@tarfa/cli 0.1.3 → 0.1.4

package/dist/{chunk-X6FKPFHV.js → chunk-OC5VX7K3.js}

@@ -3546,9 +3546,9 @@ function constantTimeEqual(a, b) {
 var REFUSAL = {
   notEnrolled: "device not enrolled",
   revoked: "device revoked",
-  // A device whose key is enrolled sent the token anyway: it should forget it.
+  // Sent only by agents from before token enrolment was removed: a device whose key is enrolled
+  // sent the token anyway, and token enrolment off (only a pairing code enrols a new phone).
   tokenNotNeeded: "token not needed",
-  // Token enrolment is off: only a pairing code enrols a new phone.
   enrolmentOff: "enrolment off",
   // No new phone can enrol, pairing code or not.
   enrolmentClosed: "enrolment closed",
@@ -3782,12 +3782,6 @@ function planSetup(flags, state) {
   }
   const addresses = [...derived ? [derived] : [], ...flags.addresses];
   if (addresses.length > MAX_ADDRESSES) return { error: `a machine takes at most ${MAX_ADDRESSES} addresses (got ${addresses.length})` };
-  const published = addresses.length > 0 || Boolean(withLegacyEnv(parseEnvFile(state.envText ?? "")).TARFA_PHONE_ADDRESSES);
-  if (published && state.roster === "on" && flags.tokenEnrolment === void 0) {
-    return {
-      error: "token enrolment is on in ~/.tarfa/devices.json, and this run gives phones an address: pass --token-enrolment off to switch it off (pairing codes only), or --token-enrolment on to keep it on deliberately"
-    };
-  }
   if (state.legacyService) steps.push({ kind: "stop-legacy-service" });
   if (state.stateDir === "legacy") steps.push({ kind: "move-state" });
   const adoption = state.adoption;
@@ -3796,12 +3790,7 @@ function planSetup(flags, state) {
   const env = planEnv(flags, state, addresses);
   if (env) steps.push(env);
   if (!state.hasKey) steps.push({ kind: "create-key" });
-  if (state.roster === "absent") steps.push({ kind: "write-roster", mode: flags.tokenEnrolment ?? "off" });
-  else if (flags.tokenEnrolment && state.roster !== flags.tokenEnrolment) steps.push({ kind: "write-roster", mode: flags.tokenEnrolment });
-  const mode = state.roster === "absent" ? flags.tokenEnrolment ?? "off" : flags.tokenEnrolment ?? state.roster;
-  if (mode === "on" && checks.some((line) => line.includes("internet") || line.includes("Funnel allowed"))) {
-    checks.push("warning: token enrolment is on, so whoever holds TARFA_TOKEN can enrol a phone on a public port: run `tarfa devices enrolment off` (or pass --token-enrolment off)");
-  }
+  if (state.roster === "absent") steps.push({ kind: "write-roster" });
   const { kind: unitKind, installed } = state.service;
   const adopted = unitRunsLauncher(unitKind, installed, state.launcher.path);
   const serviceTarget = state.install === "package" || adopted ? { kind: "launcher", path: state.launcher.path } : { kind: "clone", repo: state.repo ?? "" };
@@ -3836,7 +3825,6 @@ function planEnv(flags, state, addresses) {
   const before = legacy.text;
   const values = parseEnvFile(before);
   const wanted = [];
-  if (!values.TARFA_TOKEN) wanted.push(["TARFA_TOKEN", state.newToken, "(generated)"]);
   wanted.push(["TARFA_MACHINE_ID", flags.machineId], ["TARFA_PROJECT_ROOTS", flags.projectRoots.join(":")]);
   if (flags.defaultPath) wanted.push(["TARFA_DEFAULT_PATH", flags.defaultPath]);
   wanted.push(["TARFA_PHONE_PORT", String(flags.phonePort)]);
@@ -3926,7 +3914,7 @@ function describeStep(step, envPath) {
     case "create-key":
       return "create the agent key (~/.tarfa/agent-key.json)";
     case "write-roster":
-      return `write ~/.tarfa/devices.json with enrolment ${step.mode}${step.mode === "off" ? " (pairing codes only)" : ""}`;
+      return "write ~/.tarfa/devices.json (phones join with a `tarfa pair` code)";
     case "write-launcher":
       return `write the launcher the service runs (${step.path})`;
     case "install-unit":
@@ -3945,7 +3933,7 @@ function describeStep(step, envPath) {
       return `ask the node's Tailscale operator to run: ${step.line}`;
   }
 }
-var VALUE_FLAGS = /* @__PURE__ */ new Set(["--machine-id", "--project-roots", "--default-path", "--phone-port", "--slug", "--tailscale", "--tailscale-port", "--address", "--pwa", "--token-enrolment"]);
+var VALUE_FLAGS = /* @__PURE__ */ new Set(["--machine-id", "--project-roots", "--default-path", "--phone-port", "--slug", "--tailscale", "--tailscale-port", "--address", "--pwa"]);
 var BOOLEAN_FLAGS = /* @__PURE__ */ new Set(["--pair", "--dry-run", "--adopt"]);
 function portNumber(text) {
   if (!/^\d{1,5}$/.test(text)) return null;
@@ -3999,8 +3987,6 @@ function parseSetupFlags(argv) {
       return { error: `--pwa must be the http(s) origin phones open the app at (got ${single.get("--pwa")})` };
     }
   }
-  const tokenEnrolment = single.get("--token-enrolment");
-  if (tokenEnrolment !== void 0 && tokenEnrolment !== "on" && tokenEnrolment !== "off") return { error: "--token-enrolment takes on or off" };
   return {
     machineId,
     projectRoots,
@@ -4013,8 +3999,7 @@ function parseSetupFlags(argv) {
     ...pwa !== void 0 ? { pwa } : {},
     pair: set.has("--pair"),
     dryRun: set.has("--dry-run"),
-    adopt: set.has("--adopt"),
-    ...tokenEnrolment !== void 0 ? { tokenEnrolment } : {}
+    adopt: set.has("--adopt")
   };
 }
 
