agent-yes 1.127.1 → 1.128.0

package/dist/SUPPORTED_CLIS-9oihdzOp.js

@@ -0,0 +1,8 @@
+import "./ts-blmSvxN5.js";
+import "./logger-B9h0djqx.js";
+import "./versionChecker-BmttWH-a.js";
+import "./pidStore-CGKIhaJO.js";
+import "./globalPidIndex-C7r2m6s7.js";
+import { t as SUPPORTED_CLIS } from "./SUPPORTED_CLIS-C3hbWNlY.js";
+
+export { SUPPORTED_CLIS };

package/dist/{SUPPORTED_CLIS-BZWx2SIK.js → SUPPORTED_CLIS-C3hbWNlY.js}

@@ -1,8 +1,8 @@
-import { t as CLIS_CONFIG } from "./ts-ShVdzMAQ.js";
+import { t as CLIS_CONFIG } from "./ts-blmSvxN5.js";
 
 //#region ts/SUPPORTED_CLIS.ts
 const SUPPORTED_CLIS = Object.keys(CLIS_CONFIG);
 
 //#endregion
 export { SUPPORTED_CLIS as t };
-//# sourceMappingURL=SUPPORTED_CLIS-BZWx2SIK.js.map
+//# sourceMappingURL=SUPPORTED_CLIS-C3hbWNlY.js.map

package/dist/cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env bun
 import { n as logger } from "./logger-B9h0djqx.js";
-import { i as versionString, n as displayVersion, r as getInstalledPackage, t as checkAndAutoUpdate } from "./versionChecker-DzMmzvnT.js";
+import { i as versionString, n as displayVersion, r as getInstalledPackage, t as checkAndAutoUpdate } from "./versionChecker-BmttWH-a.js";
 import { argv } from "process";
 import { execFileSync, spawn } from "child_process";
 import ms from "ms";
@@ -482,7 +482,7 @@ function buildRustArgs(argv, cliFromScript, supportedClis) {
 {
 	const rawArg = process.argv[2];
 	const isHelpFlag = rawArg === "-h" || rawArg === "--help";
-	const { isSubcommand, runSubcommand, cmdHelp } = await import("./subcommands-DVAUjLPL.js");
+	const { isSubcommand, runSubcommand, cmdHelp } = await import("./subcommands-DA0MhdpJ.js");
 	if (isHelpFlag && process.argv.length === 3) {
 		cmdHelp();
 		process.exit(0);
@@ -515,7 +515,7 @@ if (config.useRust) {
 		}
 	}
 	if (rustBinary) {
-		const { SUPPORTED_CLIS } = await import("./SUPPORTED_CLIS-Bul6osAx.js");
+		const { SUPPORTED_CLIS } = await import("./SUPPORTED_CLIS-9oihdzOp.js");
 		const rustArgs = buildRustArgs(process.argv, config.cli, SUPPORTED_CLIS);
 		if (config.verbose) {
 			console.log(`[rust] Using binary: ${rustBinary}`);

package/dist/index.js

@@ -1,6 +1,6 @@
-import { a as removeControlCharacters, i as AgentContext, n as agentYes, r as config, t as CLIS_CONFIG } from "./ts-ShVdzMAQ.js";
+import { a as removeControlCharacters, i as AgentContext, n as agentYes, r as config, t as CLIS_CONFIG } from "./ts-blmSvxN5.js";
 import "./logger-B9h0djqx.js";
-import "./versionChecker-DzMmzvnT.js";
+import "./versionChecker-BmttWH-a.js";
 import "./pidStore-CGKIhaJO.js";
 import "./globalPidIndex-C7r2m6s7.js";
 

package/dist/{schedule-BLbUSihu.js → schedule-CNhFqdnP.js}

@@ -1,9 +1,9 @@
-import "./ts-ShVdzMAQ.js";
+import "./ts-blmSvxN5.js";
 import "./logger-B9h0djqx.js";
-import "./versionChecker-DzMmzvnT.js";
+import "./versionChecker-BmttWH-a.js";
 import "./pidStore-CGKIhaJO.js";
 import "./globalPidIndex-C7r2m6s7.js";
-import { t as SUPPORTED_CLIS } from "./SUPPORTED_CLIS-BZWx2SIK.js";
+import { t as SUPPORTED_CLIS } from "./SUPPORTED_CLIS-C3hbWNlY.js";
 import { n as resolveSpawnCwd } from "./workspaceConfig-BJO4fzEn.js";
 import { createHash } from "node:crypto";
 
