@todoforai/cli 0.1.61 → 0.1.62

package/dist/todoforai-cli.js

@@ -43055,6 +43055,19 @@ class ApiClient {
       throw new Error(`API GET /resources/show failed: ${res.status} ${await res.text()}`);
     return res.json();
   }
+  async shareShow(todoId, key) {
+    const url = `${this.apiUrl}${restBasePath(this.apiKey)}/resources/show/${encodeURIComponent(todoId)}/${encodeURIComponent(key)}/share`;
+    const res = await fetch(url, { method: "POST", headers: { "x-api-key": this.apiKey }, signal: AbortSignal.timeout(30000) });
+    if (!res.ok)
+      throw new Error(`API POST /resources/show/share failed: ${res.status} ${await res.text()}`);
+    return res.json();
+  }
+  async unshareShow(todoId, key) {
+    const url = `${this.apiUrl}${restBasePath(this.apiKey)}/resources/show/${encodeURIComponent(todoId)}/${encodeURIComponent(key)}/share`;
+    const res = await fetch(url, { method: "DELETE", headers: { "x-api-key": this.apiKey }, signal: AbortSignal.timeout(30000) });
+    if (!res.ok)
+      throw new Error(`API DELETE /resources/show/share failed: ${res.status} ${await res.text()}`);
+  }
   async removeShow(todoId, key) {
     const url = `${this.apiUrl}${restBasePath(this.apiKey)}/resources/show/${encodeURIComponent(todoId)}/${encodeURIComponent(key)}`;
     const res = await fetch(url, {
@@ -43597,6 +43610,11 @@ function qualifiedModelIds(listing, filter) {
   return q ? ids.filter((id) => id.toLowerCase().includes(q)) : ids;
 }
 // ../packages/shared-fbe/src/billing.ts
+var HOBBY_ALLOWED = new Set([
+  "anthropic/claude-sonnet-5.5",
+  "anthropic/claude-sonnet-5",
+  "anthropic/claude-haiku-4.5"
+]);
 var USAGE_WINDOWS = {
   SESSION_MS: 5 * 60 * 60 * 1000,
   WEEK_MS: 7 * 24 * 60 * 60 * 1000,
@@ -43901,6 +43919,15 @@ function manualAnswersOf(sources) {
 }
 var manualSamples = (answers) => Object.entries(answers).filter(([, a]) => a.trim()).map(([prompt, text]) => ({ prompt, text: text.trim() }));
 var senderLabel = (s) => s.kind === "team" ? `${s.name} · TODO for AI team` : s.kind === "member" ? `${s.name} · teammate` : `${s.name} · your agent`;
+// ../packages/shared-fbe/src/jarvisEvents.ts
+var STATE = {
+  ["READY" /* READY */]: "agent ended its run and handed back; not opened yet",
+  ["READY_CHECKED" /* READY_CHECKED */]: "agent ended its run and handed back; its window was opened",
+  ["DONE" /* DONE */]: "done and closed",
+  ["ERROR" /* ERROR */]: "failed; not opened yet",
+  ["ERROR_CHECKED" /* ERROR_CHECKED */]: "failed; its window was opened",
+  ["WAITING_FOR_USER" /* WAITING_FOR_USER */]: "blocked, waiting on the user's answer or approval"
+};
 // ../packages/shared-fbe/src/templateBody.ts
 var USER_HEADINGS = new Set([
   "your task",
@@ -44478,6 +44505,7 @@ var tool_catalog_default = {
     versionCmd: "linkedin-api --version 2>/dev/null | sed -n 1p"
   },
   "figma-api": {
+    preinstallCloud: true,
     category: "design",
     pkg: "@todoforai/figma-api",
     installer: "npm",
@@ -44612,6 +44640,20 @@ var tool_catalog_default = {
     ],
     description: "AI music generation, custom lyrics, multiple genres."
   },
+  "tfa-suno": {
+    preinstallCloud: true,
+    category: "media",
+    pkg: "@todoforai/suno-api",
+    installer: "npm",
+    label: "Suno (TODOforAI)",
+    summary: "Generate music and songs from a prompt, billed to your TODOforAI credit.",
+    platformAuth: true,
+    versionCmd: "tfa-suno --version 2>/dev/null | sed -n 1p",
+    credentialPaths: [
+      "~/.config/todoforai/credentials.json"
+    ],
+    description: "Suno music generation via TODOforAI — no Suno key needed, billed to the user's TODOforAI credit (generate $0.12 for 2 songs, refunded if the task fails). Same commands as suno-api: `generate [prompt] [--customMode --lyrics <file> --style --title] [--instrumental] [--model V6]` polls until done and prints audio URLs; `--no-poll` + `details <taskId> [--wait]`; `stems`, `midi`, `lyrics-ts`, `replace-section`. Audio URLs expire after 14 days — download the mp3s you keep. Prefer this over suno-api unless the user has their own sunoapi.org key."
