agent-yes 1.116.0 → 1.118.0

package/dist/SUPPORTED_CLIS-BS7EiXxW.js

@@ -0,0 +1,8 @@
+import "./ts-DYzATaI_.js";
+import "./logger-B9h0djqx.js";
+import "./versionChecker-D-OYziVA.js";
+import "./pidStore-BcGnnKQf.js";
+import "./globalPidIndex-yVd3mbsV.js";
+import { t as SUPPORTED_CLIS } from "./SUPPORTED_CLIS-CrIGjD28.js";
+
+export { SUPPORTED_CLIS };

package/dist/{SUPPORTED_CLIS-DuCEAzP9.js → SUPPORTED_CLIS-CrIGjD28.js}

@@ -1,8 +1,8 @@
-import { t as CLIS_CONFIG } from "./ts-DvnOmOAf.js";
+import { t as CLIS_CONFIG } from "./ts-DYzATaI_.js";
 
 //#region ts/SUPPORTED_CLIS.ts
 const SUPPORTED_CLIS = Object.keys(CLIS_CONFIG);
 
 //#endregion
 export { SUPPORTED_CLIS as t };
-//# sourceMappingURL=SUPPORTED_CLIS-DuCEAzP9.js.map
+//# sourceMappingURL=SUPPORTED_CLIS-CrIGjD28.js.map

package/dist/cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env bun
 import { n as logger } from "./logger-B9h0djqx.js";
-import { i as versionString, n as displayVersion, r as getInstalledPackage, t as checkAndAutoUpdate } from "./versionChecker-DeXuTfJ0.js";
+import { i as versionString, n as displayVersion, r as getInstalledPackage, t as checkAndAutoUpdate } from "./versionChecker-D-OYziVA.js";
 import { argv } from "process";
 import { execFileSync, spawn } from "child_process";
 import ms from "ms";
@@ -482,7 +482,7 @@ function buildRustArgs(argv, cliFromScript, supportedClis) {
 {
 	const rawArg = process.argv[2];
 	const isHelpFlag = rawArg === "-h" || rawArg === "--help";
-	const { isSubcommand, runSubcommand, cmdHelp } = await import("./subcommands-CxHjPXEH.js");
+	const { isSubcommand, runSubcommand, cmdHelp } = await import("./subcommands-FtwGxxtc.js");
 	if (isHelpFlag && process.argv.length === 3) {
 		cmdHelp();
 		process.exit(0);
@@ -515,7 +515,7 @@ if (config.useRust) {
 		}
 	}
 	if (rustBinary) {
-		const { SUPPORTED_CLIS } = await import("./SUPPORTED_CLIS-vFwB3bnK.js");
+		const { SUPPORTED_CLIS } = await import("./SUPPORTED_CLIS-BS7EiXxW.js");
 		const rustArgs = buildRustArgs(process.argv, config.cli, SUPPORTED_CLIS);
 		if (config.verbose) {
 			console.log(`[rust] Using binary: ${rustBinary}`);
@@ -545,7 +545,7 @@ if (config.showVersion) {
 	process.exit(0);
 }
 if (config.appendPrompt) {
-	const { PidStore } = await import("./pidStore-9b3YTuf4.js");
+	const { PidStore } = await import("./pidStore-BLcnCpkX.js");
 	const ipcPath = await PidStore.findActiveFifo(process.cwd());
 	if (!ipcPath) {
 		console.error("No active agent with IPC found in current directory.");

package/dist/index.js

@@ -1,7 +1,7 @@
-import { a as removeControlCharacters, i as AgentContext, n as agentYes, r as config, t as CLIS_CONFIG } from "./ts-DvnOmOAf.js";
+import { a as removeControlCharacters, i as AgentContext, n as agentYes, r as config, t as CLIS_CONFIG } from "./ts-DYzATaI_.js";
 import "./logger-B9h0djqx.js";
-import "./versionChecker-DeXuTfJ0.js";
-import "./pidStore-DBjlqzo8.js";
+import "./versionChecker-D-OYziVA.js";
+import "./pidStore-BcGnnKQf.js";
 import "./globalPidIndex-yVd3mbsV.js";
 