@@ -141,4 +141,4 @@ async function cmdSchedule(rest) {
 
 //#endregion
 export { cmdSchedule };
-//# sourceMappingURL=schedule-BLbUSihu.js.map
+//# sourceMappingURL=schedule-CNhFqdnP.js.map

package/dist/{serve-vOIzBN5C.js → serve-CgHUyl6K.js}

@@ -1,13 +1,13 @@
-import "./ts-ShVdzMAQ.js";
+import "./ts-blmSvxN5.js";
 import "./logger-B9h0djqx.js";
-import { r as getInstalledPackage } from "./versionChecker-DzMmzvnT.js";
+import { r as getInstalledPackage } from "./versionChecker-BmttWH-a.js";
 import "./pidStore-CGKIhaJO.js";
 import { a as updateGlobalPidStatus } from "./globalPidIndex-C7r2m6s7.js";
 import { t as pgidForWrapper } from "./reaper-BkjPN7mw.js";
 import "./configShared-C5QaNPnz.js";
-import { t as SUPPORTED_CLIS } from "./SUPPORTED_CLIS-BZWx2SIK.js";
+import { t as SUPPORTED_CLIS } from "./SUPPORTED_CLIS-C3hbWNlY.js";
 import "./remotes-D8GvSbhf.js";
-import { f as readNotes, g as snapshotStatus, m as resolveOne, o as extractTaskCounts, p as renderRawLog, r as controlCodeFromName, u as listRecords, v as writeToIpc } from "./subcommands-BBsfLrTZ.js";
+import { f as readNotes, g as snapshotStatus, m as resolveOne, o as extractTaskCounts, p as renderRawLog, r as controlCodeFromName, u as listRecords, v as writeToIpc } from "./subcommands-7ZNa2rCG.js";
 import yargs from "yargs";
 import { mkdir, open, readFile, stat, writeFile } from "fs/promises";
 import { homedir, hostname, userInfo } from "os";
@@ -208,6 +208,18 @@ function portFromArgs(args) {
 	const m = /--port[=\s](\d+)/.exec(args.join(" "));
 	return m ? Number(m[1]) : DEFAULT_PORT;
 }
+function explicitWebrtcUrl(args) {
+	for (let i = 0; i < args.length; i++) {
+		const a = args[i];
+		for (const flag of ["--webrtc", "--share"]) {
+			if (a === flag && args[i + 1]?.startsWith("webrtc://")) return args[i + 1];
+			if (a.startsWith(`${flag}=`)) {
+				const v = a.slice(flag.length + 1);
+				if (v.startsWith("webrtc://")) return v;
+			}
+		}
+	}
+}
 async function fetchDaemonVersion(port, token) {
 	try {
 		const r = await fetch(`http://127.0.0.1:${port}/api/version`, {
@@ -231,14 +243,30 @@ async function cmdServeDaemon(sub, args) {
 		const priorArgs = await readDaemonServeArgs(mgr);
 		const effArgs = args.length ? args : priorArgs ?? [];
 		const current = getInstalledPackage().version;
+		const webrtcDaemon = effArgs.some((a) => a.startsWith("--webrtc") || a.startsWith("--share"));
+		let shareLink = null;
+		let shareLinkMinted = false;
+		if (webrtcDaemon) try {
+			const { loadOrCreateShareRoom, shareLinkFromRoomUrl } = await import("./share-Cvb0PBKg.js");
+			const explicit = explicitWebrtcUrl(effArgs);
+			shareLink = shareLinkFromRoomUrl(explicit ?? await loadOrCreateShareRoom());
+			shareLinkMinted = !explicit;
+		} catch {}
+		const emitShareLink = () => {
+			if (!webrtcDaemon) return;
+			if (shareLink) process.stdout.write(`\nshared over WebRTC — open this link (the token is eaten from the URL on open):\n  ${shareLink}\n` + (shareLinkMinted ? `  (persistent room — same link across restarts; delete ~/.agent-yes/.share-room to rotate)\n` : ``));
+			else process.stdout.write("\nthe WebRTC share link carries a secret, so the daemon does NOT log it —\nread it from ~/.agent-yes/.share-link (mode 0600). The room persists in\n~/.agent-yes/.share-room, so the link survives restarts.\n");
