@vosjs/cli 0.47.0 → 0.48.1

package/dist/{chunk-E42NCNWP.js → chunk-RHPRZQRM.js}

@@ -27,8 +27,8 @@ import {
 
 // src/plugin/run.ts
 import { mkdir as mkdir10, readFile as readFile15, rm as rm5 } from "fs/promises";
-import { existsSync as existsSync16 } from "fs";
-import { join as join19, resolve as resolve9 } from "path";
+import { existsSync as existsSync18 } from "fs";
+import { join as join21, resolve as resolve9 } from "path";
 import {
   END_CARD_FROM as END_CARD_FROM2,
   docOutputDuration as docOutputDuration3,
@@ -2393,6 +2393,16 @@ function startTakeServer(rootDir, pages) {
   const server = createServer((req, res) => {
     const url = new URL(req.url ?? "/", "http://x");
     res.setHeader("access-control-allow-origin", "*");
+    res.setHeader("access-control-allow-private-network", "true");
+    if (req.method === "OPTIONS") {
+      res.writeHead(204, {
+        "access-control-allow-methods": "GET, POST, OPTIONS",
+        "access-control-allow-headers": "*",
+        "access-control-max-age": "600"
+      });
+      res.end();
+      return;
+    }
     if (req.method === "POST" && url.pathname === "/save") {
       const name = (url.searchParams.get("name") ?? "out.bin").replace(
         /[^\w.-]/g,
@@ -5120,7 +5130,7 @@ async function pickStillTimes(browser, dir, doc, duration, opts) {
   const vh = meta.captureHeight ?? meta.height;
   const probeDir = await mkdtemp(join8(tmpdir(), "vos-moments-"));
   try {
-    const probe = await framesTake(browser, dir, {
+    const probe2 = await framesTake(browser, dir, {
       times: candidates.map((c) => c.time),
       width: PROBE_WIDTH,
       height: Math.max(2, Math.round(PROBE_WIDTH * vh / vw / 2) * 2),
@@ -5131,7 +5141,7 @@ async function pickStillTimes(browser, dir, doc, duration, opts) {
       }
     });
     const byTime = /* @__PURE__ */ new Map();
-    for (const frame of probe.frames) {
+    for (const frame of probe2.frames) {
       const img = decodePng(new Uint8Array(await readFile6(frame.file)));
       if (!img) continue;
       const whole = { x: 0, y: 0, w: img.w, h: img.h };
@@ -9049,6 +9059,41 @@ async function browserLogin(origin, r, opts) {
     "no approval within 15 minutes \u2014 run `vos login` again, or mint a key at https://vos.so/app/api and pass --key"
   );
 }
+var HANDOFF_URL = /^(https?:\/\/[^/]+)\/h\/(vos_ho_[A-Za-z0-9_-]+)$/;
+function parseHandoffUrl(url) {
+  const m = HANDOFF_URL.exec(url.trim());
+  return m ? { origin: m[1], token: m[2] } : null;
+}
+async function handoffLogin(url, r, opts = {}) {
+  const parsed = parseHandoffUrl(url);
+  if (!parsed)
+    throw new Error(
+      "--handoff wants the link a person copied from vos.so, https://vos.so/h/vos_ho_\u2026"
+    );
+  r.log(`exchanging the setup link at ${parsed.origin}\u2026`);
+  const res = await apiJson(parsed.origin, "/api/cli/login/exchange", {
+    method: "POST",
+    body: { token: parsed.token, hostname: hostname().slice(0, 64) }
+  });
+  if (res.status === 200 && res.body.status === "ok") {
+    const path = (opts.store ?? writeCredential)(res.body.key);
+    const user = typeof res.body.user === "object" && res.body.user !== null ? res.body.user.name ?? "" : "";
+    return {
+      path,
+      user,
+      keyName: String(res.body.keyName ?? ""),
+      origin: parsed.origin
+    };
+  }
+  if (res.status === 404 && !res.body.status) {
+    throw new Error(
+      `${parsed.origin} does not support setup links yet \u2014 run \`vos login\` instead`
+    );
+  }
+  const said = typeof res.body.error === "string" ? res.body.error : apiError("exchange", res);
+  const hint = typeof res.body.hint === "string" ? ` ${res.body.hint}` : "";
+  throw new Error(`${said}${hint}`);
+}
 
 // src/plugin/program.ts
 var BOOLEAN_FLAGS2 = /* @__PURE__ */ new Set([
@@ -9595,6 +9640,21 @@ async function cmdLogin(argv) {
     origin: strFlag(flags, "origin"),
     api: strFlag(flags, "api")
   });
+  const handoffUrl = strFlag(flags, "handoff");
+  if (handoffUrl) {
+    const done = await handoffLogin(handoffUrl, r);
+    r.done(
+      {
+        path: done.path,
+        origin: done.origin,
+        user: done.user,
+        keyName: done.keyName,
+        next_step: "the link is spent; vos push when you want the work hosted"
+      },
+      `Signed in${done.user ? ` as ${done.user}` : ""} \u2014 key "${done.keyName}" stored at ${done.path} (used by every vos platform verb). The link is spent.`
+    );
+    return EXIT_OK;
+  }
   const explicit = strFlag(flags, "key") ?? process.env.VOS_API_KEY?.trim();
   if (explicit) return storeKey(explicit, origin, r);
   try {
@@ -9623,9 +9683,9 @@ async function cmdLogin(argv) {
   return storeKey(key, origin, r);
 }
 async function storeKey(key, origin, r) {
-  const probe = await apiJson(origin, "/api/folders", { key });
-  if (probe.status === 401 || probe.status === 403) {
-    throw new Error(apiError("validate key", probe));
+  const probe2 = await apiJson(origin, "/api/folders", { key });
+  if (probe2.status === 401 || probe2.status === 403) {
+    throw new Error(apiError("validate key", probe2));
   }
   const path = writeCredential(key);