 export { AgentContext, CLIS_CONFIG, config, agentYes as default, removeControlCharacters };

package/dist/pidStore-BLcnCpkX.js

@@ -0,0 +1,5 @@
+import "./logger-B9h0djqx.js";
+import { t as PidStore } from "./pidStore-BcGnnKQf.js";
+import "./globalPidIndex-yVd3mbsV.js";
+
+export { PidStore };

package/dist/{pidStore-DBjlqzo8.js → pidStore-BcGnnKQf.js}

@@ -223,7 +223,7 @@ var PidStore = class PidStore {
 			logger.warn("[pidStore] Failed to initialize:", error);
 		}
 	}
-	async registerProcess({ pid, cli, args, prompt, cwd }) {
+	async registerProcess({ pid, cli, args, prompt, cwd, wrapperPid }) {
 		const now = Date.now();
 		const argsJson = JSON.stringify(args);
 		const logFile = this.getRawLogPath(pid);
@@ -260,7 +260,8 @@ var PidStore = class PidStore {
 			status: "active",
 			exit_code: null,
 			exit_reason: null,
-			started_at: now
+			started_at: now,
+			wrapper_pid: wrapperPid ?? null
 		}).then(() => maybeCompactGlobalPids()).catch(() => null);
 		return result;
 	}
@@ -381,4 +382,4 @@ pid-db/
 
 //#endregion
 export { agentYesHome as n, PidStore as t };
-//# sourceMappingURL=pidStore-DBjlqzo8.js.map
+//# sourceMappingURL=pidStore-BcGnnKQf.js.map

package/dist/{serve-CSupgu7Q.js → serve-uhfwjvBd.js}

@@ -1,11 +1,11 @@
-import "./ts-DvnOmOAf.js";
+import "./ts-DYzATaI_.js";
 import "./logger-B9h0djqx.js";
-import { r as getInstalledPackage } from "./versionChecker-DeXuTfJ0.js";
-import "./pidStore-DBjlqzo8.js";
+import { r as getInstalledPackage } from "./versionChecker-D-OYziVA.js";
+import "./pidStore-BcGnnKQf.js";
 import "./globalPidIndex-yVd3mbsV.js";
-import { t as SUPPORTED_CLIS } from "./SUPPORTED_CLIS-DuCEAzP9.js";
+import { t as SUPPORTED_CLIS } from "./SUPPORTED_CLIS-CrIGjD28.js";
 import "./remotes-C3xPRtfg.js";
-import { c as listRecords, d as renderRawLog, f as resolveOne, g as writeToIpc, m as snapshotStatus, r as controlCodeFromName, u as readNotes } from "./subcommands-DLJqD_Yj.js";
+import { c as listRecords, d as renderRawLog, f as resolveOne, g as writeToIpc, m as snapshotStatus, r as controlCodeFromName, u as readNotes } from "./subcommands-tH8JdrBS.js";
 import yargs from "yargs";
 import { mkdir, open, readFile, writeFile } from "fs/promises";
 import { homedir, hostname, userInfo } from "os";
@@ -51,6 +51,21 @@ const defaultOpts = (overrides = {}) => ({
 	cwdScope: null,
 	...overrides
 });
+const SESSION_PIN_ENV = new Set([
+	"CLAUDECODE",
+	"CLAUDE_CODE_SSE_PORT",
+	"CLAUDE_CODE_SESSION_ID",
+	"CLAUDE_CODE_CHILD_SESSION",
+	"CLAUDE_CODE_ENTRYPOINT"
+]);
+function freshAgentEnv() {
+	const env = {};
+	for (const [k, v] of Object.entries(process.env)) {
+		if (v === void 0 || SESSION_PIN_ENV.has(k)) continue;
+		env[k] = v;
+	}
+	return env;
+}
 const DAEMON_NAME = "agent-yes";
 async function ensureBootAutostart(oxmgrBin) {
 	try {
@@ -669,6 +684,7 @@ Options:
 					...prompt ? ["--", prompt] : []
 				], {
 					cwd,
+					env: freshAgentEnv(),
 					stdin: "ignore",
 					stdout: "ignore",
 					stderr: "ignore"
@@ -773,4 +789,4 @@ Options:
 
