@termhub/agent 0.1.0

package/dist/cli.js

@@ -0,0 +1,1489 @@
+#!/usr/bin/env node
+
+// src/cli.ts
+import { parseArgs } from "util";
+
+// src/commands/connect.ts
+import readline from "readline";
+
+// src/client.ts
+import { WebSocket } from "ws";
+
+// ../../packages/agent-protocol/dist/frames.js
+var CONTROL_CHANNEL = 0;
+var HEADER_BYTES = 4;
+var MAX_FRAME = 1024 * 1024;
+var MAX_PASTE_FRAME = 20 * 1024 * 1024 + 1024;
+function encodeFrame(ch, payload) {
+  if (!Number.isInteger(ch) || ch < 0 || ch > 4294967295)
+    throw new Error(`invalid channel ${ch}`);
+  const body = typeof payload === "string" ? Buffer.from(payload, "utf8") : payload;
+  const out = Buffer.allocUnsafe(HEADER_BYTES + body.length);
+  out.writeUInt32BE(ch, 0);
+  body.copy(out, HEADER_BYTES);
+  return out;
+}
+function decodeFrame(buf) {
+  if (buf.length < HEADER_BYTES)
+    throw new Error("truncated frame");
+  return { ch: buf.readUInt32BE(0), payload: buf.subarray(HEADER_BYTES) };
+}
+
+// ../../packages/agent-protocol/dist/messages.js
+import { z as z2 } from "zod";
+
+// ../../packages/agent-protocol/dist/rpc.js
+import { z } from "zod";
+var SESSION_RE = /^[A-Za-z0-9_-]+$/;
+var sessionName = z.string().min(1).max(128).regex(SESSION_RE);
+var machinePath = z.string().min(1).max(4096).refine((p) => (p === "~" || p.startsWith("~/") || p.startsWith("/")) && !/[\0\n\r]/.test(p), "invalid path");
+var pasteName = z.string().min(1).max(255).regex(/^[A-Za-z0-9._-]+$/);
+var aiProvider = z.enum(["claude", "chatgpt", "gemini", "antigravity"]);
+var rpcErrorSchema = z.object({
+  code: z.enum(["eperm", "notfound", "no_tmux", "timeout", "invalid", "internal"]),
+  message: z.string().max(2e3),
+  path: z.string().max(4096).optional()
+});
+var DEFAULT_TIMEOUT = 8e3;
+var def = (params, result, timeoutMs = DEFAULT_TIMEOUT) => ({ params, result, timeoutMs });
+var RPC = {
+  "tmux.list": def(z.object({}), z.object({ sessions: z.array(sessionName) })),
+  "tmux.kill": def(z.object({ session: sessionName }), z.object({ killed: z.boolean() })),
+  "tmux.capture": def(z.object({ session: sessionName, lines: z.number().int().min(1).max(5e3) }), z.object({ text: z.string() })),
+  "tools.detect": def(z.object({}), z.object({ os: z.string().nullable(), tools: z.array(z.string().max(32)) })),
+  "hw.probe": def(z.object({}), z.object({ stdout: z.string() }), 15e3),
+  "fs.list": def(z.object({ path: machinePath }), z.object({ stdout: z.string() })),
+  "fs.mkdir": def(z.object({
+    parent: machinePath,
+    name: z.string().min(1).max(255).regex(/^[^/\\\0\n\r]+$/),
+    /** `mkdir -p`: create missing parents too (ensureDirectory parity with the ssh/local branch). Default: leaf only. */
+    recursive: z.boolean().optional()
+  }), z.object({ stdout: z.string() })),
+  "ai.credential": def(z.object({ provider: aiProvider, config_dir: machinePath.nullable() }), z.object({ stdout: z.string() }), 1e4),
+  "file.paste": def(z.object({ name: pasteName, data_b64: z.string().min(1).max(28 * 1024 * 1024) }), z.object({ path: z.string() }), 6e4)
+};
+var RPC_METHODS = Object.keys(RPC);
+var rpcMethod = z.enum(RPC_METHODS);
+
+// ../../packages/agent-protocol/dist/messages.js
+var PROTOCOL_VERSION = 1;
+var CLOSE = { UNAUTHORIZED: 4401, CONFLICT: 4409, VIOLATION: 1008 };
+var channel = z2.number().int().min(1).max(4294967295);
+var rpcId = z2.string().min(1).max(64);
+var helloMessage = z2.object({
+  type: z2.literal("hello"),
+  protocol: z2.number().int().min(1),
+  agent_version: z2.string().max(32),
+  os: z2.enum(["macos", "linux"]),
+  arch: z2.string().max(16),
+  hostname: z2.string().max(255),
+  tmux: z2.boolean(),
+  tools: z2.array(z2.string().max(32)).max(64),
+  /** `status`/`doctor` reachability check: the server validates the token and protocol as
+   *  usual but does not attach — it answers by closing 1000 `probe-ok`, so a probe never
+   *  replaces the machine's live session. */
+  probe: z2.boolean().optional()
+});
+var agentMessage = z2.discriminatedUnion("type", [
+  helloMessage,
+  z2.object({ type: z2.literal("rpc_result"), id: rpcId, ok: z2.boolean(), result: z2.unknown().optional(), error: rpcErrorSchema.optional() }),
+  z2.object({ type: z2.literal("opened"), ch: channel }),
+  z2.object({ type: z2.literal("open_error"), ch: channel, error: rpcErrorSchema }),
+  z2.object({ type: z2.literal("closed"), ch: channel, code: z2.number().int().nullable() })
+]);
+var ptyOpenParams = z2.object({ session: sessionName, cwd: machinePath, cols: z2.number().int().min(2).max(500), rows: z2.number().int().min(2).max(200) });
+var serverMessage = z2.discriminatedUnion("type", [
+  z2.object({ type: z2.literal("rpc"), id: rpcId, method: rpcMethod, params: z2.unknown() }),
+  z2.object({ type: z2.literal("open"), ch: channel, kind: z2.literal("pty"), params: ptyOpenParams }),
+  z2.object({ type: z2.literal("resize"), ch: channel, cols: z2.number().int().min(2).max(500), rows: z2.number().int().min(2).max(200) }),
+  z2.object({ type: z2.literal("close"), ch: channel })
+]);
+
+// src/client.ts
+var RevokedError = class extends Error {
+};
+var ProtocolMismatchError = class extends Error {
+};
+var UpgradeRejectedError = class extends Error {
+  constructor(status4) {
+    super(`upgrade rejected: HTTP ${status4}`);
+    this.status = status4;
+  }
+  status;
+};
+var DEFAULT_BACKOFF = { minMs: 1e3, maxMs: 3e4 };
+var DEFAULT_PING_INTERVAL_MS = 2e4;
+var DEFAULT_MAX_UNAUTHORIZED = 3;
+var SESSION_OK_MS = 5e3;
+function deriveWsUrl(base) {
+  const u = new URL(base);
+  u.protocol = u.protocol === "https:" ? "wss:" : "ws:";
+  u.pathname = `${u.pathname.replace(/\/+$/, "")}/agent/ws`;
+  u.search = "";
+  u.hash = "";
+  return u.toString();
+}
+function toBuffer(data) {
+  if (Buffer.isBuffer(data)) return data;
+  if (Array.isArray(data)) return Buffer.concat(data);
+  return Buffer.from(data);
+}
+function connectOnce(opts, signal) {
+  return new Promise((resolve, reject) => {
+    if (signal?.aborted) {