@@ -4211,7 +4196,6 @@ function loadConfig(rawEnv, home) {
   return {
     stateDir,
     machineId,
-    token: env.TARFA_TOKEN,
     port,
     phonePort,
     phoneAddresses: phoneAddresses(env),
@@ -4244,11 +4228,6 @@ function loadConfig(rawEnv, home) {
     ...env.TARFA_VOICE_DEVICE?.trim() ? { voiceDevice: env.TARFA_VOICE_DEVICE.trim() } : {}
   };
 }
-function assertServerConfig(config) {
-  if (!config.token) {
-    throw new Error("TARFA_TOKEN is required to run the agent server");
-  }
-}
 function configWarnings(rawEnv) {
   const env = withLegacyEnv(rawEnv);
   const warnings = legacyEnvNames(rawEnv).map(
@@ -4256,6 +4235,7 @@ function configWarnings(rawEnv) {
   );
   const relays = ["TARFA_RELAY_URLS", "TARFA_RELAY_URL"].filter((name) => env[name]?.trim());
   if (relays.length > 0) warnings.push(`relays are gone; remove ${relays.join(" and ")} from agent.env`);
+  if (env.TARFA_TOKEN?.trim()) warnings.push("TARFA_TOKEN is ignored: phones join only with a `tarfa pair` link; remove it from agent.env");
   if (phoneAddresses(env).length === 0) {
     warnings.push("no TARFA_PHONE_ADDRESSES: phones reach this agent only once its phone port is published (tailscale serve, a reverse proxy)");
   }
@@ -4989,17 +4969,12 @@ function parseKeys(text, path) {
 }
 
 // src/application/device-roster.ts
-var EMPTY_ROSTER = { enrolment: true, devices: [], revoked: [] };
+var EMPTY_ROSTER = { enrolment: true, tokenEnrolment: false, devices: [], revoked: [] };
 function enrolmentMode(roster) {
-  if (!roster.enrolment) return "closed";
-  return roster.tokenEnrolment === false ? "off" : "on";
+  return roster.enrolment ? "open" : "closed";
 }
 function withEnrolmentMode(roster, mode) {
-  return { ...roster, enrolment: mode !== "closed", tokenEnrolment: mode === "on" };
-}
-function mayEnrol(roster, via) {
-  const mode = enrolmentMode(roster);
-  return mode === "on" || mode === "off" && via === "pairing";
+  return { ...roster, enrolment: mode === "open", tokenEnrolment: false };
 }
 function standingOf(roster, x255192) {
   if (roster.revoked.some((d) => d.x25519 === x255192)) return "revoked";
@@ -5045,7 +5020,8 @@ function forgetDevice(roster, id2) {
 }
 
 // src/infrastructure/file-device-store.ts
-import { readFile as readFile5 } from "node:fs/promises";
+import { mkdir as mkdir5, readFile as readFile5 } from "node:fs/promises";
+import { dirname as dirname6 } from "node:path";
 import { z as z2 } from "zod";
 var key = z2.string().regex(/^[A-Za-z0-9_-]{43}$/);
 var device = z2.object({ id: z2.string(), x25519: key, ed25519: key, name: z2.string(), enrolledAt: z2.string() });
@@ -5074,9 +5050,31 @@ var FileDeviceStore = class {
     if (!parsed.success) throw new Error(`device roster ${this.filePath} is malformed; fix or move it aside`);
     return parsed.data;
   }
+  // Writes the roster once if the file lacks `tokenEnrolment: false`, missing file included, so an
+  // agent from before token enrolment was removed, brought back, finds it off. True if it wrote.
+  async sealTokenEnrolment() {
+    let raw = null;
+    try {
+      raw = await readFile5(this.filePath, "utf8");
+    } catch (err) {
+      if (err.code !== "ENOENT") throw err;
+    }
+    if (raw !== null) {
+      let parsed = null;
+      try {
+        parsed = JSON.parse(raw);
+      } catch {
+        return false;
+      }
+      if (parsed?.tokenEnrolment === false) return false;
+    }
+    await mkdir5(dirname6(this.filePath), { recursive: true, mode: 448 });
+    await this.update((roster) => roster);
+    return true;
+  }
   async update(change) {
     return withFileLock(this.filePath, this.staleLockMs, async () => {
-      const next = change(await this.read());
+      const next = { ...change(await this.read()), tokenEnrolment: false };
       await writeFileAtomic(this.filePath, `${JSON.stringify(next, null, 2)}
 `);
       return next;
@@ -5140,8 +5138,8 @@ var FilePairingStore = class {
 // src/infrastructure/agent-env-file.ts
 import { execFile as execFile3 } from "node:child_process";
 import { existsSync as existsSync3 } from "node:fs";
-import { chmod, copyFile, mkdir as mkdir5, readFile as readFile7, writeFile as writeFile4 } from "node:fs/promises";
-import { dirname as dirname6, resolve as resolve5 } from "node:path";
+import { chmod, copyFile, mkdir as mkdir6, readFile as readFile7, writeFile as writeFile4 } from "node:fs/promises";
+import { dirname as dirname7, resolve as resolve5 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 import { promisify as promisify3 } from "node:util";
 
