBAAE,QAAQ,GAAG,KAAK,CAAC;gBAAC,SAAS;YAAC,CAAC;YACpI,IAAI,CAAC,KAAK,GAAG;gBAAE,QAAQ,GAAG,IAAI,CAAC;iBAC1B,IAAI,CAAC,KAAK,GAAG;gBAAE,KAAK,EAAE,CAAC;iBACvB,IAAI,CAAC,KAAK,GAAG,IAAI,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC;gBAAC,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAC,KAAK,GAAG,CAAC,CAAC;gBAAC,MAAM;YAAC,CAAC;QAC5F,CAAC;IACH,CAAC;AACH,CAAC;AACD;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAa;IACjD,MAAM,UAAU,GAAqB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACxD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI;QAAE,OAAO,UAAU,CAAC;IAC3E,IAAI,GAAwC,EAAE,KAAK,GAAG,CAAC,CAAC;IACxD,KAAK,MAAM,SAAS,IAAI,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,IAAI,EAAE,KAAK,GAAG,EAAE;YAAE,MAAM;QACxB,IAAI,KAAc,CAAC;QACnB,IAAI,CAAC;YAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,SAAS;QAAC,CAAC;QAC1D,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,OAAQ,KAAiC,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAAC,GAAG,GAAG,KAAgC,CAAC;YAAC,MAAM;QAAC,CAAC;IACzL,CAAC;IACD,IAAI,CAAC,GAAG;QAAE,OAAO,UAAU,CAAC;IAC5B,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACtD,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC1E,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACzE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAChG,CAAC"}

package/dist/cli.js

@@ -16,6 +16,8 @@ applyNetworkReliabilityDefaults();
 import { checkNodeVersion } from "./node-version-guard.js";
 checkNodeVersion();
 import { Command, Option } from "commander";
+import { registerBuildInfoCommand } from "./build-provenance-cli.js";
+import { launchdServiceDomain } from "./launchd-service-domain.js";
 import { registerBugReportCommand } from "./bug-report-cli.js";
 import { join, dirname } from "node:path";
 import { SchedulerDb } from "./scheduler/db.js";
@@ -25,7 +27,8 @@ import { homedir, totalmem, freemem, userInfo } from "node:os";
 import { fileURLToPath } from "node:url";
 import { spawnSync, execSync, execFileSync } from "node:child_process";
 import { spawn } from "./child-process.js";
-import { getAgendHome, getTmuxSocketName, isDefaultAgendHome, realDefaultAgendHome } from "./paths.js";
+import { getAgendHome, isDefaultAgendHome, realDefaultAgendHome } from "./paths.js";
+import { tmuxArgs as tmuxArgsFor, tmuxBinary as tmuxBin, tmuxEnvOption as tmuxEnvOpt } from "./tmux-binary.js";
 import { hasPausedMarker } from "./pause-marker.js";
 import { COMPLETION_SHELLS, completionScript } from "./completion.js";
 import { getUpdateSelector, isExactVersion, isUnrequestedDowngrade, downgradeRefusal, lookupTargetVersion, reportUpdateRestart, shouldSkipUpdate, runningFleetPredatesInstall, fleetProvenStopped, readFleetPidEvidence, pidAlive, processStartMs, } from "./update-check.js";
@@ -38,7 +41,7 @@ import { limitFleetCoreDumps } from "./coredump-filter.js";
 import { SYSTEMD_RESTART_TIMEOUT_MS, getServicePath, getSystemServicePath, serviceDefinitionHome } from "./service-installer.js";
 import { withFsPlanLock } from "./service-plan.js";
 import { selectSystemdRestartTarget, SYSTEMD_RESTART_INDETERMINATE_EXIT_CODE, } from "./service-restart-selection.js";
-import { loadRawFleetConfig } from "./config.js";
+import { getTmuxSession, loadRawFleetConfig } from "./config.js";
 import { detectLocale, setLocale, getLocale, t } from "./locale.js";
 import { settingsSourceLabel } from "./settings-confirmation.js";
 import { DeliveryOutbox, deliveryStatusSelector } from "./delivery-outbox.js";
@@ -48,11 +51,8 @@ import { requestSettingsConfirmation } from "./settings-control.js";
 import { canonicalCliEntry, selfCommand } from "./cli-entry.js";
 import { DIRECT_FLEET_START_ENV, redirectsToService, serviceRunsHome, startedByServiceManager } from "./service-owner.js";
 import { handOff, shouldHandOff } from "./launchd-handoff.js";
-/** Prefix tmux args with -L when socket isolation is active. */
-function tmuxArgs(args) {
-    const socket = getTmuxSocketName();
-    return socket ? ["-L", socket, ...args] : args;
-}
+/** This fleet's tmux socket (and, with the bundled tmux, its config) in front of `args` (tmux-binary.ts). */
+const tmuxArgs = (args) => tmuxArgsFor(args);
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 const DATA_DIR = getAgendHome();
@@ -178,6 +178,7 @@ program
     // `agend --version`, prints this version and installs nothing.
