agent-comms 8.6.2 → 8.7.0

package/.claude-plugin/marketplace.json

@@ -15,7 +15,7 @@
         "source": "url",
         "url": "https://github.com/ExaDev/agent-comms.git"
       },
-      "version": "8.6.2"
+      "version": "8.7.0"
     }
   ]
 }

package/.claude-plugin/plugin.json

@@ -18,5 +18,5 @@
   },
   "name": "agent-comms",
   "repository": "https://github.com/ExaDev/agent-comms",
-  "version": "8.6.2"
+  "version": "8.7.0"
 }

package/README.md

@@ -2,7 +2,7 @@
 
 [![GitHub](https://img.shields.io/badge/GitHub-181717?logo=github&logoColor=white)](https://github.com/ExaDev/agent-comms)
 [![npm](https://img.shields.io/badge/npm-CB3837?logo=npm&logoColor=white)](https://www.npmjs.com/package/agent-comms)
-[![version](https://img.shields.io/badge/version-8.6.2-blue)](https://github.com/ExaDev/agent-comms/releases/tag/v8.6.2)
+[![version](https://img.shields.io/badge/version-8.7.0-blue)](https://github.com/ExaDev/agent-comms/releases/tag/v8.7.0)
 [![CI](https://img.shields.io/github/actions/workflow/status/ExaDev/agent-comms/ci.yml?branch=main)](https://github.com/ExaDev/agent-comms/actions)
 
 Cross-harness communication mesh for LLM agents: rooms, DMs, presence, and visibility over TCP with zero filesystem dependencies.
@@ -519,3 +519,29 @@ agent_comms({
 ```
 
 The fingerprint is never a trust anchor supplied by the keyserver — it's the thing the redeemer already independently trusts (from a business card, a prior verification, wherever), and the redeemer's own check is that the key actually fetched or pasted verifies to that exact fingerprint, not merely that _some_ key was found. Redemption never calls back to whoever generated the code: the whole point is bootstrapping trust before any connection between the two devices exists.
+
+### One account on several machines
+
+Your user principal is your account: the key in `~/.agent-comms/user-identity.json` that signs your devices' membership proofs and every DM grant you issue. The same account can live on several machines, and each of them then vouches for its own devices as that one principal, so anyone who trusts your principal covers every machine you run with no per-machine or per-pair step.
+
+A new machine joins with one deliberate act. On a machine that already holds the account, issue an invite, which is a connection code, and carry it to the new machine out of band:
+
+```bash
+npx agent-comms account invite   # on a machine that holds the account; keep it running
+npx agent-comms account join     # on the new machine; paste the invite at the prompt
+```
+
+Both are commands you run, not `agent_comms` tool actions: an invite is the account key to whoever redeems it first, and a join replaces the account the machine holds, so nothing an agent is told can do either, and the invite is printed only to your terminal, never into an agent's transcript. `join` reads the invite at a prompt that does not echo, so it stays out of shell history.
+
+`account invite` runs a store of its own and keeps it up until the invite is redeemed or expires, since the issuing device keeps invites only in memory and answers each one once and never after it expires. An invite is valid for as long as a connection code, and can be made shorter with `--ttl-minutes <n>` but not longer. Redeeming it trusts the issuing device, exactly as `gateway_redeem_connection_code` does, then asks that device for the account key over the mesh's end-to-end authenticated request path, directly or relayed by the hub; the key comes back sealed under a key derived from the invite, which only its holder can open. A join the issuing device refuses or never answers withdraws that trust again, so a failed join leaves the new machine trusting no one it did not trust before. An invite can be PGP-signed with `--sign-key <armored private key file>`, and a signed one is checked on `join` against `--public-key <file>`, pinned to `--fingerprint <hex>` when you give one. Issuing an invite also trusts your own principal on the issuing machine, and joining trusts it on the new one, so the two list each other's devices from then on. The account the new machine held before is kept beside it as `user-identity.replaced-<id>.json`, since its key is still the only one that can revoke what it issued, and the machine's running bridges pick up the account when they restart.
+
+To copy the account without the mesh, export it to a passphrase-sealed file and import that on the other machine. The key is never printed; the passphrase is read from `AGENT_COMMS_ACCOUNT_PASSPHRASE` or asked for without echo, and the file is written owner-only and never over an existing one:
+
+```bash
+npx agent-comms account export ~/account.bundle   # on a machine that holds the account
+npx agent-comms account import ~/account.bundle   # on the other machine, then delete the file
+```
+
+Copy the account this way or by joining, never by copying `~/.agent-comms` between machines: each machine keeps a writer id of its own for the grant ledger below, and two machines sharing one would corrupt it.
+
+Every grant your account issues, and every revocation of one, is recorded in a replicated ledger rather than on the machine that minted it: each machine appends to a data-domain log of its own (wire-mesh's replicated issuer grant ledger pattern, `spec/PATTERNS.md`), and the logs replicate to every machine holding the account, so `dm_revoke` on any of them finds and revokes a grant another one issued. Entries are sealed under a key derived from the account key, so a device that stores or relays them without holding the account sees only ciphertext, and writing to the ledger still needs the account's private key. The ledger replicates over direct peer connections (the local mesh, or machines that reach each other directly), not yet through the relay hub, which does not forward data-domain frames between devices; a revocation itself is also announced to every connected peer the moment it is made. Grants a build before the ledger recorded in `user-identity.json` are moved into it the first time a bridge starts, with nothing to do by hand.

package/dist/account-cli.d.ts

@@ -0,0 +1,34 @@
+/**
+ * `agent-comms account <export|import|invite|join>` (agent-comms#344): the deliberate, consented ways the account key that lets one user principal span machines leaves or reaches a machine. Export and import carry the key as a passphrase-sealed bundle (account-bundle.ts), written to a new owner-only file and never printed; the passphrase comes from AGENT_COMMS_ACCOUNT_PASSPHRASE when set, else from a prompt that does not echo. Invite and join carry it over the mesh (account-join-cli.ts). All four are commands a person runs, never agent_comms tool actions, so nothing an agent is told can move the account and no key or invite lands in an agent's transcript.
