agent-pager 0.1.0 → 0.1.1

package/README.md

@@ -2,19 +2,11 @@
 
 **Because people ignore their messages, but not their agents.**
 
-Agent Pager is a secure friend network for paging trusted friends through their active coding agent sessions. The current repo contains the local prototype plus the hosted V1 foundation: Supabase schema/auth/realtime setup, typed database client helpers, safe Vercel config, MCP tools, Codex/Claude skills, and a retro Authorized Human Contact Service web app.
+Agent Pager lets trusted friends page your local Codex or Claude agent session. Public links can request access, but only approved friends can send pages. Messages are text-only, device-signed, friend-gated, and rate-limited.
 
-Production V1 is deployed at:
+Web app: https://agent-pager.vercel.app
 
-```text
-https://agent-pager.vercel.app
-```
-
-Current launch status: GitHub, Supabase, Vercel production, and the npm CLI package are live.
-
-## Quickstart
-
-Install the CLI:
+## Install
 
 ```bash
 npm install -g agent-pager
@@ -22,148 +14,62 @@ agent-pager login
 agent-pager start
 ```
 
-Local prototype:
+`agent-pager login` opens a device-pairing flow. Approve the device in the web app, then keep `agent-pager start` running to receive pages.
 
-Terminal 1:
+## First Run
 
-```bash
-npm install
-npm run build
-npm start
-```
+1. Create an account at https://agent-pager.vercel.app.
+2. Run `agent-pager login` on the machine where your coding agent runs.
+3. Approve the pairing code in the web app.
+4. Run `agent-pager start`.
+5. Optional: run `agent-pager setup codex` or `agent-pager setup claude`.
 
-Terminal 2:
+## Share
 
 ```bash
-node dist/src/cli.js login --username bryson --local-dev
-node dist/src/cli.js start
+agent-pager share
 ```
 
-Terminal 3, pretending to be a friend:
+Your share link lets people request access. It does not let strangers page you. You approve or deny friend requests before any pages can be delivered.
 
-```bash
-AGENT_PAGER_HOME=/tmp/agent-pager-sarah node dist/src/cli.js login --username sarah --local-dev
-node dist/src/cli.js friends invite
-AGENT_PAGER_HOME=/tmp/agent-pager-sarah node dist/src/cli.js friends add <bryson-invite-url>
-AGENT_PAGER_HOME=/tmp/agent-pager-sarah node dist/src/cli.js page bryson "Can you check the PR?"
-```
-
-Open the web app:
-
-```text
-http://127.0.0.1:8787
-```
-
-Hosted V1 foundation:
+## Agent Tools
 
 ```bash
-npm run db:start
-npm run db:types:local
-npm run check
-npm run test:doctor
-npm run test:config
-npm run build
-npm run test:web
-npm run test:mcp
-npm run test:smoke
-npm run test:package
-npm run test:hosted
+agent-pager setup codex
+agent-pager setup claude
+agent-pager mcp
 ```
 
-The hosted foundation includes Vercel-compatible API handlers under `/api` for public config, profiles, public profile links, friend requests, secure device pairing, devices, invites, friends, pages, deliveries, abuse reports, audit events, presence, and health. The retro web app uses Supabase Auth plus those hosted APIs for profile setup, `Page my agent` request-access links, friend invites, page compose/history, report filing, device approvals, and security logs. The tests are local-only and do not push to Supabase cloud or deploy to Vercel.
-
-`agent-pager doctor` is a local-only readiness check for the hosted V1. It verifies the npm package manifest, Vercel Git deployment guard, required environment variables, server signing keypair, local pairing state, Git remote/status, Docker runtime, and cloud-smoke gate without linking Supabase, pushing Git, publishing npm, or deploying Vercel.
-
-`agent-pager launch-check` is the live hosted preflight. It reads GitHub, Supabase, and Vercel state to confirm repo, schema, project, and env readiness before a manual preview deployment.
-
-`agent-pager login` now uses secure hosted device pairing by default. The old local prototype login is still available with `--username` / `--local-dev`.
-
-`agent-pager start` uses Supabase Realtime as the fast path and a signed HTTP polling fallback while it is running. `agent-pager check-pages` remains available for manual recovery or debugging.
-
-The npm package ships the built CLI plus bundled retro web assets. `npm run test:package` dry-runs `npm pack` and verifies the package contents.
+The setup commands install local instructions and MCP wiring so agents know how to list friends, send pages, reply, review friend requests, mute/block users, and avoid abusing the pager.
 