     .enablePositionalOptions();
 registerBugReportCommand(program, pkgVersion);
+registerBuildInfoCommand(program);
 function signalFleetReload() {
     const pidPath = join(DATA_DIR, "fleet.pid");
     try {
@@ -312,6 +313,23 @@ fleet
         }
         catch { /* fleet not running, fall through */ }
     }
+    // A service manager owns stop/start sequencing. Before this replacement claims any shared fleet state,
+    // an enabled Hub waits for the previous process and both old listener endpoints to close.
+    if (loadRawFleetConfig(FLEET_CONFIG_PATH).hub?.enabled === true) {
+        const [{ waitForHubServiceStart, HubServiceStartError }, { ht }] = await Promise.all([
+            import("./hub/service-start.js"), import("./hub/init/text.js"),
+        ]);
+        console.log(ht("service_drain_wait"));
+        try {
+            await waitForHubServiceStart(DATA_DIR);
+        }
+        catch (err) {
+            const reason = err instanceof HubServiceStartError ? err.reason : "config";
+            console.error(ht(`service_drain_${reason}`));
+            process.exitCode = 1;
+            return;
+        }
+    }
     // Claim the singleton before constructing FleetManager: its constructor and
     // startAll path touch shared tmux, sockets, state files and adapters.
     if (!claimFleetSingleton())
@@ -852,7 +870,9 @@ backend
     // tmux
     try {
         const { execSync } = await import("node:child_process");
-        const ver = execSync("tmux -V", { stdio: "pipe" }).toString().trim();
+        const { tmuxBinary, tmuxEnvOption } = await import("./tmux-binary.js");
+        const { execFileSync: run } = await import("node:child_process");
+        const ver = run(tmuxBinary(), ["-V"], { stdio: "pipe", ...tmuxEnvOption() }).toString().trim();
         ok(`tmux${" ".repeat(16)} ${ver}`);
     }
     catch {
@@ -1428,7 +1448,7 @@ program
         const systemUnit = getSystemServicePath();
         const ownService = systemUnit ? null : getServicePath();
         const manager = systemUnit ? { kind: "systemd", unit: "agend", user: false, unitPath: systemUnit }
-            : ownService && detectPlatform() === "macos" ? { kind: "launchd", label: "com.agend.fleet", plistPath: ownService, domain: `gui/${process.getuid?.() ?? 501}` }
+            : ownService && detectPlatform() === "macos" ? { kind: "launchd", label: "com.agend.fleet", plistPath: ownService, domain: launchdServiceDomain() }
                 : ownService ? { kind: "systemd", unit: "com.agend.fleet", user: true, unitPath: ownService }
                     : { kind: "detached" };
         // C6: a failure before the fleet runs the new install puts the previous package back too (taken before npm).