+ */
+import { type AccountCliStore } from "./account-join-cli.js";
+import { type UserIdentityOptions } from "./core/user-identity.js";
+/** Where a script supplies the passphrase instead of typing it. */
+export declare const ACCOUNT_PASSPHRASE_ENV = "AGENT_COMMS_ACCOUNT_PASSPHRASE";
+export declare const ACCOUNT_USAGE: string;
+export interface AccountCliIo {
+    /** Reads a secret (a passphrase, an invite) without echoing it. */
+    readSecret: (prompt: string) => Promise<string>;
+    log: (line: string) => void;
+    env: Readonly<Record<string, string | undefined>>;
+    /** Starts a store on this machine's mesh for invite and join, which need one to reach the other machine. */
+    openStore: () => Promise<AccountCliStore>;
+}
+/** Runs one `account` subcommand. Throws with a message fit to show the person on any failure: an unknown subcommand or option, a file that already exists (an export never overwrites), a weak or wrong passphrase, a file that is not a bundle, or an invite that is malformed or refused. */
+export declare function runAccountCommand(args: readonly string[], io: Readonly<AccountCliIo>, userIdentityOptions?: Readonly<UserIdentityOptions>): Promise<void>;
+/** What one keypress does to a hidden line being typed. */
+export type HiddenLineStep = {
+    kind: "typing";
+    value: string;
+} | {
+    kind: "done";
+    value: string;
+} | {
+    kind: "failed";
+    message: string;
+};
+/** Applies one character typed at a hidden prompt to the line so far. Enter, or Ctrl-D on a line with something on it, ends the line; Ctrl-C, and Ctrl-D on an empty line, cancel it. Backspace and Delete remove the last character. An escape sequence (an arrow or function key) or any other control character is refused rather than kept, since it would end up in the value invisibly and could never be typed the same way again. */
+export declare function hiddenLineStep(value: string, character: string): HiddenLineStep;
+/** Reads one line from a terminal with echo off, keystroke by keystroke as hiddenLineStep describes. Throws when stdin is not a terminal, since there is nowhere to prompt; a bundle passphrase can then come from ACCOUNT_PASSPHRASE_ENV instead. */
+export declare function readHiddenLine(prompt: string): Promise<string>;
+//# sourceMappingURL=account-cli.d.ts.map

package/dist/account-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-cli.d.ts","sourceRoot":"","sources":["../src/account-cli.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,EAGL,KAAK,eAAe,EACrB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAIL,KAAK,mBAAmB,EACzB,MAAM,yBAAyB,CAAC;AAEjC,mEAAmE;AACnE,eAAO,MAAM,sBAAsB,mCAAmC,CAAC;AAKvE,eAAO,MAAM,aAAa,QAKd,CAAC;AAEb,MAAM,WAAW,YAAY;IAC3B,mEAAmE;IACnE,UAAU,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAClD,4GAA4G;IAC5G,SAAS,EAAE,MAAM,OAAO,CAAC,eAAe,CAAC,CAAC;CAC3C;AAmBD,gSAAgS;AAChS,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,QAAQ,CAAC,YAAY,CAAC,EAC1B,mBAAmB,GAAE,QAAQ,CAAC,mBAAmB,CAAM,GACtD,OAAO,CAAC,IAAI,CAAC,CA+Cf;AAED,2DAA2D;AAC3D,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC/B;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AASxC,6aAA6a;AAC7a,wBAAgB,cAAc,CAC5B,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,GAChB,cAAc,CA0BhB;AAED,sPAAsP;AACtP,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAoCpE"}

package/dist/account-cli.js

@@ -0,0 +1,140 @@
+/**
+ * `agent-comms account <export|import|invite|join>` (agent-comms#344): the deliberate, consented ways the account key that lets one user principal span machines leaves or reaches a machine. Export and import carry the key as a passphrase-sealed bundle (account-bundle.ts), written to a new owner-only file and never printed; the passphrase comes from AGENT_COMMS_ACCOUNT_PASSPHRASE when set, else from a prompt that does not echo. Invite and join carry it over the mesh (account-join-cli.ts). All four are commands a person runs, never agent_comms tool actions, so nothing an agent is told can move the account and no key or invite lands in an agent's transcript.