-After an approved Vercel/Supabase deployment, `npm run cloud-smoke:run -- <vercel-url>` can verify the real hosted flow. The underlying cloud test skips by default and only touches hosted resources when `AGENT_PAGER_CLOUD_SMOKE=1` plus the smoke user credentials are set.
-
-## Commands
+## Useful Commands
 
 ```bash
-agent-pager server
-agent-pager login
-agent-pager login --username bryson --local-dev
-agent-pager start
 agent-pager status
-agent-pager share
-agent-pager doctor
-agent-pager launch-check
-agent-pager settings quiet-hours on --start 22:00 --end 08:00 --timezone America/Denver
-agent-pager settings quiet-hours off
-agent-pager settings rate-limit 8
-agent-pager devices list
-agent-pager devices revoke <device-id>
-agent-pager logout
-agent-pager page sarah "Can you review this?"
-agent-pager mute sarah --for 1h
-agent-pager unmute sarah
-agent-pager mutes list
-agent-pager block sarah
-agent-pager unblock sarah
-agent-pager blocks list
-agent-pager report sarah --reason spam
-agent-pager report --page-id <page-id> --reason spam
-agent-pager reports list
-agent-pager friends invite
-agent-pager friends invites
-agent-pager friends revoke-invite <invite-url-or-code>
-agent-pager friends add <invite-url-or-code>
-agent-pager friends request sarah "Page my agent?"
 agent-pager friends requests
 agent-pager friends approve <request-id>
 agent-pager friends deny <request-id>
-agent-pager friends cancel <request-id>
 agent-pager friends list
-agent-pager friends remove <username>
-agent-pager check-pages
-agent-pager setup codex
-agent-pager setup claude
-agent-pager mcp
+agent-pager page <friend> "Can you check the PR?"
+agent-pager mute <friend> --for 1h
+agent-pager devices list
+agent-pager devices revoke <device-id>
+agent-pager logout
 ```
 
-## Security Model
+## Security
 
 - Devices generate local Ed25519 keypairs.
-- The service stores public keys only.
+- The hosted service stores public keys only.
 - Device requests are signed with timestamped canonical request signatures.
-- Devices can be revoked from the web dashboard or CLI; revoked devices cannot sign future requests.
-- Page delivery envelopes are signed by the server and verified locally.
-- Pages deliver only between approved friends.
-- Approved friendships can be removed without blocking; removed friends cannot page unless friendship is approved again.
-- Public profiles do not allow arbitrary pages.
-- Pending friend requests can be approved, denied, or canceled before they grant access.
-- Messages are text-only; Agent Pager never lets a remote friend run commands.
-- Per-friend mutes block delivery before a page reaches a local session and can be listed or removed.
-- Blocks prevent friend requests, invite acceptance, approvals, and pages in either direction.
-- Abuse reports can target a username or a page the reporter participated in.
-- Quiet hours block delivery before page rows are created.
-- Invite links expire and can be revoked before use.
-- Rate limits and message length limits protect against spam.
-- Hosted V1 uses Supabase RLS policies and realtime delivery rows instead of exposing raw session lists.
-
-## Agent Integration
-
-`agent-pager setup codex` installs:
-
-- a Codex skill at `~/.codex/skills/agent-pager/SKILL.md`
-- an MCP config block for `agent-pager mcp`
-
-`agent-pager setup claude` installs:
-
-- a Claude skill at `~/.claude/skills/agent-pager/SKILL.md`
-- setup instructions for `claude mcp add agent-pager -- agent-pager mcp`
-
-The MCP server exposes paging, replies, presence, Page my agent sharing, friend-request review, muting, blocking, removal, and abuse-report tools with explicit human-intent wording for access-changing actions.
-
-Claude Code channels are the best future path for true push into an already-running Claude session. The current local listener already receives signed pages, persists them, and sends desktop notifications.
+- Delivery envelopes are signed by the server and verified locally.
+- Pages only deliver between approved friends.
+- Public profile links create friend requests, not unrestricted messages.
+- Incoming pages are text-only. Agent Pager does not allow remote command execution.
+- Mutes, blocks, quiet hours, message limits, and per-friend rate limits are enforced before delivery.
+- Devices can be revoked from the web app or CLI.
+- Friends see limited presence only; raw local agent sessions are not exposed.
 