@@ -5161,10 +5159,10 @@ function withoutGitVars(env) {
 }
 async function mainCheckout(kind2 = installKind()) {
   if (kind2 === "package") return null;
-  const here = dirname6(fileURLToPath2(import.meta.url));
+  const here = dirname7(fileURLToPath2(import.meta.url));
   try {
     const { stdout } = await exec3("git", ["-C", here, "rev-parse", "--path-format=absolute", "--git-common-dir"], { env: withoutGitVars(process.env) });
-    return dirname6(stdout.trim());
+    return dirname7(stdout.trim());
   } catch {
     return resolve5(here, "..", "..", "..", "..");
   }
@@ -5194,7 +5192,7 @@ function agentEnvFile(path, now = () => /* @__PURE__ */ new Date()) {
         if (err.code !== "ENOENT") throw err;
         backup = null;
       }
-      await mkdir5(dirname6(path), { recursive: true, mode: 448 });
+      await mkdir6(dirname7(path), { recursive: true, mode: 448 });
       await writeFile4(path, text, { mode: 384 });
       await chmod(path, 384);
       return backup;
@@ -5204,7 +5202,7 @@ function agentEnvFile(path, now = () => /* @__PURE__ */ new Date()) {
 
 // src/infrastructure/file-status-store.ts
 import { readFileSync as readFileSync2, writeFileSync, mkdirSync } from "node:fs";
-import { dirname as dirname7 } from "node:path";
+import { dirname as dirname8 } from "node:path";
 
 // ../contracts/src/domain/workspace-status.ts
 var WORKSPACE_STATUSES = [
@@ -5390,6 +5388,7 @@ var machineStatsSchema = z6.object({
   }).optional()
 });
 var clientMessageSchema = z6.discriminatedUnion("type", [
+  // `token` carries a `tarfa pair` code for a new phone, or nothing (an enrolled key needs none).
   z6.object({ type: z6.literal("auth"), token: z6.string() }),
   z6.object({ type: z6.literal("list") }),
   z6.object({ type: z6.literal("getRecentPaths") }),
@@ -5442,8 +5441,9 @@ var detachReasonSchema = z6.enum(["opened-elsewhere", "closed", "error"]);
 var PROTOCOL_VERSION = 1;
 var AGENT_FEATURES = { lastReply: "lastReply" };
 var agentMessageSchema = z6.discriminatedUnion("type", [
-  // `credential` is what authenticated the session; `enrolled` says the device key is enrolled (written), so the
-  // phone forgets its token and pairing secret. Both optional: an older agent sends neither.
+  // `credential` is what authenticated the session (`token` only from an agent from before token
+  // enrolment was removed); `enrolled` says the device key is enrolled (written), so the phone
+  // forgets its pairing secret. Both optional: an older agent sends neither.
   // `pushed`: the agent served the phone at once (its hello asked) and has sent the opening replies
   // (workspaces, keyterms) behind it, so the phone does not ask for them.
   z6.object({
@@ -5495,7 +5495,7 @@ var agentMessageSchema = z6.discriminatedUnion("type", [
   z6.object({ type: z6.literal("voiceDone"), id: z6.string(), ok: z6.boolean(), error: z6.string().optional() }),
   z6.object({ type: z6.literal("detached"), workspaceId: z6.string(), reason: detachReasonSchema }),
   z6.object({ type: z6.literal("closed"), workspaceId: z6.string() }),
-  // A phone was just enrolled on this machine (a pairing code or the token), told to every other
+  // A phone was just enrolled on this machine (a pairing code), told to every other
   // phone connected to it: a device nobody meant to add must not go unnoticed. An older PWA drops
   // the unknown type.
   z6.object({ type: z6.literal("deviceEnrolled"), id: z6.string(), name: z6.string(), at: z6.string() }),
@@ -5696,7 +5696,7 @@ var FileStatusStore = class {
     }
   }
   persist() {
-    mkdirSync(dirname7(this.filePath), { recursive: true });
+    mkdirSync(dirname8(this.filePath), { recursive: true });
     writeFileSync(this.filePath, JSON.stringify(Object.fromEntries(this.statuses), null, 2), "utf8");
   }
 };
@@ -5725,8 +5725,8 @@ function parseEntry(value) {
 }
 