@@ -1564,8 +1584,7 @@ program
         // delete so a newer plan published during the slow bootout is left (#2376 / #2439).
         if (manager.kind === "launchd") {
             const { consumeCarriedOutPlan } = await import("./service-plan.js");
-            const uid = process.getuid?.() ?? 501;
-            consumeCarriedOutPlan(DATA_DIR, `gui/${uid}/com.agend.fleet`, planDeps());
+            consumeCarriedOutPlan(DATA_DIR, `${launchdServiceDomain()}/com.agend.fleet`, planDeps());
         }
         // #1853: in a WSL terminal without the Windows desktop shortcuts, say once how to make them (never makes them).
         if (outcome.ok)
@@ -1889,7 +1908,20 @@ program
         } })() : null,
         isDefault: isDefaultAgendHome,
     });
-    const serviceVars = { label: "com.agend.fleet", execPath, path: process.env.PATH, ...service };
+    const isHub = loadRawFleetConfig(FLEET_CONFIG_PATH).hub?.enabled === true;
+    if (isHub && opts.activate !== false) {
+        const [{ assertHubServiceInstallIdle }, { ht }] = await Promise.all([import("./hub/service-start.js"), import("./hub/init/text.js")]);
+        try {
+            assertHubServiceInstallIdle(service.workingDirectory);
+        }
+        catch {
+            console.error(ht("service_install_idle"));
+            process.exitCode = 1;
+            return;
+        }
+    }
+    const serviceVars = { label: "com.agend.fleet", execPath, path: process.env.PATH, ...service,
+        ...(!existingPath && isHub ? { launchdSessionType: "Background" } : {}) };
     // #1450 C6: on launchd, writing a new plist without activating is a PLANNED activation — proven, recorded, and
     // left for `agend restart` (a reload there would itself start the job). See service-plan.ts.
     if (opts.activate === false && detectPlatform() === "macos") {
@@ -1905,9 +1937,10 @@ program
         }
         const uid = process.getuid?.() ?? 501;
         const plistPath = launchdPlistPath(serviceVars.label);
+        const domain = serviceVars.launchdSessionType === "Background" ? `user/${uid}` : launchdServiceDomain(serviceVars.label);
         mkdirSync(dirname(plistPath), { recursive: true });
         const outcome = refreshLaunchdWithoutActivating({
-            label: serviceVars.label, target: `gui/${uid}/${serviceVars.label}`, plistPath, newPlist: renderLaunchdPlist(serviceVars),
+            label: serviceVars.label, target: `${domain}/${serviceVars.label}`, plistPath, newPlist: renderLaunchdPlist(serviceVars),
             expected: expectation.expected, pkgDir: dirname(dirname(execPath)), agendHome: DATA_DIR,
         }, planDeps());
         if (!outcome.ok) {
@@ -1954,8 +1987,16 @@ program
     if (opts.activate !== false) {
         const pidPath = join(DATA_DIR, "fleet.pid");
         try {
-            activateService(svcPath, pidPath);
-            console.log(t("install.running"));
+            if (isHub)
+                activateService(svcPath, pidPath, { preservePidFile: true });
+            else
+                activateService(svcPath, pidPath);
+            if (isHub) {
+                const { ht } = await import("./hub/init/text.js");
+                console.log(ht("service_ok"));
+            }
+            else
+                console.log(t("install.running"));
         }
         catch (err) {
             console.error(t("install.start_failed", err.message));
@@ -2130,7 +2171,7 @@ program
         // A service file means the service manager owns this fleet. Falling back
         // to a detached process here creates a second fleet when the bus recovers.
         console.error("Failed to start the installed AgEnD service; refusing to start a detached duplicate.");
-        console.error(t("cli.service_retry", process.platform === "darwin" ? "launchctl print gui/$(id -u)/com.agend.fleet" : systemServicePath ? "systemctl status agend" : "systemctl --user status com.agend.fleet"));
+        console.error(t("cli.service_retry", process.platform === "darwin" ? `launchctl print ${launchdServiceDomain()}/com.agend.fleet` : systemServicePath ? "systemctl status agend" : "systemctl --user status com.agend.fleet"));
         // #2356: a service file that cannot run here (never activated, no session for it) would otherwise leave no start.