-## Design
+## Notes
 
-The web app is inspired by retro authorized-service computing artwork: warm paper, chunky panels, rainbow service stripe, compact operator-console layout, and original Agent Pager branding. It intentionally avoids Apple logos or trademarks.
+Agent Pager is experimental. Treat it like an early access tool: only approve people you trust, keep the CLI updated, and revoke devices you no longer use.

package/dist/src/cli.js

@@ -13,6 +13,8 @@ import { statusBox } from "./render.js";
 import { runServer } from "./server.js";
 import { setupClaude, setupCodex } from "./setup.js";
 const DEFAULT_HOSTED_POLL_INTERVAL_MS = 30_000;
+const DEFAULT_HOSTED_SERVER_URL = "https://agent-pager.vercel.app";
+const DEFAULT_LOCAL_SERVER_URL = "http://127.0.0.1:8787";
 const EXPECTED_GITHUB_REPO = "brysonkbarney/agent-pager";
 const EXPECTED_SUPABASE_REF = "ghwzvpuggpqntowmbpih";
 const EXPECTED_VERCEL_PROJECT = "agent-pager";
@@ -112,7 +114,7 @@ async function login(args) {
         await localDevLogin(args);
         return;
     }
-    const serverUrl = (readFlag(args, "--server") || process.env.AGENT_PAGER_SERVER_URL || "http://127.0.0.1:8787").replace(/\/+$/, "");
+    const serverUrl = (readFlag(args, "--server") || process.env.AGENT_PAGER_SERVER_URL || DEFAULT_HOSTED_SERVER_URL).replace(/\/+$/, "");
     const deviceName = readFlag(args, "--device") || `${process.env.USER || "local"}@${process.env.HOSTNAME || "mac"}`;
     const timeoutSeconds = Number(readFlag(args, "--timeout") || 600);
     const keys = createDeviceKeyPair();
@@ -120,7 +122,7 @@ async function login(args) {
         name: deviceName,
         publicKeyPem: keys.publicKeyPem,
         platform: process.platform,
-        appVersion: "0.1.0"
+        appVersion: "0.1.1"
     });
     console.log(statusBox({
         Pairing: pairing.code,
@@ -153,7 +155,7 @@ async function login(args) {
     }));
 }
 async function localDevLogin(args) {
-    const serverUrl = (readFlag(args, "--server") || process.env.AGENT_PAGER_SERVER_URL || "http://127.0.0.1:8787").replace(/\/+$/, "");
+    const serverUrl = (readFlag(args, "--server") || process.env.AGENT_PAGER_SERVER_URL || DEFAULT_LOCAL_SERVER_URL).replace(/\/+$/, "");
     let username = readFlag(args, "--username");
     let displayName = readFlag(args, "--name");
     if (!username) {
@@ -1067,7 +1069,7 @@ Because people ignore their messages, but not their agents.
 
 Usage:
   agent-pager server [--host 127.0.0.1] [--port 8787]
-  agent-pager login [--server https://agentpager.dev]
+  agent-pager login [--server https://agent-pager.vercel.app]
   agent-pager login --username bryson [--local-dev]
   agent-pager start
   agent-pager status

package/dist/src/local-config.js

@@ -13,7 +13,7 @@ export function inboxPath() {
 export function loadLocalConfig() {
     const path = configPath();
     if (!existsSync(path)) {
-        throw new Error("not logged in. Run `agent-pager login --username <name>` first.");
+        throw new Error("not logged in. Run `agent-pager login` first.");
     }
     return JSON.parse(readFileSync(path, "utf8"));
 }