 // src/infrastructure/file-parked-store.ts
-import { readFile as readFile8, writeFile as writeFile5, mkdir as mkdir6 } from "node:fs/promises";
-import { dirname as dirname8 } from "node:path";
+import { readFile as readFile8, writeFile as writeFile5, mkdir as mkdir7 } from "node:fs/promises";
+import { dirname as dirname9 } from "node:path";
 var FileParkedStore = class {
   constructor(filePath) {
     this.filePath = filePath;
@@ -5760,7 +5760,7 @@ var FileParkedStore = class {
     await this.persist(rest);
   }
   async persist(entries) {
-    await mkdir6(dirname8(this.filePath), { recursive: true });
+    await mkdir7(dirname9(this.filePath), { recursive: true });
     await writeFile5(this.filePath, JSON.stringify(entries, null, 2), "utf8");
   }
 };
@@ -5795,10 +5795,10 @@ function parseEntry2(value) {
 }
 
 // src/infrastructure/fs-file-writer.ts
-import { mkdir as mkdir7, writeFile as writeFile6, access } from "node:fs/promises";
+import { mkdir as mkdir8, writeFile as writeFile6, access } from "node:fs/promises";
 var FsFileWriter = class {
   async ensureDir(dir) {
-    await mkdir7(dir, { recursive: true });
+    await mkdir8(dir, { recursive: true });
   }
   async exists(path) {
     try {
@@ -6090,7 +6090,6 @@ export {
   stateDirLayout,
   migrateStateDir,
   loadConfig,
-  assertServerConfig,
   configWarnings,
   systemClock,
   systemPathResolver,
@@ -6116,7 +6115,6 @@ export {
   loadOrCreateAgentKeys,
   enrolmentMode,
   withEnrolmentMode,
-  mayEnrol,
   standingOf,
   enrolDevice,
   revokeDevice,

package/dist/cli.js

@@ -63,7 +63,7 @@ import {
   unitRunsLauncher,
   withEnrolmentMode,
   withLegacyEnv
-} from "./chunk-X6FKPFHV.js";
+} from "./chunk-OC5VX7K3.js";
 
 // src/cli.ts
 import { randomBytes } from "node:crypto";
@@ -344,7 +344,7 @@ async function apply(step, effects) {
       await effects.createKey();
       return describeStep(step, "").replace(/^create/, "created");
     case "write-roster":
-      await effects.writeRoster(step.mode);
+      await effects.writeRoster();
       return describeStep(step, "").replace(/^write/, "wrote");
     case "stop-legacy-service":
       return `stopped the old agent service: ${(await effects.stopLegacyService()).join("; ")}`;
@@ -541,6 +541,10 @@ function findMise(home, pathVar, exists2 = existsSync) {
   const candidates = [join2(home, ".local", "bin", "mise"), "/opt/homebrew/bin/mise", "/usr/local/bin/mise", ...(pathVar ?? "").split(delimiter).filter(Boolean).map((dir) => join2(dir, "mise"))];
   return candidates.find(exists2) ?? null;
 }
+function findInstalledCli(install, exists2 = existsSync) {
+  if (!install) return null;
+  return [join2(install, "bin", "tarfa"), join2(install, "node_modules", "@tarfa", "cli", "dist", "cli.js")].find(exists2) ?? null;
+}
 function miseCli(home) {
   const run4 = async (mise, args, timeout) => {
     try {
@@ -555,9 +559,9 @@ function miseCli(home) {
     async locate(mise, version) {
       const install = await run4(mise, ["where", `npm:@tarfa/cli@${version}`], 6e4);
       const nodeHome = await run4(mise, ["where", "node"], 6e4);
-      const cli = join2(install, "bin", "tarfa");
+      const cli = findInstalledCli(install);
       const node = join2(nodeHome, "bin", "node");
-      if (!install || !existsSync(cli)) throw new Error(`mise knows no install of @tarfa/cli ${version} with a bin/tarfa`);
+      if (!cli) throw new Error(`mise knows no install of @tarfa/cli ${version} with a bin/tarfa or node_modules/@tarfa/cli/dist/cli.js`);
       if (!nodeHome || !existsSync(node)) throw new Error("mise knows no node");
       return { node, cli };
     },
@@ -909,7 +913,7 @@ var systemDeps = {
   exec: async (command, args) => (await run2(command, args, { env: childEnv() })).stdout,
   readFile: (path) => readFile5(path, "utf8")
 };
-var AGENT_COMMAND = /\bsrc\/serve\.ts\b|(^|[\s/])tarfa serve(\s|$)/;
+var AGENT_COMMAND = /\bsrc\/serve\.ts\b|(^|[\s/])tarfa serve(\s|$)|\/@tarfa\/cli\/dist\/cli\.js serve(\s|$)/;
 function isFree(port) {
   return new Promise((resolve2, reject) => {
     const server = createServer();
@@ -1283,7 +1287,7 @@ var HELP = `usage: tarfa <command> [options]   (\`tarfa setup --help\`, \`tarfa
 Set up this machine:
   setup          write agent.env, the agent key, the service and the hooks, then check the phone port
   pair           print a one-time pairing link and QR code for a phone
-  devices        list, revoke or forget paired phones; switch enrolment on, off or closed
+  devices        list, revoke or forget paired phones; open or close enrolment
   update         install the newest @tarfa/cli and apply it (package installs)
   apply          rewrite the launcher and service if they changed, reinstall the hooks, restart
   install-hooks  install the Claude Code and Codex hooks that report each workspace's status
@@ -1684,7 +1688,7 @@ agent key, a new device roster that admits pairing codes only (an existing one i
 user unit with linger, or launchd), the Claude Code hooks, and optionally a Tailscale address for
 phones. Rerunning it with the same flags, or with none, changes nothing: --machine-id, --project-roots,
 --phone-port and --default-path default to what the agent.env it finds holds. It refuses rather than
-replace anything it did not make (an agent key, a token, another tailscale serve entry).
+replace anything it did not make (an agent key, another tailscale serve entry).
 