         console.error(t("cli.service_direct_hint"));
         process.exitCode = 1;
@@ -2472,7 +2513,8 @@ program
     if (plat === "macos") {
         const uid = process.getuid?.() ?? 501;
         const label = "com.agend.fleet";
-        const target = `gui/${uid}/${label}`;
+        const domain = launchdServiceDomain(label, { uid });
+        const target = `${domain}/${label}`;
         const deps = planDeps();
         const printed = deps.run("launchctl", ["print", target]);
         if (printed.status === 0) {
@@ -2494,7 +2536,7 @@ program
                 if (await handOffLaunchdActivation("restart"))
                     return;
                 const { activateService } = await import("./service-activation.js");
-                const outcome = activateService({ kind: "launchd", label, plistPath: plan.plistPath, domain: `gui/${uid}` }, { bin: expectation.expected.entry, entry: expectation.expected.entry, node: expectation.expected.node, dir: pkgDir }, {
+                const outcome = activateService({ kind: "launchd", label, plistPath: plan.plistPath, domain }, { bin: expectation.expected.entry, entry: expectation.expected.entry, node: expectation.expected.node, dir: pkgDir }, {
                     ...deps,
                     readFirstLine: path => deps.readFile(path)?.split("\n", 1)[0] ?? null,
                     isExecutable: path => { try {
@@ -2523,7 +2565,12 @@ program
             if (expectation.ok && refuses(guard.guardLaunchd(captureRun, target, plistPath, deps.readFile, expectation.expected, guardDeps)))
                 return;
             if (run(`launchctl kickstart -k ${target}`)) {
-                console.log("Service restarted.");
+                if (loadRawFleetConfig(FLEET_CONFIG_PATH).hub?.enabled === true) {
+                    const { ht } = await import("./hub/init/text.js");
+                    console.log(ht("service_restart_requested"));
+                }
+                else
+                    console.log("Service restarted.");
                 return;
             }
             console.error(`  ✗ launchctl kickstart -k ${target} failed.`);
@@ -2773,6 +2820,19 @@ program
     const { runQuickstart } = await import("./quickstart.js");
     await runQuickstart();
 });
+// #3095 Hub (experimental, off by default): `agend hub init` sets up a team Hub on this machine. Nothing Hub-related
+// loads unless this command runs.
+const hub = program.command("hub").description("AgEnD Hub (experimental): a team Hub where colleagues sign in with the directory");
+hub.command("handoff")
+    .description("Show this Hub's installation record, pairing steps and stop/uninstall guidance")
+    .action(async () => { const { runHubHandoffCommand } = await import("./hub/init/handoff.js"); await runHubHandoffCommand(); });
+hub
+    .command("init")
+    .description("Set up this machine as a team Hub: addresses, browser certificate, directory (LDAPS), administrator, service")
+    .action(async () => {
+    const { runHubInitCommand } = await import("./hub/init/cli.js");
+    await runHubInitCommand();
+});
 program
     .command("init")
     .description("Interactive advanced wizard (setup-wizard); for first-run use `agend quickstart` or `agend setup`")
@@ -3355,7 +3415,10 @@ async function listInstanceNames(config) {
 }
 async function lsAction(opts) {
     const yaml = (await import("js-yaml")).default;
-    const config = yaml.load(readFileSync(FLEET_CONFIG_PATH, "utf-8"));
+    const config = (yaml.load(readFileSync(FLEET_CONFIG_PATH, "utf-8")) ?? {});
+    // A fleet.yaml without an `instances:` section is an empty fleet (as `agend doctor` and the fleet read it), not a crash.
+    if (!config.instances || typeof config.instances !== "object")
+        config.instances = {};
     const names = Object.keys(config.instances);
     // --names-only feeds shell completion, so it must return before any tmux or
     // status work (a tab press should not wait on the fleet) and must print
@@ -3413,6 +3476,8 @@ async function lsAction(opts) {
     }
     if (allNames.length === 0) {
         console.log("No instances configured.");
+        // The same hint `agend doctor` gives for this file.
