@wirecat/cli-core 0.361.0 → 0.362.0

package/CHANGELOG.md

@@ -7,6 +7,23 @@ shape of this file.
 
 ## Unreleased
 
+## 0.362.0 — 19.10.2026
+
+### Changed — may break callers
+
+- **Without a terminal, `loginQr` prints the QR code as text an agent pastes into the chat; the PNG is gone.** The
+  owner signed in through a PNG an agent opened in an image viewer, a window the person can lose. Now, when the
+  diagnostic stream is not a terminal (`terminal: false`, by default whether stderr is one), `show` prints
+  `plainQr(link)` on it: half blocks with no colours, the light modules and the quiet zone drawn, so the code reads
+  dark on light in a dark terminal theme and every line starts and ends with a block. A WhatsApp-sized code stays
+  under 80 columns. Then it notes `PASTE_QR` (paste the block in a code block, exactly as printed; paste a renewed one
+  and say the old one expired) and where to scan. With `json: true` each code is also one line on stderr,
+  `{"event":"qr","qr":{"text","expires_at","scan"}}`; stdout keeps only the answer. `show` takes the code's expiry as
+  a third argument. In a terminal the code is drawn as before.
+- Removed: `loginQr`'s `qrFile` option, `LoginQr.path` and `LoginQr.close()`, `qrPng` and `qrNeedsTerminal`. A CLI
+  drops `--qr-file` and its refusal of a QR login without a terminal. `parity.json` no longer expects `--qr-file` on
+  `session start` or `setup`.
+
 ## 0.361.0 — 19.10.2026
 
 ### Fixed

package/dist/cli/program.d.ts

@@ -29,7 +29,7 @@ export interface ProgramOptions {
 export declare const createProgram: ({ app, commands, configure, firstScreen }: ProgramDefinition, { out, err }?: ProgramOptions) => Command;
 export type RunOptions = BaseEnvironment & Record<string, unknown>;
 /**
- * An interactive command run without a terminal — an agent's `session start --qr-file` — waits on a person scanning a
+ * An interactive command run without a terminal — an agent's `session start qr` — waits on a person scanning a
  * code somewhere else, which 30 s does not cover.
  */
 export declare const HEADLESS_INTERACTIVE_MS: number;

package/dist/cli/program.js

@@ -93,7 +93,7 @@ class Relayed extends Error {
     }
 }
 /**
- * An interactive command run without a terminal — an agent's `session start --qr-file` — waits on a person scanning a
+ * An interactive command run without a terminal — an agent's `session start qr` — waits on a person scanning a
  * code somewhere else, which 30 s does not cover.
  */
 export const HEADLESS_INTERACTIVE_MS = 5 * 60_000;

package/dist/index.d.ts

@@ -22,6 +22,6 @@ export { defaultRules, ModerationRules, moderationPathFor } from "./moderation/r
 export { type OutputOptions, resolveOutput } from "./output.js";
 export { pollLines, type RenderOptions, renderMessage, renderMessages } from "./render/messages.js";
 export { isId, type PeopleLookup, pickChat, pickPerson } from "./resolve.js";
-export { atTerminal, type LoginQr, type LoginQrOptions, loginQr, qrNeedsTerminal, } from "./terminal/login-qr.js";
+export { atTerminal, type LoginQr, type LoginQrOptions, loginQr, PASTE_QR, } from "./terminal/login-qr.js";
 export { readSecret, type SecretInput } from "./terminal/prompt.js";
-export { qrPng, terminalQr } from "./terminal/qr.js";
+export { plainQr, terminalQr } from "./terminal/qr.js";

package/dist/index.js

@@ -15,6 +15,6 @@ export { defaultRules, ModerationRules, moderationPathFor } from "./moderation/r
 export { resolveOutput } from "./output.js";
 export { pollLines, renderMessage, renderMessages } from "./render/messages.js";
 export { isId, pickChat, pickPerson } from "./resolve.js";
-export { atTerminal, loginQr, qrNeedsTerminal, } from "./terminal/login-qr.js";
+export { atTerminal, loginQr, PASTE_QR, } from "./terminal/login-qr.js";
 export { readSecret } from "./terminal/prompt.js";
-export { qrPng, terminalQr } from "./terminal/qr.js";
+export { plainQr, terminalQr } from "./terminal/qr.js";