   --machine-id <id>             the name phones show for this machine
   --project-roots <dir,dir>     absolute folders new workspaces may be made in
@@ -1700,7 +1704,6 @@ replace anything it did not make (an agent key, a token, another tailscale serve
                                 4 in all), e.g. a reverse proxy
   --pwa <origin>                where phones open the app (default https://tarfa.app; an existing
                                 TARFA_PWA_ORIGIN is kept unless this is given)
-  --token-enrolment on|off      let TARFA_TOKEN enrol phones (off by default on a new roster)
   --pair                        print a pairing link and QR code at the end
   --adopt                       a machine whose service runs a clone's deploy/run-agent.sh: move it to
                                 the installed package (copies deploy/agent.env to ~/.tarfa/agent.env,
@@ -1722,8 +1725,7 @@ Several agents on one node (one per Linux user) share a Tailscale port, each und
 The node has one operator: a second user runs \`--tailscale none --slug <name> --address <url>\`
 with their own --phone-port, and setup prints the \`tailscale serve\` line for the operator to run:
 on the port of that --address (or --tailscale-port), as \`tailscale funnel\` when the port is already
-on Funnel. Setup refuses to give phones an address while token enrolment is on, until
---token-enrolment says which way. Run as another user (sudo -u), set XDG_RUNTIME_DIR=/run/user/<uid>.
+on Funnel. Run as another user (sudo -u), set XDG_RUNTIME_DIR=/run/user/<uid>.
 
 Related: \`tarfa apply\` brings the service and hooks in line with the installed package and checks
 the agent came back; \`tarfa update\` installs a newer release with mise, then runs its apply.
@@ -1803,7 +1805,6 @@ ${SETUP_USAGE.split("\n")[0]}
     service: { kind: service.kind, template: await service.template(), installed: installedUnit, enabled: await service.enabled() },
     envPath,
     envText,
-    newToken: randomBytes(32).toString("hex"),
     hasKey: await readFile6(config.agentKeyPath).then(() => true, () => false),
     roster: hasRoster ? enrolmentMode(await devices2.read()) : "absent",
     hooksCurrent: await hooks.current(),
@@ -1828,9 +1829,9 @@ ${SETUP_USAGE.split("\n")[0]}
       createKey: async () => {
         await loadOrCreateAgentKeys(config.agentKeyPath);
       },
-      writeRoster: async (mode) => {
+      writeRoster: async () => {
         await mkdir4(dirname4(config.devicesPath), { recursive: true, mode: 448 });
-        await devices2.update((roster) => withEnrolmentMode(roster, mode));
+        await devices2.update((roster) => roster);
       },
       writeLauncher: (path, text) => atomicWrite(path, text, 493),
       copyEnv: (from, to) => copyEnvOnce(from, to),
@@ -1977,14 +1978,12 @@ function pairingInstructions(link, minutes = PAIRING_TTL_MS / 6e4) {
   ].join("\n");
 }
 var DEVICES_USAGE = [
-  "usage: tarfa devices [list | revoke <id|key> | forget <id|key> | enrolment on|off|closed]",
-  "  enrolment on      the token or a pairing code enrols a new phone",
-  "  enrolment off     only a pairing code from `tarfa pair` enrols one",
+  "usage: tarfa devices [list | revoke <id|key> | forget <id|key> | enrolment open|closed]",
+  "  enrolment open    a pairing code from `tarfa pair` enrols a new phone",
   "  enrolment closed  no new phone can enrol"
 ].join("\n");
 var ENROLMENT_MODES = {
-  on: "on (the token or a pairing code enrols a phone)",
-  off: "off (only a pairing code from `tarfa pair` enrols a phone)",
+  open: "open (a pairing code from `tarfa pair` enrols a phone)",
   closed: "closed (no new phone can enrol)"
 };
 async function devices(store, [action = "list", arg]) {
@@ -1995,23 +1994,19 @@ async function devices(store, [action = "list", arg]) {
     case "forget": {
       if (!arg) throw new Error(DEVICES_USAGE);
       const found = { device: null };
-      const written = await store.update((roster) => {
+      await store.update((roster) => {
         const result = action === "revoke" ? revokeDevice(roster, arg, /* @__PURE__ */ new Date()) : forgetDevice(roster, arg);
         found.device = result.device;
         return result.roster;
       });
       const { device } = found;
       if (!device) throw new Error(`no single device matches ${arg}; see tarfa devices, and name it by its full key if its id is shared`);
-      if (action === "forget") return `forgot ${device.id} (${sanitizeDeviceName(device.name)}); it can enrol again (a \`tarfa pair\` code, or the token while enrolment is on)`;
-      const lines = [`revoked ${device.id} (${sanitizeDeviceName(device.name)}); this key stays refused until forgotten`];
-      if (enrolmentMode(written) === "on") {
-        lines.push("enrolment is on: whoever holds the token can still enrol a new key.");
-        lines.push("Run `tarfa devices enrolment off`, or rotate the token, to stop that.");
-      }
-      return lines.join("\n");
+      if (action === "forget") return `forgot ${device.id} (${sanitizeDeviceName(device.name)}); it can enrol again with a \`tarfa pair\` code`;
+      return `revoked ${device.id} (${sanitizeDeviceName(device.name)}); this key stays refused until forgotten`;
     }
     case "enrolment": {
-      if (arg !== "on" && arg !== "off" && arg !== "closed") throw new Error(DEVICES_USAGE);
+      if (arg === "on" || arg === "off") throw new Error(`token enrolment is gone: phones join only with a \`tarfa pair\` code. Use \`enrolment open\` or \`enrolment closed\``);
+      if (arg !== "open" && arg !== "closed") throw new Error(DEVICES_USAGE);
       await store.update((roster) => withEnrolmentMode(roster, arg));
       return `enrolment: ${ENROLMENT_MODES[arg]}`;
     }