+        console.log("Hint: no general_topic instance — there is no general dispatcher to receive un-topic'd messages. Run `agend doctor`.");
         await printResources();
         return;
     }
@@ -3441,7 +3506,17 @@ async function lsAction(opts) {
     const singleSource = channelTypes.size === 1
         ? (channelTypes.has("telegram") ? "TG" : channelTypes.has("discord") ? "DC" : "—")
         : null;
+    // A fleet instance's source is the adapter the fleet routes it by: its channel_id, else the first connection
+    // (FleetManager.getInstanceAdapterId) — never guessed from its topic id, so `ls` and routing cannot disagree.
+    const channelList = config.channels?.length ? config.channels : config.channel ? [config.channel] : [];
+    const typeByAdapter = new Map(channelList.map((ch) => [ch.id ?? ch.type, ch.type]));
+    const firstAdapter = channelList[0] ? (channelList[0].id ?? channelList[0].type) : undefined;
+    const sourceOfType = (type) => (type === "telegram" ? "TG" : type === "discord" ? "DC" : "—");
+    const { isNativeExecInstance } = await import("./native-instance-registry.js");
     const getSource = (name, inst) => {
+        // A Windows exec agent has no chat binding (getInstanceAdapterId gives none): no source, in any fleet. A pane keeps its own.
+        if (inst && isNativeExecInstance(inst))
+            return "—";
         if (singleSource)
             return singleSource;
         if (classicNames.has(name)) {
@@ -3449,18 +3524,14 @@ async function lsAction(opts) {
             const matchedChId = classicChannelIdByName.get(name) ?? "";
             return matchedChId.startsWith("-") || matchedChId.length < 17 ? "TG" : "DC";
         }
-        const topicId = String(inst?.topic_id ?? "");
-        if (topicId.length >= 17)
-            return "DC";
-        if (topicId.length > 0 && topicId.length < 17)
-            return "TG";
-        return "—";
+        const bound = typeof inst?.channel_id === "string" && inst.channel_id ? inst.channel_id : firstAdapter;
+        return sourceOfType(bound === undefined ? undefined : typeByAdapter.get(bound));
     };
     // Row collection runs concurrently (see ls-rows.ts): the per-instance
     // tmux captures overlap instead of stacking their 2s bounds serially.
     const { collectLsRows, capturePaneAsync, formatTimeSince, lsStatusIcon, lsStatusLabel, displayWidth, computeLsNameWidth, padToDisplayWidth } = await import("./ls-rows.js");
-    const { getTmuxSocketName } = await import("./paths.js");
-    const socketName = getTmuxSocketName();
+    const { tmuxSocket } = await import("./tmux-binary.js");
+    const socketName = tmuxSocket();
     const rows = await collectLsRows(allNames.map(name => {
         const isClassic = classicNames.has(name);
         const inst = config.instances[name];
@@ -3858,6 +3929,32 @@ program
     console.log(`\n${classIcon} Fleet: ${classification}`);
     process.exit(exitCode);
 });
+program
+    .command("tmux")
+    .description("Run a tmux command on this fleet's own tmux server — its tmux binary and socket — e.g. `agend tmux ls`, `agend tmux capture-pane -p -t <window>`.")
+    .argument("[args...]", "tmux's own command and arguments")
+    .allowUnknownOption(true)
+    .helpOption(false)
+    .action(async (rest = []) => {
+    // Everything after the command goes to tmux as typed (its own options and a `--` included: commander keeps them in
+    // order, with allowUnknownOption), with this fleet's -L socket (and, with AgEnD's bundled tmux, its binary and -f
+    // config) in front: M-2457 §5.
+    let bin;
+    try {
+        bin = tmuxBin();
+    }
+    catch (e) {
+        console.error(e.message);
+        process.exit(1);
+    }
+    const { spawnSync } = await import("node:child_process");
+    const r = spawnSync(bin, tmuxArgs(rest), { stdio: "inherit", ...tmuxEnvOpt() });
+    if (r.error) {
+        console.error(`tmux could not run: ${r.error.message}`);
+        process.exit(1);
+    }
+    process.exit(r.status ?? 1);
+});
 program
     .command("attach")
     .description("Attach to an instance's tmux window. Accepts display name, instance name, row number from ls, or a substring. No argument: interactive picker.")