 //#endregion
 export { cmdServe };
-//# sourceMappingURL=serve-CSupgu7Q.js.map
+//# sourceMappingURL=serve-uhfwjvBd.js.map

package/dist/{subcommands-CxHjPXEH.js → subcommands-FtwGxxtc.js}

@@ -1,6 +1,6 @@
 import "./logger-B9h0djqx.js";
 import "./globalPidIndex-yVd3mbsV.js";
 import "./remotes-C3xPRtfg.js";
-import { a as finalizedLines, c as listRecords, d as renderRawLog, f as resolveOne, g as writeToIpc, h as stopTipForCli, i as cursorAbs, l as matchKeyword, m as snapshotStatus, n as cmdHelp, o as isPidAlive, p as runSubcommand, r as controlCodeFromName, s as isSubcommand, t as GRACEFUL_EXIT_COMMANDS, u as readNotes } from "./subcommands-DLJqD_Yj.js";
+import { a as finalizedLines, c as listRecords, d as renderRawLog, f as resolveOne, g as writeToIpc, h as stopTipForCli, i as cursorAbs, l as matchKeyword, m as snapshotStatus, n as cmdHelp, o as isPidAlive, p as runSubcommand, r as controlCodeFromName, s as isSubcommand, t as GRACEFUL_EXIT_COMMANDS, u as readNotes } from "./subcommands-tH8JdrBS.js";
 
 export { cmdHelp, isSubcommand, runSubcommand };