+  },
   ntn: {
     preinstallCloud: true,
     category: "utility",
@@ -44672,6 +44714,9 @@ var tool_catalog_default = {
     preinstallCloud: true
   },
   glab: {
+    preinstallCloud: true,
+    cloudInstallCmd: "curl -fsSL https://gitlab.com/gitlab-org/cli/-/releases/v1.119.0/downloads/glab_1.119.0_linux_amd64.tar.gz | tar -xz -C /tmp bin/glab && install -m0755 /tmp/bin/glab /usr/local/bin/glab",
+    cloudVerifyCmd: "glab --version",
     category: "development",
     pkg: "glab",
     installer: "binary",
@@ -44703,6 +44748,7 @@ var tool_catalog_default = {
     canStreamLogin: true
   },
   eas: {
+    preinstallCloud: true,
     category: "deployment",
     pkg: "eas-cli",
     installer: "npm",
@@ -44718,6 +44764,7 @@ var tool_catalog_default = {
     versionCmd: "eas --version 2>/dev/null | sed -n 1p"
   },
   netlify: {
+    preinstallCloud: true,
     category: "deployment",
     pkg: "netlify-cli",
     installer: "npm",
@@ -44783,6 +44830,9 @@ var tool_catalog_default = {
     canStreamLogin: true
   },
   flyctl: {
+    preinstallCloud: true,
+    cloudInstallCmd: "curl -fsSL https://github.com/superfly/flyctl/releases/download/v0.4.108/flyctl_0.4.108_Linux_x86_64.tar.gz | tar -xz -C /usr/local/bin flyctl",
+    cloudVerifyCmd: "flyctl version",
     category: "cloud",
     pkg: "flyctl",
     installer: "binary",
@@ -44810,6 +44860,7 @@ var tool_catalog_default = {
     versionCmd: "supabase --version 2>/dev/null | sed -n 1p"
   },
   railway: {
+    preinstallCloud: true,
     category: "cloud",
     pkg: "@railway/cli",
     installer: "npm",
@@ -44851,6 +44902,7 @@ var tool_catalog_default = {
     versionCmd: "shop-app --version 2>/dev/null | sed -n 1p"
   },
   "datadog-ci": {
+    preinstallCloud: true,
     category: "monitoring",
     pkg: "@datadog/datadog-ci",
     installer: "npm",
@@ -44879,7 +44931,7 @@ var tool_catalog_default = {
     installer: "npm",
     label: "TODOforAI",
     summary: "Create and follow up on your TODOs, and show results in the chat.",
-    description: 'Manage the user\'s OWN TODOforAI tasks (not code `// TODO` comments). Delegate/spin off work: `tfa-cli "prompt"` creates a real TODO with its own agent and chat (`-n` wait for completion, `--no-watch` fire-and-forget, `--project/--agent/--model`, `--resume <id>`, `addmessage <id> "text"`). Inspect: `list [--status open]`, `--inspect <id>`. Edit any todo without opening it: `status <id> DONE|READY|ARCHIVED|POSTPONED|CANCELLED|DELETED` (close, reopen, shelve, trash — `todo restore <id>` undoes a delete) and `todo set <id|-> title=… group=… star=true schedule=<unix-ms> agent=… brand=…` (own todo fields). Both take ONE id, so a loop over `list --json | jq -r \'.items[].id\'` is how you close, retitle, refile or archive MANY todos at once; `project set|settings|groups …` (name, settings, todo groups), `agent create|update <agent> model=… sysmsg=…` (permissions/MCP/device wiring and delete are refused from an agent shell). Surface results into chat: `show <file|-> [todo-id]` (renders by mimetype; `--card <name>` via project renderer; `--alias <name>` updates in place), `open <url>` embeds a live preview. Notifications: `inbox [needs-you|messages|activity] [--unread]` reads the user\'s bell feed (what finished/failed/needs them while away), `inbox seen [tab]` marks it read; `notify "Title" "message" [--href /t/<id>]` leaves a note in the user\'s Messages tab + phone push (shown as from you); `--to <email>` reaches a member of the current project instead (`project members` lists them, 20/day) — nobody else; same text is delivered once, max 10/day to the user, use for things they must see later (not chat replies). This is the ONLY way to display a local file (image, pdf, html) in the chat: markdown `![](path.png)` with a local/relative path does NOT resolve to workspace files or attachments and 404s in the browser. `--template` for registry workflows.',