+      reject(new Error("aborted"));
+      return;
+    }
+    const wsUrl = deriveWsUrl(opts.url);
+    const ws = new WebSocket(wsUrl, { headers: { Authorization: `Bearer ${opts.token}` } });
+    let opened = false;
+    let socket;
+    const onAbort = () => {
+      if (opened) ws.close(1e3, "aborted");
+      else ws.terminate();
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
+    const stopWatchingAbort = () => signal?.removeEventListener("abort", onAbort);
+    let resolveClosed;
+    const closed = new Promise((res) => {
+      resolveClosed = res;
+    });
+    let liveness;
+    let pongSeen = true;
+    ws.on("pong", () => {
+      pongSeen = true;
+    });
+    ws.on("close", (code, reasonBuf) => {
+      stopWatchingAbort();
+      if (liveness) clearInterval(liveness);
+      const info = { code, reason: reasonBuf.toString() };
+      resolveClosed(info);
+      if (!opened) reject(new Error(`connection closed before open (code ${code})`));
+    });
+    ws.on("unexpected-response", (_req, res) => {
+      stopWatchingAbort();
+      const statusCode = res.statusCode ?? 0;
+      res.resume();
+      ws.terminate();
+      reject(new UpgradeRejectedError(statusCode));
+    });
+    ws.on("error", (err) => {
+      if (!opened) {
+        stopWatchingAbort();
+        reject(err);
+      } else {
+        opts.log("agent socket error", { error: err.message });
+      }
+    });
+    ws.on("open", () => {
+      opened = true;
+      liveness = setInterval(() => {
+        if (!pongSeen) {
+          opts.log("agent liveness ping unanswered, terminating");
+          ws.terminate();
+          return;
+        }
+        pongSeen = false;
+        ws.ping();
+      }, opts.pingIntervalMs ?? DEFAULT_PING_INTERVAL_MS);
+      socket = {
+        sendControl: (msg) => ws.send(encodeFrame(CONTROL_CHANNEL, JSON.stringify(msg))),
+        sendStream: (ch, data) => ws.send(encodeFrame(ch, data))
+      };
+      const hello = { type: "hello", protocol: PROTOCOL_VERSION, ...opts.hello };
+      socket.sendControl(hello);
+      resolve({ socket, closed });
+    });
+    ws.on("message", (data) => {
+      if (!socket) return;
+      let frame;
+      try {
+        frame = decodeFrame(toBuffer(data));
+      } catch (err) {
+        opts.log("dropped malformed frame", { error: err.message });
+        return;
+      }
+      if (frame.ch === CONTROL_CHANNEL) {
+        let parsed;
+        try {
+          parsed = JSON.parse(frame.payload.toString("utf8"));
+        } catch {
+          opts.log("dropped non-JSON control message");
+          return;
+        }
+        const result = serverMessage.safeParse(parsed);
+        if (!result.success) {
+          opts.log("dropped invalid server message", { issues: result.error.issues.length });
+          return;
+        }
+        opts.onServerMessage(result.data, socket);
+      } else {
+        opts.onStream(frame.ch, frame.payload);
+      }
+    });
+  });
+}
+function sleep(ms, signal) {
+  return new Promise((resolve) => {
+    if (signal?.aborted) {
+      resolve();
+      return;
+    }
+    const timer = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort);
+      resolve();
+    }, ms);
+    function onAbort() {
+      clearTimeout(timer);
+      resolve();
+    }
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
+}
+function nextBackoff(prevMs, min, max, rand = Math.random) {
+  const base = Math.min(prevMs * 2, max);
+  const jittered = base * (0.8 + 0.4 * rand());
+  return Math.min(max, Math.max(min, jittered));
+}
+async function runForever(opts, signal) {
+  const min = opts.backoff?.minMs ?? DEFAULT_BACKOFF.minMs;
+  const max = opts.backoff?.maxMs ?? DEFAULT_BACKOFF.maxMs;
+  const maxUnauthorized = opts.maxUnauthorized ?? DEFAULT_MAX_UNAUTHORIZED;
+  let unauthorized = 0;
+  let backoff = min;
+  while (!signal?.aborted) {
+    let sessionOk = false;
+    let closeInfo;
+    let upgradeRejectedStatus;
+    const innerOpts = {
+      ...opts,
+      onServerMessage: (msg, conn) => {
+        sessionOk = true;
+        opts.onServerMessage(msg, conn);
+      }
+    };
+    try {
+      const { closed } = await connectOnce(innerOpts, signal);
+      const startedAt = Date.now();
+      closeInfo = await closed;
+      if (Date.now() - startedAt > SESSION_OK_MS) sessionOk = true;
+      opts.log("agent connection closed", { code: closeInfo.code, reason: closeInfo.reason });
+    } catch (err) {
+      if (err instanceof UpgradeRejectedError) {
+        upgradeRejectedStatus = err.status;
+        opts.log("agent upgrade rejected", { status: err.status });
+      } else {
+        opts.log("agent connect failed", { error: err.message });
+      }
+    }
+    opts.onDisconnect?.();
+    if (closeInfo?.code === CLOSE.UNAUTHORIZED || upgradeRejectedStatus === 401) {
+      unauthorized += 1;
+      opts.log("agent unauthorized", { attempt: unauthorized, maxUnauthorized });
+      if (unauthorized >= maxUnauthorized) {
+        throw new RevokedError(`token rejected ${unauthorized} times in a row`);
+      }
+    } else if (closeInfo?.code === CLOSE.CONFLICT && closeInfo.reason === "protocol") {
+      throw new ProtocolMismatchError("server rejected the agent protocol version");
+    } else if (sessionOk) {
+      unauthorized = 0;
+      backoff = min;
+    }
+    if (signal?.aborted) return;
+    const wait = nextBackoff(backoff, min, max);
+    opts.log("reconnecting", { inMs: Math.round(wait) });
+    await sleep(wait, signal);
+    backoff = wait;
+  }
+}
+
+// src/config.ts
+import fs from "fs";
+import os from "os";
+import path from "path";
+import { z as z3 } from "zod";
+var CONFIG_FILE = "config.json";
+var agentConfigSchema = z3.object({
+  url: z3.string().min(1),
+  token: z3.string().min(1),
+  // The server does not hand the agent its machine id/name in v1 (see task-13); `connect`
+  // stores '' for both until a later protocol version fills them in, so these can't require
+  // min(1) like the other fields.