package/dist/{subcommands-DLJqD_Yj.js → subcommands-tH8JdrBS.js}

@@ -60,6 +60,74 @@ async function compactNotes() {
 	})).join("\n");
 	await writeFile(notesPath(), lines ? lines + "\n" : "");
 }
+const READ_WINDOW_MS = 6e4;
+const READS_KEY_SEP = "\0";
+function readsPath() {
+	const dir = process.env.AGENT_YES_HOME ?? path.join(homedir(), ".agent-yes");
+	return path.join(dir, "reads.jsonl");
+}
+async function readReads() {
+	let raw;
+	try {
+		raw = await readFile(readsPath(), "utf-8");
+	} catch {
+		return /* @__PURE__ */ new Map();
+	}
+	const map = /* @__PURE__ */ new Map();
+	for (const line of raw.split("\n")) {
+		const t = line.trim();
+		if (!t) continue;
+		try {
+			const { by, target, at } = JSON.parse(t);
+			if (typeof by === "string" && typeof target === "number" && typeof at === "number") map.set(`${by}${READS_KEY_SEP}${target}`, at);
+		} catch {}
+	}
+	return map;
+}
+async function recordRead(by, target) {
+	const p = readsPath();
+	try {
+		await mkdir(path.dirname(p), { recursive: true });
+		await appendFile(p, JSON.stringify({
+			by,
+			target,
+			at: Date.now()
+		}) + "\n");
+		if ((await readFile(p, "utf-8").catch(() => "")).split("\n").length > 200) {
+			const lines = [...(await readReads()).entries()].map(([k, at]) => {
+				const i = k.indexOf(READS_KEY_SEP);
+				return JSON.stringify({
+					by: k.slice(0, i),
+					target: Number(k.slice(i + 1)),
+					at
+				});
+			}).join("\n");
+			await writeFile(p, lines ? lines + "\n" : "");
+		}
+	} catch {}
+}
+async function lastReadAt(by, target) {
+	return (await readReads()).get(`${by}${READS_KEY_SEP}${target}`) ?? null;
+}
+async function resolveSender() {
+	const envPid = process.env.AGENT_YES_PID ? Number(process.env.AGENT_YES_PID) : null;
+	if (!envPid || Number.isNaN(envPid)) return null;
+	const recs = await listRecords(void 0, {
+		all: true,
+		active: false,
+		json: false,
+		latest: false,
+		cwdScope: null
+	});
+	return recs.find((r) => r.wrapper_pid === envPid) ?? recs.find((r) => r.pid === envPid) ?? null;
+}
+async function senderContext() {
+	const agent = await resolveSender();
+	return {
+		key: agent ? `agent:${agent.pid}` : "human",
+		agent
+	};
+}
 /**
 * Read the per-cwd TS PidStore JSONL and convert to the global record shape,
 * so pre-existing TS agents that were spawned before the global-index mirror
@@ -163,7 +231,7 @@ async function runSubcommand(argv) {
 			case "restart": return await cmdRestart(rest);
 			case "note": return await cmdNote(rest);
 			case "serve": {
-				const { cmdServe } = await import("./serve-CSupgu7Q.js");
+				const { cmdServe } = await import("./serve-uhfwjvBd.js");
 				return cmdServe(rest);
 			}
 			case "setup": {
@@ -762,6 +830,8 @@ async function cmdRead(rest, { mode }) {
 	const record = await resolveOne(keyword, opts);
 	const logPath = record.log_file;
 	if (!logPath) throw new Error(`pid ${record.pid}: no log_file recorded`);
+	const reader = await senderContext();
+	await recordRead(reader.key, record.pid);
 	let stats;
 	try {
 		stats = await stat(logPath);
@@ -779,7 +849,10 @@ async function cmdRead(rest, { mode }) {
 	process.stderr.write(header + "\n");
 	process.stdout.write(rendered);
 	if (!rendered.endsWith("\n")) process.stdout.write("\n");
-	if (follow) return plain ? followPlainLocal(logPath, buf) : followRawLocal(logPath, buf);
+	if (follow) {
+		setInterval(() => void recordRead(reader.key, record.pid), 3e4).unref?.();
+		return plain ? followPlainLocal(logPath, buf) : followRawLocal(logPath, buf);
+	}
 	process.stderr.write(`
   ay ls                                 # list all agents
   ay tail -f ${record.pid}              # follow live output\n  ay send ${record.pid} "next: ..."      # send a prompt\n  ay send ${record.pid} "" --code=ctrl-c # interrupt\n`);
@@ -1067,6 +1140,10 @@ async function cmdSend(rest) {
 	}).option("cwd", {
 		type: "string",
 		description: "Restrict to agents under this dir"
+	}).option("force", {
+		type: "boolean",
+		default: false,
+		description: "Skip the 'tailed recently' safety check (also: AGENT_YES_FORCE_SEND=1)"
 	}).help(false).version(false).exitProcess(false).parseAsync();
 	const opts = {
 		all: argv.all,
@@ -1093,9 +1170,17 @@ async function cmdSend(rest) {
 		for await (const chunk of process.stdin) chunks.push(chunk);
 		body = Buffer.concat(chunks).toString("utf-8").trimEnd();
 	} else body = rawMessage;
-	const sourcePid = process.env.AGENT_YES_PID ? Number(process.env.AGENT_YES_PID) : null;
-	const talkBack = sourcePid ? `\n(from AGENT_YES_PID=${sourcePid} — reply: ay send ${sourcePid} "...")` : "";
-	const fullBody = body + talkBack;
+	const sender = await senderContext();
+	const force = Boolean(argv.force) || process.env.AGENT_YES_FORCE_SEND === "1";
+	if (sender.agent && sender.agent.pid === record.pid && !force) throw new Error(`refusing to send to yourself (pid ${record.pid}) — pass --force if you really mean it.`);
+	const last = await lastReadAt(sender.key, record.pid);
+	if (!(last !== null && Date.now() - last <= READ_WINDOW_MS) && !force) {
+		const ago = last === null ? "never read" : `last read ${Math.round((Date.now() - last) / 1e3)}s ago`;
+		const what = `pid ${record.pid} (${record.cli}, ${shortenPath(record.cwd)}) — ${ago}, not within ${READ_WINDOW_MS / 1e3}s`;
+		if (sender.agent) throw new Error(`${what}.\n  Confirm it's the right agent first:  ay tail ${record.pid}\n  then resend, or pass --force to override.`);
+		process.stderr.write(`warning: ${what} — make sure this is the agent you meant (ay tail ${record.pid}).\n`);
+	}
+	const fullBody = (sender.agent ? `[from ${sender.agent.cli} #${sender.agent.pid} @ ${shortenPath(sender.agent.cwd)} — reply: ay send ${sender.agent.pid} "..."]\n` : "") + body;
 	if (fullBody && trailing) {
 		await writeToIpc(fifoPath, fullBody);
 		await new Promise((r) => setTimeout(r, 200));
@@ -1103,7 +1188,7 @@ async function cmdSend(rest) {
 	} else await writeToIpc(fifoPath, fullBody + trailing);
 	const payload = body + trailing;
 	process.stdout.write(`sent to pid ${record.pid} (${record.cli}): ${truncate(payload, 80)}\n`);
-	const replyHint = sourcePid ? `  ay send ${sourcePid} "..."              # reply to sender\n` : "";
+	const replyHint = sender.agent ? `  ay send ${sender.agent.pid} "..."              # reply to sender\n` : "";
 	process.stderr.write(`\n` + replyHint + `  ay tail ${record.pid}                  # watch output\n  ay ls                                  # list all agents\n`);
 	if (codeName === "ctrl-c" || codeName === "ctrlc") {
 		const tip = stopTipForCli(record.cli, record.pid);
@@ -1595,4 +1680,4 @@ async function cmdStatus(rest) {
 