+		};
 		if (priorArgs !== null) {
+			const sameConfig = JSON.stringify(effArgs) === JSON.stringify(priorArgs);
 			const runningVer = await fetchDaemonVersion(portFromArgs(effArgs), token);
-			if (runningVer === current) {
+			if (runningVer === current && sameConfig) {
 				await ensureBootAutostart(mgr);
 				process.stdout.write(`'${DAEMON_NAME}' already running v${current} (up to date)\n`);
+				emitShareLink();
 				return 0;
 			}
-			process.stdout.write(`rolling '${DAEMON_NAME}' ${runningVer ? `v${runningVer}` : "(unknown)"} → v${current}…\n`);
+			process.stdout.write(runningVer === current ? `reconfiguring '${DAEMON_NAME}' (serve args changed)…\n` : `rolling '${DAEMON_NAME}' ${runningVer ? `v${runningVer}` : "(unknown)"} → v${current}…\n`);
 			await spawnExit([
 				mgr.bin,
 				"stop",
@@ -251,7 +279,7 @@ async function cmdServeDaemon(sub, args) {
 			]);
 		}
 		const serveArgv = ayServeArgv(effArgs);
-		const oxmgrHealth = effArgs.some((a) => a.startsWith("--webrtc") || a.startsWith("--share")) && mgr.id === "oxmgr" ? [
+		const oxmgrHealth = webrtcDaemon && mgr.id === "oxmgr" ? [
 			"--health-cmd",
 			ayServeArgv(["healthcheck"]).join(" "),
 			"--health-interval",
@@ -291,7 +319,6 @@ async function cmdServeDaemon(sub, args) {
 		if (code === 0) {
 			const onBoot = await ensureBootAutostart(mgr);
 			const port = portFromArgs(effArgs);
-			const webrtcish = effArgs.some((a) => a.startsWith("--webrtc") || a.startsWith("--share"));
 			const httpish = effArgs.some((a) => a.startsWith("--http") || a.startsWith("--share")) || !effArgs.some((a) => a.startsWith("--webrtc"));
 			process.stdout.write(`\n${priorArgs !== null ? `rolled '${DAEMON_NAME}' forward to` : `installed '${DAEMON_NAME}' as a daemon via ${mgr.id} —`} v${current}\n`);
 			if (mgr.id === "oxmgr") process.stdout.write(onBoot ? `start-on-boot: enabled (systemd --user + linger, starts at boot)\n` : `start-on-boot: not registered — needs a user systemd session; run \`oxmgr service install\` to enable\n`);
@@ -304,7 +331,7 @@ async function cmdServeDaemon(sub, args) {
 			}
 			process.stdout.write(`  ay serve logs                # view server logs\n`);
 			process.stdout.write(`  ay serve uninstall           # remove daemon\n`);
-			if (webrtcish) process.stdout.write("\nthe WebRTC share link carries a secret, so the daemon does NOT log it —\nread it from ~/.agent-yes/.share-link (mode 0600). The room persists in\n~/.agent-yes/.share-room, so the link survives restarts.\n");
+			emitShareLink();
 		}
 		return code ?? 1;
 	}
@@ -1052,7 +1079,7 @@ Options:
 		const webrtcVal = argv.webrtc ?? argv.share;
 		const explicitUrl = typeof webrtcVal === "string" && webrtcVal.startsWith("webrtc://") ? webrtcVal : void 0;
 		try {
-			const { startShare, loadOrCreateShareRoom } = await import("./share-YuM6-Q6A.js");
+			const { startShare, loadOrCreateShareRoom } = await import("./share-Cvb0PBKg.js");
 			const linkFile = path.join(process.env.AGENT_YES_HOME ?? path.join(homedir(), ".agent-yes"), ".share-link");
 			const announce = async (room, link, rotated) => {
 				const lead = rotated ? "the room was rejected by signaling (stale generation) — rotated to a fresh link" : "shared over WebRTC — open this link (the token is eaten from the URL on open)";
@@ -1107,4 +1134,4 @@ Options:
 