+  machine_id: z3.string(),
+  machine_name: z3.string(),
+  created_at: z3.string().min(1)
+});
+function agentHome() {
+  const override = process.env.TERMHUB_AGENT_HOME?.trim();
+  return override && override.length > 0 ? override : path.join(os.homedir(), ".termhub");
+}
+function configPath() {
+  return path.join(agentHome(), CONFIG_FILE);
+}
+function readConfig() {
+  let raw;
+  try {
+    raw = fs.readFileSync(configPath(), "utf8");
+  } catch {
+    return null;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  const result = agentConfigSchema.safeParse(parsed);
+  return result.success ? result.data : null;
+}
+function writeConfig(config) {
+  const home = agentHome();
+  fs.mkdirSync(home, { recursive: true, mode: 448 });
+  fs.chmodSync(home, 448);
+  const dest = configPath();
+  const tmp = path.join(home, `.${CONFIG_FILE}.${process.pid}.${Date.now()}.tmp`);
+  fs.writeFileSync(tmp, JSON.stringify(config, null, 2), { encoding: "utf8", mode: 384 });
+  fs.chmodSync(tmp, 384);
+  fs.renameSync(tmp, dest);
+}
+function deleteConfig() {
+  try {
+    fs.unlinkSync(configPath());
+  } catch (err) {
+    if (err.code !== "ENOENT") throw err;
+  }
+}
+
+// src/run.ts
+import os4 from "os";
+
+// src/exec.ts
+import { execFile } from "child_process";
+import os2 from "os";
+
+// ../../packages/machine-ops/dist/shell.js
+function shellQuote(s) {
+  return `'${s.replace(/'/g, `'\\''`)}'`;
+}
+var REMOTE_PATH_PREFIX = 'export PATH="$HOME/.local/bin:/opt/homebrew/bin:/usr/local/bin:$PATH"; ';
+
+// ../../packages/machine-ops/dist/detect.js
+var DETECT_TOOLS = ["tmux", "claude", "gh", "git", "node", "pnpm", "xcodebuild", "docker", "adb", "python3"];
+var WDA_RUNNER_APP = "$HOME/.termhub/WebDriverAgent/DerivedData/Build/Products/Debug-iphonesimulator/WebDriverAgentRunner-Runner.app";
+var DETECT_SCRIPT = `echo OS:$(uname -s); for t in ${DETECT_TOOLS.join(" ")}; do command -v $t >/dev/null 2>&1 && echo CAP:$t; done; [ -d "${WDA_RUNNER_APP}" ] && echo CAP:wda; exit 0`;
+function parseDetect(stdout) {
+  let os8 = null;
+  const caps = [];
+  for (const line of stdout.split("\n")) {
+    if (line.startsWith("OS:")) {
+      const raw = line.slice(3).trim().toLowerCase();
+      os8 = raw === "darwin" ? "macos" : raw || null;
+    } else if (line.startsWith("CAP:"))
+      caps.push(line.slice(4).trim());
+  }
+  return { os: os8, capabilities: caps };
+}
+
+// ../../packages/machine-ops/dist/hardware-script.js
+var LINUX = [
+  `echo "OS:linux"`,
+  `echo "HOST:$(hostname 2>/dev/null)"`,
+  `echo "CPUMODEL:$(grep -m1 'model name' /proc/cpuinfo 2>/dev/null | cut -d: -f2- | sed 's/^ *//')"`,
+  `echo "NCPU:$(nproc 2>/dev/null || grep -c ^processor /proc/cpuinfo)"`,
+  `echo "UPTIME:$(cut -d' ' -f1 /proc/uptime)"`,
+  `echo "LOAD:$(cut -d' ' -f1-3 /proc/loadavg)"`,
+  `echo "STAT1:$(head -1 /proc/stat)"`,
+  `sleep 1`,
+  `echo "STAT2:$(head -1 /proc/stat)"`,
+  `grep -E '^(MemTotal|MemAvailable|SwapTotal|SwapFree):' /proc/meminfo | sed 's/^/MEM:/'`,
+  `df -Pk 2>/dev/null | tail -n +2 | awk '{ for (i = 6; i <= NF; i++) if ($i ~ /^\\//) { m = $i; for (j = i + 1; j <= NF; j++) m = m " " $j; printf "DISK:%s\\t%s\\t%s\\t%s\\t%s\\n", $1, $2, $3, $4, m; break } }'`,
+  `for z in /sys/class/thermal/thermal_zone*; do [ -f "$z/temp" ] && printf 'TEMP:%s\\t%s\\n' "$(cat "$z/type" 2>/dev/null)" "$(cat "$z/temp" 2>/dev/null)"; done`,
+  `for h in /sys/class/hwmon/hwmon*; do n=$(cat "$h/name" 2>/dev/null); for t in "$h"/temp*_input; do [ -f "$t" ] && printf 'TEMP:%s\\t%s\\n' "$n $(cat "\${t%_input}_label" 2>/dev/null)" "$(cat "$t" 2>/dev/null)"; done; done`,
+  `command -v nvidia-smi >/dev/null 2>&1 && nvidia-smi --query-gpu=name,utilization.gpu,memory.used,memory.total,temperature.gpu --format=csv,noheader,nounits 2>/dev/null | sed 's/^/GPU:/'`,
+  `ps -eo pcpu,pmem,comm --sort=-pcpu 2>/dev/null | tail -n +2 | head -7 | sed 's/^ *//;s/^/PROC:/'`,
+  `exit 0`
+].join("; ");
+var DARWIN = [
+  `echo "OS:macos"`,
+  `echo "HOST:$(hostname 2>/dev/null)"`,
+  `echo "CPUMODEL:$(sysctl -n machdep.cpu.brand_string 2>/dev/null)"`,
+  `echo "NCPU:$(sysctl -n hw.ncpu)"`,
+  `echo "BOOT:$(sysctl -n kern.boottime | sed 's/^{ sec = \\([0-9]*\\),.*/\\1/')"`,
+  `echo "NOW:$(date +%s)"`,
+  `echo "LOAD:$(sysctl -n vm.loadavg | tr -d '{}')"`,
+  `echo "MEMSIZE:$(sysctl -n hw.memsize)"`,
+  `vm_stat | sed 's/^/VMSTAT:/'`,
+  `echo "SWAPUSAGE:$(sysctl -n vm.swapusage)"`,
+  `top -l 2 -s 1 -n 0 2>/dev/null | grep 'CPU usage' | tail -1 | sed 's/^/CPUUSAGE:/'`,
+  `df -Pk 2>/dev/null | tail -n +2 | awk '{ for (i = 6; i <= NF; i++) if ($i ~ /^\\//) { m = $i; for (j = i + 1; j <= NF; j++) m = m " " $j; printf "DISK:%s\\t%s\\t%s\\t%s\\t%s\\n", $1, $2, $3, $4, m; break } }'`,
+  `ps -A -o pcpu,pmem,comm -r 2>/dev/null | tail -n +2 | head -7 | sed 's/^ *//;s/^/PROC:/'`,
+  `exit 0`
+].join("; ");
+var HARDWARE_SCRIPT = `if [ "$(uname -s)" = Darwin ]; then ${DARWIN}; else ${LINUX}; fi`;
+
+// ../../packages/machine-ops/dist/fs-script.js
+var EXPAND_HOME = `case "$P" in "~") P=$HOME;; "~/"*) P="$HOME/\${P#\\~/}";; esac`;
+function buildFsListScript(quotedPath) {
+  return [
+    `P=${quotedPath}`,
+    `case "$P" in ""|"~") P=$HOME;; "~/"*) P="$HOME/\${P#\\~/}";; esac`,
+    `echo "HOME:$HOME"`,
+    // discos: fonte, tamanho, livre e mount point (mount pode ter espaços: fica no fim da linha)
+    `df -Pk 2>/dev/null | tail -n +2 | while IFS= read -r line; do set -- $line; src=$1; size=$2; avail=$4; shift 5; [ -d "$*" ] && printf 'MNT:%s\\t%s\\t%s\\t%s\\n' "$src" "$size" "$avail" "$*"; done`,
+    `if [ ! -e "$P" ]; then echo "ERR:notfound"; exit 0; fi`,
+    // notdir before eperm: a readable regular file fails `-x`, and "sem acesso" would be the
+    // wrong diagnosis for it — "não é um diretório" is.