 //#endregion
 export { finalizedLines as a, listRecords as c, renderRawLog as d, resolveOne as f, writeToIpc as g, stopTipForCli as h, cursorAbs as i, matchKeyword as l, snapshotStatus as m, cmdHelp as n, isPidAlive as o, runSubcommand as p, controlCodeFromName as r, isSubcommand as s, GRACEFUL_EXIT_COMMANDS as t, readNotes as u };
-//# sourceMappingURL=subcommands-DLJqD_Yj.js.map
+//# sourceMappingURL=subcommands-tH8JdrBS.js.map

package/dist/{ts-DvnOmOAf.js → ts-DYzATaI_.js}

@@ -1,6 +1,6 @@
 import { n as logger, t as addTransport } from "./logger-B9h0djqx.js";
-import { r as getInstalledPackage } from "./versionChecker-DeXuTfJ0.js";
-import { n as agentYesHome, t as PidStore } from "./pidStore-DBjlqzo8.js";
+import { r as getInstalledPackage } from "./versionChecker-D-OYziVA.js";
+import { n as agentYesHome, t as PidStore } from "./pidStore-BcGnnKQf.js";
 import { i as shouldUseLock, r as releaseLock, t as acquireLock } from "./runningLock-CJxsoGdb.js";
 import { i as readGlobalPids } from "./globalPidIndex-yVd3mbsV.js";
 import { arch, platform } from "process";
@@ -1218,7 +1218,8 @@ async function agentYes({ cli, cliArgs = [], prompt, robust = true, cwd, env, ex
 			cli,
 			args: cliArgs,
 			prompt,
-			cwd: workingDir
+			cwd: workingDir,
+			wrapperPid: process.pid
 		});
 	} catch (error) {
 		logger.warn(`[pidStore] Failed to register process ${shell.pid}:`, error);
@@ -1713,4 +1714,4 @@ function sleep(ms) {
 
 //#endregion
 export { removeControlCharacters as a, AgentContext as i, agentYes as n, config as r, CLIS_CONFIG as t };
-//# sourceMappingURL=ts-DvnOmOAf.js.map
+//# sourceMappingURL=ts-DYzATaI_.js.map

package/dist/{versionChecker-DeXuTfJ0.js → versionChecker-D-OYziVA.js}

@@ -7,7 +7,7 @@ import { fileURLToPath } from "url";
 