+ */
+import * as fs from "node:fs";
+import { deviceIdToHex } from "wire-mesh-core/domain/device-id";
+import { inviteToAccount, joinAccount, } from "./account-join-cli.js";
+import { openAccountBundle, sealAccountBundle } from "./core/account-bundle.js";
+import { importAccountKey, loadOrCreateUserIdentity, readAccountPrivateKey, } from "./core/user-identity.js";
+/** Where a script supplies the passphrase instead of typing it. */
+export const ACCOUNT_PASSPHRASE_ENV = "AGENT_COMMS_ACCOUNT_PASSPHRASE";
+/** A bundle holds the account key, so its file is readable by its owner alone. */
+const BUNDLE_FILE_MODE = 0o600;
+export const ACCOUNT_USAGE = [
+    "Usage: agent-comms account export <file>",
+    "       agent-comms account import <file>",
+    "       agent-comms account invite [--ttl-minutes <n>] [--sign-key <file>]",
+    "       agent-comms account join [--public-key <file>] [--fingerprint <hex>]",
+].join("\n");
+async function passphrase(io, confirm) {
+    const fromEnv = io.env[ACCOUNT_PASSPHRASE_ENV];
+    if (fromEnv !== undefined)
+        return fromEnv;
+    const first = await io.readSecret("Account bundle passphrase: ");
+    if (!confirm)
+        return first;
+    const second = await io.readSecret("Repeat the passphrase: ");
+    if (first !== second)
+        throw new Error("The passphrases do not match");
+    return first;
+}
+function principalOf(identity) {
+    return deviceIdToHex(Uint8Array.from(identity.deviceId));
+}
+/** Runs one `account` subcommand. Throws with a message fit to show the person on any failure: an unknown subcommand or option, a file that already exists (an export never overwrites), a weak or wrong passphrase, a file that is not a bundle, or an invite that is malformed or refused. */
+export async function runAccountCommand(args, io, userIdentityOptions = {}) {
+    const [subcommand, ...rest] = args;
+    if (subcommand === "invite") {
+        await inviteToAccount(rest, io);
+        return;
+    }
+    if (subcommand === "join") {
+        await joinAccount(rest, io);
+        return;
+    }
+    const [file, ...extra] = rest;
+    if (file === undefined || extra.length > 0)
+        throw new Error(ACCOUNT_USAGE);
+    if (subcommand === "export") {
+        const identity = loadOrCreateUserIdentity(userIdentityOptions);
+        const bundle = sealAccountBundle(readAccountPrivateKey(userIdentityOptions), await passphrase(io, true));
+        fs.writeFileSync(file, `${bundle}\n`, {
+            encoding: "utf-8",
+            mode: BUNDLE_FILE_MODE,
+            flag: "wx",
+        });
+        io.log(`Exported account ${principalOf(identity)} to ${file}. Anyone with this file and its passphrase holds the account; import it on your other machine with \`agent-comms account import ${file}\`, then delete it.`);
+        return;
+    }
+    if (subcommand === "import") {
+        const privateKeyPem = openAccountBundle(fs.readFileSync(file, "utf-8"), await passphrase(io, false));
+        const { identity, replacedFile } = importAccountKey(userIdentityOptions, privateKeyPem);
+        io.log(`This machine now holds account ${principalOf(identity)}.`);
+        if (replacedFile !== undefined) {
+            io.log(`The account it held before was moved to ${replacedFile}; it is still the only key that can revoke what that account issued.`);
+        }
+        io.log("Restart running agent-comms bridges so they use it.");
+        return;
+    }
+    throw new Error(ACCOUNT_USAGE);
+}
+const END_OF_TEXT = "\u0003";
+const END_OF_TRANSMISSION = "\u0004";
+const BACKSPACE = "\b";
+const DELETE = "\u007f";
+/** Every character ordered before this one is a C0 control character, none of which a passphrase can hold. */
+const FIRST_PRINTABLE = " ";
+/** Applies one character typed at a hidden prompt to the line so far. Enter, or Ctrl-D on a line with something on it, ends the line; Ctrl-C, and Ctrl-D on an empty line, cancel it. Backspace and Delete remove the last character. An escape sequence (an arrow or function key) or any other control character is refused rather than kept, since it would end up in the value invisibly and could never be typed the same way again. */
+export function hiddenLineStep(value, character) {
+    if (character === "\r" || character === "\n")
+        return { kind: "done", value };
+    if (character === END_OF_TEXT)
+        return { kind: "failed", message: "Cancelled" };
+    if (character === END_OF_TRANSMISSION) {
+        return value === ""
+            ? { kind: "failed", message: "Cancelled: no input before end of input" }
+            : { kind: "done", value };
+    }
+    if (character === BACKSPACE || character === DELETE) {
+        // A terminal's backspace removes one visible character, which may be several code points.
+        const graphemes = Array.from(new Intl.Segmenter().segment(value), ({ segment }) => segment);
+        return { kind: "typing", value: graphemes.slice(0, -1).join("") };
+    }
+    // Escape, which starts every arrow and function key's sequence, is one of these.
+    if (character < FIRST_PRINTABLE) {
+        return {
+            kind: "failed",
+            message: "Arrow keys, Escape and other control keys cannot be used at this prompt, since they would be kept in it invisibly; start again and type it plainly",
+        };
+    }
+    return { kind: "typing", value: value + character };
+}
+/** Reads one line from a terminal with echo off, keystroke by keystroke as hiddenLineStep describes. Throws when stdin is not a terminal, since there is nowhere to prompt; a bundle passphrase can then come from ACCOUNT_PASSPHRASE_ENV instead. */
+export async function readHiddenLine(prompt) {
+    const { stdin, stderr } = process;
+    if (!stdin.isTTY) {
+        throw new Error(`No terminal to ask on (${prompt.trim()}); a bundle passphrase can be set in ${ACCOUNT_PASSPHRASE_ENV} instead`);
+    }
+    stderr.write(prompt);
+    stdin.setRawMode(true);
+    stdin.setEncoding("utf-8");
+    stdin.resume();
+    return new Promise((resolve, reject) => {
+        let value = "";
+        // Replaced once the listener exists, so the listener can detach itself.