+    description: 'Manage the user\'s OWN TODOforAI tasks (not code `// TODO` comments). Delegate/spin off work: `tfa-cli "prompt"` creates a real TODO with its own agent and chat (`-n` wait for completion, `--no-watch` fire-and-forget, `--project/--agent/--model`, `--resume <id>`, `addmessage <id> "text"`). Inspect: `list [--status open]`, `--inspect <id>`. Edit any todo without opening it: `status <id> DONE|READY|ARCHIVED|POSTPONED|CANCELLED|DELETED` (close, reopen, shelve, trash — `todo restore <id>` undoes a delete) and `todo set <id|-> title=… group=… star=true schedule=<unix-ms> agent=… brand=…` (own todo fields). Both take ONE id, so a loop over `list --json | jq -r \'.items[].id\'` is how you close, retitle, refile or archive MANY todos at once; `project set|settings|groups …` (name, settings, todo groups), `agent create|update <agent> model=… sysmsg=…` (permissions/MCP/device wiring and delete are refused from an agent shell). Surface results into chat: `show <file|-> [todo-id]` (renders by mimetype, private to the todo\'s readers; `--card <name>` via project renderer; `--alias <name>` updates in place, `--alias <todoId>:<name>` updates another todo\'s artifact; `show share <ref>` makes it public and prints the link, `show unshare <ref>` makes it private again), `open <url>` embeds a live preview. Pick by where the output lives: read once → plain reply; interactive, this chat only → `html_snippet`; kept/revised later → `show --alias`, then `show share` only if someone outside needs a link; format the user asked for (pptx, docx…) → `show` the file. Notifications: `inbox [needs-you|messages|activity] [--unread]` reads the user\'s bell feed (what finished/failed/needs them while away), `inbox seen [tab]` marks it read; `notify "Title" "message" [--href /t/<id>]` leaves a note in the user\'s Messages tab + phone push (shown as from you); `--to <email>` reaches a member of the current project instead (`project members` lists them, 20/day) — nobody else; same text is delivered once, max 10/day to the user, use for things they must see later (not chat replies). This is the ONLY way to display a local file (image, pdf, html) in the chat: markdown `![](path.png)` with a local/relative path does NOT resolve to workspace files or attachments and 404s in the browser. `--template` for registry workflows.',
     installCmd: "npm install -g @todoforai/cli",
     versionCmd: "tfa-cli --version 2>/dev/null | sed -n 1p",
     preinstallCloud: true,
@@ -45006,7 +45058,7 @@ var tool_catalog_default = {
     label: "Google Cloud",
     summary: "Manage your Google Cloud projects and services.",
     needsPython: true,
-    installCmd: `curl -fsSL https://dl.google.com/dl/cloudsdk/channels/rapid/google-cloud-sdk.tar.gz | tar -xzC "$HOME" && CLOUDSDK_PYTHON="$py" "$HOME/google-cloud-sdk/install.sh" --quiet --install-python false --usage-reporting false --path-update false --command-completion false && mkdir -p "$HOME/.todoforai/tools/bin" && rm -f "$HOME/.todoforai/tools/bin/gcloud" && printf '#!/bin/sh\\nCLOUDSDK_PYTHON="\${CLOUDSDK_PYTHON:-%s}" exec "$HOME/google-cloud-sdk/bin/gcloud" "$@"\\n' "$py" > "$HOME/.todoforai/tools/bin/gcloud" && chmod +x "$HOME/.todoforai/tools/bin/gcloud"`,
+    installCmd: `case "$(uname -s)-$(uname -m)" in Darwin-arm64) p=darwin-arm;; Darwin-*) p=darwin-x86_64;; Linux-aarch64|Linux-arm64) p=linux-arm;; *) p=linux-x86_64;; esac && tmp="$HOME/.gcloud-new.$$" && rm -rf "$tmp" && mkdir -p "$tmp" && curl -fsSL "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-cli-$p.tar.gz" | tar -xzC "$tmp" && rm -rf "$HOME/google-cloud-sdk" && mv "$tmp/google-cloud-sdk" "$HOME/google-cloud-sdk" && rm -rf "$tmp" && mkdir -p "$HOME/.todoforai/tools/bin" && rm -f "$HOME/.todoforai/tools/bin/gcloud" && printf '#!/bin/sh\\nCLOUDSDK_PYTHON="\${CLOUDSDK_PYTHON:-%s}" exec "$HOME/google-cloud-sdk/bin/gcloud" "$@"\\n' "$py" > "$HOME/.todoforai/tools/bin/gcloud" && chmod +x "$HOME/.todoforai/tools/bin/gcloud"`,