   r.done(
@@ -10764,8 +10824,551 @@ async function cmdActionsScript(input, flags) {
   return EXIT_OK;
 }
 
-// src/plugin/run.ts
+// src/plugin/machineCmd.ts
+import { spawnSync } from "child_process";
+import {
+  cpSync,
+  existsSync as existsSync17,
+  mkdirSync as mkdirSync3,
+  readFileSync as readFileSync8,
+  rmSync as rmSync2,
+  writeFileSync as writeFileSync3
+} from "fs";
+import { homedir as homedir3 } from "os";
+import { join as join20 } from "path";
+import { chromium as chromium2 } from "playwright";
+
+// src/plugin/machine.ts
+import { existsSync as existsSync16, readFileSync as readFileSync7, readdirSync as readdirSync4, statSync as statSync4 } from "fs";
+import { dirname as dirname5, join as join19 } from "path";
+var AGENT_NAMES = [
+  "claude",
+  "cursor",
+  "codex",
+  "copilot"
+];
+var PROJECT_DIRS = {
+  claude: [".claude"],
+  cursor: [".cursor"],
+  codex: [".codex", ".agents"],
+  copilot: [".github/copilot"]
+};
+var HOME_DIRS = {
+  claude: [".claude"],
+  cursor: [".cursor"],
+  codex: [".codex", ".agents"],
+  copilot: [".copilot"]
+};
+function detectAgents(root, opts = {}) {
+  const exists = opts.exists ?? existsSync16;
+  const out = [];
+  for (const agent of AGENT_NAMES) {
+    for (const rel of PROJECT_DIRS[agent]) {
+      const dir = join19(root, rel);
+      if (exists(dir)) out.push({ agent, dir, scope: "project" });
+    }
+    if (agent === "copilot" && !out.some((h) => h.agent === "copilot") && exists(join19(root, ".github", "copilot-instructions.md"))) {
+      out.push({
+        agent,
+        dir: join19(root, ".github", "copilot"),
+        scope: "project"
+      });
+    }
+  }
+  if (opts.global && opts.home) {
+    for (const agent of AGENT_NAMES) {
+      for (const rel of HOME_DIRS[agent]) {
+        const dir = join19(opts.home, rel);
+        if (exists(dir)) out.push({ agent, dir, scope: "global" });
+      }
+    }
+  }
+  return out;
+}
+function agentsFromFlag(value, root) {
+  const wanted = value.trim() === "all" ? [...AGENT_NAMES] : value.split(",").map((s) => s.trim()).filter(Boolean);
+  const bad = wanted.filter((w) => !AGENT_NAMES.includes(w));
+  if (bad.length)
+    return {
+      error: `--agent takes ${AGENT_NAMES.join(", ")} or all, not "${bad.join(", ")}"`
+    };
+  if (!wanted.length) return { error: "--agent expects a name" };
+  return {
+    homes: wanted.map((agent) => ({
+      agent,
+      dir: join19(root, PROJECT_DIRS[agent][0]),
+      scope: "project"
+    }))
+  };
+}
+function skillsDirFor(home) {
+  return join19(home.dir, "skills");
+}
+function fallbackSkillsHome(root) {
+  return { agent: "codex", dir: join19(root, ".agents"), scope: "project" };
+}
+function installedSkills(dir, exists = existsSync16, list = (p) => {
+  try {
+    return readdirSync4(p);
+  } catch {
+    return [];
+  }
+}) {
+  if (!exists(dir)) return [];
+  return list(dir).filter((name) => exists(join19(dir, name, "SKILL.md"))).sort();
+}
+var RULES_BEGIN = "<!-- vos:begin (written by vos setup; the block is replaced on the next run) -->";
+var RULES_END = "<!-- vos:end -->";
+var RULES_BODY = `## Product videos (vosso)
+- Skill: product-video (npx skills add vosjs/skills) records the real product from actions.json
+- Look before you cut: vos frames take --at-zooms; edit take/doc.json and re-render, never re-record
+- Hand back: vos open take serves the take into the studio at vos.so, doc.json intact
+- Local by default: vos push only when asked for a link, the shelf or a cloud render
+- Credentials: VOS_API_KEY, then ~/.config/vos/credentials, then vos login; never print one
+- Reference: https://vos.so/llms-full.txt`;
+var RULES_BLOCK = `${RULES_BEGIN}
+${RULES_BODY}
+${RULES_END}`;
+function applyRulesBlock(existing) {
+  const current = existing ?? "";
+  const begin = current.indexOf(RULES_BEGIN);
+  const end = current.indexOf(RULES_END);
+  let text;
+  if (begin !== -1 && end !== -1 && end > begin) {
+    text = current.slice(0, begin) + RULES_BLOCK + current.slice(end + RULES_END.length);
+  } else if (current.trim() === "") {
+    text = `${RULES_BLOCK}
+`;
+  } else {
+    text = `${current.replace(/\s*$/, "")}
+
+${RULES_BLOCK}
+`;
+  }
+  return { text, changed: text !== current };
+}
+function rulesFileFor(root, exists = existsSync16) {
+  const agents = join19(root, "AGENTS.md");
+  if (exists(agents)) return agents;
+  const claude = join19(root, "CLAUDE.md");
+  if (exists(claude)) return claude;
+  return agents;
+}
+function chromeCandidates(platform, env) {
+  if (platform === "darwin")
+    return ["/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"];
+  if (platform === "win32")
+    return [
+      join19(
+        env["PROGRAMFILES"] ?? "C:\\Program Files",
+        "Google",
+        "Chrome",
+        "Application",
+        "chrome.exe"
+      ),
+      join19(
+        env["LOCALAPPDATA"] ?? "",
+        "Google",
+        "Chrome",
+        "Application",
+        "chrome.exe"
+      )
+    ];
+  return [
+    "/usr/bin/google-chrome",
+    "/usr/bin/google-chrome-stable",
+    "/opt/google/chrome/chrome"
+  ];
+}
+function probeBrowser(opts) {