+    `if [ ! -d "$P" ]; then echo "ERR:notdir"; exit 0; fi`,
+    `if [ ! -r "$P" ] || [ ! -x "$P" ]; then echo "ERR:eperm"; exit 0; fi`,
+    `cd -- "$P" 2>/dev/null || { echo "ERR:denied"; exit 0; }`,
+    `echo "PWD:$(pwd)"`,
+    `ls -1Ap 2>/dev/null | grep '/$' | sed 's#/$##' | while IFS= read -r n; do echo "DIR:$n"; done`,
+    `exit 0`
+  ].join("; ");
+}
+function buildMkdirScript(quotedParent, quotedName, opts = {}) {
+  if (opts.recursive) {
+    return [
+      `P=${quotedParent}`,
+      EXPAND_HOME,
+      `N=${quotedName}`,
+      `if [ -e "$P/$N" ]; then echo "ERR:exists"; exit 0; fi`,
+      `mkdir -p -- "$P/$N" 2>/dev/null || { echo "ERR:denied"; exit 0; }`,
+      `cd -- "$P/$N" && echo "PWD:$(pwd)"`,
+      `exit 0`
+    ].join("; ");
+  }
+  return [
+    `P=${quotedParent}`,
+    EXPAND_HOME,
+    `cd -- "$P" 2>/dev/null || { echo "ERR:parent"; exit 0; }`,
+    `N=${quotedName}`,
+    `if [ -e "$N" ]; then echo "ERR:exists"; exit 0; fi`,
+    `mkdir -- "$N" 2>/dev/null || { echo "ERR:denied"; exit 0; }`,
+    `cd -- "$N" && echo "PWD:$(pwd)"`,
+    `exit 0`
+  ].join("; ");
+}
+
+// ../../packages/machine-ops/dist/paste.js
+import { randomBytes } from "crypto";
+var PASTE_MAX_BYTES = 20 * 1024 * 1024;
+var PASTE_DIR = ".cache/termhub/paste";
+var PASTE_KEEP_DAYS = 7;
+function buildPasteScript(name) {
+  return [
+    `d="$HOME/${PASTE_DIR}"`,
+    `mkdir -p "$d" || exit 1`,
+    `cat > "$d/${name}" || exit 1`,
+    `find "$d" -name 'paste-*' -type f -mtime +${PASTE_KEEP_DAYS} -delete 2>/dev/null`,
+    `printf '%s\\n' "$d/${name}"`
+  ].join("; ");
+}
+
+// ../../packages/machine-ops/dist/ai-credentials.js
+function credentialScript(provider) {
+  switch (provider) {
+    case "claude":
+      return [
+        `if [ -f "$D/.credentials.json" ]; then cat "$D/.credentials.json"`,
+        `elif [ "$(uname -s)" = Darwin ]; then security find-generic-password -s "Claude Code-credentials" -w 2>/dev/null || true`,
+        `fi`
+      ].join("; ");
+    case "chatgpt":
+      return `if [ -f "$D/auth.json" ]; then cat "$D/auth.json"; fi`;
+    case "gemini":
+      return `if [ -f "$D/oauth_creds.json" ]; then cat "$D/oauth_creds.json"; fi`;
+    case "antigravity":
+      return `if [ -f "$D/antigravity-cli/antigravity-oauth-token" ]; then cat "$D/antigravity-cli/antigravity-oauth-token"; fi`;
+  }
+}
+var DEFAULT_CONFIG_DIRS = { claude: ".claude", chatgpt: ".codex", gemini: ".gemini", antigravity: ".gemini" };
+function configDirPrefix(configDir, defaultDir) {
+  const raw = (configDir ?? "").trim();
+  if (!raw)
+    return `D="$HOME/${defaultDir}"`;
+  if (raw.includes("\0") || raw.includes("\n"))
+    throw new Error("Invalid config dir");
+  return `P=${shellQuote(raw)}; case "$P" in "~") P=$HOME;; "~/"*) P="$HOME/\${P#\\~/}";; esac; D="$P"`;
+}
+
+// ../../packages/machine-ops/dist/pty.js
+var UTF8_LOCALE = "en_US.UTF-8";
+function clampSize(size) {
+  const cols = Math.min(Math.max(Math.floor(size.cols ?? 80), 2), 500);
+  const rows = Math.min(Math.max(Math.floor(size.rows ?? 24), 2), 200);
+  return { cols, rows };
+}
+function ptyEnv(base, shell) {
+  return {
+    ...base,
+    TERM: "xterm-256color",
+    COLORTERM: "truecolor",
+    LANG: /utf-?8/i.test(base.LANG ?? "") ? base.LANG : UTF8_LOCALE,
+    LC_ALL: /utf-?8/i.test(base.LC_ALL ?? "") ? base.LC_ALL : UTF8_LOCALE,
+    SHELL: shell,
+    TERMHUB: "1"
+  };
+}
+
+// src/exec.ts
+var DEFAULT_TIMEOUT_MS = 8e3;
+var RpcFailure = class extends Error {
+  constructor(code, message, path8) {
+    super(message);
+    this.code = code;
+    this.path = path8;
+  }
+  code;
+  path;
+};
+function pathPrefixDirs() {
+  const m = REMOTE_PATH_PREFIX.match(/PATH="([^"]+):\$PATH"/);
+  if (!m) throw new Error("unexpected REMOTE_PATH_PREFIX format");
+  return m[1];
+}
+function agentEnv(base = process.env) {
+  const prefix = pathPrefixDirs().replace("$HOME", os2.homedir());
+  return { ...base, PATH: `${prefix}:${base.PATH ?? ""}` };
+}
+function tmuxPath() {
+  return process.env.TMUX_PATH || "tmux";
+}
+function run(file, args, opts = {}) {
+  const { timeoutMs = DEFAULT_TIMEOUT_MS, input, env = agentEnv() } = opts;
+  return new Promise((resolve) => {
+    const child = execFile(
+      file,
+      args,
+      { timeout: timeoutMs, env, maxBuffer: 8 * 1024 * 1024, encoding: "utf8" },
+      (err, stdout, stderr) => {
+        const e = err;
+        resolve({
+          code: e ? typeof e.code === "number" ? e.code : null : 0,
+          stdout: String(stdout ?? ""),
+          stderr: String(stderr ?? ""),
+          timedOut: !!e?.killed || e?.signal === "SIGTERM",
+          error: e?.code === "ENOENT" ? "enoent" : e?.code === "ERR_CHILD_PROCESS_STDIO_MAXBUFFER" ? "maxbuffer" : void 0
+        });
+      }
+    );
+    child.stdin?.on("error", () => {
+    });
+    if (input !== void 0) child.stdin?.end(input);
+    else child.stdin?.end();
+  });
+}
+function sh(script, opts = {}) {
+  return run("/bin/sh", ["-c", script], opts);
+}
+
+// src/dispatch.ts
+async function handleRpc(msg, socket, handlers2, log2) {
+  const method = msg.method;
+  const def2 = RPC[method];
+  const handler = handlers2[method];
+  if (!def2 || !handler) {
+    socket.sendControl({ type: "rpc_result", id: msg.id, ok: false, error: { code: "invalid", message: "unknown method" } });
+    return;
+  }
+  const parsedParams = def2.params.safeParse(msg.params);
+  if (!parsedParams.success) {
+    socket.sendControl({ type: "rpc_result", id: msg.id, ok: false, error: { code: "invalid", message: "invalid params" } });
+    return;
+  }
+  let result;
+  try {
+    result = await handler(parsedParams.data);
+  } catch (err) {
+    if (err instanceof RpcFailure) {
+      socket.sendControl({ type: "rpc_result", id: msg.id, ok: false, error: { code: err.code, message: err.message, path: err.path } });
+    } else {
+      log2("rpc handler failed", { method, error: err instanceof Error ? err.stack ?? err.message : String(err) });
+      socket.sendControl({ type: "rpc_result", id: msg.id, ok: false, error: { code: "internal", message: "internal error" } });
+    }
+    return;
+  }
+  const parsedResult = def2.result.safeParse(result);
+  if (!parsedResult.success) {
+    log2("rpc handler returned an invalid result", { method, issues: parsedResult.error.issues.length });
+    socket.sendControl({ type: "rpc_result", id: msg.id, ok: false, error: { code: "internal", message: "internal error" } });
+    return;
+  }
+  socket.sendControl({ type: "rpc_result", id: msg.id, ok: true, result: parsedResult.data });
+}
+function createDispatcher(deps) {
+  return (msg, socket) => {
+    switch (msg.type) {
+      case "rpc":
+        void handleRpc(msg, socket, deps.handlers, deps.log);
+        break;
+      case "open":
+        deps.pty.open(msg.ch, msg.params, socket).catch((err) => {
+          deps.log("pty.open rejected unexpectedly", { ch: msg.ch, error: err instanceof Error ? err.message : String(err) });
+        });
+        break;
+      case "resize":
+        deps.pty.resize(msg.ch, msg.cols, msg.rows);
+        break;