+        let finish = () => undefined;
+        const onData = (chunk) => {
+            for (const character of chunk) {
+                const step = hiddenLineStep(value, character);
+                if (step.kind === "typing") {
+                    value = step.value;
+                    continue;
+                }
+                finish();
+                if (step.kind === "done")
+                    resolve(step.value);
+                else
+                    reject(new Error(step.message));
+                return;
+            }
+        };
+        finish = () => {
+            stdin.off("data", onData);
+            stdin.setRawMode(false);
+            stdin.pause();
+            stderr.write("\n");
+        };
+        stdin.on("data", onData);
+    });
+}
+//# sourceMappingURL=account-cli.js.map

package/dist/account-cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-cli.js","sourceRoot":"","sources":["../src/account-cli.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,EACL,eAAe,EACf,WAAW,GAEZ,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAChF,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,qBAAqB,GAEtB,MAAM,yBAAyB,CAAC;AAEjC,mEAAmE;AACnE,MAAM,CAAC,MAAM,sBAAsB,GAAG,gCAAgC,CAAC;AAEvE,kFAAkF;AAClF,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAE/B,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,0CAA0C;IAC1C,0CAA0C;IAC1C,2EAA2E;IAC3E,6EAA6E;CAC9E,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAWb,KAAK,UAAU,UAAU,CACvB,EAA0B,EAC1B,OAAgB;IAEhB,MAAM,OAAO,GAAG,EAAE,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IAC/C,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IAC1C,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,6BAA6B,CAAC,CAAC;IACjE,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,yBAAyB,CAAC,CAAC;IAC9D,IAAI,KAAK,KAAK,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACtE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAAC,QAA4C;IAC/D,OAAO,aAAa,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,gSAAgS;AAChS,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAuB,EACvB,EAA0B,EAC1B,sBAAqD,EAAE;IAEvD,MAAM,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IACnC,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,eAAe,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAChC,OAAO;IACT,CAAC;IACD,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;QAC1B,MAAM,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC5B,OAAO;IACT,CAAC;IACD,MAAM,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC;IAC9B,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;IAC3E,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,wBAAwB,CAAC,mBAAmB,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,iBAAiB,CAC9B,qBAAqB,CAAC,mBAAmB,CAAC,EAC1C,MAAM,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,CAC3B,CAAC;QACF,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,GAAG,MAAM,IAAI,EAAE;YACpC,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,gBAAgB;YACtB,IAAI,EAAE,IAAI;SACX,CAAC,CAAC;QACH,EAAE,CAAC,GAAG,CACJ,oBAAoB,WAAW,CAAC,QAAQ,CAAC,OAAO,IAAI,mIAAmI,IAAI,qBAAqB,CACjN,CAAC;QACF,OAAO;IACT,CAAC;IACD,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,aAAa,GAAG,iBAAiB,CACrC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,EAC9B,MAAM,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,CAC5B,CAAC;QACF,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,gBAAgB,CACjD,mBAAmB,EACnB,aAAa,CACd,CAAC;QACF,EAAE,CAAC,GAAG,CAAC,kCAAkC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACnE,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,EAAE,CAAC,GAAG,CACJ,2CAA2C,YAAY,sEAAsE,CAC9H,CAAC;QACJ,CAAC;QACD,EAAE,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC;QAC9D,OAAO;IACT,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;AACjC,CAAC;AAQD,MAAM,WAAW,GAAG,QAAQ,CAAC;AAC7B,MAAM,mBAAmB,GAAG,QAAQ,CAAC;AACrC,MAAM,SAAS,GAAG,IAAI,CAAC;AACvB,MAAM,MAAM,GAAG,QAAQ,CAAC;AACxB,8GAA8G;AAC9G,MAAM,eAAe,GAAG,GAAG,CAAC;AAE5B,6aAA6a;AAC7a,MAAM,UAAU,cAAc,CAC5B,KAAa,EACb,SAAiB;IAEjB,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC7E,IAAI,SAAS,KAAK,WAAW;QAC3B,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAClD,IAAI,SAAS,KAAK,mBAAmB,EAAE,CAAC;QACtC,OAAO,KAAK,KAAK,EAAE;YACjB,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,yCAAyC,EAAE;YACxE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;IACD,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;QACpD,0FAA0F;QAC1F,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAC1B,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,EACnC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,OAAO,CACzB,CAAC;QACF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;IACpE,CAAC;IACD,iFAAiF;IACjF,IAAI,SAAS,GAAG,eAAe,EAAE,CAAC;QAChC,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,OAAO,EACL,oJAAoJ;SACvJ,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,GAAG,SAAS,EAAE,CAAC;AACtD,CAAC;AAED,sPAAsP;AACtP,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAc;IACjD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAClC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,0BAA0B,MAAM,CAAC,IAAI,EAAE,wCAAwC,sBAAsB,UAAU,CAChH,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACrB,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACvB,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IAC3B,KAAK,CAAC,MAAM,EAAE,CAAC;IACf,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,KAAK,GAAG,EAAE,CAAC;QACf,wEAAwE;QACxE,IAAI,MAAM,GAAG,GAAS,EAAE,CAAC,SAAS,CAAC;QACnC,MAAM,MAAM,GAAG,CAAC,KAAa,EAAQ,EAAE;YACrC,KAAK,MAAM,SAAS,IAAI,KAAK,EAAE,CAAC;gBAC9B,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;gBAC9C,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAC3B,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;oBACnB,SAAS;gBACX,CAAC;gBACD,MAAM,EAAE,CAAC;gBACT,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;oBAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;;oBACzC,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;gBACrC,OAAO;YACT,CAAC;QACH,CAAC,CAAC;QACF,MAAM,GAAG,GAAS,EAAE;YAClB,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC1B,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YACxB,KAAK,CAAC,KAAK,EAAE,CAAC;YACd,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC,CAAC;QACF,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/account-join-cli.d.ts

@@ -0,0 +1,17 @@
+/**
+ * `agent-comms account invite` and `agent-comms account join` (agent-comms#344): joining a new machine to the account over the mesh (see core/account-join.ts for the flow). Each runs a store of its own for as long as the command runs. An invite is printed to this terminal only, and the command keeps its store up until the invite is redeemed or expires, since invites live only in the issuing store's memory. A join reads the invite at a prompt that does not echo, so it never sits in shell history.