 //#endregion
 export { cmdServe };
-//# sourceMappingURL=serve-vOIzBN5C.js.map
+//# sourceMappingURL=serve-CgHUyl6K.js.map

package/dist/{setup-BQUtWMgU.js → setup-Bituq_if.js}

@@ -32,7 +32,7 @@ async function cmdSetup(rest) {
 	if (!existsSync(abs)) process.stderr.write(`  note: that directory doesn't exist yet — create it, or agents spawned there will fail\n`);
 	if (noShare) return 0;
 	process.stdout.write(`\nsharing this machine to agent-yes.com…\n`);
-	const { cmdServe } = await import("./serve-vOIzBN5C.js");
+	const { cmdServe } = await import("./serve-CgHUyl6K.js");
 	return cmdServe([
 		"install",
 		"--share",
@@ -42,4 +42,4 @@ async function cmdSetup(rest) {
 
 //#endregion
 export { cmdSetup };
-//# sourceMappingURL=setup-BQUtWMgU.js.map
+//# sourceMappingURL=setup-Bituq_if.js.map

package/dist/{share-YuM6-Q6A.js → share-Cvb0PBKg.js}

@@ -244,6 +244,15 @@ function parseShareUrl(s) {
 		host: m[3]
 	};
 }
+function formatShareLink(room, S, host) {
+	return `${host === "s.agent-yes.com" ? "https://agent-yes.com/w" : "http://localhost:7778/w"}/#${room}:${MARKER}${S}${host === "s.agent-yes.com" ? "" : "@" + host}`;
+}
+function shareLinkFromRoomUrl(url) {
+	const { room, token, host } = parseShareUrl(url);
+	const { s, v2 } = parseSecret(token);
+	if (!v2) throw new Error("refusing to derive a link for an unencrypted room — delete ~/.agent-yes/.share-room to rotate to an encrypted link");
+	return formatShareLink(room, s, host);
+}
 async function linkFromBunCache() {
 	const { existsSync, symlinkSync, mkdirSync, readdirSync } = await import("fs");
 	const path = (await import("path")).default;
@@ -320,9 +329,7 @@ async function startShare(opts) {
 	if (!v2) throw new Error("refusing to host an unencrypted room — delete ~/.agent-yes/.share-room to rotate to an encrypted link");
 	let S = firstS;
 	const wsScheme = host.startsWith("localhost") || host.startsWith("127.") ? "ws" : "wss";
-	const ui = host === "s.agent-yes.com" ? "https://agent-yes.com/w" : "http://localhost:7778/w";
-	const suffix = host === "s.agent-yes.com" ? "" : "@" + host;
-	const mkLink = () => `${ui}/#${room}:${MARKER}${S}${suffix}`;
+	const mkLink = () => formatShareLink(room, S, host);
 	let authToken = await deriveAuthToken(S, room, host);
 	let link = mkLink();
 	const RTCPeerConnection = await importRTC();
@@ -698,5 +705,5 @@ async function startShare(opts) {
 }
 
 //#endregion
-export { loadOrCreateShareRoom, startShare };
-//# sourceMappingURL=share-YuM6-Q6A.js.map
+export { loadOrCreateShareRoom, shareLinkFromRoomUrl, startShare };
+//# sourceMappingURL=share-Cvb0PBKg.js.map

package/dist/{subcommands-BBsfLrTZ.js → subcommands-7ZNa2rCG.js}

@@ -524,15 +524,15 @@ async function runSubcommand(argv) {
 			case "restart": return await cmdRestart(rest);
 			case "note": return await cmdNote(rest);
 			case "serve": {
-				const { cmdServe } = await import("./serve-vOIzBN5C.js");
+				const { cmdServe } = await import("./serve-CgHUyl6K.js");
 				return cmdServe(rest);
 			}
 			case "setup": {
-				const { cmdSetup } = await import("./setup-BQUtWMgU.js");
+				const { cmdSetup } = await import("./setup-Bituq_if.js");
 				return cmdSetup(rest);
 			}
 			case "schedule": {
-				const { cmdSchedule } = await import("./schedule-BLbUSihu.js");
+				const { cmdSchedule } = await import("./schedule-CNhFqdnP.js");
 				return cmdSchedule(rest);
 			}
 			case "remote": {
@@ -2304,4 +2304,4 @@ async function cmdResultSet(rest) {
 
 //#endregion
 export { stopTipForCli as _, extractNeedsInput as a, isPidAlive as c, matchKeyword as d, readNotes as f, snapshotStatus as g, runSubcommand as h, cursorAbs as i, isSubcommand as l, resolveOne as m, cmdHelp as n, extractTaskCounts as o, renderRawLog as p, controlCodeFromName as r, finalizedLines as s, GRACEFUL_EXIT_COMMANDS as t, listRecords as u, writeToIpc as v };
-//# sourceMappingURL=subcommands-BBsfLrTZ.js.map
+//# sourceMappingURL=subcommands-7ZNa2rCG.js.map