+  const explicit = opts.env.VOS_BROWSER_PATH?.trim();
+  if (explicit) {
+    return opts.exists(explicit) ? { kind: "env", path: explicit, line: `${explicit} (VOS_BROWSER_PATH)` } : {
+      kind: "none",
+      path: null,
+      line: `VOS_BROWSER_PATH points at ${explicit}, which does not exist`
+    };
+  }
+  const chrome = chromeCandidates(opts.platform, opts.env).find(opts.exists);
+  if (chrome) return { kind: "chrome", path: chrome, line: "Chrome (system)" };
+  const chromium3 = opts.bundled();
+  if (chromium3)
+    return { kind: "chromium", path: chromium3, line: "Chromium (Playwright)" };
+  return {
+    kind: "none",
+    path: null,
+    line: "none: install Google Chrome, or run npx playwright install chromium"
+  };
+}
+var NODE_MIN_MAJOR = 18;
+function major(version) {
+  return parseInt(version.split(".")[0] ?? "0", 10);
+}
+function doctorReport(facts) {
+  const lines = [];
+  const nodeOk = major(facts.node) >= NODE_MIN_MAJOR;
+  lines.push(
+    `node        ${facts.node} ${nodeOk ? "\u2713" : `\u2717  ${NODE_MIN_MAJOR} or newer is needed`}`
+  );
+  const browserOk = facts.browser.kind !== "none";
+  lines.push(`browser     ${facts.browser.line} ${browserOk ? "\u2713" : "\u2717"}`);
+  lines.push(
+    `ffmpeg      ${facts.ffmpeg ? `${facts.ffmpeg} \u2713` : "absent (optional)"}`
+  );
+  const withSkills = facts.skills.filter((s) => s.names.length);
+  if (withSkills.length) {
+    const names = [...new Set(withSkills.flatMap((s) => s.names))].sort();
+    const agents = [
+      ...new Set(
+        withSkills.map(
+          (s) => s.scope === "global" ? `${s.agent} (global)` : s.agent
+        )
+      )
+    ];
+    lines.push(`skills      ${names.join(", ")} (${agents.join(", ")}) \u2713`);
+  } else {
+    lines.push("skills      none \u2717  run: npx vos setup");
+  }
+  lines.push(
+    `credential  ${facts.credential ? "present \u2713" : "absent (vos login when you need hosting)"}`
+  );
+  if (facts.devServer) {
+    const d = facts.devServer;
+    lines.push(
+      `dev server  ${d.url} ${d.ok ? "answers \u2713" : `does not answer \u2717${d.error ? `  (${d.error})` : d.status ? `  (HTTP ${d.status})` : ""}`}`
+    );
+  }
+  let next_step;
+  if (!nodeOk)
+    next_step = `Install Node ${NODE_MIN_MAJOR} or newer, then run npx vos doctor again`;
+  else if (!browserOk)
+    next_step = "Install Google Chrome, or run: npx playwright install chromium";
+  else if (facts.devServer && !facts.devServer.ok)
+    next_step = `Start the dev server so ${facts.devServer.url} answers, then record`;
+  else if (!withSkills.length) next_step = "Run: npx vos setup";
+  else
+    next_step = "Record: npx vos record --actions actions.json --out take --strict (the product-video skill writes actions.json)";
+  return { ok: nodeOk && browserOk, lines, next_step, facts };
+}
+function bundledSkillsDir(from) {
+  let dir = dirname5(from);
+  for (let i = 0; i < 6; i++) {
+    const pkg = join19(dir, "package.json");
+    if (existsSync16(pkg)) {
+      try {
+        const name = JSON.parse(readFileSync7(pkg, "utf8")).name;
+        if (name === "@vosjs/cli") {
+          const skills = join19(dir, "skills");
+          return existsSync16(skills) && statSync4(skills).isDirectory() ? skills : null;
+        }
+      } catch {
+      }
+    }
+    const up = dirname5(dir);
+    if (up === dir) break;
+    dir = up;
+  }
+  return null;
+}
+
+// src/plugin/machineCmd.ts
 var BOOLEAN_FLAGS5 = /* @__PURE__ */ new Set([
+  "json",
+  "help",
+  "global",
+  "no-skills",
+  "no-rules",
+  "no-browser"
+]);
+var SKILLS_SOURCE = "vosjs/skills";
+function reporterFor(flags) {
+  return createReporter(flags.json === true || process.stdout.isTTY !== true);
+}
+function npx() {
+  return process.platform === "win32" ? "npx.cmd" : "npx";
+}
+function bundledChromium() {
+  try {
+    const p = chromium2.executablePath();
+    return p && existsSync17(p) ? p : null;
+  } catch {
+    return null;
+  }
+}
+function probe() {
+  return probeBrowser({
+    platform: process.platform,
+    env: process.env,
+    exists: existsSync17,
+    bundled: bundledChromium
+  });
+}
+function ffmpegVersion() {
+  const res = spawnSync("ffmpeg", ["-version"], { encoding: "utf8" });
+  if (res.status !== 0 || !res.stdout) return null;
+  const m = /ffmpeg version (\S+)/.exec(res.stdout);
+  return m ? m[1] : "present";
+}
+async function devServerFact(url) {
+  try {
+    const res = await fetch(url, {
+      signal: AbortSignal.timeout(2e3),
+      redirect: "manual"
+    });
+    return { url, ok: res.status < 500, status: res.status };
+  } catch (e) {
+    return {
+      url,
+      ok: false,
+      status: null,
+      error: e instanceof Error ? e.message.split("\n")[0] : String(e)
+    };
+  }
+}
+function catalogNames() {
+  const bundled = bundledSkillsDir(import.meta.url.replace("file://", ""));
+  return bundled ? installedSkills(bundled) : null;
+}
+function skillsFacts(homes) {
+  const ours = catalogNames();
+  return homes.map((h) => ({
+    agent: h.agent,
+    scope: h.scope,
+    names: installedSkills(skillsDirFor(h)).filter(
+      (n) => !ours || ours.includes(n)
+    )