+ */
+import type { AccountJoin } from "./core/account-join.js";
+import { type AccountCliIo } from "./account-cli.js";
+/** A store started for one invite or join, and its shutdown. */
+export interface AccountCliStore {
+    account: Pick<AccountJoin, "invite" | "join">;
+    close: () => Promise<void>;
+}
+/** Starts a store on this machine's mesh, holding the machine's account, with one hidden agent: that is what gives it a hub session once it trusts the other machine, and a hidden agent is reachable by device id without being listed. */
+export declare function openMachineAccountStore(): Promise<AccountCliStore>;
+/** Issues an invite, prints it, and returns once it has been redeemed or has expired. */
+export declare function inviteToAccount(args: readonly string[], io: Readonly<AccountCliIo>): Promise<void>;
+/** Reads an invite at a prompt and makes this machine hold the account it came from. */
+export declare function joinAccount(args: readonly string[], io: Readonly<AccountCliIo>): Promise<void>;
+//# sourceMappingURL=account-join-cli.d.ts.map

package/dist/account-join-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-join-cli.d.ts","sourceRoot":"","sources":["../src/account-join-cli.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAU1D,OAAO,EAAiB,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEpE,gEAAgE;AAChE,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,GAAG,MAAM,CAAC,CAAC;IAC9C,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B;AAKD,4OAA4O;AAC5O,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,eAAe,CAAC,CAwBxE;AAwDD,yFAAyF;AACzF,wBAAsB,eAAe,CACnC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,QAAQ,CAAC,YAAY,CAAC,GACzB,OAAO,CAAC,IAAI,CAAC,CAuBf;AA+BD,wFAAwF;AACxF,wBAAsB,WAAW,CAC/B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,QAAQ,CAAC,YAAY,CAAC,GACzB,OAAO,CAAC,IAAI,CAAC,CAiBf"}

package/dist/account-join-cli.js

@@ -0,0 +1,140 @@
+/**
+ * `agent-comms account invite` and `agent-comms account join` (agent-comms#344): joining a new machine to the account over the mesh (see core/account-join.ts for the flow). Each runs a store of its own for as long as the command runs. An invite is printed to this terminal only, and the command keeps its store up until the invite is redeemed or expires, since invites live only in the issuing store's memory. A join reads the invite at a prompt that does not echo, so it never sits in shell history.
+ */
+import * as fs from "node:fs";
+import { createBridgeMesh } from "./core/bridge-mesh.js";
+import { createMeshErrorReporter } from "./core/error-reporting.js";
+import { releaseIdentityLock, } from "./core/identity-store.js";
+import { ConnectionCodeSchema } from "./core/types.js";
+import { ACCOUNT_USAGE } from "./account-cli.js";
+/** The identity slot harness these commands' own store runs under, apart from every bridge's. */
+const ACCOUNT_CLI_HARNESS = "account";
+/** Starts a store on this machine's mesh, holding the machine's account, with one hidden agent: that is what gives it a hub session once it trusts the other machine, and a hidden agent is reachable by device id without being listed. */
+export async function openMachineAccountStore() {
+    const slot = {
+        harness: ACCOUNT_CLI_HARNESS,
+        cwd: process.cwd(),
+    };
+    const { store } = await createBridgeMesh(slot);
+    store.onError = createMeshErrorReporter();
+    await store.init();
+    const agent = await store.registerAgent({
+        name: ACCOUNT_CLI_HARNESS,
+        harness: ACCOUNT_CLI_HARNESS,
+        cwd: slot.cwd,
+        pid: process.pid,
+        visibility: "hidden",
+        tags: [],
+    });
+    return {
+        account: store.account,
+        close: async () => {
+            await store.setAgentOffline(agent.id);
+            await store.shutdown();
+            releaseIdentityLock(slot);
+        },
+    };
+}
+const MS_PER_SECOND = 1000;
+const SECONDS_PER_MINUTE = 60;
+const MS_PER_MINUTE = SECONDS_PER_MINUTE * MS_PER_SECOND;
+/** Parses `--name value` pairs, allowing only `allowed` names, each at most once. */
+function parseOptions(args, allowed) {
+    const options = new Map();
+    for (let i = 0; i < args.length; i += 2) {
+        const name = args[i];
+        const value = args[i + 1];
+        if (name === undefined ||
+            !name.startsWith("--") ||
+            !allowed.includes(name.slice(2)) ||
+            options.has(name.slice(2)) ||
+            value === undefined) {
+            throw new Error(ACCOUNT_USAGE);
+        }
+        options.set(name.slice(2), value);
+    }
+    return options;
+}
+function ttlMsFrom(minutes) {
+    if (minutes === undefined)
+        return undefined;
+    const parsed = Number(minutes);
+    if (!Number.isInteger(parsed) || parsed <= 0) {
+        throw new Error(`--ttl-minutes must be a whole number of minutes above zero, not ${minutes}`);
+    }
+    return parsed * MS_PER_MINUTE;
+}
+async function signingOptions(keyFile, io) {
+    if (keyFile === undefined)
+        return {};
+    const privateKeyArmored = fs.readFileSync(keyFile, "utf-8");
+    const passphrase = await io.readSecret("PGP key passphrase (press Enter if it has none): ");
+    return passphrase === ""
+        ? { privateKeyArmored }
+        : { privateKeyArmored, passphrase };
+}
+/** Issues an invite, prints it, and returns once it has been redeemed or has expired. */
+export async function inviteToAccount(args, io) {
+    const options = parseOptions(args, ["ttl-minutes", "sign-key"]);
+    const ttlMs = ttlMsFrom(options.get("ttl-minutes"));
+    const signing = await signingOptions(options.get("sign-key"), io);
+    const store = await io.openStore();
+    try {
+        const { code, settled } = await store.account.invite({
+            ...(ttlMs !== undefined && { ttlMs }),
+            ...signing,
+        });
+        io.log(`Account invite, valid until ${code.expiresAt} and for one use. Whoever redeems it takes a full copy of this account, so give it only to your own new machine, out of band, and run \`agent-comms account join\` there. Keep this command running until then.`);
+        io.log(JSON.stringify(code));
+        const outcome = await settled;
+        io.log(outcome === "redeemed"
+            ? "The invite was redeemed: the new machine now holds this account."