     statusCmd: `gcloud auth list --filter=status:ACTIVE --format="value(account)" 2>/dev/null | tr -d '\\r' | grep -m1 .`,
     loginCmd: "gcloud auth login --no-launch-browser",
     loginNeedsPty: true,
@@ -45015,8 +45067,7 @@ var tool_catalog_default = {
     credentialPaths: ["~/.config/gcloud"],
     description: "Official Google Cloud CLI. `gcloud auth login --no-launch-browser` prints the OAuth URL and waits for the pasted verification code.",
     versionCmd: "gcloud --version 2>/dev/null | sed -n 1p",
-    uninstallCmd: 'rm -rf "$HOME/google-cloud-sdk" "$HOME/.todoforai/tools/bin/gcloud"; hash -r 2>/dev/null; ! command -v gcloud >/dev/null 2>&1 || { echo "gcloud is still on PATH: $(command -v gcloud)"; exit 1; }',
-    updateCmd: "gcloud components update --quiet"
+    uninstallCmd: 'rm -rf "$HOME/google-cloud-sdk" "$HOME/.todoforai/tools/bin/gcloud"; hash -r 2>/dev/null; ! command -v gcloud >/dev/null 2>&1 || { echo "gcloud is still on PATH: $(command -v gcloud)"; exit 1; }'
   },
   az: {
     category: "cloud",
@@ -45150,19 +45201,6 @@ var tool_catalog_default = {
     },
     preinstallJarvis: true
   },
-  "todoforai-browser": {
-    category: "development",
-    pkg: "@todoforai/browser",
-    aliases: ["tfa-browser"],
-    installer: "npm",
-    preinstallCloud: true,
-    label: "Browser (Extension)",
-    summary: "Drive your own browser through the TODOforAI extension.",
-    versionCmd: `node -p "require(require('fs').realpathSync(require('child_process').execSync('command -v todoforai-browser',{encoding:'utf8'}).trim()).replace(/\\/dist\\/index\\.js$/, '/package.json')).version" 2>/dev/null`,
-    internal: true,
-    preinstallJarvis: true,
-    description: "Browser automation via extension (non-headless), web scraping, accessibility tree snapshots, screenshots, PDF generation"
-  },
   "tfa-explore": {
     preinstallCloud: true,
     category: "development",
@@ -45633,6 +45671,20 @@ var tool_catalog_default = {
     description: "WordPress REST API CLI. `wordpress-api auth --site https://example.com --user <user> --password '<application password>'` (application password, not the login password). Reading published content needs no auth. `posts list|get|create|update|delete`, `pages`, `media`, `categories`. `posts create` saves a draft unless --status publish. On Elementor/JetEngine sites content.rendered comes back empty — fetch the post's public URL for the body.",
     versionCmd: "wordpress-api --version 2>/dev/null | sed -n 1p"
   },
+  "mailchimp-api": {
+    category: "marketing",
+    pkg: "@todoforai/mailchimp-api",
+    installer: "npm",
+    label: "Mailchimp",
+    summary: "Manage Mailchimp audiences, contacts, email campaigns and reports.",
+    loginCmd: "mailchimp-api auth --api-key <api_key>",
+    statusCmd: `mailchimp-api whoami 2>/dev/null | sed -n 's/.*"account_name"[[:space:]]*:[[:space:]]*"\\([^"]*\\)".*/\\1/p' | grep -m1 .`,
+    credentialPaths: [
+      "~/.config/mailchimp-api/credentials.json"
+    ],
+    versionCmd: "mailchimp-api --version 2>/dev/null | sed -n 1p",
+    description: "Independent CLI over the official Mailchimp Marketing API: 155 endpoint commands for lists (email audiences), members (contacts; email or MD5), tags, segments, merge fields, interests, notes/events, campaigns/content/tests/scheduling, templates, reports, assets, landing pages, classic automations, journey triggers, webhooks and batches. JSON output; --data JSON|@file|-; --schema; --all pagination. Every write requires --yes; use --dry-run first. Raw request METHOD /path covers other Marketing endpoints. API-key auth, not OAuth onboarding. Plan/API restrictions apply; no Transactional/Mandrill or Open Commerce. Run --help for limits and consent cautions."