+  }));
+}
+async function doctorFacts(opts) {
+  return {
+    node: process.versions.node,
+    browser: probe(),
+    ffmpeg: ffmpegVersion(),
+    skills: skillsFacts(opts.homes),
+    credential: resolveCredential() !== null,
+    ...opts.url ? { devServer: await devServerFact(opts.url) } : {}
+  };
+}
+async function cmdSetup(argv) {
+  const { flags } = parseArgs(argv, BOOLEAN_FLAGS5);
+  const r = reporterFor(flags);
+  const root = process.cwd();
+  const global = flags.global === true;
+  const url = strFlag(flags, "url");
+  const noSkills = flags["no-skills"] === true;
+  const noRules = flags["no-rules"] === true;
+  const noBrowser = flags["no-browser"] === true;
+  const wanted = strFlag(flags, "agent");
+  let homes;
+  if (wanted) {
+    const v = agentsFromFlag(wanted, root);
+    if ("error" in v) throw new UsageError(v.error);
+    homes = v.homes;
+  } else {
+    homes = detectAgents(root, { home: homedir3(), global });
+  }
+  const agents = [...new Set(homes.map((h) => h.agent))];
+  r.event({ event: "agents", agents, global });
+  r.log(
+    agents.length ? `agents: ${agents.join(", ")}` : "agents: none detected here (the skills land in .agents/skills, which every agent reads)"
+  );
+  let skillsVia = "skipped";
+  let skillNames = [];
+  if (!noSkills) {
+    const args = [
+      "skills",
+      "add",
+      SKILLS_SOURCE,
+      "-y",
+      ...global ? ["-g"] : []
+    ];
+    r.log(`installing the vos skills: npx ${args.join(" ")}`);
+    const res = spawnSync(npx(), args, {
+      cwd: root,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"],
+      shell: process.platform === "win32",
+      timeout: 12e4
+    });
+    if (res.status === 0) {
+      skillsVia = "skills.sh";
+    } else {
+      const bundled = bundledSkillsDir(import.meta.url.replace("file://", ""));
+      if (!bundled)
+        throw new Error(
+          `could not install the skills: npx skills add ${SKILLS_SOURCE} failed (${(res.stderr ?? "").trim().split("\n").at(-1) ?? res.error?.message ?? "no output"}) and this build carries no bundled copy`
+        );
+      const targets = homes.length ? homes : [fallbackSkillsHome(root)];
+      for (const home of targets) {
+        const dest = skillsDirFor(home);
+        mkdirSync3(dest, { recursive: true });
+        for (const name of installedSkills(bundled)) {
+          cpSync(join20(bundled, name), join20(dest, name), { recursive: true });
+        }
+      }
+      skillsVia = "bundled";
+      r.log(
+        `skills.sh did not answer; copied the bundled skills into ${targets.map((t) => skillsDirFor(t)).join(", ")}`
+      );
+    }
+    skillNames = [
+      ...new Set(
+        (homes.length ? homes : [fallbackSkillsHome(root)]).flatMap(
+          (h) => installedSkills(skillsDirFor(h))
+        )
+      )
+    ].sort();
+  }
+  r.event({ event: "skills", via: skillsVia, names: skillNames });
+  let browser = probe();
+  if (browser.kind === "none" && !noBrowser) {
+    r.log(
+      "no browser found; installing Chromium: npx playwright install chromium"
+    );
+    spawnSync(npx(), ["playwright", "install", "chromium"], {
+      cwd: root,
+      stdio: ["ignore", "ignore", "inherit"],
+      shell: process.platform === "win32",
+      timeout: 6e5
+    });
+    browser = probe();
+  }
+  r.event({ event: "browser", kind: browser.kind, path: browser.path });
+  r.log(`browser: ${browser.line}`);
+  let rules = null;
+  if (!noRules) {
+    const file = rulesFileFor(root);
+    const existing = existsSync17(file) ? readFileSync8(file, "utf8") : null;
+    const { text, changed } = applyRulesBlock(existing);
+    if (changed) writeFileSync3(file, text);
+    rules = { file, changed };
+    r.log(
+      changed ? `rules: wrote the vosso block into ${file}` : `rules: ${file} already carries the block`
+    );
+  }
+  r.event({ event: "rules", ...rules ?? { file: null, changed: false } });
+  const report = doctorReport(
+    await doctorFacts({
+      homes: homes.length ? homes : [fallbackSkillsHome(root)],
+      url
+    })
+  );
+  r.done(
+    {
+      agents,
+      skills: { via: skillsVia, names: skillNames },
+      browser: { kind: browser.kind, path: browser.path },
+      rules,
+      doctor: { ok: report.ok, ...report.facts },
+      next_step: report.next_step
+    },
+    `${report.lines.join("\n")}
+
+Next: ${report.next_step}`
+  );
+  return report.ok ? EXIT_OK : EXIT_NO_BROWSER;
+}
+async function cmdDoctor(argv) {
+  const { flags } = parseArgs(argv, BOOLEAN_FLAGS5);
+  const r = reporterFor(flags);
+  const root = process.cwd();
+  const homes = detectAgents(root, { home: homedir3(), global: true });
+  const report = doctorReport(
+    await doctorFacts({
+      homes: homes.length ? homes : [fallbackSkillsHome(root)],
+      url: strFlag(flags, "url")
+    })
+  );
+  r.done(
+    { ok: report.ok, ...report.facts, next_step: report.next_step },
+    `${report.lines.join("\n")}
+
+Next: ${report.next_step}`
+  );
+  return report.ok ? EXIT_OK : EXIT_NO_BROWSER;
+}
+async function cmdWhoami(argv) {
+  const { flags } = parseArgs(argv, BOOLEAN_FLAGS5);
+  const r = reporterFor(flags);