package/dist/serve.js

@@ -25,7 +25,6 @@ import {
   ShortWorkspaceIds,
   TmuxAdapter,
   WrongStaticKeyError,
-  assertServerConfig,
   audioMediaType,
   b64url,
   browseDir,
@@ -55,7 +54,6 @@ import {
   loadOrCreateAgentKeys,
   locateAgentEnv,
   loginShellResolver,
-  mayEnrol,
   migrateStateDir,
   packageVersion,
   parseBrowserAgentMessage,
@@ -75,7 +73,7 @@ import {
   systemPathResolver,
   withLegacyEnv,
   writeFileAtomic
-} from "./chunk-X6FKPFHV.js";
+} from "./chunk-OC5VX7K3.js";
 
 // src/serve.ts
 import { homedir as homedir2 } from "node:os";
@@ -1324,7 +1322,7 @@ var NoiseClientConnection = class {
     return this.keyAuth !== null && this.state.kind !== "failed" ? this.keyAuth : void 0;
   }
   // An accepted `auth` is answered with whether the device key is now enrolled: the phone drops
-  // its token or pairing secret on `enrolled`, so for a new device the answer waits for the
+  // its pairing secret on `enrolled`, so for a new device the answer waits for the
   // roster to be written.
   send(message) {
     if (!this.session || this.state.kind === "failed") return;
@@ -1451,7 +1449,7 @@ var NoiseClientConnection = class {
       return;
     }
     this.keyAuth = standing === "enrolled" ? "device" : null;
-    this.state = standing === "enrolled" ? { kind: "open" } : { kind: "enrolling", hello, tokenEnrols: enrolment === "on" };
+    this.state = standing === "enrolled" ? { kind: "open" } : { kind: "enrolling", hello };
     if (standing === "enrolled" && hello.push && this.keyAuthenticatedListeners.length > 0 && this.options.pushBudget?.take(key)) {
       this.awaitingPhone = true;
       this.keyAuthenticatedListeners.forEach((l) => l());
@@ -1509,16 +1507,16 @@ var NoiseClientConnection = class {
   route(raw) {
     if (this.state.kind === "failed") return;
     const message = raw;
-    if (this.state.kind === "enrolling" && (message?.type !== "auth" || message.token === "")) {
+    const pairing = message?.type === "auth" && typeof message.token === "string" && PAIRING_SECRET.test(message.token);
+    if (this.state.kind === "enrolling" && !pairing) {
+      this.logRefusal("no-code", `phone: device ${deviceFingerprint(this.deviceKey)} not enrolled and sent no pairing code`);
       this.fail(REFUSAL.notEnrolled, DEVICE_REFUSED);
       return;
     }
-    const pairing = message?.type === "auth" && typeof message.token === "string" && PAIRING_SECRET.test(message.token);
     if (pairing && (this.state.kind === "enrolling" || this.keyAuth !== null)) {
       this.spendPairing(message.token, raw);
       return;
     }
-    if (this.refusesToken()) return;
     this.listeners.forEach((l) => l(raw));
   }
   spendPairing(secret, auth) {
@@ -1531,12 +1529,12 @@ var NoiseClientConnection = class {
       const held = this.held ?? [];
       this.held = null;
       if (this.state.kind === "failed") return;
-      if (!redemption.redeemed && redemption.reason) {
-        this.logRefusal(redemption.reason, `phone: device ${fingerprint} refused: ${redemption.reason}`);
-        this.fail(redemption.reason, DEVICE_REFUSED);
+      if (!redemption.redeemed && (redemption.reason || this.keyAuth === null)) {
+        const reason = redemption.reason ?? REFUSAL.notEnrolled;
+        this.logRefusal(reason, `phone: device ${fingerprint} refused: ${reason}`);
+        this.fail(reason, DEVICE_REFUSED);
         return;
       }
-      if (!redemption.redeemed && this.refusesToken()) return;
       this.listeners.forEach((l) => l(auth));
       held.forEach((raw) => this.drain(raw));
     };
@@ -1550,24 +1548,15 @@ var NoiseClientConnection = class {
       );
     }
   }
-  // An unknown device whose `auth` is about to be checked as a token, while only a pairing code
-  // may enrol it: refused here, so the token never gets as far as the handler.
-  refusesToken() {
-    if (this.state.kind !== "enrolling" || this.state.tokenEnrols || this.keyAuth !== null) return false;
-    this.logRefusal("token-off", `phone: device ${deviceFingerprint(this.deviceKey)} refused: token enrolment is off`);
-    this.fail(REFUSAL.enrolmentOff, DEVICE_REFUSED);
-    return true;
-  }
   // `declined`: the roster would not take the device (enrolment turned off or closed since the
   // handshake, or its id taken), so the credential that authenticated this session no longer
   // admits it. `failed`: the write itself failed; the session goes on unenrolled, and the phone
   // keeps its credential to try again.
   async enrol(hello) {
     const key = this.deviceKey;
-    const via = this.keyAuth === "pairing" ? "pairing" : "token";
     this.state = { kind: "open" };
     try {
-      const enrolled = await this.options.devices.enrol({ x25519: key, ed25519: hello.sig, name: hello.name }, via);
+      const enrolled = await this.options.devices.enrol({ x25519: key, ed25519: hello.sig, name: hello.name });
       this.options.log?.(
         enrolled ? `phone: enrolled device ${deviceFingerprint(key)} "${hello.name}"` : `phone: device ${deviceFingerprint(key)} not enrolled (enrolment changed meanwhile, or its id is taken); closing its session`
       );
@@ -1581,7 +1570,6 @@ var NoiseClientConnection = class {
     try {
       const { enrolment } = await this.options.devices.check(this.deviceKey);