 //#region package.json
 var name = "agent-yes";
-var version = "1.116.0";
+var version = "1.118.0";
 
 //#endregion
 //#region ts/versionChecker.ts
@@ -221,4 +221,4 @@ async function displayVersion() {
 
 //#endregion
 export { versionString as i, displayVersion as n, getInstalledPackage as r, checkAndAutoUpdate as t };
-//# sourceMappingURL=versionChecker-DeXuTfJ0.js.map
+//# sourceMappingURL=versionChecker-D-OYziVA.js.map

package/lab/ui/index.html

@@ -1545,6 +1545,15 @@
         try {
           localStorage.setItem("ay.sel", sel);
         } catch {}
+        // Reflect it in the URL hash as #room:pid. The fragment is never sent in
+        // any request, so — unlike the old ?pid= query that landed in the server's
+        // access logs — the agent id stays client-side, while still surviving a
+        // refresh and being copy-pasteable as a deep link.
+        try {
+          const want = "#" + e._room + ":" + e.pid;
+          if (location.hash !== want)
+            history.replaceState(null, document.title, location.pathname + want);
+        } catch {}
         // pid + tx are how we talk to the agent's own host; sel (composite) is
         // only for UI identity/highlight, since pids can collide across rooms.
         const pid = e.pid;
@@ -2256,7 +2265,23 @@
         }
         const full = pending ? null : /^([A-Za-z0-9_-]+):([^@]+)(?:@(.+))?$/.exec(h);
         const bare = /^([A-Za-z0-9_-]+)$/.exec(h);
-        if (full) {
+        // Treat the colon form as #room:agentId only when there's no @host, the id
+        // is a bare pid (digits), AND we can actually reconnect that room (it's
+        // cached or local). Otherwise the second part must be the token we need to
+        // connect — so a fresh browser still honours #room:token even when the token
+        // is custom and happens to be all digits.
+        // …and bounded to a plausible pid width (≤7 digits) so a long numeric
+        // custom token can't be mistaken for an agent id. A returning user's room
+        // token is persisted, so even a short numeric token reconnects fine from
+        // cache; only the share-link form needs the token, which stays uneaten.
+        const aidLike =
+          full &&
+          !full[3] &&
+          /^\d{1,7}$/.test(full[2]) &&
+          (full[1] === LOCAL || !!loadRooms()[full[1]]);
+        if (full && !aidLike) {
+          // #room:token — a share link. Connect, then eat the token so only #room
+          // lingers.
           const [, room, token, host] = full;
           // SECURITY: strip the token from the URL immediately so it never lingers in
           // the omnibox, history, or a screenshot. Keep only the room mnemonic.
@@ -2266,6 +2291,16 @@
             location.pathname + location.search + "#" + room,
           );
           pending = { room, token, host };
+        } else if (full) {
+          // #room:agentId — a deep link to one agent in a (cached) room. The id is
+          // not a secret, so it stays in the hash; reconnect the room from its
+          // cached token and select the agent once it streams in. autoPid uses the
+          // composite key so it picks the right host when pids collide across rooms.
+          const [, room, aid] = full;
+          autoPid = room + "#" + aid;
+          autoPidExplicit = true;
+          const r = loadRooms()[room];
+          if (r) pending = { room, token: r.token, host: r.host };
         } else if (bare && loadRooms()[bare[1]]) {
           const r = loadRooms()[bare[1]];
           pending = { room: bare[1], token: r.token, host: r.host };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-yes",
-  "version": "1.116.0",
+  "version": "1.118.0",
   "description": "A wrapper tool that automates interactions with various AI CLI tools by automatically handling common prompts and responses.",
   "keywords": [
     "ai",

package/ts/globalPidIndex.ts

@@ -36,6 +36,11 @@ export interface GlobalPidRecord {
   exit_code: number | null;
   exit_reason: string | null;
   started_at: number;
+  // The `ay` wrapper process pid that spawned this agent. The wrapper injects
+  // its own pid as AGENT_YES_PID into the agent's env (the agent's OWN pid isn't
+  // known until after spawn), so this maps that env value back to the agent's
+  // canonical record — see resolveSender() in subcommands.ts.
+  wrapper_pid?: number | null;
 }
 