+  const origin = platformOrigin({
+    origin: strFlag(flags, "origin"),
+    api: strFlag(flags, "api")
+  });
+  const key = resolveCredential(strFlag(flags, "key"));
+  if (!key) {
+    r.done(
+      {
+        signedIn: false,
+        origin,
+        next_step: "vos login (only needed for hosting, sharing or cloud rendering)"
+      },
+      `Not signed in to ${origin}. Recording and rendering need no account; vos login when you want a link.`
+    );
+    return EXIT_ERROR;
+  }
+  const res = await apiJson(origin, "/api/user/whoami", { key });
+  if (res.status === 404) {
+    r.done(
+      {
+        signedIn: true,
+        origin,
+        user: null,
+        key: null,
+        next_step: "vos push when you want the work hosted"
+      },
+      `A credential is present for ${origin} (this origin cannot say whose).`
+    );
+    return EXIT_OK;
+  }
+  if (res.status === 401 || res.status === 403) {
+    r.done(
+      {
+        signedIn: false,
+        origin,
+        error: apiError("whoami", res),
+        next_step: "vos login"
+      },
+      `The stored credential is refused by ${origin}: ${apiError("whoami", res)}. Run vos login.`
+    );
+    return EXIT_ERROR;
+  }
+  if (res.status !== 200) throw new Error(apiError("whoami", res));
+  const user = res.body.user;
+  const k = res.body.key;
+  const who = user?.username ? `@${user.username}` : user?.name ?? "an account";
+  const keyLine = k ? `key "${k.name ?? ""}" (${k.prefix ?? "\u2026"}, ${(k.scopes ?? []).join(", ") || "no scopes"})` : "a session, not a key";
+  r.done(
+    {
+      signedIn: true,
+      origin,
+      user,
+      key: k,
+      next_step: "vos push when you want the work hosted"
+    },
+    `Signed in to ${origin} as ${who}, with ${keyLine}.`
+  );
+  return EXIT_OK;
+}
+function cmdLogout(argv) {
+  const { flags } = parseArgs(argv, BOOLEAN_FLAGS5);
+  const r = reporterFor(flags);
+  const had = existsSync17(CREDENTIALS_PATH);
+  rmSync2(CREDENTIALS_PATH, { force: true });
+  const envKey = Boolean(process.env.VOS_API_KEY?.trim());
+  r.done(
+    {
+      path: CREDENTIALS_PATH,
+      removed: had,
+      envCredential: envKey,
+      next_step: envKey ? "unset VOS_API_KEY as well; it still resolves" : "vos login when you next need hosting"
+    },
+    (had ? `Removed ${CREDENTIALS_PATH}.` : `Nothing stored at ${CREDENTIALS_PATH}.`) + (envKey ? " VOS_API_KEY is still set in this shell and still resolves." : "")
+  );
+  return EXIT_OK;
+}
+
+// src/plugin/run.ts
+var BOOLEAN_FLAGS6 = /* @__PURE__ */ new Set([
   "json",
   "help",
   "picture",
@@ -10811,11 +11414,29 @@ Take pipeline
   vos actions script <actions.json> [--json]
             the flow as numbered beats in words, for a person recording it by hand
 
+This machine (no account)
+  vos setup [--agent claude,cursor,codex,copilot|all] [--global] [--no-skills] [--no-rules] [--no-browser] [--url <dev server>] [--json]
+            ready this computer for the loop: the vos skills into your
+            agent's directories (npx skills add vosjs/skills, else the copy
+            bundled in this package), a browser found or installed, one
+            idempotent block in AGENTS.md (or CLAUDE.md), then doctor.
+            NDJSON whenever stdout is not a TTY; done carries next_step
+  vos doctor [--url <dev server>] [--json]
+            what is ready, in words: node, browser, ffmpeg, the skills per
+            agent, a credential (present or absent, never printed), and the
+            dev server when --url names one. Exit 3 when no browser
+  vos whoami [--json]
+            the key's name and the account it belongs to, never the key
+  vos logout [--json]
+            remove ~/.config/vos/credentials (VOS_API_KEY still resolves)
+
 Platform (vos.so) \u2014 fetch, edit, push, pull, repeat
-  vos login [--key <vos_sk_\u2026>] [--label <name>] [--no-browser]
+  vos login [--key <vos_sk_\u2026>] [--handoff <url>] [--label <name>] [--no-browser]
             sign in via the browser (approve at vos.so/cli/auth; works
             headless \u2014 print the URL, a human approves, the key stores
-            itself). --key skips the browser (mint at vos.so/app/api)
+            itself). --key skips the browser (mint at vos.so/app/api).
+            --handoff https://vos.so/h/\u2026 exchanges the setup link a
+            signed-in person's line carries for a key, once, no click
   vos fetch <vosId|watch-url> [--out dir] [--media] [--json]
             writes config.json + vos.json (no auth needed for public programs);
             a take vos also gets its doc.json, and --media its footage
@@ -11014,7 +11635,8 @@ before them (-u gives links their href); what the recorder cannot follow
 dropped. Then: vos record --actions actions.json --strict.
 open serves the take and loads it into the studio (?take=<server>) \u2014
 doc.json edits arrive intact; a human can drag every zoom span. Keeps
-serving until Ctrl-C; --studio overrides the default http://localhost:6060.
+serving until Ctrl-C. The studio is https://vos.so by default (VOS_ORIGIN
+moves it; --studio http://localhost:6060 for a dev server).