package/dist/terminal/login-qr.d.ts

@@ -1,30 +1,34 @@
-import { CliError } from "@wirecat/cli-base";
 /** Whether a person can scan a code drawn here and answer what the login asks next. */
 export declare const atTerminal: (input: NodeJS.ReadableStream & {
     isTTY?: boolean;
 }) => boolean;
-/** The one refusal of a QR login that nobody could scan. */
-export declare const qrNeedsTerminal: (command: string) => CliError;
+/** What an agent reads off the plain-text code: the same words a person reads under the drawn one. */
+export declare const PASTE_QR: string;
 export interface LoginQrOptions {
-    /** `--qr-file`: the PNG to write instead of drawing the code. */
-    qrFile?: string;
     /** Where the code and the narrow-terminal hint go; `--quiet` must not hide either. */
     diagnostic: (text: string) => void;
-    /** Where the file's location is said. */
+    /** Where where-to-scan and the agent's instruction go. */
     note: (text: string) => void;
     /** How far the code sits right, to line up under a setup step. */
     indent?: number;
     /** Read on every code, so a widened terminal draws the next one. Unknown draws the code. */
     columns?: () => number | undefined;
+    /**
+     * Whether a person reads the diagnostic stream in a terminal. Off one, the code is plain text for an agent to
+     * paste into the chat (`plainQr`). Defaults to whether stderr is a terminal.
+     */
+    terminal?: boolean;
+    /**
+     * Machine output (`--json`, `--jsonl`, or no terminal): each code is also one JSON line on the diagnostic stream,
+     * `{"event":"qr","qr":{"text","expires_at","scan"}}`. stdout keeps only the answer, which comes after the scan.
+     */
+    json?: boolean;
 }
 export interface LoginQr {
-    readonly path: string | undefined;
     /**
      * `scan` says where to scan; it follows the code, and is not said when the terminal is too narrow to draw one.
      * Never throws for a code that does not fit: the messengers call it from inside their own event loops.
      */
-    show: (link: string, scan?: string) => void;
-    /** The image logs the account in while it is valid; call this in `finally`. */
-    close: () => void;
+    show: (link: string, scan?: string, expiresAt?: Date) => void;
 }
-export declare const loginQr: ({ qrFile, diagnostic, note, indent: pad, columns, }: LoginQrOptions) => LoginQr;
+export declare const loginQr: ({ diagnostic, note, indent: pad, columns, terminal, json, }: LoginQrOptions) => LoginQr;