+  },
   "facebook-pages-api": {
     preinstallCloud: true,
     category: "social",
@@ -45647,8 +45699,10 @@ var tool_catalog_default = {
     versionCmd: "facebook-pages-api --version 2>/dev/null | sed -n 1p"
   },
   "ews-api": {
+    preinstallCloud: true,
     category: "email",
     pkg: "ews-api",
+    packages: ["ews-api==0.2.0"],
     installer: "pip",
     label: "Exchange (EWS)",
     summary: "Read and write mail on a company Exchange server.",
@@ -45676,6 +45730,7 @@ var tool_catalog_default = {
     canStreamLogin: true
   },
   neonctl: {
+    preinstallCloud: true,
     category: "database",
     pkg: "neonctl",
     installer: "npm",
@@ -45698,7 +45753,7 @@ var tool_catalog_default = {
     label: "Microsoft 365",
     summary: "Work with Microsoft 365 mail, Teams, SharePoint and users.",
     statusCmd: `m365 status --output text 2>/dev/null | tr -d '"' | grep -vi 'logged out' | grep -m1 .`,
-    loginCmd: "m365 login --authType deviceCode --appId 04b07795-8ddb-461a-bbee-02f9e1bf7b46",
+    loginCmd: "m365 login --authType deviceCode --appId 14d82eec-204b-4c2f-b7e8-296a70dab67e",
     deviceCodePattern: "enter the code ([A-Z0-9]{8,}) to authenticate",
     oauthUrlPattern: "open the page (https://\\S+) and enter",
     credentialPaths: ["~/.cli-m365-msal.json", "~/.cli-m365-connection.json"],
@@ -45737,6 +45792,7 @@ var tool_catalog_default = {
     versionCmd: "posthog-cli --version 2>/dev/null | sed -n 1p"
   },
   canva: {
+    preinstallCloud: true,
     category: "design",
     pkg: "@canva/cli",
     installer: "npm",
@@ -45752,6 +45808,7 @@ var tool_catalog_default = {
     oauthUrlPattern: "OPEN_URL: (https://www\\.canva\\.com/api/oauth/authorize\\S+)"
   },
   webflow: {
+    preinstallCloud: true,
     category: "development",
     pkg: "@webflow/webflow-cli",
     installer: "npm",
@@ -45766,6 +45823,7 @@ var tool_catalog_default = {
     versionCmd: "webflow --version 2>/dev/null | sed -n 1p"
   },
   readwise: {
+    preinstallCloud: true,
     category: "productivity",
     pkg: "@readwise/cli",
     installer: "npm",
@@ -45836,6 +45894,7 @@ var tool_catalog_default = {
     versionCmd: "exa --version 2>/dev/null | sed -n 1p"
   },
   mobbin: {
+    preinstallCloud: true,
     category: "design",
     pkg: "mobbin",
     installer: "npm",
@@ -45866,6 +45925,7 @@ var tool_catalog_default = {
     versionCmd: "{ python -c 'import sys; from importlib.metadata import version; print(version(sys.argv[1]))' blender-mcp || python3 -c 'import sys; from importlib.metadata import version; print(version(sys.argv[1]))' blender-mcp; } 2>/dev/null"
   },
   "google-ads": {
+    preinstallCloud: true,
     category: "marketing",
     pkg: "google-ads",
     packages: [
@@ -45935,6 +45995,7 @@ var model_promos_default = {
     { family: "gpt-5-6-sol", rate: 0.85, starts: "2026-08-26", ends: "2026-09-13" },
     { family: "gpt-5-6-sol", rate: 0.8, starts: "2026-09-14", ends: "2026-11-21" },
     { family: "gpt-6-sol", rate: 0.8, starts: "2026-09-22", ends: "2026-11-21" },
+    { family: "gpt-6-1-sol", rate: 0.8, starts: "2026-09-29", ends: "2026-11-21" },
     { family: "gpt-6-luna", rate: 0.8, starts: "2026-09-22", ends: "2026-11-21" },
     { family: "gpt-6-astra", rate: 0.85, starts: "2026-09-05", ends: "2026-09-13", boostable: false },
     { family: "gpt-6-astra", rate: 0.8, starts: "2026-09-14", ends: "2026-11-21", boostable: false },
@@ -46135,7 +46196,7 @@ import { parseArgs } from "util";
 // package.json
 var package_default = {
   name: "@todoforai/cli",
-  version: "0.1.61",
+  version: "0.1.62",
   type: "module",
   bin: {
     "todoforai-cli": "bin/todoforai-cli.js",
@@ -46247,15 +46308,27 @@ Usage:
   tfa-cli show <file|-> [todo-id]     Render a file by mimetype (- reads stdin)
                                       [--title T] [--alias A] [--mime M] [--card <name>] [--link] [--json]
                                       --link: compact download chip instead of inline render
-                                      Prints "<todoId>:<alias|id>  <public url>". Re-showing with the same
-                                      --alias updates the block in place; old versions stay at /<id>/<version>
-  tfa-cli show rm <ref|alias>         Take it down (block, url, every version)
+                                      Prints "<todoId>:<alias|id>". Private: visible to whoever can read the todo.