package/dist/{subcommands-DVAUjLPL.js → subcommands-DA0MhdpJ.js}

@@ -2,6 +2,6 @@ import "./logger-B9h0djqx.js";
 import "./globalPidIndex-C7r2m6s7.js";
 import "./configShared-C5QaNPnz.js";
 import "./remotes-D8GvSbhf.js";
-import { _ as stopTipForCli, a as extractNeedsInput, c as isPidAlive, d as matchKeyword, f as readNotes, g as snapshotStatus, h as runSubcommand, i as cursorAbs, l as isSubcommand, m as resolveOne, n as cmdHelp, o as extractTaskCounts, p as renderRawLog, r as controlCodeFromName, s as finalizedLines, t as GRACEFUL_EXIT_COMMANDS, u as listRecords, v as writeToIpc } from "./subcommands-BBsfLrTZ.js";
+import { _ as stopTipForCli, a as extractNeedsInput, c as isPidAlive, d as matchKeyword, f as readNotes, g as snapshotStatus, h as runSubcommand, i as cursorAbs, l as isSubcommand, m as resolveOne, n as cmdHelp, o as extractTaskCounts, p as renderRawLog, r as controlCodeFromName, s as finalizedLines, t as GRACEFUL_EXIT_COMMANDS, u as listRecords, v as writeToIpc } from "./subcommands-7ZNa2rCG.js";
 
 export { cmdHelp, isSubcommand, runSubcommand };

package/dist/{ts-ShVdzMAQ.js → ts-blmSvxN5.js}

@@ -1,5 +1,5 @@
 import { n as logger, t as addTransport } from "./logger-B9h0djqx.js";
-import { r as getInstalledPackage } from "./versionChecker-DzMmzvnT.js";
+import { r as getInstalledPackage } from "./versionChecker-BmttWH-a.js";
 import { t as agentYesHome } from "./agentYesHome-BvaUOzCV.js";
 import { i as shouldUseLock, r as releaseLock, t as acquireLock } from "./runningLock-CJxsoGdb.js";
 import { t as PidStore } from "./pidStore-CGKIhaJO.js";
@@ -1787,4 +1787,4 @@ function sleep(ms) {
 
 //#endregion
 export { removeControlCharacters as a, AgentContext as i, agentYes as n, config as r, CLIS_CONFIG as t };
-//# sourceMappingURL=ts-ShVdzMAQ.js.map
+//# sourceMappingURL=ts-blmSvxN5.js.map

package/dist/{versionChecker-DzMmzvnT.js → versionChecker-BmttWH-a.js}

@@ -7,7 +7,7 @@ import { fileURLToPath } from "url";
 
 //#region package.json
 var name = "agent-yes";
-var version = "1.127.1";
+var version = "1.128.0";
 
 //#endregion
 //#region ts/versionChecker.ts
@@ -215,4 +215,4 @@ async function displayVersion() {
 
 //#endregion
 export { versionString as i, displayVersion as n, getInstalledPackage as r, checkAndAutoUpdate as t };
-//# sourceMappingURL=versionChecker-DzMmzvnT.js.map
+//# sourceMappingURL=versionChecker-BmttWH-a.js.map

package/lab/ui/index.html

@@ -1368,6 +1368,13 @@
       let es = null; // live-tail subscription closer
       let term = null; // xterm.js Terminal rendering the raw PTY stream
       let fit = null;
+      // Re-fit the open terminal and re-assert its size to the agent's PTY. Set per
+      // selection in select(); invoked on open AND whenever the tab is re-activated.
+      // A backgrounded tab can miss window resizes, and another viewer may have
+      // resized the shared PTY while we were away — either leaves our stream
+      // rendering at the wrong width/height until something nudges it. null when no
+      // agent is open.
+      let resyncTerm = null;
       // Terminal font size (px) — adjustable from the ⋯ menu, persisted across
       // reloads, applied live to the open terminal and used by every new one.
       let termFontSize = 12;
@@ -2947,9 +2954,17 @@
           }
           suppressPush = false;
         };
-        tx.fetchJSON("/api/size/" + encodeURIComponent(pid))
-          .then(fitAndSync)
-          .catch(() => fitAndSync(null));
+        // Fit + sync now, and on every later tab re-activation: re-measure our pane
+        // and re-assert our size to the agent so the stream always reflows to OUR
+        // viewport (see the visibilitychange hook in startPolling). Push-if-different
+        // inside fitAndSync keeps an already-matching agent from a redundant SIGWINCH.
+        resyncTerm = () => {
+          if (sel !== selKey || !term) return;
+          tx.fetchJSON("/api/size/" + encodeURIComponent(pid))
+            .then(fitAndSync)
+            .catch(() => fitAndSync(null));
+        };
+        resyncTerm();
 