package/dist/terminal/login-qr.js

@@ -1,48 +1,36 @@
-import { rmSync } from "node:fs";
-import { resolve } from "node:path";
-import { CliError, indent, writeSecurely } from "@wirecat/cli-base";
+import { indent } from "@wirecat/cli-base";
 import { inputPolicy } from "../cli/input-policy.js";
-import { qrPng, terminalQr } from "./qr.js";
+import { plainQr, terminalQr } from "./qr.js";
 const MARGIN = 2;
 /** Whether a person can scan a code drawn here and answer what the login asks next. */
 export const atTerminal = (input) => input.isTTY === true && !inputPolicy(input).noInput;
-/** The one refusal of a QR login that nobody could scan. */
-export const qrNeedsTerminal = (command) => new CliError("validation_error", `${command} shows a QR code to scan — run it in a terminal, or pass --qr-file <png>`, {
-    param: "--qr-file",
-    reason: "input.required",
-});
-export const loginQr = ({ qrFile, diagnostic, note, indent: pad = 0, columns = () => process.stderr.columns, }) => {
-    const path = qrFile === undefined ? undefined : resolve(qrFile);
-    // Only what this login wrote is removed: a refused or never-reached write leaves the owner's file alone.
-    let written = false;
-    return {
-        path,
-        show: (link, scan) => {
-            if (path) {
-                writeSecurely(path, qrPng(link), 0o600);
-                written = true;
-                note(`the QR code is in ${path} — it is replaced when the code renews`);
-                if (scan)
-                    note(scan);
-                return;
-            }
-            const drawn = terminalQr(link);
-            const need = drawn.width + pad + MARGIN;
-            const width = columns();
-            if (width !== undefined && need > width) {
-                diagnostic(`the terminal is ${width} columns wide and the QR code needs ${need} — widen it, ` +
-                    "or run again with --qr-file <png>");
-                return;
-            }
-            diagnostic(`\n${indent(drawn.text, pad + MARGIN)}`);
+/** What an agent reads off the plain-text code: the same words a person reads under the drawn one. */
+export const PASTE_QR = "agents: paste the QR code above into the chat as a code block, exactly as printed; " +
+    "when a new one is printed, paste it and say the old one expired";
+export const loginQr = ({ diagnostic, note, indent: pad = 0, columns = () => process.stderr.columns, terminal = process.stderr.isTTY === true, json = false, }) => ({
+    show: (link, scan, expiresAt) => {
+        if (!terminal) {
+            const text = plainQr(link);
+            diagnostic(`\n${text}\n`);
+            if (json)
+                diagnostic(JSON.stringify({
+                    event: "qr",
+                    qr: { text, expires_at: expiresAt?.toISOString() ?? null, scan: scan ?? null },
+                }));
+            note(PASTE_QR);
             if (scan)
                 note(scan);
-        },
-        close: () => {
-            if (!path || !written)
-                return;
-            written = false;
-            rmSync(path, { force: true });
-        },
-    };
-};
+            return;
+        }
+        const drawn = terminalQr(link);
+        const need = drawn.width + pad + MARGIN;
+        const width = columns();
+        if (width !== undefined && need > width) {
+            diagnostic(`the terminal is ${width} columns wide and the QR code needs ${need} — widen it`);
+            return;
+        }
+        diagnostic(`\n${indent(drawn.text, pad + MARGIN)}`);
+        if (scan)
+            note(scan);
+    },
+});

package/dist/terminal/qr.d.ts

@@ -1,8 +1,3 @@
-/**
- * The same code as a PNG, `scale` pixels a module, for a person or an agent to pass on as an image.
- * 8-bit greyscale, one filter-free row per pixel line: the smallest PNG any decoder reads.
- */
-export declare const qrPng: (link: string, scale?: number) => Uint8Array;
 /**
  * A QR code as text, two modules per character cell with half blocks, so it fits a terminal
  * without being twice as tall as it is wide. `width` is in columns, for deciding whether it fits.
@@ -11,3 +6,10 @@ export declare const terminalQr: (link: string) => {
     text: string;
     width: number;
 };
+/**
+ * The same code as plain text, for an agent to paste into a chat where no colour survives. Without colours a glyph
+ * takes the foreground colour, so the light modules and the quiet zone are the glyphs: on a dark background the code
+ * reads dark on light, and every line starts and ends with a glyph, so nothing trims it. Half blocks keep a long
+ * WhatsApp code under 80 columns; full blocks would need about 140 and wrap.
+ */
+export declare const plainQr: (link: string) => string;