+                                      Re-showing with the same --alias updates the block in place (new version)
+                                      --alias <todoId>:<alias> updates that todo's block instead,
+                                      so a later chat can revise an artifact made elsewhere
+  tfa-cli show share <ref|alias>      Make it public; prints its link (serves the latest version)
+  tfa-cli show unshare <ref|alias>    Make it private again (the link stops working)
+  tfa-cli show rm <ref|alias>         Take it down (block, link, every version)
   tfa-cli show list [todo-id]         List show blocks (ref, title, mime/url, card)
                                       [--project <id>] [--card <name>] [--json]
                                       no todo-id + --project (or $TODOFORAI_PROJECT_ID) = every todo
   tfa-cli open <url> [todo-id]        Live http(s) url as a preview  [--title T] [--alias A] [--json]
 
 todo-id defaults to $TODOFORAI_TODO_ID (agent shell) or the last todo this CLI touched.
+
+When to use what:
+  read once, move on             → plain chat reply
+  interactive, this chat only    → html_snippet (can exec/connect/chat back)
+  keep / revise later            → show <file> --alias <name>  (versioned, private)
+  someone outside needs it       → show share <alias>  (public link, revocable)
+  a live web page                → open <url>
+  a format the user asked for    → show the file (pptx, docx, xlsx, pdf…)
 `);
 }
 var STATUS_HELP = {
@@ -48308,7 +48381,7 @@ var createBuilder = (self, _styler, _isEmpty) => {
       return applyStyle(builder, "" + arguments_[0]);
     }
     if (arguments_.length === 2) {
-      return applyStyle(builder, arguments_[0] + " " + arguments_[1]);
+      return applyStyle(builder, `${arguments_[0] ?? ""} ${arguments_[1] ?? ""}`);
     }
     return applyStyle(builder, arguments_.join(" "));
   };
@@ -56024,7 +56097,7 @@ class $ZodCyclicError extends Error {
     this.name = "ZodCyclicError";
   }
 }
-var STATE = "~memo";
+var STATE2 = "~memo";
 var NO_ISSUES = [];
 function isRef(value) {
   return value !== null && typeof value === "object";
@@ -56234,10 +56307,10 @@ var memo = {
         const input = payload.value;
         if (!isRef(input))
           return base(payload, ctx);
-        let state = ctx[STATE];
+        let state = ctx[STATE2];
         if (!state) {
           state = { buckets: new WeakMap, backEdges: undefined };
-          ctx[STATE] = state;
+          ctx[STATE2] = state;
         }
         let bucket;
         if (lastCtx === ctx) {
@@ -56286,7 +56359,7 @@ function memoizer() {
   return memo;
 }
 function isBackEdge(ctx, value) {
-  const backEdges = ctx[STATE]?.backEdges;
+  const backEdges = ctx[STATE2]?.backEdges;
   return backEdges !== undefined && isRef(value) && backEdges.has(value);
 }
 // node_modules/zod/v4/locales/index.js
@@ -73525,53 +73598,124 @@ function protocolErrorResponse(error62) {
   };
 }
 
+// node_modules/@agentclientprotocol/sdk/dist/stream-limits.js
+var DEFAULT_MAX_MESSAGE_BYTES = 32 * 1024 * 1024;
+
+class MessageTooLargeError extends Error {
+  maxMessageBytes;
+  constructor(maxMessageBytes) {
+    super(`Incoming ACP data exceeds the configured ${maxMessageBytes} byte limit`);
+    this.maxMessageBytes = maxMessageBytes;
+    this.name = "MessageTooLargeError";
+  }
+}
+function resolveMaxMessageBytes(value) {
+  const maxMessageBytes = value ?? DEFAULT_MAX_MESSAGE_BYTES;
+  if (!Number.isSafeInteger(maxMessageBytes) || maxMessageBytes <= 0) {
+    throw new RangeError("maxMessageBytes must be a positive safe integer");
+  }
+  return maxMessageBytes;
+}
+
+class MessageBuffer {
+  #buffer = new Uint8Array(0);
+  #length = 0;
+  #maxMessageBytes;
+  constructor(maxMessageBytes) {
+    this.#maxMessageBytes = resolveMaxMessageBytes(maxMessageBytes);
+  }
+  get byteLength() {
+    return this.#length;
+  }
+  get lastByte() {
+    return this.#buffer[this.#length - 1];
+  }
+  #checkAppend(byteLength) {
+    if (byteLength > this.#maxMessageBytes - this.#length) {
+      this.clear();
+      throw new MessageTooLargeError(this.#maxMessageBytes);
+    }
+  }
+  append(bytes) {