+            : "The invite expired unused.");
+    }
+    finally {
+        await store.close();
+    }
+}
+const NOT_AN_INVITE = "That is not an account invite: paste the whole line `agent-comms account invite` printed";
+function parseInvite(raw) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new Error(NOT_AN_INVITE);
+    }
+    if (!ConnectionCodeSchema.is(parsed)) {
+        throw new Error(NOT_AN_INVITE);
+    }
+    return parsed;
+}
+function verifyingOptions(options) {
+    const keyFile = options.get("public-key");
+    const fingerprint = options.get("fingerprint");
+    return {
+        ...(keyFile !== undefined && {
+            publicKeyArmored: fs.readFileSync(keyFile, "utf-8"),
+        }),
+        ...(fingerprint !== undefined && { expectedFingerprint: fingerprint }),
+    };
+}
+/** Reads an invite at a prompt and makes this machine hold the account it came from. */
+export async function joinAccount(args, io) {
+    const options = parseOptions(args, ["public-key", "fingerprint"]);
+    const redeemOptions = verifyingOptions(options);
+    const invite = parseInvite(await io.readSecret("Account invite: "));
+    const store = await io.openStore();
+    try {
+        const result = await store.account.join(invite, redeemOptions);
+        io.log(`This machine now holds account ${result.principal}.`);
+        if (result.replacedFile !== undefined) {
+            io.log(`The account it held before was moved to ${result.replacedFile}; it is still the only key that can revoke what that account issued.`);
+        }
+        io.log("Restart running agent-comms bridges so they use it.");
+    }
+    finally {
+        await store.close();
+    }
+}
+//# sourceMappingURL=account-join-cli.js.map

package/dist/account-join-cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-join-cli.js","sourceRoot":"","sources":["../src/account-join-cli.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EACL,mBAAmB,GAEpB,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAAE,oBAAoB,EAAuB,MAAM,iBAAiB,CAAC;AAC5E,OAAO,EAAE,aAAa,EAAqB,MAAM,kBAAkB,CAAC;AAQpE,iGAAiG;AACjG,MAAM,mBAAmB,GAAG,SAAS,CAAC;AAEtC,4OAA4O;AAC5O,MAAM,CAAC,KAAK,UAAU,uBAAuB;IAC3C,MAAM,IAAI,GAAiB;QACzB,OAAO,EAAE,mBAAmB;QAC5B,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;KACnB,CAAC;IACF,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC/C,KAAK,CAAC,OAAO,GAAG,uBAAuB,EAAE,CAAC;IAC1C,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;IACnB,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC;QACtC,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,mBAAmB;QAC5B,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,UAAU,EAAE,QAAQ;QACpB,IAAI,EAAE,EAAE;KACT,CAAC,CAAC;IACH,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,MAAM,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACtC,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAC;YACvB,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,aAAa,GAAG,IAAI,CAAC;AAC3B,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAC9B,MAAM,aAAa,GAAG,kBAAkB,GAAG,aAAa,CAAC;AAEzD,qFAAqF;AACrF,SAAS,YAAY,CACnB,IAAuB,EACvB,OAA0B;IAE1B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACrB,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,IACE,IAAI,KAAK,SAAS;YAClB,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YACtB,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAChC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC1B,KAAK,KAAK,SAAS,EACnB,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;QACjC,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,SAAS,CAAC,OAA2B;IAC5C,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,mEAAmE,OAAO,EAAE,CAC7E,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,GAAG,aAAa,CAAC;AAChC,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,OAA2B,EAC3B,EAA0B;IAI1B,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACrC,MAAM,iBAAiB,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC5D,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,UAAU,CACpC,mDAAmD,CACpD,CAAC;IACF,OAAO,UAAU,KAAK,EAAE;QACtB,CAAC,CAAC,EAAE,iBAAiB,EAAE;QACvB,CAAC,CAAC,EAAE,iBAAiB,EAAE,UAAU,EAAE,CAAC;AACxC,CAAC;AAED,yFAAyF;AACzF,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAuB,EACvB,EAA0B;IAE1B,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,SAAS,EAAE,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YACnD,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,CAAC;YACrC,GAAG,OAAO;SACX,CAAC,CAAC;QACH,EAAE,CAAC,GAAG,CACJ,+BAA+B,IAAI,CAAC,SAAS,iNAAiN,CAC/P,CAAC;QACF,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC;QAC9B,EAAE,CAAC,GAAG,CACJ,OAAO,KAAK,UAAU;YACpB,CAAC,CAAC,kEAAkE;YACpE,CAAC,CAAC,4BAA4B,CACjC,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;AACH,CAAC;AAED,MAAM,aAAa,GACjB,0FAA0F,CAAC;AAE7F,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,CAAC,oBAAoB,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,gBAAgB,CACvB,OAAoC;IAEpC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC/C,OAAO;QACL,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI;YAC3B,gBAAgB,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC;SACpD,CAAC;QACF,GAAG,CAAC,WAAW,KAAK,SAAS,IAAI,EAAE,mBAAmB,EAAE,WAAW,EAAE,CAAC;KACvE,CAAC;AACJ,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,IAAuB,EACvB,EAA0B;IAE1B,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC,CAAC;IAClE,MAAM,aAAa,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,SAAS,EAAE,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QAC/D,EAAE,CAAC,GAAG,CAAC,kCAAkC,MAAM,CAAC,SAAS,GAAG,CAAC,CAAC;QAC9D,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACtC,EAAE,CAAC,GAAG,CACJ,2CAA2C,MAAM,CAAC,YAAY,sEAAsE,CACrI,CAAC;QACJ,CAAC;QACD,EAAE,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC;IAChE,CAAC;YAAS,CAAC;QACT,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;AACH,CAAC"}

package/dist/bridges/mcp/server.d.ts

@@ -8,16 +8,13 @@
  * Run via: npx agent-comms bridge mcp
  */
 import { type BridgeMeshOptions } from "../../core/index.js";
-import type { Readable } from "node:stream";
 import type { IdentitySlot } from "../../core/identity-store.js";