+      case "close":
+        deps.pty.close(msg.ch);
+        break;
+    }
+  };
+}
+
+// src/pty.ts
+import fs2 from "fs";
+import path2 from "path";
+function expandHome(rawCwd, home) {
+  if (rawCwd === "~") return home;
+  if (rawCwd.startsWith("~/")) return path2.join(home, rawCwd.slice(2));
+  return rawCwd;
+}
+function existsDir(p) {
+  try {
+    return fs2.statSync(p).isDirectory();
+  } catch {
+    return false;
+  }
+}
+function resolveCwd(rawCwd) {
+  const home = process.env.HOME || "/";
+  const expanded = expandHome(rawCwd, home);
+  return existsDir(expanded) ? expanded : home;
+}
+function isEnoent(err) {
+  const e = err;
+  if (e?.code === "ENOENT") return true;
+  const message = e instanceof Error ? e.message : String(err);
+  return /ENOENT/.test(message);
+}
+function createPtyManager(deps) {
+  const procs = /* @__PURE__ */ new Map();
+  const tmux = deps.tmuxPath ?? tmuxPath();
+  let spawnFn = deps.spawn;
+  async function resolveSpawn() {
+    if (!spawnFn) {
+      const nodePty = await import("node-pty");
+      spawnFn = nodePty.spawn;
+    }
+    return spawnFn;
+  }
+  return {
+    async open(ch, params, socket) {
+      if (procs.has(ch)) {
+        socket.sendControl({ type: "open_error", ch, error: { code: "invalid", message: "channel in use" } });
+        return;
+      }
+      let proc;
+      let cols;
+      let rows;
+      try {
+        ({ cols, rows } = clampSize(params));
+        const cwd = resolveCwd(params.cwd);
+        const env = {
+          ...ptyEnv(agentEnv(), process.env.SHELL ?? "/bin/sh"),
+          TERMHUB_TAB_ID: params.session,
+          TERMHUB_SESSION: params.session
+        };
+        const spawn = await resolveSpawn();
+        proc = spawn(tmux, ["-u", "new-session", "-A", "-s", params.session, "-c", cwd], { name: "xterm-256color", cols, rows, cwd, env });
+      } catch (err) {
+        socket.sendControl({
+          type: "open_error",
+          ch,
+          error: isEnoent(err) ? { code: "no_tmux", message: "tmux not found" } : { code: "internal", message: "failed to start pty" }
+        });
+        return;
+      }
+      let closedSent = false;
+      const entry = {
+        proc,
+        closed: false,
+        sendClosed: (code) => {
+          if (closedSent) return;
+          closedSent = true;
+          try {
+            socket.sendControl({ type: "closed", ch, code });
+          } catch (err) {
+            deps.log("pty closed send failed", { ch, error: err instanceof Error ? err.message : String(err) });
+          }
+        }
+      };
+      procs.set(ch, entry);
+      deps.log("pty opened", { ch, session: params.session, cols, rows });
+      proc.onData((data) => {
+        if (entry.closed) return;
+        try {
+          socket.sendStream(ch, Buffer.from(data, "utf8"));
+        } catch (err) {
+          deps.log("pty stream send failed", { ch, error: err instanceof Error ? err.message : String(err) });
+        }
+      });
+      proc.onExit(({ exitCode }) => {
+        if (procs.get(ch) === entry) procs.delete(ch);
+        const code = exitCode ?? null;
+        deps.log("pty exited", { ch, code });
+        entry.sendClosed(code);
+      });
+      try {
+        socket.sendControl({ type: "opened", ch });
+      } catch (err) {
+        deps.log("pty opened send failed", { ch, error: err instanceof Error ? err.message : String(err) });
+      }
+    },
+    write(ch, data) {
+      const entry = procs.get(ch);
+      if (!entry) return;
+      entry.proc.write(data.toString("utf8"));
+    },
+    resize(ch, cols, rows) {
+      const entry = procs.get(ch);
+      if (!entry) return;
+      const size = clampSize({ cols, rows });
+      try {
+        entry.proc.resize(size.cols, size.rows);
+      } catch {
+      }
+    },
+    close(ch) {
+      const entry = procs.get(ch);
+      if (!entry) return;
+      entry.closed = true;
+      procs.delete(ch);
+      try {
+        entry.proc.kill();
+      } catch {
+      }
+      entry.sendClosed(null);
+    },
+    closeAll() {
+      for (const [ch, entry] of procs) {
+        entry.closed = true;
+        procs.delete(ch);
+        try {
+          entry.proc.kill();
+        } catch {
+        }
+      }
+    }
+  };
+}
+
+// src/rpc/ai.ts
+async function credential(params) {
+  let prefix;
+  try {
+    prefix = configDirPrefix(params.config_dir, DEFAULT_CONFIG_DIRS[params.provider]);
+  } catch (err) {
+    throw new RpcFailure("invalid", err instanceof Error ? err.message : "invalid config dir");
+  }
+  const script = `${prefix}; ${credentialScript(params.provider)}`;
+  const r = await sh(script);
+  if (r.timedOut) throw new RpcFailure("timeout", "ai.credential timed out");
+  if (r.code !== 0) throw new RpcFailure("internal", `ai.credential exited with code ${r.code}`);
+  return { stdout: r.stdout };
+}
+
+// src/rpc/fs.ts
+function processFailure(method, r) {
+  if (r.timedOut) return new RpcFailure("timeout", `${method} timed out`);
+  if (r.code !== 0) return new RpcFailure("internal", `${method} exited with code ${r.code}`);
+  return null;
+}
+async function list(params) {
+  const r = await sh(buildFsListScript(shellQuote(params.path)));
+  const failure = processFailure("fs.list", r);
+  if (failure) throw failure;
+  return { stdout: r.stdout };
+}
+async function mkdir(params) {
+  const r = await sh(buildMkdirScript(shellQuote(params.parent), shellQuote(params.name), { recursive: params.recursive === true }));
+  const failure = processFailure("fs.mkdir", r);
+  if (failure) throw failure;
+  return { stdout: r.stdout };
+}
+
+// src/rpc/hw.ts
+async function probe(_params) {
+  const r = await sh(HARDWARE_SCRIPT, { timeoutMs: 14e3 });
+  if (r.timedOut) throw new RpcFailure("timeout", "hw.probe timed out");
+  if (r.code !== 0) throw new RpcFailure("internal", `hw.probe exited with code ${r.code}`);
+  return { stdout: r.stdout };
+}
+
+// src/rpc/paste.ts
+async function pasteFile(params) {
+  const data = Buffer.from(params.data_b64, "base64");
+  if (data.length > PASTE_MAX_BYTES) throw new RpcFailure("invalid", "file too large");
+  const r = await sh(buildPasteScript(params.name), { input: data, timeoutMs: 6e4 });
+  if (r.timedOut) throw new RpcFailure("timeout", "file.paste timed out");
+  if (r.code !== 0) throw new RpcFailure("internal", `file.paste exited with code ${r.code}`);
+  const lines = r.stdout.split("\n").map((l) => l.trim()).filter(Boolean);
+  const path8 = lines[lines.length - 1] ?? "";
+  if (!path8.startsWith("/")) throw new RpcFailure("internal", "unexpected paste output");
+  return { path: path8 };
+}
+
+// src/rpc/tmux.ts
+function processFailure2(r) {
+  if (r.timedOut) return new RpcFailure("timeout", "tmux timed out");
+  if (r.error === "enoent") return new RpcFailure("no_tmux", "tmux not found");
+  if (r.error === "maxbuffer") return new RpcFailure("internal", "output too large");
+  return null;
+}
+async function list2(_params) {
+  const r = await run(tmuxPath(), ["list-sessions", "-F", "#{session_name}"]);
+  const failure = processFailure2(r);