         // True live tail via ay serve's SSE stream. First event is an xterm-rendered
         // tail snapshot; later events are incremental deltas. We normalise terminal
@@ -3719,6 +3734,11 @@
           if (document.visibilityState === "visible") {
             lastActivity = Date.now();
             loadList();
+            // Re-assert our viewport size to the open agent: while we were away the
+            // window may have resized (a hidden tab can miss it) or another viewer
+            // may have resized the shared PTY, so the stream could be rendering at
+            // the wrong width/height. fit + push-if-different brings it back.
+            resyncTerm?.();
           }
         });
         watchVersion();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-yes",
-  "version": "1.127.1",
+  "version": "1.128.0",
   "description": "A wrapper tool that automates interactions with various AI CLI tools by automatically handling common prompts and responses.",
   "keywords": [
     "ai",

package/ts/resultEnvelope.spec.ts

@@ -1,3 +1,4 @@
+import path from "node:path";
 import { describe, expect, it } from "vitest";
 import { buildStoredResult, normalizeEnvelope, resultPath, resultsDir } from "./resultEnvelope.ts";
 
@@ -38,6 +39,8 @@ describe("buildStoredResult", () => {
 
 describe("resultPath", () => {
   it("derives a per-pid path under the results dir", () => {
-    expect(resultPath(777)).toBe(`${resultsDir()}/777.json`);
+    // Use path.join (not a hardcoded "/") so the expectation matches the
+    // platform separator — resultPath itself joins, so on Windows it's "\".
+    expect(resultPath(777)).toBe(path.join(resultsDir(), "777.json"));
   });
 });

package/ts/serve.ts

@@ -276,6 +276,24 @@ function portFromArgs(args: string[]): number {
   return m ? Number(m[1]) : DEFAULT_PORT;
 }
 
+// An explicit webrtc:// URL passed to --webrtc/--share in the daemon's serve args,
+// or undefined for a bare flag (which mints a persisted room instead). Mirrors how
+// cmdServe resolves argv.webrtc/argv.share, but over the raw arg list install holds
+// (oxmgr splits the command on whitespace → `--webrtc url`; pm2/`=` → `--webrtc=url`).
+function explicitWebrtcUrl(args: string[]): string | undefined {
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i]!;
+    for (const flag of ["--webrtc", "--share"]) {
+      if (a === flag && args[i + 1]?.startsWith("webrtc://")) return args[i + 1];
+      if (a.startsWith(`${flag}=`)) {
+        const v = a.slice(flag.length + 1);
+        if (v.startsWith("webrtc://")) return v;
+      }
+    }
+  }
+  return undefined;
+}
+
 // Ask the live daemon its version over the local HTTP API. null if it's not
 // listening (webrtc-only) or too old to expose /api/version — both of which we
 // treat as "outdated" so a re-install rolls it forward.
@@ -314,19 +332,68 @@ async function cmdServeDaemon(sub: string, args: string[]): Promise<number> {
     const effArgs = args.length ? args : (priorArgs ?? []);
     const current = getInstalledPackage().version;
 