@@ -3880,10 +3977,11 @@ program
         }
     }
     catch { /* ignore */ }
-    const session = "agend";
+    // The fleet's session (AGEND_TMUX_SESSION, else per AGEND_HOME), not a hardcoded "agend" (M-2457 §5).
+    const session = getTmuxSession();
     // Verify tmux session exists
     try {
-        execFileSync("tmux", tmuxArgs(["has-session", "-t", session]), { stdio: "pipe" });
+        execFileSync(tmuxBin(), tmuxArgs(["has-session", "-t", session]), { stdio: "pipe" });
     }
     catch {
         console.error(`tmux session "${session}" not found. Is the fleet running?`);
@@ -3896,7 +3994,7 @@ program
     let selected = false;
     for (const t of targets) {
         try {
-            execFileSync("tmux", tmuxArgs(["select-window", "-t", t]), { stdio: "pipe" });
+            execFileSync(tmuxBin(), tmuxArgs(["select-window", "-t", t]), { stdio: "pipe" });
             selected = true;
             break;
         }
@@ -3905,13 +4003,13 @@ program
     // Fallback: search tmux windows for a partial name match (handles CJK truncation)
     if (!selected) {
         try {
-            const winList = execFileSync("tmux", tmuxArgs(["list-windows", "-t", session, "-F", "#{window_id} #{window_name}"]), { stdio: "pipe" }).toString().trim();
+            const winList = execFileSync(tmuxBin(), tmuxArgs(["list-windows", "-t", session, "-F", "#{window_id} #{window_name}"]), { stdio: "pipe" }).toString().trim();
             for (const line of winList.split("\n")) {
                 const [wid, ...rest] = line.split(" ");
                 const wname = rest.join(" ").replace(/-?\*?$/, ""); // strip trailing -/* markers
                 if (wname === name || name.startsWith(wname) || wname.startsWith(name)) {
                     try {
-                        execFileSync("tmux", tmuxArgs(["select-window", "-t", `${session}:${wid}`]), { stdio: "pipe" });
+                        execFileSync(tmuxBin(), tmuxArgs(["select-window", "-t", `${session}:${wid}`]), { stdio: "pipe" });
                         selected = true;
                         break;
                     }
@@ -3925,11 +4023,14 @@ program
         console.error(`Cannot find tmux window for "${name}". The instance may need to be restarted.`);
         process.exit(1);
     }
-    // Attach or switch-client depending on whether we're already in tmux
-    if (process.env.TMUX) {
+    // Attach or switch-client depending on whether we're already in tmux — in THIS fleet's tmux: with the bundled tmux,
+    // $TMUX naming another server (the user's own, on its own socket) is not "inside"; that is an ordinary attach.
+    const { bundledTmuxEnabled, insideFleetTmux, tmuxSocket } = await import("./tmux-binary.js");
+    const insideOurs = insideFleetTmux(process.env.TMUX, bundledTmuxEnabled(), tmuxSocket());
+    if (insideOurs) {
         // Already inside tmux — switch client
         try {
-            execFileSync("tmux", tmuxArgs(["switch-client", "-t", session]), { stdio: "inherit" });
+            execFileSync(tmuxBin(), tmuxArgs(["switch-client", "-t", session]), { stdio: "inherit", ...tmuxEnvOpt() });
         }
         catch {
             console.error("Failed to switch tmux client.");
@@ -3939,7 +4040,7 @@ program
     else {
         // Outside tmux — attach
         try {
-            execFileSync("tmux", tmuxArgs(["attach-session", "-t", session]), { stdio: "inherit" });
+            execFileSync(tmuxBin(), tmuxArgs(["attach-session", "-t", session]), { stdio: "inherit", ...tmuxEnvOpt() });
         }
         catch {
             console.error("Failed to attach to tmux session.");