package/dist/terminal/qr.js

@@ -1,4 +1,3 @@
-import { deflateSync } from "node:zlib";
 import qrcode from "qrcode-generator";
 const QUIET_ZONE = 4;
 // Dark modules on a light ground whatever the terminal's theme: a phone camera reads an inverted
@@ -18,52 +17,6 @@ const modules = (link) => {
     };
     return { size, dark };
 };
-/**
- * The same code as a PNG, `scale` pixels a module, for a person or an agent to pass on as an image.
- * 8-bit greyscale, one filter-free row per pixel line: the smallest PNG any decoder reads.
- */
-export const qrPng = (link, scale = 8) => {
-    const { size, dark } = modules(link);
-    const side = size * scale;
-    const pixels = Buffer.alloc((side + 1) * side, 0xff);
-    for (let y = 0; y < side; y++) {
-        pixels[y * (side + 1)] = 0;
-        for (let x = 0; x < side; x++) {
-            if (dark(Math.floor(y / scale), Math.floor(x / scale)))
-                pixels[y * (side + 1) + 1 + x] = 0;
-        }
-    }
-    const header = Buffer.alloc(13);
-    header.writeUInt32BE(side, 0);
-    header.writeUInt32BE(side, 4);
-    header.set([8, 0, 0, 0, 0], 8);
-    return Buffer.concat([
-        Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]),
-        chunk("IHDR", header),
-        chunk("IDAT", deflateSync(pixels)),
-        chunk("IEND", Buffer.alloc(0)),
-    ]);
-};
-const chunk = (type, data) => {
-    const body = Buffer.concat([Buffer.from(type, "ascii"), data]);
-    const out = Buffer.alloc(body.length + 8);
-    out.writeUInt32BE(data.length, 0);
-    body.copy(out, 4);
-    out.writeUInt32BE(crc32(body), body.length + 4);
-    return out;
-};
-const CRC_TABLE = Array.from({ length: 256 }, (_, n) => {
-    let c = n;
-    for (let k = 0; k < 8; k++)
-        c = c & 1 ? 0xedb88320 ^ (c >>> 1) : c >>> 1;
-    return c >>> 0;
-});
-const crc32 = (bytes) => {
-    let c = 0xffffffff;
-    for (const byte of bytes)
-        c = CRC_TABLE[(c ^ byte) & 0xff] ^ (c >>> 8);
-    return (c ^ 0xffffffff) >>> 0;
-};
 /**
  * A QR code as text, two modules per character cell with half blocks, so it fits a terminal
  * without being twice as tall as it is wide. `width` is in columns, for deciding whether it fits.
@@ -82,3 +35,24 @@ export const terminalQr = (link) => {
     }
     return { text: lines.join("\n"), width: size };
 };
+/**
+ * The same code as plain text, for an agent to paste into a chat where no colour survives. Without colours a glyph
+ * takes the foreground colour, so the light modules and the quiet zone are the glyphs: on a dark background the code
+ * reads dark on light, and every line starts and ends with a glyph, so nothing trims it. Half blocks keep a long
+ * WhatsApp code under 80 columns; full blocks would need about 140 and wrap.
+ */
+export const plainQr = (link) => {
+    const { size, dark } = modules(link);
+    const light = (row, col) => row < size && !dark(row, col);
+    const lines = [];
+    for (let row = 0; row < size; row += 2) {
+        let line = "";
+        for (let col = 0; col < size; col++) {
+            const top = light(row, col);
+            const bottom = light(row + 1, col);
+            line += top && bottom ? "█" : top ? "▀" : bottom ? "▄" : " ";
+        }
+        lines.push(line);
+    }
+    return lines.join("\n");
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wirecat/cli-core",
-  "version": "0.361.0",
+  "version": "0.362.0",
   "description": "The messenger-neutral half of a messaging CLI: domain model, message locators, rendering, name resolution, the SQLite seam, the command skeleton and shared read commands, the send guard, run records and the message store",
   "license": "Apache-2.0",
   "author": "Viacheslav Ptsarev",

package/parity.json

@@ -810,10 +810,6 @@
       "value": "<url>",
       "meaning": "the tunnel's https address the browser apps use"
     },
-    "--qr-file": {
-      "value": "<png>",
-      "meaning": "write the QR code to this PNG instead of drawing it, for an agent to pass on"
-    },
     "--question": {
       "meaning": "match only questions"
     },
@@ -4053,7 +4049,6 @@
           "in": ["tg"],
           "reason": "Telegram asks each client for its own app from my.telegram.org; MAX has no such step; WhatsApp has no application registration"
         },
-        "--qr-file": "all",
         "--sms": {
           "in": ["tg"],
           "reason": "asks Telegram to resend its login code by SMS; MAX has no such choice; WhatsApp links a device by QR or pairing code, never by an SMS code"
@@ -4068,8 +4063,7 @@
           "in": ["tg"],
           "reason": "Telegram requires an application from my.telegram.org; MAX has no application registration step; WhatsApp has no application registration"
         },
-        "--method": "all",
-        "--qr-file": "all"
+        "--method": "all"
       }
     },
     "skill": {