-/** Seams that let a test run the real bridge against an isolated mesh and a piped stdin; every real launch omits them. */
+/** Seams that let a test run the real bridge against an isolated mesh; every real launch omits them. */
 export interface McpBridgeOptions {
     /** Ports and hub for the bridge's own mesh store; see BridgeMeshOptions. */
     mesh?: BridgeMeshOptions | undefined;
     /** The identity slot. Defaults to this process's working directory under the `mcp` harness. */
     slot?: IdentitySlot | undefined;
-    /** The stream JSON-RPC requests are read from. Defaults to process.stdin. */
-    input?: Readable | undefined;
 }
 export declare function run(options?: Readonly<McpBridgeOptions>): Promise<void>;
 //# sourceMappingURL=server.d.ts.map

package/dist/bridges/mcp/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../src/bridges/mcp/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,OAAO,EAQL,KAAK,iBAAiB,EACvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAgBjE,0HAA0H;AAC1H,MAAM,WAAW,gBAAgB;IAC/B,4EAA4E;IAC5E,IAAI,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;IACrC,+FAA+F;IAC/F,IAAI,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IAChC,6EAA6E;IAC7E,KAAK,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;CAC9B;AAED,wBAAsB,GAAG,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,gBAAgB,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAiG7E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../src/bridges/mcp/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,OAAO,EAQL,KAAK,iBAAiB,EACvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAgBjE,wGAAwG;AACxG,MAAM,WAAW,gBAAgB;IAC/B,4EAA4E;IAC5E,IAAI,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;IACrC,+FAA+F;IAC/F,IAAI,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;CACjC;AAED,wBAAsB,GAAG,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,gBAAgB,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAiG7E"}

package/dist/bridges/mcp/server.js

@@ -77,7 +77,7 @@ export async function run(options) {
     await store.init();
     const webHandle = await tryStartBridgeWebServer(store, "mcp");
     tool.getWebUrlStatus = () => getWebUrlStatus(webHandle);
-    await mcp.connect(new StdioServerTransport(options?.input));
+    await mcp.connect(new StdioServerTransport());
     const reg = await ensureRegistered({
         cwd: process.cwd(),
         store,

package/dist/bridges/mcp/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../../../src/bridges/mcp/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AAEjF,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,6BAA6B,EAC7B,eAAe,GAEhB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EACL,uBAAuB,EACvB,eAAe,GAChB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAE9C,uHAAuH;AACvH,MAAM,gCAAgC,GAAG,CAAC,CAAC;AAE3C,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAYD,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,OAAoC;IAC5D,8HAA8H;IAC9H,MAAM,YAAY,GAAiB,OAAO,EAAE,IAAI,IAAI;QAClD,OAAO,EAAE,KAAK;QACd,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;KACnB,CAAC;IACF,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,gBAAgB,CAAC,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC5E,KAAK,CAAC,OAAO,GAAG,uBAAuB,EAAE,CAAC;IAC1C,KAAK,CAAC,wBAAwB,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;IAC/D,IAAI,OAA2B,CAAC;IAEhC,MAAM,GAAG,GAAG,IAAI,SAAS,CACvB,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,EACzC,EAAE,YAAY,EAAE,EAAE,EAAE,CACrB,CAAC;IAEF,0EAA0E;IAC1E,oBAAoB;IACpB,0EAA0E;IAE1E,GAAG,CAAC,YAAY,CACd,aAAa,EACb;QACE,WAAW,EAAE;YACX,kDAAkD;YAClD,oFAAoF;YACpF,+EAA+E;YAC/E,2DAA2D;SAC5D,CAAC,IAAI,CAAC,GAAG,CAAC;QACX,WAAW,EAAE,eAAe;KAC7B,EACD,KAAK,EAAE,SAAkB,EAAE,EAAE;QAC3B,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC;QAElC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,GACR,WAAW,KAAK,UAAU,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;gBAC3D,CAAC,CAAC,MAAM,CAAC,IAAI;gBACb,CAAC,CAAC,OAAO,MAAM,CAAC,gCAAgC,CAAC,EAAE,CAAC;YACxD,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC;gBACjC,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;gBAClB,KAAK;gBACL,OAAO,EAAE,KAAK;gBACd,WAAW,EAAE,IAAI;aAClB,CAAC,CAAC;YACH,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;QACxB,CAAC;QAED,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAC9B,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EACjE,MAAM,CACP,CAAC;QAEF,yDAAyD;QACzD,MAAM,aAAa,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAqC;YAChD,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE;SACvC,CAAC;QAEF,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,yBAAyB,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;aAC3D,CAAC,CAAC;QACL,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IAC9C,CAAC,CACF,CAAC;IAEF,0EAA0E;IAC1E,UAAU;IACV,0EAA0E;IAE1E,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;IACnB,MAAM,SAAS,GAAG,MAAM,uBAAuB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC9D,IAAI,CAAC,eAAe,GAAG,GAAG,EAAE,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;IACxD,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,oBAAoB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IAE5D,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC;QACjC,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;QAClB,KAAK;QACL,OAAO,EAAE,KAAK;QACd,WAAW,EAAE,OAAO,MAAM,CAAC,gCAAgC,CAAC,EAAE;KAC/D,CAAC,CAAC;IACH,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IAEtB,6BAA6B,CAAC;QAC5B,QAAQ,EAAE,KAAK,IAAI,EAAE;YACnB,IAAI,OAAO,KAAK,SAAS;gBAAE,MAAM,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;YAChE,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAC;YACvB,mBAAmB,CAAC,YAAY,CAAC,CAAC;QACpC,CAAC;QACD,WAAW,EAAE,MAAM;KACpB,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../../src/bridges/mcp/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AAEjF,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,6BAA6B,EAC7B,eAAe,GAEhB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EACL,uBAAuB,EACvB,eAAe,GAChB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAE9C,uHAAuH;AACvH,MAAM,gCAAgC,GAAG,CAAC,CAAC;AAE3C,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAUD,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