+    this.#checkAppend(bytes.byteLength);
+    const length = this.#length + bytes.byteLength;
+    if (length > this.#buffer.byteLength) {
+      const capacity = Math.min(this.#maxMessageBytes, Math.max(length, this.#buffer.byteLength * 2, 1024));
+      const buffer = new Uint8Array(capacity);
+      buffer.set(this.#buffer.subarray(0, this.#length));
+      this.#buffer = buffer;
+    }
+    this.#buffer.set(bytes, this.#length);
+    this.#length = length;
+  }
+  take() {
+    const bytes = this.#buffer.subarray(0, this.#length);
+    this.clear();
+    return bytes;
+  }
+  clear() {
+    this.#buffer = new Uint8Array(0);
+    this.#length = 0;
+  }
+}
+
 // node_modules/@agentclientprotocol/sdk/dist/line-buffer.js
 var newline = 10;
 
 class LineBuffer {
-  #pending = [];
-  push(chunk) {
-    const lines = [];
+  #pending;
+  #maxMessageBytes;
+  constructor(maxMessageBytes) {
+    this.#maxMessageBytes = resolveMaxMessageBytes(maxMessageBytes);
+    this.#pending = new MessageBuffer(Math.min(Number.MAX_SAFE_INTEGER, this.#maxMessageBytes + 1));
+  }
+  *push(chunk) {
     let start = 0;
     let newlineIndex = chunk.indexOf(newline, start);
     while (newlineIndex !== -1) {
-      lines.push(this.#takeLine(chunk.subarray(start, newlineIndex)));
+      yield this.#takeLine(chunk.subarray(start, newlineIndex));
       start = newlineIndex + 1;
       newlineIndex = chunk.indexOf(newline, start);
     }
     if (start < chunk.byteLength) {
-      this.#pending.push(start === 0 ? chunk : new Uint8Array(chunk.subarray(start)));
+      const tail = chunk.subarray(start);
+      this.#checkLine(tail);
+      this.#pending.append(tail);
     }
-    return lines;
   }
   flush() {
-    if (this.#pending.length === 0) {
+    if (this.#pending.byteLength === 0) {
       return;
     }
-    return this.#takeLine(new Uint8Array(0));
+    return stripCarriageReturn(this.#pending.take());
+  }
+  clear() {
+    this.#pending.clear();
   }
   #takeLine(tail) {
-    if (this.#pending.length === 0) {
-      return tail;
+    this.#checkLine(tail);
+    if (this.#pending.byteLength === 0) {
+      return stripCarriageReturn(tail);
     }
-    let total = tail.byteLength;
-    for (const part of this.#pending) {
-      total += part.byteLength;
-    }
-    const line = new Uint8Array(total);
-    let offset = 0;
-    for (const part of this.#pending) {
-      line.set(part, offset);
-      offset += part.byteLength;
+    this.#pending.append(tail);
+    return stripCarriageReturn(this.#pending.take());
+  }
+  #checkLine(tail) {
+    const lastByte = tail.byteLength > 0 ? tail[tail.byteLength - 1] : this.#pending.lastByte;
+    const byteLength = this.#pending.byteLength + tail.byteLength - (lastByte === 13 ? 1 : 0);
+    if (byteLength > this.#maxMessageBytes) {
+      this.clear();
+      throw new MessageTooLargeError(this.#maxMessageBytes);
     }
-    line.set(tail, offset);
-    this.#pending = [];
-    return line;
   }
 }
+function stripCarriageReturn(line) {
+  return line[line.byteLength - 1] === 13 ? line.subarray(0, -1) : line;
+}
 
 // node_modules/@agentclientprotocol/sdk/dist/stream.js
-function ndJsonStream(output2, input2) {
+function ndJsonStream(output2, input2, options = {}) {
+  const maxMessageBytes = resolveMaxMessageBytes(options.maxMessageBytes);
   const textEncoder = new TextEncoder;
   const textDecoder = new TextDecoder;
   let cancelled = false;
@@ -73593,7 +73737,7 @@ function ndJsonStream(output2, input2) {
   };
   const readable = new ReadableStream({
     async start(controller) {
-      const lines = new LineBuffer;
+      const lines = new LineBuffer(maxMessageBytes);
       const enqueueLine = async (lineBytes) => {
         const trimmedLine = textDecoder.decode(lineBytes).trim();
         if (!trimmedLine) {
@@ -73645,8 +73789,10 @@ function ndJsonStream(output2, input2) {
           return;
         }
         controller.error(err);
+        reader.cancel(err).catch(() => {});
         return;
       } finally {
+        lines.clear();
         if (inputReader === reader) {
           inputReader = undefined;
         }
@@ -73688,8 +73834,8 @@ var zGuardCreateElicitationResponseCancel = object({