       if (enrolment === "closed") return REFUSAL.enrolmentClosed;
-      if (enrolment === "off" && this.keyAuth !== "pairing") return REFUSAL.enrolmentOff;
     } catch {
     }
     return REFUSAL.enrolmentRefused;
@@ -2305,17 +2293,11 @@ var ConnectionHandler = class {
       return;
     }
     if (message.type === "auth") {
-      const token = this.deps.config.token;
-      const isToken = token !== void 0 && constantTimeEqual(message.token, token);
-      const byKey = this.conn.keyCredential;
-      if (byKey === "device" && isToken && this.conn.refuse) {
-        this.conn.refuse(REFUSAL.tokenNotNeeded);
-        return;
-      }
       if (this.authed) return;
-      if (byKey || isToken) {
+      const byKey = this.conn.keyCredential;
+      if (byKey) {
         this.authed = true;
-        this.conn.send({ type: "authResult", ok: true, credential: byKey ?? "token" });
+        this.conn.send({ type: "authResult", ok: true, credential: byKey });
       } else {
         this.conn.send({ type: "authResult", ok: false });
         this.conn.close();
@@ -3792,23 +3774,23 @@ var RosterDevices = class {
     const roster = await this.deps.store.read();
     return { standing: standingOf(roster, x25519), enrolment: enrolmentMode(roster) };
   }
-  async enrol(device, via) {
+  async enrol(device) {
     let known = true;
     const roster = await this.deps.store.update((current) => {
       known = standingOf(current, device.x25519) !== "unknown";
-      return mayEnrol(current, via) ? enrolDevice(current, device, this.deps.now()) : current;
+      return current.enrolment ? enrolDevice(current, device, this.deps.now()) : current;
     });
     this.deps.onChange();
     const entry = known ? void 0 : roster.devices.find((d) => d.x25519 === device.x25519);
     try {
-      if (entry) this.deps.onEnrolled?.({ id: entry.id, name: entry.name, at: entry.enrolledAt, x25519: entry.x25519 }, via);
+      if (entry) this.deps.onEnrolled?.({ id: entry.id, name: entry.name, at: entry.enrolledAt, x25519: entry.x25519 });
     } catch {
     }
     return standingOf(roster, device.x25519) === "enrolled";
   }
   // Spends a pairing secret for the device (X25519 key) about to be enrolled, binding it to that
   // device. Atomic across processes, so two phones racing with one code cannot both get in. A
-  // secret this agent never issued (or has forgotten) gives no reason: it may be a token after all.
+  // secret this agent never issued (or has forgotten) gives no reason.
   async redeemPairing(secret, device) {
     if (!(await this.deps.store.read()).enrolment) return { redeemed: false, reason: REFUSAL.enrolmentClosed };
     const outcome = await this.spend(secret, device);
@@ -3870,8 +3852,8 @@ function startDeviceGate(deps) {
     pairings: deps.pairings,
     now: () => /* @__PURE__ */ new Date(),
     onChange: wrote,
-    onEnrolled: (device, via) => {
-      log(`device enrolled: ${device.id} "${device.name}" (${via === "pairing" ? "pairing code" : "token"})`);
+    onEnrolled: (device) => {
+      log(`device enrolled: ${device.id} "${device.name}" (pairing code)`);
       server.broadcastDeviceEnrolled(device);
     }
   });
@@ -4041,7 +4023,7 @@ function limitedDevices(devices, limiter, roster) {
       if (known && standingOf(known, x25519) === "enrolled") return { standing: "enrolled", enrolment: enrolmentMode(known) };
       return limited(limiter, () => devices.check(x25519));
     },
-    enrol: (device, via) => devices.enrol(device, via),
+    enrol: (device) => devices.enrol(device),
     redeemPairing: (secret, device) => limited(limiter, () => devices.redeemPairing(secret, device)),
     burnPairing: (secret, device) => devices.burnPairing(secret, device)
   };
@@ -4202,7 +4184,6 @@ async function main() {
   }
   const env = withLegacyEnv(process.env);
   const config = loadConfig(env, homedir2());
-  assertServerConfig(config);
   for (const warning of configWarnings(process.env)) process.stderr.write(`${warning}
 `);
   await securePrivateDir(config.stateDir);
@@ -4211,7 +4192,7 @@ async function main() {
     config.devicesPath,
     config.pairingPath,
     join7(config.stateDir, "token"),
-    // It holds TARFA_TOKEN, which enrols a phone.
+    // The launcher sources it: whoever can write it runs code as this user.
     await locateAgentEnv(env, homedir2())
   ]);
   const hookToken = await writeHookToken(config.stateDir);
@@ -4283,10 +4264,12 @@ async function main() {
   const keys = await loadOrCreateAgentKeys(config.agentKeyPath);
   const log = (message) => process.stdout.write(`${message}
 `);
+  const devices = new FileDeviceStore(config.devicesPath);
+  if (await devices.sealTokenEnrolment()) log("tarfa agent: wrote token enrolment off into devices.json (phones join with `tarfa pair` only)");
   const gate = startDeviceGate({
     keys,
     server,
-    store: new FileDeviceStore(config.devicesPath),
+    store: devices,
     pairings: new FilePairingStore(config.pairingPath),
     log,
     rosterPollMs: ROSTER_POLL_MS,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tarfa/cli",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "Tarfa agent and CLI: serves your Claude Code terminal sessions (tmux workspaces) to the Tarfa phone app.",
   "repository": {
     "type": "git",