,OAAoC;IAC5D,8HAA8H;IAC9H,MAAM,YAAY,GAAiB,OAAO,EAAE,IAAI,IAAI;QAClD,OAAO,EAAE,KAAK;QACd,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;KACnB,CAAC;IACF,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,gBAAgB,CAAC,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC5E,KAAK,CAAC,OAAO,GAAG,uBAAuB,EAAE,CAAC;IAC1C,KAAK,CAAC,wBAAwB,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;IAC/D,IAAI,OAA2B,CAAC;IAEhC,MAAM,GAAG,GAAG,IAAI,SAAS,CACvB,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,EACzC,EAAE,YAAY,EAAE,EAAE,EAAE,CACrB,CAAC;IAEF,0EAA0E;IAC1E,oBAAoB;IACpB,0EAA0E;IAE1E,GAAG,CAAC,YAAY,CACd,aAAa,EACb;QACE,WAAW,EAAE;YACX,kDAAkD;YAClD,oFAAoF;YACpF,+EAA+E;YAC/E,2DAA2D;SAC5D,CAAC,IAAI,CAAC,GAAG,CAAC;QACX,WAAW,EAAE,eAAe;KAC7B,EACD,KAAK,EAAE,SAAkB,EAAE,EAAE;QAC3B,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC;QAElC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,GACR,WAAW,KAAK,UAAU,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;gBAC3D,CAAC,CAAC,MAAM,CAAC,IAAI;gBACb,CAAC,CAAC,OAAO,MAAM,CAAC,gCAAgC,CAAC,EAAE,CAAC;YACxD,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC;gBACjC,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;gBAClB,KAAK;gBACL,OAAO,EAAE,KAAK;gBACd,WAAW,EAAE,IAAI;aAClB,CAAC,CAAC;YACH,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;QACxB,CAAC;QAED,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAC9B,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EACjE,MAAM,CACP,CAAC;QAEF,yDAAyD;QACzD,MAAM,aAAa,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAqC;YAChD,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE;SACvC,CAAC;QAEF,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,yBAAyB,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;aAC3D,CAAC,CAAC;QACL,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IAC9C,CAAC,CACF,CAAC;IAEF,0EAA0E;IAC1E,UAAU;IACV,0EAA0E;IAE1E,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;IACnB,MAAM,SAAS,GAAG,MAAM,uBAAuB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC9D,IAAI,CAAC,eAAe,GAAG,GAAG,EAAE,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;IACxD,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,oBAAoB,EAAE,CAAC,CAAC;IAE9C,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC;QACjC,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;QAClB,KAAK;QACL,OAAO,EAAE,KAAK;QACd,WAAW,EAAE,OAAO,MAAM,CAAC,gCAAgC,CAAC,EAAE;KAC/D,CAAC,CAAC;IACH,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IAEtB,6BAA6B,CAAC;QAC5B,QAAQ,EAAE,KAAK,IAAI,EAAE;YACnB,IAAI,OAAO,KAAK,SAAS;gBAAE,MAAM,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;YAChE,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAC;YACvB,mBAAmB,CAAC,YAAY,CAAC,CAAC;QACpC,CAAC;QACD,WAAW,EAAE,MAAM;KACpB,CAAC,CAAC;AACL,CAAC"}

package/dist/cli.d.ts

@@ -13,6 +13,10 @@
  *   npx agent-comms rooms                     # list rooms
  *   npx agent-comms agents                    # list agents
  *   npx agent-comms read <room>               # read room messages
+ *   npx agent-comms account export <file>     # write this machine's account key, passphrase-sealed
+ *   npx agent-comms account import <file>     # make this machine hold an exported account
+ *   npx agent-comms account invite            # print a one-use invite that joins another machine to this account
+ *   npx agent-comms account join              # join this machine to an account with an invite
  *
  * The bridge subcommand lets harnesses invoke the bridge via npx:
  *   .mcp.json:  \{ "command": "npx", "args": ["agent-comms", "bridge", "claude-code"] \}

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG"}

package/dist/cli.js

@@ -14,6 +14,10 @@
  *   npx agent-comms rooms                     # list rooms
  *   npx agent-comms agents                    # list agents
  *   npx agent-comms read <room>               # read room messages
+ *   npx agent-comms account export <file>     # write this machine's account key, passphrase-sealed
+ *   npx agent-comms account import <file>     # make this machine hold an exported account
+ *   npx agent-comms account invite            # print a one-use invite that joins another machine to this account
+ *   npx agent-comms account join              # join this machine to an account with an invite
  *
  * The bridge subcommand lets harnesses invoke the bridge via npx:
  *   .mcp.json:  \{ "command": "npx", "args": ["agent-comms", "bridge", "claude-code"] \}
@@ -28,6 +32,8 @@ import { bridges } from "./bridges/registry.js";
 import { resolveDefaultCommand } from "./core/default-command.js";
 import { runTui } from "./bridges/user/tui.js";
 import { runCli } from "./bridges/user/cli.js";
+import { readHiddenLine, runAccountCommand } from "./account-cli.js";
+import { openMachineAccountStore } from "./account-join-cli.js";
 // ---------------------------------------------------------------------------
 // Zod schemas for config files
 // ---------------------------------------------------------------------------
@@ -190,8 +196,25 @@ switch (command) {
         runUserCli(command, cliArgs);
         break;
     }
+    case "account": {
+        runAccountCommand(resolvedArgs.slice(SUBCOMMAND_ARGS_START_INDEX), {
+            readSecret: readHiddenLine,
+            log: (line) => {
+                console.log(line);
+            },
+            env: process.env,
+            openStore: openMachineAccountStore,
+        }).then(() => {
+            // The store an invite or join ran leaves timers and sockets behind it, so the command ends the process itself once it is done.
+            process.exit(0);
+        }, (err) => {
+            console.error(err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        });
+        break;
+    }
     default:
-        console.log("Usage: agent-comms [setup|status|remove|bridge <id>|chat|send|dm|rooms|agents|read]");
+        console.log("Usage: agent-comms [setup|status|remove|bridge <id>|chat|send|dm|rooms|agents|read|account <export|import|invite|join>]");
         console.log("With no subcommand: setup when stdin is a terminal, the MCP server when it is not.");
         process.exit(1);
 }