+    // WebRTC daemon: resolve the share link up front so we can print it on every
+    // install path (fresh install, roll-forward, and the already-up-to-date no-op).
+    // The link is a pure transform of the room URL, so the foreground install
+    // command can show it even though the background daemon is what runs the bridge.
+    // Resolve (and persist, when auto-minting) the room BEFORE spawning, so the
+    // daemon reads the SAME ~/.agent-yes/.share-room and can't race us into minting
+    // a divergent one. We print the link directly — the install receipt already
+    // prints the bearer token, so the operator's terminal is the right trust scope
+    // for a secret-bearing link (unlike the daemon's persisted logs, which omit it).
+    const webrtcDaemon = effArgs.some((a) => a.startsWith("--webrtc") || a.startsWith("--share"));
+    let shareLink: string | null = null;
+    let shareLinkMinted = false; // auto-minted (persisted/rotatable) vs explicit URL
+    if (webrtcDaemon) {
+      try {
+        const { loadOrCreateShareRoom, shareLinkFromRoomUrl } = await import("./share.ts");
+        const explicit = explicitWebrtcUrl(effArgs);
+        shareLink = shareLinkFromRoomUrl(explicit ?? (await loadOrCreateShareRoom()));
+        shareLinkMinted = !explicit;
+      } catch {
+        /* best effort — fall back to the .share-link file hint in emitShareLink */
+      }
+    }
+    const emitShareLink = () => {
+      if (!webrtcDaemon) return;
+      if (shareLink)
+        process.stdout.write(
+          `\nshared over WebRTC — open this link (the token is eaten from the URL on open):\n` +
+            `  ${shareLink}\n` +
+            (shareLinkMinted
+              ? `  (persistent room — same link across restarts; delete ~/.agent-yes/.share-room to rotate)\n`
+              : ``),
+        );
+      else
+        process.stdout.write(
+          `\nthe WebRTC share link carries a secret, so the daemon does NOT log it —\n` +
+            `read it from ~/.agent-yes/.share-link (mode 0600). The room persists in\n` +
+            `~/.agent-yes/.share-room, so the link survives restarts.\n`,
+        );
+    };
+
     if (priorArgs !== null) {
-      // A daemon already exists — only disturb it if it's actually outdated.
+      // A daemon already exists. Treat this as a no-op only when it's BOTH current
+      // AND already running the requested config — otherwise a config change (e.g.
+      // `install --webrtc` over an --http daemon, which the version probe still
+      // reaches on the default port) would be silently ignored, and we'd print a
+      // share link for a WebRTC bridge that isn't actually running. A bare re-run
+      // passes no args, so effArgs === priorArgs and this stays a no-op as before.
+      const sameConfig = JSON.stringify(effArgs) === JSON.stringify(priorArgs);
       const runningVer = await fetchDaemonVersion(portFromArgs(effArgs), token);
-      if (runningVer === current) {
+      if (runningVer === current && sameConfig) {
         await ensureBootAutostart(mgr);
         process.stdout.write(`'${DAEMON_NAME}' already running v${current} (up to date)\n`);
+        emitShareLink();
         return 0;
       }
-      // Outdated (or unreachable/too-old to report) → graceful roll-forward.
-      // `stop` sends SIGTERM, which cmdServe handles cleanly (closing share
-      // peers so browsers reconnect fast), then we re-create with the new binary.
+      // Outdated, unreachable, or reconfigured → graceful roll-forward. `stop` sends
+      // SIGTERM, which cmdServe handles cleanly (closing share peers so browsers
+      // reconnect fast), then we re-create with the new binary/args.
       process.stdout.write(
-        `rolling '${DAEMON_NAME}' ${runningVer ? `v${runningVer}` : "(unknown)"} → v${current}…\n`,
+        runningVer === current
+          ? `reconfiguring '${DAEMON_NAME}' (serve args changed)…\n`
+          : `rolling '${DAEMON_NAME}' ${runningVer ? `v${runningVer}` : "(unknown)"} → v${current}…\n`,
       );
       await spawnExit([mgr.bin, "stop", DAEMON_NAME]);
       await spawnExit([mgr.bin, "delete", DAEMON_NAME]);
@@ -340,7 +407,7 @@ async function cmdServeDaemon(sub: string, args: string[]): Promise<number> {
     // freeze the JS event loop (host answers nobody, no in-process timer can
     // recover it), so an EXTERNAL probe of the serve heartbeat is the only thing
     // that can detect+restart it. 15s stale + 3 misses at 10s ≈ 45s to auto-recover.
-    const webrtcDaemon = effArgs.some((a) => a.startsWith("--webrtc") || a.startsWith("--share"));
+    // (webrtcDaemon resolved above, where we also derive the share link.)
     const oxmgrHealth =
       webrtcDaemon && mgr.id === "oxmgr"
         ? [
@@ -389,7 +456,6 @@ async function cmdServeDaemon(sub: string, args: string[]): Promise<number> {
       const onBoot = await ensureBootAutostart(mgr);
       const port = portFromArgs(effArgs);
       // Mirror cmdServe's mode resolution: webrtc-only daemons open no HTTP port.
-      const webrtcish = effArgs.some((a) => a.startsWith("--webrtc") || a.startsWith("--share"));
       const httpish =
         effArgs.some((a) => a.startsWith("--http") || a.startsWith("--share")) ||
         !effArgs.some((a) => a.startsWith("--webrtc"));
@@ -421,13 +487,7 @@ async function cmdServeDaemon(sub: string, args: string[]): Promise<number> {
       }
       process.stdout.write(`  ay serve logs                # view server logs\n`);
       process.stdout.write(`  ay serve uninstall           # remove daemon\n`);
-      if (webrtcish) {
-        process.stdout.write(
-          `\nthe WebRTC share link carries a secret, so the daemon does NOT log it —\n` +
-            `read it from ~/.agent-yes/.share-link (mode 0600). The room persists in\n` +
-            `~/.agent-yes/.share-room, so the link survives restarts.\n`,
-        );
-      }
+      emitShareLink();
     }
     return code ?? 1;
   }