package/templates/tarfa-agent.sh

@@ -40,8 +40,17 @@ for mise_bin in "$home/.local/bin/mise" /opt/homebrew/bin/mise /usr/local/bin/mi
   if [ -x "$mise_bin" ]; then
     install="$("$mise_bin" --cd "$home" where npm:@tarfa/cli 2>/dev/null || true)"
     node_home="$("$mise_bin" --cd "$home" where node 2>/dev/null || true)"
-    if [ -n "$install" ] && [ -n "$node_home" ] && [ -x "$node_home/bin/node" ] && [ -f "$install/bin/tarfa" ]; then
-      exec "$node_home/bin/node" "$install/bin/tarfa" serve
+    # npm links the CLI into <install>/bin; aube (a newer mise's npm backend) leaves it in the
+    # package under node_modules, whose .bin/tarfa is a shell script node cannot run.
+    cli=""
+    for candidate in "$install/bin/tarfa" "$install/node_modules/@tarfa/cli/dist/cli.js"; do
+      if [ -n "$install" ] && [ -f "$candidate" ]; then
+        cli="$candidate"
+        break
+      fi
+    done
+    if [ -n "$cli" ] && [ -n "$node_home" ] && [ -x "$node_home/bin/node" ]; then
+      exec "$node_home/bin/node" "$cli" serve
     fi
     exec "$mise_bin" exec -- tarfa serve
   fi

package/templates/tarfa-cli-wrapper.sh

@@ -22,8 +22,17 @@ fi
 if [ -n "$mise_bin" ]; then
   install="$("$mise_bin" --cd "$HOME" where npm:@tarfa/cli 2>/dev/null || true)"
   node_home="$("$mise_bin" --cd "$HOME" where node 2>/dev/null || true)"
-  if [ -n "$install" ] && [ -n "$node_home" ] && [ -x "$node_home/bin/node" ] && [ -f "$install/bin/tarfa" ]; then
-    exec "$node_home/bin/node" "$install/bin/tarfa" "$@"
+  # npm links the CLI into <install>/bin; aube (a newer mise's npm backend) leaves it in the
+  # package under node_modules, whose .bin/tarfa is a shell script node cannot run.
+  cli=""
+  for candidate in "$install/bin/tarfa" "$install/node_modules/@tarfa/cli/dist/cli.js"; do
+    if [ -n "$install" ] && [ -f "$candidate" ]; then
+      cli="$candidate"
+      break
+    fi
+  done
+  if [ -n "$cli" ] && [ -n "$node_home" ] && [ -x "$node_home/bin/node" ]; then
+    exec "$node_home/bin/node" "$cli" "$@"
   fi
 fi