+  if (failure) throw failure;
+  if (r.code !== 0) return { sessions: [] };
+  const sessions = r.stdout.split("\n").map((s) => s.trim()).filter(Boolean);
+  return { sessions };
+}
+async function kill(params) {
+  const r = await run(tmuxPath(), ["kill-session", "-t", `=${params.session}`]);
+  const failure = processFailure2(r);
+  if (failure) throw failure;
+  return { killed: r.code === 0 };
+}
+async function capture(params) {
+  const r = await run(tmuxPath(), ["capture-pane", "-p", "-S", `-${params.lines}`, "-t", `=${params.session}:`]);
+  const failure = processFailure2(r);
+  if (failure) throw failure;
+  if (r.code !== 0) throw new RpcFailure("notfound", "session not found");
+  return { text: r.stdout };
+}
+
+// src/rpc/tools.ts
+async function detect(_params) {
+  const r = await sh(DETECT_SCRIPT);
+  if (r.timedOut) throw new RpcFailure("timeout", "tools.detect timed out");
+  if (r.code !== 0) throw new RpcFailure("internal", `tools.detect exited with code ${r.code}`);
+  const { os: os8, capabilities } = parseDetect(r.stdout);
+  return { os: os8, tools: capabilities };
+}
+
+// src/rpc/index.ts
+var handlers = {
+  "tmux.list": list2,
+  "tmux.kill": kill,
+  "tmux.capture": capture,
+  "tools.detect": detect,
+  "hw.probe": probe,
+  "fs.list": list,
+  "fs.mkdir": mkdir,
+  "ai.credential": credential,
+  "file.paste": pasteFile
+};
+
+// src/service/launchd.ts
+import fs3 from "fs";
+import os3 from "os";
+import path3 from "path";
+var LABEL = "dev.termhub.agent";
+function renderPlist({ label, node, script, logPath }) {
+  const escape = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>${escape(label)}</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>${escape(node)}</string>
+    <string>${escape(script)}</string>
+    <string>run</string>
+  </array>
+  <key>RunAtLoad</key>
+  <true/>
+  <key>KeepAlive</key>
+  <dict>
+    <key>SuccessfulExit</key>
+    <false/>
+  </dict>
+  <key>StandardOutPath</key>
+  <string>${escape(logPath)}</string>
+  <key>StandardErrorPath</key>
+  <string>${escape(logPath)}</string>
+  <key>EnvironmentVariables</key>
+  <dict>
+    <key>PATH</key>
+    <string>${escape(agentEnv().PATH ?? "")}</string>
+  </dict>
+  <key>WorkingDirectory</key>
+  <string>${escape(os3.homedir())}</string>
+</dict>
+</plist>
+`;
+}
+function plistPath() {
+  return path3.join(os3.homedir(), "Library", "LaunchAgents", `${LABEL}.plist`);
+}
+function gui() {
+  return `gui/${process.getuid ? process.getuid() : 0}`;
+}
+async function install(opts, deps = {}) {
+  const runFn = deps.run ?? run;
+  const file = plistPath();
+  const plist = renderPlist({ label: LABEL, node: opts.node, script: opts.script, logPath: opts.logPath });
+  fs3.mkdirSync(path3.dirname(file), { recursive: true });
+  fs3.writeFileSync(file, plist, "utf8");
+  await runFn("launchctl", ["bootout", gui(), file]);
+  const result = await runFn("launchctl", ["bootstrap", gui(), file]);
+  if (result.code !== 0) {
+    throw new Error(`launchctl bootstrap failed (code ${result.code}): ${result.stderr.trim() || result.stdout.trim()}`);
+  }
+}
+async function uninstall(deps = {}) {
+  const runFn = deps.run ?? run;
+  const file = plistPath();
+  await runFn("launchctl", ["bootout", gui(), file]);
+  try {
+    fs3.unlinkSync(file);
+  } catch (err) {
+    if (err.code !== "ENOENT") throw err;
+  }
+}
+async function stopRestartLoop(deps = {}) {
+  const platform = deps.platform ?? process.platform;
+  if (platform !== "darwin") return;
+  const runFn = deps.run ?? run;
+  try {
+    await runFn("launchctl", ["bootout", `${gui()}/${LABEL}`]);
+  } catch {
+  }
+}
+async function status(deps = {}) {
+  const runFn = deps.run ?? run;
+  const result = await runFn("launchctl", ["print", `${gui()}/${LABEL}`]);
+  return result.code === 0;
+}
+
+// src/version.ts
+var AGENT_VERSION = "0.1.0";
+
+// src/run.ts
+function detectOs(platform = process.platform) {
+  if (platform === "darwin") return "macos";
+  if (platform === "linux") return "linux";
+  return null;
+}
+async function buildHello(osName) {
+  let tools = [];
+  try {
+    const result = await handlers["tools.detect"]({});
+    tools = result.tools;
+  } catch {
+    tools = [];
+  }
+  return {
+    agent_version: AGENT_VERSION,
+    os: osName,
+    arch: process.arch,
+    hostname: os4.hostname(),
+    tmux: tools.includes("tmux"),
+    tools
+  };
+}
+var REVOKED_MESSAGE = "Token inv\xE1lido ou revogado";
+var UPGRADE_MESSAGE = "Atualize o agente: npm i -g @termhub/agent";
+async function checkServerConnection(config, timeoutMs = 5e3) {
+  const osName = detectOs() ?? "linux";
+  const controller = new AbortController();
+  let timedOut = false;
+  const timer = setTimeout(() => {
+    timedOut = true;
+    controller.abort();
+  }, timeoutMs);
+  try {
+    const { closed } = await connectOnce(
+      {
+        url: config.url,
+        token: config.token,
+        hello: { agent_version: AGENT_VERSION, os: osName, arch: process.arch, hostname: os4.hostname(), tmux: false, tools: [], probe: true },
+        onServerMessage: () => {
+        },
+        onStream: () => {
+        },
+        log: () => {
+        }
+      },
+      controller.signal
+    );
+    const info = await closed;
+    if (info.code === 1e3 && info.reason === "probe-ok") return { ok: true };
+    if (info.code === CLOSE.UNAUTHORIZED) return { ok: false, error: REVOKED_MESSAGE };
+    if (info.code === CLOSE.CONFLICT && info.reason === "protocol") return { ok: false, error: UPGRADE_MESSAGE };
+    if (timedOut) return { ok: false, error: "O servidor n\xE3o respondeu" };
+    return { ok: false, error: `Conex\xE3o encerrada (${info.code}${info.reason ? ` ${info.reason}` : ""})` };
+  } catch (err) {
+    if (err instanceof UpgradeRejectedError && err.status === 401) {
+      return { ok: false, error: REVOKED_MESSAGE };
+    }
+    return { ok: false, error: err instanceof Error ? err.message : String(err) };
+  } finally {
+    clearTimeout(timer);
+    controller.abort();
+  }
+}
+async function exitWithoutRestart(message) {
+  console.error(message);
+  await stopRestartLoop();
+  process.exit(78);
+}
+async function runAgent(config, opts) {
+  const osName = detectOs();
+  if (!osName) {
+    console.error("Sistema n\xE3o suportado");
+    process.exit(1);
+  }
+  const hello = await buildHello(osName);
+  const pty = createPtyManager({ log: opts.log });
+  const dispatch = createDispatcher({ handlers, pty, log: opts.log });
+  try {
+    await runForever(
+      {
+        url: config.url,
+        token: config.token,
+        hello,
+        onServerMessage: dispatch,
+        onStream: (ch, data) => pty.write(ch, data),
+        onDisconnect: () => pty.closeAll(),
+        log: opts.log
+      },
+      opts.signal
+    );
+  } catch (err) {
+    if (err instanceof RevokedError) {
+      await exitWithoutRestart("Token revogado. Rode: termhub-agent connect --url <url>");
+    }
+    if (err instanceof ProtocolMismatchError) {
+      await exitWithoutRestart(UPGRADE_MESSAGE);
+    }
+    throw err;
+  }
+}
+