 /**

package/ts/index.ts

@@ -374,7 +374,16 @@ export default async function agentYes({
 
   // Register process in pidStore (non-blocking - failures should not prevent agent from running)
   try {
-    await pidStore.registerProcess({ pid: shell.pid, cli, args: cliArgs, prompt, cwd: workingDir });
+    await pidStore.registerProcess({
+      pid: shell.pid,
+      cli,
+      args: cliArgs,
+      prompt,
+      cwd: workingDir,
+      // We inject our own pid as AGENT_YES_PID into the agent's env above; record
+      // it so a child `ay send` can map that env value back to this agent.
+      wrapperPid: process.pid,
+    });
   } catch (error) {
     logger.warn(`[pidStore] Failed to register process ${shell.pid}:`, error);
   }

package/ts/pidStore.ts

@@ -54,12 +54,14 @@ export class PidStore {
     args,
     prompt,
     cwd,
+    wrapperPid,
   }: {
     pid: number;
     cli: string;
     args: string[];
     prompt?: string;
     cwd: string;
+    wrapperPid?: number;
   }): Promise<PidRecord> {
     const now = Date.now();
     const argsJson = JSON.stringify(args);
@@ -113,6 +115,7 @@ export class PidStore {
       exit_code: null,
       exit_reason: null,
       started_at: now,
+      wrapper_pid: wrapperPid ?? null,
     })
       .then(() => maybeCompactGlobalPids())
       .catch(() => null);

package/ts/serve.ts

@@ -65,6 +65,33 @@ const defaultOpts = (overrides: Partial<CommonOpts> = {}): CommonOpts => ({
   ...overrides,
 });
 
+// The vars that pin a process to a PARENT Claude Code session — NOT the many
+// other CLAUDE_CODE_* settings that configure provider/auth/limits (USE_BEDROCK,
+// USE_VERTEX, MAX_OUTPUT_TOKENS, …), which must pass through untouched.
+const SESSION_PIN_ENV = new Set([
+  "CLAUDECODE",
+  "CLAUDE_CODE_SSE_PORT",
+  "CLAUDE_CODE_SESSION_ID",
+  "CLAUDE_CODE_CHILD_SESSION",
+  "CLAUDE_CODE_ENTRYPOINT",
+]);
+
+// Env for a console-spawned agent, minus only the session-pinning vars above. If
+// `ay serve` was launched from inside Claude Code (or any shell carrying these),
+// it would otherwise leak the parent's SSE port / session id into every spawned
+// agent — so the new `claude` thinks it's a nested child and tries to attach to a
+// stale port, surfacing as "fail to connect". Dropping them makes each agent a
+// clean top-level session; all config/provider env (CLAUDE_EFFORT, CLAUDE_CODE_*
+// settings) is preserved.
+function freshAgentEnv(): Record<string, string> {
+  const env: Record<string, string> = {};
+  for (const [k, v] of Object.entries(process.env)) {
+    if (v === undefined || SESSION_PIN_ENV.has(k)) continue;
+    env[k] = v;
+  }
+  return env;
+}
+
 // ---------------------------------------------------------------------------
 // ay serve install / uninstall / logs  (oxmgr daemon management)
 // ---------------------------------------------------------------------------
@@ -860,6 +887,7 @@ export async function cmdServe(rest: string[]): Promise<number> {
       try {
         const child = Bun.spawn(["ay", cli, ...(prompt ? ["--", prompt] : [])], {
           cwd,
+          env: freshAgentEnv(), // don't leak our Claude Code session into the agent
           stdin: "ignore",
           stdout: "ignore",
           stderr: "ignore",