   action: literal("cancel")
 });
 // node_modules/@agentclientprotocol/sdk/dist/acp.js
-function ndJsonStream2(output2, input2) {
-  return ndJsonStream(output2, input2);
+function ndJsonStream2(output2, input2, options) {
+  return ndJsonStream(output2, input2, options);
 }
 function emptyObjectResponse(response) {
   return response ?? {};
@@ -75128,6 +75274,7 @@ try {
   const pkgPath = path4.resolve(fileURLToPath(import.meta.url), "../../package.json");
   checkForUpdates(JSON.parse(readFileSync3(pkgPath, "utf-8")));
 } catch {}
+var aliasTodoId = (alias) => typeof alias === "string" && alias.includes(":") ? alias.slice(0, alias.indexOf(":")) : undefined;
 function formatPathWithTilde(path5) {
   const home = homedir3();
   return path5.startsWith(home) ? path5.replace(home, "~") : path5;
@@ -75472,14 +75619,16 @@ async function main() {
       const kind = it.url ? `url ${it.url}` : it.mime || "";
       const card = it.cardRef ? ` card=${it.cardRef}` : "";
       const link = it.display === "link" ? " link" : "";
-      console.log(`${it.ref}  ${it.title || it.filename || ""}  ${kind}${card}${link}`);
+      const shared = it.shareUrl ? `  ${it.shareUrl}` : "";
+      console.log(`${it.ref}  ${it.title || it.filename || ""}  ${kind}${card}${link}${shared}`);
     }
     return;
   }
-  if (positionals[0] === "show" && positionals[1] === "rm") {
+  const showSub = positionals[1];
+  if (positionals[0] === "show" && (showSub === "rm" || showSub === "share" || showSub === "unshare")) {
     const arg = positionals[2];
     if (!arg) {
-      process.stderr.write(`${RED3}Usage: tfa-cli show rm <ref|alias>${RESET2}
+      process.stderr.write(`${RED3}Usage: tfa-cli show ${showSub} <ref|alias>${RESET2}
 `);
       process.exit(2);
     }
@@ -75487,18 +75636,30 @@ async function main() {
     const todoId = sep >= 0 ? arg.slice(0, sep) : getEnv("TODO_ID") || cfgScope.data.last_todo_id;
     const key = sep >= 0 ? arg.slice(sep + 1) : arg;
     if (!todoId || !key) {
-      process.stderr.write(`${RED3}show rm: need <todoId>:<alias> (no current todo)${RESET2}
+      process.stderr.write(`${RED3}show ${showSub}: need <todoId>:<alias> (no current todo)${RESET2}
 `);
       process.exit(2);
     }
-    await api2.removeShow(todoId, key);
-    process.stderr.write(`${GREEN2}\u2705 removed ${todoId}:${key}${RESET2}
+    if (showSub === "rm") {
+      await api2.removeShow(todoId, key);
+      process.stderr.write(`${GREEN2}\u2705 removed ${todoId}:${key}${RESET2}
 `);
+    } else if (showSub === "share") {
+      const res = await api2.shareShow(todoId, key);
+      if (args.json)
+        console.log(JSON.stringify(res, null, 2));
+      else
+        console.log(res.url);
+    } else {
+      await api2.unshareShow(todoId, key);
+      process.stderr.write(`${GREEN2}\u2705 ${todoId}:${key} is private again${RESET2}
+`);
+    }
     return;
   }
   if (positionals[0] === "show") {
     const [, filePath, todoArg] = positionals;
-    const todoId = todoArg || getEnv("TODO_ID") || cfgScope.data.last_todo_id;
+    const todoId = todoArg || aliasTodoId(args.alias) || getEnv("TODO_ID") || cfgScope.data.last_todo_id;
     if (!filePath || !todoId) {
       process.stderr.write(`${RED3}Usage: tfa-cli show <file|-> [todo-id] [--title T] [--alias A] [--mime M] [--card <name>] [--link]${RESET2}
 `);
@@ -75536,12 +75697,12 @@ async function main() {
     if (args.json)
       console.log(JSON.stringify(res, null, 2));
     else
-      console.log(res.url ? `${res.ref}  ${res.url}` : res.ref);
+      console.log(res.shareUrl ? `${res.ref}  ${res.shareUrl}` : res.ref);
     return;
   }
   if (positionals[0] === "open") {
     const [, url2, todoArg] = positionals;
-    const todoId = todoArg || getEnv("TODO_ID") || cfgScope.data.last_todo_id;
+    const todoId = todoArg || aliasTodoId(args.alias) || getEnv("TODO_ID") || cfgScope.data.last_todo_id;
     if (!url2 || !todoId) {
       process.stderr.write(`${RED3}Usage: tfa-cli open <url> [todo-id]${RESET2}
 `);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@todoforai/cli",
-  "version": "0.1.61",
+  "version": "0.1.62",
   "type": "module",
   "bin": {
     "todoforai-cli": "bin/todoforai-cli.js",