package/dist/src/mcp.js

@@ -197,7 +197,7 @@ async function handle(method, params) {
         return {
             protocolVersion: params.protocolVersion || "2024-11-05",
             capabilities: { tools: {} },
-            serverInfo: { name: "agent-pager", version: "0.1.0" }
+            serverInfo: { name: "agent-pager", version: "0.1.1" }
         };
     }
     if (method === "tools/list") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-pager",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Authorized Human Contact Service for paging trusted coding agents.",
   "private": false,
   "type": "module",
@@ -14,13 +14,6 @@
     "vercel"
   ],
   "homepage": "https://agent-pager.vercel.app",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/brysonkbarney/agent-pager.git"
-  },
-  "bugs": {
-    "url": "https://github.com/brysonkbarney/agent-pager/issues"
-  },
   "main": "./dist/src/cli.js",
   "bin": {
     "agent-pager": "dist/src/cli.js"
@@ -30,7 +23,18 @@
     "registry": "https://registry.npmjs.org/"
   },
   "files": [
-    "dist/src",
+    "dist/src/cli.js",
+    "dist/src/crypto.js",
+    "dist/src/delivery.js",
+    "dist/src/http-client.js",
+    "dist/src/local-config.js",
+    "dist/src/mcp.js",
+    "dist/src/render.js",
+    "dist/src/server.js",
+    "dist/src/session-adapters.js",
+    "dist/src/setup.js",
+    "dist/src/store.js",
+    "dist/src/types.js",
     "web",
     "README.md"
   ],

package/web/app.js

@@ -201,8 +201,9 @@ function render() {
   const username = profile?.username || state.session?.user?.email || "not signed in";
 
   els["auth-panel"].classList.toggle("is-signed-in", signedIn);
-  els["profile-line"].textContent = signedIn ? `Signed in as ${username}` : "Signed out";
-  els["status-human"].textContent = username;
+  renderAuthActions(signedIn);
+  els["profile-line"].textContent = signedIn ? `Signed in as ${username}` : "Create an account or sign in to start.";
+  els["status-human"].textContent = signedIn ? username : "Create account or sign in";
   els["status-cloud"].textContent = state.config?.publicUrl || "hosted API";
   els["status-friends"].textContent = `${friends.length} approved`;
   els["status-pending"].textContent = `${pending.length} pending`;
@@ -348,6 +349,13 @@ function render() {
   `).join("") || empty("No abuse reports filed.", "Reports you file appear here.");
 }
 
+function renderAuthActions(signedIn) {
+  for (const element of document.querySelectorAll("#auth-panel [data-auth-when]")) {
+    const shouldShow = element.dataset.authWhen === (signedIn ? "signed-in" : "signed-out");
+    element.classList.toggle("is-hidden", !shouldShow);
+  }
+}
+
 function renderSettings() {
   const settings = state.settings || {};
   const quietHours = quietHoursDefaults(settings.quietHours);
@@ -362,6 +370,7 @@ function renderPrototype() {
   const users = state.prototype?.users || [];
   const pages = state.prototype?.pages || [];
   els["auth-panel"].classList.remove("is-signed-in");
+  renderAuthActions(false);
   els["profile-line"].textContent = "Prototype mode";
   els["status-human"].textContent = `${users.length} registered`;
   els["status-cloud"].textContent = state.prototype?.publicUrl || "local service";

package/web/index.html

@@ -71,10 +71,10 @@
               <label>Name<input id="auth-name" autocomplete="name" /></label>
             </div>
             <div class="button-row">
-              <button data-action="sign-in">Sign in</button>
-              <button data-action="sign-up">Create</button>
-              <button data-action="save-profile">Save profile</button>
-              <button data-action="sign-out">Sign out</button>
+              <button data-action="sign-in" data-auth-when="signed-out">Sign in</button>
+              <button data-action="sign-up" data-auth-when="signed-out">Create</button>
+              <button data-action="save-profile" data-auth-when="signed-in">Save profile</button>
+              <button data-action="sign-out" data-auth-when="signed-in">Sign out</button>
             </div>
           </article>
           <article class="operator-card">