 
 push/pull \u2014 the hosted iteration loop (credentials: --key, VOS_API_KEY, or
 ~/.config/vos/credentials via vos login; origin via VOS_ORIGIN, default
@@ -11106,7 +11728,7 @@ function takeStorageState(flags) {
   const raw = strFlag(flags, "storage-state");
   if (!raw) return void 0;
   const path = resolve9(raw);
-  if (!existsSync16(path))
+  if (!existsSync18(path))
     throw new UsageError(`--storage-state: no such file: ${path}`);
   return path;
 }
@@ -11119,7 +11741,7 @@ function takeSessionName(flags, storageState) {
     throw new UsageError(
       "--session and --storage-state are two doors to one take: a persistent profile cannot take a storage state. Pass one"
     );
-  if (!existsSync16(sessionDir(name)))
+  if (!existsSync18(sessionDir(name)))
     throw new UsageError(
       `no session "${name}". Make one: vos session open <url> --name ${name} (a Chrome window opens; sign in and close it)`
     );
@@ -11175,7 +11797,7 @@ function wallGate(flags, r, opts) {
 async function cmdRecord(argv) {
   const { positionals, flags, multi } = parseArgs(
     argv,
-    BOOLEAN_FLAGS5,
+    BOOLEAN_FLAGS6,
     MULTI_FLAGS2
   );
   const actionsPath = strFlag(flags, "actions") ?? positionals[0];
@@ -11252,7 +11874,7 @@ ${lines.join("\n")}
   }
   const paths = takePaths(outDir);
   const prepare = async () => {
-    if (existsSync16(join19(outDir, "meta.json"))) {
+    if (existsSync18(join21(outDir, "meta.json"))) {
       const { prevDoc, kept } = await prepareReRecord(outDir);
       r.log(
         `note: re-recording ${outDir} \u2014 kept ${kept.length ? kept.join(", ") : "nothing"}` + (prevDoc ? "; apply the previous cut to the new footage with: vos plan " + outDir + " --reuse" : "")
@@ -11317,7 +11939,7 @@ ${lines.join("\n")}
       },
       strictFail ? `STRICT: take recorded but incomplete \u2014 ${strictReason(rec)}; fix the flow and re-record.${skippedNote}${exposureNote(rec)}` : `Take ready: ${outDir}
   ${(rec.meta.durationMs / 1e3).toFixed(1)}s \xB7 ${rec.frames.length} frames \xB7 ${rec.events.length} cursor events \xB7 ${clicks} clicks \xB7 ${plan.doc.zoom.length} zoom spans planned \xB7 ${rec.freezePct}% frozen \xB7 ${rec.dead.pct}% dead${deadWarns(rec.dead) ? " \u26A0 " + deadLine(rec.dead) : ""}${skippedNote}
-  Next: edit ${join19(outDir, "doc.json")} (optional), then: vos render ${outDir}${exposureNote(rec)}`
+  Next: edit ${join21(outDir, "doc.json")} (optional), then: vos render ${outDir}${exposureNote(rec)}`
     );
     return strictFail ? EXIT_USAGE : EXIT_OK;
   } finally {
@@ -11327,7 +11949,7 @@ ${lines.join("\n")}
 async function cmdCreate2(argv) {
   const { positionals, flags, multi } = parseArgs(
     argv,
-    BOOLEAN_FLAGS5,
+    BOOLEAN_FLAGS6,
     MULTI_FLAGS2
   );
   const actionsPath = strFlag(flags, "actions");
@@ -11346,7 +11968,7 @@ async function cmdCreate2(argv) {
   if (fmtRaw !== "webm" && fmtRaw !== "mp4")
     throw new UsageError("--format must be webm or mp4");
   const format = fmtRaw;
-  const out = positionals[0] ?? join19(outDir, `out.${format}`);
+  const out = positionals[0] ?? join21(outDir, `out.${format}`);
   const parallel = numFlag(flags, "parallel", 1);
   if (!Number.isInteger(parallel) || parallel < 1 || parallel > 16) {
     throw new UsageError("--parallel expects an integer between 1 and 16");
@@ -11359,7 +11981,7 @@ async function cmdCreate2(argv) {
   const headers = takeHeaders(multi);
   const paths = takePaths(outDir);
   const prepare = async () => {
-    if (existsSync16(join19(outDir, "meta.json"))) {
+    if (existsSync18(join21(outDir, "meta.json"))) {
       const { prevDoc, kept } = await prepareReRecord(outDir);
       r.log(
         `note: re-recording ${outDir} \u2014 kept ${kept.length ? kept.join(", ") : "nothing"}` + (prevDoc ? "; apply the previous cut to the new footage with: vos plan " + outDir + " --reuse" : "")
@@ -11456,7 +12078,7 @@ async function cmdCreate2(argv) {
 async function cmdPlan(argv) {
   const { positionals, flags, multi } = parseArgs(
     argv,
-    BOOLEAN_FLAGS5,
+    BOOLEAN_FLAGS6,
     /* @__PURE__ */ new Set(["with"])
   );
   const dir = positionals[0];
@@ -11466,13 +12088,13 @@ async function cmdPlan(argv) {
     );
   const r = createReporter(flags.json === true);
   if (flags.fresh === true) {
-    await rm5(join19(dir, "doc.json"), { force: true });
+    await rm5(join21(dir, "doc.json"), { force: true });
     r.log("note: --fresh discarded the existing doc.json");
   }
   let reuse;
   if (flags.reuse === true) {
-    const from = resolve9(strFlag(flags, "from") ?? join19(dir, PREV_DOC_NAME));
-    if (!existsSync16(from)) {
+    const from = resolve9(strFlag(flags, "from") ?? join21(dir, PREV_DOC_NAME));
+    if (!existsSync18(from)) {
       throw new UsageError(
         `--reuse: ${from} does not exist \u2014 a re-record into this take writes doc.prev.json, or pass --from <doc.json>`
       );
@@ -11483,7 +12105,7 @@ async function cmdPlan(argv) {
     };
   }
   const style = await resolveStyleRef(flags);
-  const hasDoc = existsSync16(join19(dir, "doc.json"));
+  const hasDoc = existsSync18(join21(dir, "doc.json"));
   const backdrop = hasDoc ? null : await takeBackdrop(flags, r);
   const release = await releaseInputs(dir, flags, r, multi.with ?? []);
   const motionWanted = !hasDoc || flags.motion === true || flags.fresh === true;
@@ -11541,7 +12163,7 @@ async function cmdPlan(argv) {