+// src/commands/connect.ts
+var TOKEN_RE = /^thb_ag_[A-Za-z0-9_-]{43}$/;
+function promptToken() {
+  return new Promise((resolve) => {
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    rl.question("Cole o token do agente: ", (answer) => {
+      rl.close();
+      resolve(answer.trim());
+    });
+  });
+}
+async function runForegroundUntilSignal(config, log2) {
+  const controller = new AbortController();
+  const onSignal = () => controller.abort();
+  process.once("SIGINT", onSignal);
+  process.once("SIGTERM", onSignal);
+  try {
+    await runAgent(config, { signal: controller.signal, log: log2 });
+  } finally {
+    process.off("SIGINT", onSignal);
+    process.off("SIGTERM", onSignal);
+  }
+  process.exit(0);
+}
+async function connectCommand(values, log2) {
+  const url = values.url ?? process.env.TERMHUB_URL;
+  if (!url) {
+    console.error("Uso: termhub-agent connect --url <url> [--token <token>]");
+    process.exitCode = 2;
+    return;
+  }
+  let token = values.token ?? process.env.TERMHUB_TOKEN;
+  if (!token) {
+    if (!process.stdin.isTTY) {
+      console.error("Uso: termhub-agent connect --url <url> --token <token>");
+      process.exitCode = 2;
+      return;
+    }
+    token = await promptToken();
+  }
+  if (!TOKEN_RE.test(token)) {
+    console.error("Token inv\xE1lido.");
+    process.exitCode = 2;
+    return;
+  }
+  const osName = detectOs();
+  if (!osName) {
+    console.error("Sistema n\xE3o suportado");
+    process.exitCode = 1;
+    return;
+  }
+  const hello = await buildHello(osName);
+  const controller = new AbortController();
+  try {
+    await connectOnce({ url, token, hello: { ...hello, probe: true }, onServerMessage: () => {
+    }, onStream: () => {
+    }, log: log2 }, controller.signal);
+    controller.abort();
+  } catch (err) {
+    if (err instanceof UpgradeRejectedError && err.status === 401) {
+      console.error("Token inv\xE1lido ou revogado");
+    } else {
+      console.error(`N\xE3o foi poss\xEDvel conectar: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    process.exitCode = 1;
+    return;
+  }
+  const config = { url, token, machine_id: "", machine_name: "", created_at: (/* @__PURE__ */ new Date()).toISOString() };
+  writeConfig(config);
+  console.log("Conectado. Agora rode: termhub-agent service install");
+  await runForegroundUntilSignal(config, log2);
+}
+
+// src/commands/disconnect.ts
+function disconnectCommand() {
+  deleteConfig();
+  console.log("Configura\xE7\xE3o removida. Revogue o token no app.");
+}
+
+// src/doctor.ts
+import fs4 from "fs";
+import os5 from "os";
+import path4 from "path";
+var SERVER_CHECK_TIMEOUT_MS = 5e3;
+function defaultDoctorPaths() {
+  const home = os5.homedir();
+  const paths = [home, path4.join(home, "Documents"), path4.join(home, "Desktop")];
+  if (process.platform === "darwin") {
+    try {
+      for (const entry of fs4.readdirSync("/Volumes", { withFileTypes: true })) {
+        if (entry.isDirectory()) paths.push(path4.join("/Volumes", entry.name));
+      }
+    } catch {
+    }
+  }
+  return paths;
+}
+function pathErrorCode(err) {
+  const e = err;
+  if (e?.code === "EPERM" || e?.code === "EACCES") return "eperm";
+  if (e?.code) return e.code;
+  return err instanceof Error ? err.message : String(err);
+}
+function checkPathAccess(p, fsImpl = fs4) {
+  try {
+    fsImpl.readdirSync(p);
+    return { path: p, ok: true };
+  } catch (err) {
+    return { path: p, ok: false, error: pathErrorCode(err) };
+  }
+}
+function fullDiskAccessNote(execPath = process.execPath) {
+  return `Conceda Acesso Total ao Disco a ${execPath} em Ajustes \u2192 Privacidade e Seguran\xE7a \u2192 Acesso Total ao Disco`;
+}
+async function runDoctor(paths, deps = {}) {
+  const fsImpl = deps.fs ?? fs4;
+  const connect = deps.connect ?? checkServerConnection;
+  const config = readConfig();
+  const configReport = { ok: config !== null, path: configPath() };
+  const server = config ? await connect(config, SERVER_CHECK_TIMEOUT_MS) : { ok: false, error: "sem configura\xE7\xE3o" };
+  const tmuxCheck = await sh("command -v tmux");
+  const tmux = { ok: tmuxCheck.code === 0, path: tmuxCheck.code === 0 ? tmuxCheck.stdout.trim() || void 0 : void 0 };
+  let nodePty;
+  try {
+    await import("node-pty");
+    nodePty = { ok: true };
+  } catch (err) {
+    nodePty = { ok: false, error: err instanceof Error ? err.message : String(err) };
+  }
+  const pathsReport = paths.map((p) => checkPathAccess(p, fsImpl));
+  return { config: configReport, server, tmux, nodePty, paths: pathsReport };
+}
+function mark(ok) {
+  return ok ? "\u2713" : "\u2717";
+}
+function formatDoctor(report, deps = {}) {
+  const platform = deps.platform ?? process.platform;
+  const execPath = deps.execPath ?? process.execPath;
+  const lines = [];
+  lines.push(`${mark(report.config.ok)} Configura\xE7\xE3o (${report.config.path})`);
+  lines.push(`${mark(report.server.ok)} Servidor${report.server.ok ? "" : report.server.error ? `: ${report.server.error}` : ""}`);
+  lines.push(`${mark(report.tmux.ok)} tmux${report.tmux.path ? ` (${report.tmux.path})` : ""}`);
+  lines.push(`${mark(report.nodePty.ok)} node-pty${report.nodePty.ok ? "" : report.nodePty.error ? `: ${report.nodePty.error}` : ""}`);
+  for (const p of report.paths) {
+    lines.push(`${mark(p.ok)} ${p.path}${p.ok ? "" : p.error ? `: ${p.error}` : ""}`);
+    if (!p.ok && p.error === "eperm" && platform === "darwin") {
+      lines.push(`  \u2192 ${fullDiskAccessNote(execPath)}`);
+    }
+  }
+  return lines.join("\n");
+}
+
+// src/commands/doctor.ts
+async function doctorCommand(paths, json) {
+  const targets = paths.length > 0 ? paths : defaultDoctorPaths();
+  const report = await runDoctor(targets);
+  if (json) {
+    console.log(JSON.stringify(report));
+  } else {
+    console.log(formatDoctor(report));
+  }
+  const allOk = report.config.ok && report.server.ok && report.tmux.ok && report.nodePty.ok && report.paths.every((p) => p.ok);
+  process.exitCode = allOk ? 0 : 1;
+}
+
+// src/commands/run.ts
+async function runCommand(log2) {
+  const config = readConfig();
+  if (!config) {
+    return exitWithoutRestart("Nenhuma configura\xE7\xE3o. Rode: termhub-agent connect --url <url>");
+  }
+  await runForegroundUntilSignal(config, log2);
+}
+
+// src/commands/service.ts
+import os7 from "os";
+
+// src/service/index.ts
+import path7 from "path";
+
+// src/paths.ts
+import { realpathSync } from "fs";
+import path5 from "path";
+import { pathToFileURL } from "url";
+function resolveScriptPath(argv1) {
+  if (!argv1) return "";
+  try {
+    return realpathSync(argv1);
+  } catch {
+    return path5.resolve(argv1);
+  }
+}
+function isMainModule(importMetaUrl, argv1) {
+  if (!argv1) return false;
+  return importMetaUrl === pathToFileURL(resolveScriptPath(argv1)).href;
+}
+
+// src/service/systemd.ts
+import fs5 from "fs";
+import os6 from "os";
+import path6 from "path";
+var UNIT_NAME = "termhub-agent";
+function renderUnit({ node, script, logPath }) {
+  const lines = [
+    "[Unit]",
+    "Description=termhub agent",