package/ts/subcommands.spec.ts

@@ -537,6 +537,13 @@ describe("subcommands.cmdSend writes bytes to FIFO", () => {
         stdout.push(String(s));
         return true;
       };
+      // Isolate from the send-safety guard: if the suite itself runs inside an
+      // ay-managed agent, AGENT_YES_PID would make cmdSend treat this as an agent
+      // sender (adding a "from …" prefix / blocking). Force-send to test pure
+      // byte delivery. --force keeps the agent prefix off only when no agent
+      // context resolves, so also clear AGENT_YES_PID for determinism.
+      const savedAyPid = process.env.AGENT_YES_PID;
+      delete process.env.AGENT_YES_PID;
       try {
         const code = await runSubcommand([
           "bun",
@@ -544,11 +551,13 @@ describe("subcommands.cmdSend writes bytes to FIFO", () => {
           "send",
           String(process.pid),
           "hello-fifo",
+          "--force",
         ]);
         expect(code).toBe(0);
         expect(stdout.join("")).toMatch(/sent to pid/);
       } finally {
         process.stdout.write = orig;
+        if (savedAyPid !== undefined) process.env.AGENT_YES_PID = savedAyPid;
       }
 
       // Now read the bytes back from our RDWR fd.
@@ -568,6 +577,47 @@ describe("subcommands.cmdSend writes bytes to FIFO", () => {
   });
 });
 
+describe("subcommands.cmdSend safety guards", () => {
+  it("maps AGENT_YES_PID→wrapper_pid and blocks an agent from sending to itself", async () => {
+    const { runSubcommand } = await loadModule();
+    const { appendGlobalPid } = await import("./globalPidIndex.ts");
+    // We register an agent whose wrapper_pid is a known value, then run `ay send`
+    // with AGENT_YES_PID set to that wrapper — so resolveSender maps it back to
+    // this same agent, and sending to its own pid trips the self-send guard.
+    const wrapperPid = 424242;
+    await appendGlobalPid({
+      pid: process.pid,
+      cli: "claude",
+      prompt: null,
+      cwd: process.cwd(),
+      log_file: null,
+      fifo_file: "/tmp/ay-guard-test.fifo",
+      status: "active",
+      exit_code: null,
+      exit_reason: null,
+      started_at: Date.now(),
+      wrapper_pid: wrapperPid,
+    });
+    const stderr: string[] = [];
+    const orig = process.stderr.write.bind(process.stderr);
+    (process.stderr as any).write = (s: any) => {
+      stderr.push(String(s));
+      return true;
+    };
+    const savedAyPid = process.env.AGENT_YES_PID;
+    process.env.AGENT_YES_PID = String(wrapperPid);
+    try {
+      const code = await runSubcommand(["bun", "cli.js", "send", String(process.pid), "loop?"]);
+      expect(code).toBe(1);
+      expect(stderr.join("")).toMatch(/refusing to send to yourself/);
+    } finally {
+      process.stderr.write = orig;
+      if (savedAyPid === undefined) delete process.env.AGENT_YES_PID;
+      else process.env.AGENT_YES_PID = savedAyPid;
+    }
+  });
+});
+
 // ---------------------------------------------------------------------------
 // cmdLs additional arg coverage
 // ---------------------------------------------------------------------------

package/dist/SUPPORTED_CLIS-vFwB3bnK.js

@@ -1,8 +0,0 @@
-import "./ts-DvnOmOAf.js";
-import "./logger-B9h0djqx.js";
-import "./versionChecker-DeXuTfJ0.js";
-import "./pidStore-DBjlqzo8.js";
-import "./globalPidIndex-yVd3mbsV.js";
-import { t as SUPPORTED_CLIS } from "./SUPPORTED_CLIS-DuCEAzP9.js";
-
-export { SUPPORTED_CLIS };

package/dist/pidStore-9b3YTuf4.js

@@ -1,5 +0,0 @@
-import "./logger-B9h0djqx.js";
-import { t as PidStore } from "./pidStore-DBjlqzo8.js";
-import "./globalPidIndex-yVd3mbsV.js";
-
-export { PidStore };