       ...s.motion ? { motion: s.motion } : {},
       ...s.reuse ? { reuse: s.reuse } : {}
     },
-    `${s.reuse ? "Reused" : s.fresh ? "Planned" : "Refreshed"} ${join19(dir, "doc.json")}: ${s.zoomAuto} auto + ${s.zoomManual} manual zoom spans${s.cursorKept ? "" : " (cursor track dropped)"}${layoutLines}${motionLines}${reuseLines}`
+    `${s.reuse ? "Reused" : s.fresh ? "Planned" : "Refreshed"} ${join21(dir, "doc.json")}: ${s.zoomAuto} auto + ${s.zoomManual} manual zoom spans${s.cursorKept ? "" : " (cursor track dropped)"}${layoutLines}${motionLines}${reuseLines}`
   );
   return EXIT_OK;
 }
@@ -11654,7 +12276,7 @@ async function releaseInputs(dir, flags, r, withRefs = []) {
 async function cmdRender(argv) {
   const { positionals, flags, multi } = parseArgs(
     argv,
-    BOOLEAN_FLAGS5,
+    BOOLEAN_FLAGS6,
     MULTI_FLAGS2
   );
   const dir = positionals[0];
@@ -11667,7 +12289,7 @@ async function cmdRender(argv) {
   if (fmtRaw !== "webm" && fmtRaw !== "mp4")
     throw new UsageError("--format must be webm or mp4");
   const format = fmtRaw;
-  const out = positionals[1] ?? join19(dir, `out.${format}`);
+  const out = positionals[1] ?? join21(dir, `out.${format}`);
   const parallel = numFlag(flags, "parallel", 1);
   if (!Number.isInteger(parallel) || parallel < 1 || parallel > 16) {
     throw new UsageError("--parallel expects an integer between 1 and 16");
@@ -11725,7 +12347,7 @@ async function cmdRender(argv) {
 async function cmdFrames(argv) {
   const { positionals, flags, multi } = parseArgs(
     argv,
-    BOOLEAN_FLAGS5,
+    BOOLEAN_FLAGS6,
     MULTI_FLAGS2
   );
   const dir = positionals[0];
@@ -11798,7 +12420,7 @@ async function cmdFrames(argv) {
 async function cmdDeliver(argv) {
   const { positionals, flags, multi } = parseArgs(
     argv,
-    BOOLEAN_FLAGS5,
+    BOOLEAN_FLAGS6,
     MULTI_FLAGS2
   );
   const dir = positionals[0];
@@ -11914,11 +12536,11 @@ async function resolveStyleRef(flags) {
 }
 async function resolveDocRef(ref, flags, what) {
   const styleRef = ref;
-  const file = existsSync16(styleRef) ? resolve9(
+  const file = existsSync18(styleRef) ? resolve9(
     styleRef,
-    existsSync16(join19(styleRef, "doc.json")) ? "doc.json" : ""
+    existsSync18(join21(styleRef, "doc.json")) ? "doc.json" : ""
   ) : null;
-  if (file && existsSync16(file)) {
+  if (file && existsSync18(file)) {
     return {
       from: file,
       doc: migrateHostedDoc5(
@@ -11964,7 +12586,7 @@ async function officialTemplate(origin, ref) {
   }
 }
 async function cmdDigest(argv) {
-  const { positionals, flags } = parseArgs(argv, BOOLEAN_FLAGS5);
+  const { positionals, flags } = parseArgs(argv, BOOLEAN_FLAGS6);
   const dir = positionals[0];
   if (!dir)
     throw new UsageError(
@@ -12005,7 +12627,7 @@ async function cmdDigest(argv) {
         kinds,
         frames: d.images.full,
         crops: d.images.crop,
-        sheet: d.images.sheet ? join19(result.outDir, d.images.sheet) : null,
+        sheet: d.images.sheet ? join21(result.outDir, d.images.sheet) : null,
         scenes: kinds.scene ?? 0,
         sourceDuration: d.take.sourceDuration,
         outputDuration: d.take.outputDuration,
@@ -12028,15 +12650,15 @@ async function cmdDigest(argv) {
   }
 }
 async function cmdOpen(argv) {
-  const { positionals, flags } = parseArgs(argv, BOOLEAN_FLAGS5);
+  const { positionals, flags } = parseArgs(argv, BOOLEAN_FLAGS6);
   const dir = positionals[0];
   if (!dir) throw new UsageError("vos open <take> [--studio <url>]");
   const r = createReporter(flags.json === true);
   const take = await loadTake(dir);
-  if (!existsSync16(take.paths.recording)) {
+  if (!existsSync18(take.paths.recording)) {
     throw new UsageError(`${dir} has no recording \u2014 re-run record`);
   }
-  const studio = (strFlag(flags, "studio") ?? "http://localhost:6060").replace(
+  const studio = (strFlag(flags, "studio") ?? platformOrigin()).replace(
     /\/+$/,
     ""
   );
@@ -12066,7 +12688,7 @@ async function cmdOpen(argv) {
   return EXIT_OK;
 }
 async function cmdJudge(argv) {
-  const { positionals, flags } = parseArgs(argv, BOOLEAN_FLAGS5);
+  const { positionals, flags } = parseArgs(argv, BOOLEAN_FLAGS6);
   const target = positionals[0];
   const against = strFlag(flags, "against");
   if (!target || !against)
@@ -12074,9 +12696,9 @@ async function cmdJudge(argv) {
       "vos judge <kit.json> --against <MANIFEST.json> [--out dir] [--json]\n(the manifest names the reference set: id, file, role, layout, facts, rule per asset)"
     );
   const r = createReporter(flags.json === true);
-  const kitFile = target.endsWith("kit.json") ? target : join19(target, "kit.json");
-  if (!existsSync16(kitFile)) throw new UsageError(`${kitFile}: no kit manifest`);
-  if (!existsSync16(against))
+  const kitFile = target.endsWith("kit.json") ? target : join21(target, "kit.json");
+  if (!existsSync18(kitFile)) throw new UsageError(`${kitFile}: no kit manifest`);
+  if (!existsSync18(against))
     throw new UsageError(`${against}: no reference manifest`);
   const result = await judgeKit(kitFile, against, strFlag(flags, "out"));
   const verdicts = JSON.parse(await readFile15(result.verdictFile, "utf8")).verdicts;
@@ -12095,7 +12717,7 @@ Win rate so far: ${rate.wins} win(s), ${rate.ties} tie(s) of ${rate.judged} judg
   return EXIT_OK;
 }
 async function cmdCallout(argv) {