+    "After=network-online.target",
+    "",
+    "[Service]",
+    `ExecStart=${node} ${script} run`,
+    "Restart=on-failure",
+    "RestartSec=2",
+    "RestartPreventExitStatus=78",
+    `Environment=PATH=${agentEnv().PATH ?? ""}`
+  ];
+  if (logPath) {
+    lines.push(`StandardOutput=append:${logPath}`, `StandardError=append:${logPath}`);
+  }
+  lines.push("", "[Install]", "WantedBy=default.target", "");
+  return lines.join("\n");
+}
+function unitPath() {
+  return path6.join(os6.homedir(), ".config", "systemd", "user", `${UNIT_NAME}.service`);
+}
+async function install2(opts, deps = {}) {
+  const runFn = deps.run ?? run;
+  const file = unitPath();
+  const unit = renderUnit({ node: opts.node, script: opts.script, logPath: opts.logPath });
+  fs5.mkdirSync(path6.dirname(file), { recursive: true });
+  fs5.writeFileSync(file, unit, "utf8");
+  const reload = await runFn("systemctl", ["--user", "daemon-reload"]);
+  if (reload.code !== 0) throw new Error(`systemctl daemon-reload failed (code ${reload.code}): ${reload.stderr.trim()}`);
+  const enable = await runFn("systemctl", ["--user", "enable", "--now", UNIT_NAME]);
+  if (enable.code !== 0) throw new Error(`systemctl enable --now failed (code ${enable.code}): ${enable.stderr.trim()}`);
+  console.log("Para o agente continuar ap\xF3s o logout: loginctl enable-linger $USER");
+}
+async function uninstall2(deps = {}) {
+  const runFn = deps.run ?? run;
+  await runFn("systemctl", ["--user", "disable", "--now", UNIT_NAME]);
+  try {
+    fs5.unlinkSync(unitPath());
+  } catch (err) {
+    if (err.code !== "ENOENT") throw err;
+  }
+  await runFn("systemctl", ["--user", "daemon-reload"]);
+}
+async function status2(deps = {}) {
+  const runFn = deps.run ?? run;
+  const result = await runFn("systemctl", ["--user", "is-active", UNIT_NAME]);
+  return result.code === 0;
+}
+
+// src/service/index.ts
+function serviceFileOptions() {
+  return {
+    node: process.execPath,
+    script: resolveScriptPath(process.argv[1]),
+    logPath: path7.join(agentHome(), "agent.log")
+  };
+}
+function assertSupported(platform) {
+  if (platform !== "darwin" && platform !== "linux") throw new Error("Sistema n\xE3o suportado");
+}
+async function install3() {
+  const platform = process.platform;
+  assertSupported(platform);
+  const opts = serviceFileOptions();
+  if (platform === "darwin") await install(opts);
+  else await install2(opts);
+}
+async function uninstall3() {
+  const platform = process.platform;
+  assertSupported(platform);
+  if (platform === "darwin") await uninstall();
+  else await uninstall2();
+}
+async function status3() {
+  const platform = process.platform;
+  assertSupported(platform);
+  if (platform === "darwin") return status();
+  return status2();
+}
+
+// src/commands/service.ts
+async function serviceCommand(sub) {
+  switch (sub) {
+    case "install": {
+      const homeCheck = checkPathAccess(os7.homedir());
+      if (!homeCheck.ok && homeCheck.error === "eperm" && process.platform === "darwin") {
+        console.error(fullDiskAccessNote());
+      }
+      await install3();
+      console.log("Servi\xE7o instalado.");
+      return;
+    }
+    case "uninstall":
+      await uninstall3();
+      console.log("Servi\xE7o removido.");
+      return;
+    case "status": {
+      const active = await status3();
+      console.log(active ? "ativo \u2713" : "inativo \u2717");
+      return;
+    }
+    default:
+      console.error("Uso: termhub-agent service install|uninstall|status");
+      process.exitCode = 2;
+  }
+}
+
+// src/commands/status.ts
+var CHECK_TIMEOUT_MS = 5e3;
+async function statusCommand(json) {
+  const config = readConfig();
+  if (!config) {
+    console.error("Nenhuma configura\xE7\xE3o. Rode: termhub-agent connect --url <url>");
+    process.exitCode = 1;
+    return;
+  }
+  const check = await checkServerConnection(config, CHECK_TIMEOUT_MS);
+  if (json) {
+    console.log(JSON.stringify({ url: config.url, machine_name: config.machine_name || null, version: AGENT_VERSION, connected: check.ok }));
+    return;
+  }
+  console.log(`Servidor: ${config.url}`);
+  console.log(`M\xE1quina: ${config.machine_name || "\u2014"}`);
+  console.log(`Vers\xE3o: ${AGENT_VERSION}`);
+  console.log(check.ok ? "conectado \u2713" : `desconectado \u2717${check.error ? ` (${check.error})` : ""}`);
+}
+
+// src/cli.ts
+var log = (msg, meta) => {
+  console.error(meta ? `[termhub-agent] ${msg} ${JSON.stringify(meta)}` : `[termhub-agent] ${msg}`);
+};
+function printHelp() {
+  console.log(`Uso: termhub-agent <comando> [op\xE7\xF5es]
+
+Comandos:
+  connect [--url <url>] [--token <token>]   Conecta este agente ao termhub
+  run                                       Roda o agente em primeiro plano
+  status                                    Mostra o estado da conex\xE3o
+  disconnect                                Remove a configura\xE7\xE3o local
+  service install|uninstall|status          Gerencia o servi\xE7o do sistema
+  doctor [caminhos...]                      Diagnostica problemas comuns
+
+Op\xE7\xF5es:
+  --url <url>       URL do servidor termhub (ou $TERMHUB_URL)
+  --token <token>   Token do agente (ou $TERMHUB_TOKEN)
+  --json            Sa\xEDda em JSON (status, doctor)
+  --version         Mostra a vers\xE3o e sai
+  --help            Mostra esta ajuda e sai`);
+}
+function printVersion() {
+  console.log(`termhub-agent ${AGENT_VERSION}`);
+}
+async function main(argv = process.argv.slice(2)) {
+  let values;
+  let positionals;
+  try {
+    ({ values, positionals } = parseArgs({
+      args: argv,
+      allowPositionals: true,
+      options: {
+        url: { type: "string" },
+        token: { type: "string" },
+        version: { type: "boolean" },
+        help: { type: "boolean" },
+        json: { type: "boolean" }
+      }
+    }));
+  } catch (err) {
+    console.error(err instanceof Error ? err.message : String(err));
+    printHelp();
+    process.exitCode = 2;
+    return;
+  }
+  if (values.version) {
+    printVersion();
+    return;
+  }
+  if (values.help || positionals.length === 0) {
+    printHelp();
+    process.exitCode = values.help ? 0 : 2;
+    return;
+  }
+  const [cmd, ...rest] = positionals;
+  try {
+    switch (cmd) {
+      case "connect":
+        await connectCommand({ url: values.url, token: values.token }, log);
+        break;
+      case "run":
+        await runCommand(log);
+        break;
+      case "status":
+        await statusCommand(!!values.json);
+        break;
+      case "disconnect":
+        disconnectCommand();
+        break;
+      case "service":
+        await serviceCommand(rest[0]);
+        break;
+      case "doctor":
+        await doctorCommand(rest, !!values.json);
+        break;
+      default:
+        console.error(`Comando desconhecido: ${cmd}`);
+        printHelp();
+        process.exitCode = 2;
+    }
+  } catch (err) {
+    console.error(err instanceof Error ? err.message : String(err));
+    process.exitCode = 1;
+  }
+}
+if (isMainModule(import.meta.url, process.argv[1])) {
+  void main();
+}
+export {
+  main
+};