-  const { positionals, flags } = parseArgs(argv, BOOLEAN_FLAGS5);
+  const { positionals, flags } = parseArgs(argv, BOOLEAN_FLAGS6);
   const dir = positionals[0];
   const shape = positionals[1];
   if (!dir || !shape || !isCalloutShape(shape))
@@ -12194,11 +12816,11 @@ async function cmdCallout(argv) {
   return EXIT_OK;
 }
 async function cmdValidate(argv) {
-  const { positionals, flags } = parseArgs(argv, BOOLEAN_FLAGS5);
+  const { positionals, flags } = parseArgs(argv, BOOLEAN_FLAGS6);
   const target = positionals[0];
   if (!target) throw new UsageError("vos validate <actions.json|take>");
   const r = createReporter(flags.json === true);
-  const kitTarget = target.endsWith("kit.json") ? target : existsSync16(join19(target, "kit.json")) && !isTakeDir(target) ? join19(target, "kit.json") : null;
+  const kitTarget = target.endsWith("kit.json") ? target : existsSync18(join21(target, "kit.json")) && !isTakeDir(target) ? join21(target, "kit.json") : null;
   if (kitTarget) {
     const picture = flags.picture === true;
     const verdict = await validateKit(kitTarget, { picture });
@@ -12230,9 +12852,9 @@ async function cmdValidate(argv) {
     r.done({ valid: true, target }, `${target}: valid actions file`);
     return EXIT_OK;
   }
-  if (!isTakeDir(target) && existsSync16(join19(target, "config.json"))) {
+  if (!isTakeDir(target) && existsSync18(join21(target, "config.json"))) {
     const parsed = JSON.parse(
-      await readFile15(join19(target, "config.json"), "utf8")
+      await readFile15(join21(target, "config.json"), "utf8")
     );
     const pre = preflightConfig(parsed);
     const problems2 = pre.ok ? [] : pre.issues.map((i) => `config.json: ${i}`);
@@ -12248,9 +12870,9 @@ async function cmdValidate(argv) {
         ...collectConfigMediaUrls(pre.config ?? parsed),
         ...collectDocMediaUrls(doc)
       ];
-      const probe = mediaProbeLints(await probeMediaUrls([...new Set(urls)]));
-      problems2.push(...probe.problems);
-      warnings2.push(...probe.warnings);
+      const probe2 = mediaProbeLints(await probeMediaUrls([...new Set(urls)]));
+      problems2.push(...probe2.problems);
+      warnings2.push(...probe2.warnings);
     }
     if (problems2.length) {
       r.done(
@@ -12273,7 +12895,7 @@ async function cmdValidate(argv) {
   const take = await loadTake(target);
   const problems = [];
   const warnings = [];
-  if (!existsSync16(take.paths.recording)) {
+  if (!existsSync18(take.paths.recording)) {
     problems.push("missing recording (re-run record)");
   } else {
     const mismatch = containerMismatch(
@@ -12299,11 +12921,11 @@ async function cmdValidate(argv) {
     const lint = lintDoc(take.doc);
     problems.push(...lint.problems.map((p) => `doc.json: ${p}`));
     warnings.push(...lint.warnings.map((w) => `doc.json: ${w}`));
-    const probe = mediaProbeLints(
+    const probe2 = mediaProbeLints(
       await probeMediaUrls(collectDocMediaUrls(take.doc))
     );
-    problems.push(...probe.problems);
-    warnings.push(...probe.warnings);
+    problems.push(...probe2.problems);
+    warnings.push(...probe2.warnings);
     if (flags.picture === true && (take.doc.overlays ?? []).some((o) => o.kind === "html")) {
       const doc = take.doc;
       const times = [
@@ -12356,7 +12978,7 @@ async function cmdValidate(argv) {
 async function cmdPush3(argv) {
   const { positionals, flags, multi } = parseArgs(
     argv,
-    BOOLEAN_FLAGS5,
+    BOOLEAN_FLAGS6,
     MULTI_FLAGS2
   );
   const dir = positionals[0];
@@ -12403,7 +13025,7 @@ async function cmdPush3(argv) {
   return EXIT_OK;
 }
 async function cmdPull2(argv) {
-  const { positionals, flags } = parseArgs(argv, BOOLEAN_FLAGS5, MULTI_FLAGS2);
+  const { positionals, flags } = parseArgs(argv, BOOLEAN_FLAGS6, MULTI_FLAGS2);
   const dir = positionals[0] ?? ".";
   const r = createReporter(flags.json === true);
   const result = await pullTake(
@@ -12490,6 +13112,14 @@ async function run(argv) {
         return await cmdDuplicate(rest);
       case "login":
         return await cmdLogin(rest);
+      case "setup":
+        return await cmdSetup(rest);
+      case "doctor":
+        return await cmdDoctor(rest);
+      case "whoami":
+        return await cmdWhoami(rest);
+      case "logout":
+        return cmdLogout(rest);
       case "push": {
         const target = rest.find((a) => !a.startsWith("-"));
         if (target && isTakeDir(target)) {
@@ -12550,7 +13180,7 @@ async function run(argv) {
   }
 }
 async function cmdSession(argv) {
-  const { positionals, flags } = parseArgs(argv, BOOLEAN_FLAGS5);
+  const { positionals, flags } = parseArgs(argv, BOOLEAN_FLAGS6);
   const [sub, arg] = positionals;
   const r = createReporter(flags.json === true);
   const usage = "vos session open <url> --name <app> | check <name> [--url <url>] | list | rm <name>";
@@ -12586,7 +13216,7 @@ async function cmdSession(argv) {
       if (!arg) throw new UsageError(usage);
       const bad = sessionNameVerdict(arg);
       if (bad) throw new UsageError(bad);
-      if (!existsSync16(sessionDir(arg)))
+      if (!existsSync18(sessionDir(arg)))
         throw new UsageError(`no session "${arg}" (vos session list)`);
       const summary2 = await summarizeSession(arg);
       const url = strFlag(flags, "url");
@@ -12696,4 +13326,4 @@ export {
   verbHelp,
   run
 };
-//# sourceMappingURL=chunk-E42NCNWP.js.map
+//# sourceMappingURL=chunk-RHPRZQRM.js.map