package/ts/share.spec.ts

@@ -0,0 +1,36 @@
+import { describe, it, expect } from "vitest";
+import { shareLinkFromRoomUrl } from "./share.ts";
+import { MARKER } from "../lab/ui/e2e.js";
+
+const S = "a".repeat(64); // a valid 64-hex room secret
+const TOK = `${MARKER}${S}`; // encrypted-room token (v2)
+
+// shareLinkFromRoomUrl turns a persisted/explicit webrtc://room:token@host room
+// into the browser console link `ay serve install` prints — it MUST match the
+// link startShare announces from the same room (both go through formatShareLink).
+describe("shareLinkFromRoomUrl", () => {
+  it("derives the prod console link (no host suffix; secret rides in the fragment)", () => {
+    const link = shareLinkFromRoomUrl(`webrtc://r1a2b3c:${TOK}@s.agent-yes.com`);
+    expect(link).toBe(`https://agent-yes.com/w/#r1a2b3c:${MARKER}${S}`);
+  });
+
+  it("derives a dev/self-hosted link carrying the signaling host in the fragment", () => {
+    const link = shareLinkFromRoomUrl(`webrtc://r1a2b3c:${TOK}@localhost:7778`);
+    expect(link).toBe(`http://localhost:7778/w/#r1a2b3c:${MARKER}${S}@localhost:7778`);
+  });
+
+  it("round-trips room + token in the fragment the browser splits back out", () => {
+    const link = shareLinkFromRoomUrl(`webrtc://room0:${TOK}@s.agent-yes.com`);
+    expect(link.split("#")[1]).toBe(`room0:${TOK}`);
+  });
+
+  it("refuses a legacy (unencrypted) room — operator must rotate to an encrypted link", () => {
+    expect(() => shareLinkFromRoomUrl(`webrtc://room0:${S}@s.agent-yes.com`)).toThrow(
+      /unencrypted/,
+    );
+  });
+
+  it("rejects a malformed room url", () => {
+    expect(() => shareLinkFromRoomUrl("not-a-webrtc-url")).toThrow(/webrtc:\/\//);
+  });
+});

package/ts/share.ts

@@ -160,6 +160,33 @@ function parseShareUrl(s: string): { room: string; token: string; host: string }
   return { room: m[1]!, token: m[2]!, host: m[3]! };
 }
 
+// The browser console URL for a room — what the operator opens to reach the host.
+// Pure function of (room, secret S, signaling host): S rides in the URL fragment
+// (never sent to any server) and is eaten by the page on open. Single source of
+// truth for the link format, shared by startShare's live announce and by
+// shareLinkFromRoomUrl (so `ay serve install` prints the exact link the daemon serves).
+function formatShareLink(room: string, S: string, host: string): string {
+  // The console web-app is served under /w/ (landing page lives at /). A non-prod
+  // signaling host targets the local dev UI and carries the host in the fragment.
+  const ui = host === "s.agent-yes.com" ? "https://agent-yes.com/w" : "http://localhost:7778/w";
+  const suffix = host === "s.agent-yes.com" ? "" : "@" + host;
+  return `${ui}/#${room}:${MARKER}${S}${suffix}`;
+}
+
+// Derive the shareable console link from a persisted/explicit webrtc://room:token@host
+// URL WITHOUT starting a bridge, so `ay serve install` can print the same link the
+// background daemon will serve. Throws on a legacy (unencrypted) room, mirroring
+// startShare's refusal to host one.
+export function shareLinkFromRoomUrl(url: string): string {
+  const { room, token, host } = parseShareUrl(url);
+  const { s, v2 } = parseSecret(token);
+  if (!v2)
+    throw new Error(
+      "refusing to derive a link for an unencrypted room — delete ~/.agent-yes/.share-room to rotate to an encrypted link",
+    );
+  return formatShareLink(room, s, host);
+}
+
 // node-datachannel ships a native addon. Under Bun the module sometimes resolves
 // from the global cache where the prebuilt .node isn't linked; this best-effort
 // shim symlinks it in before we import. In a normal npm/bunx install the binary
@@ -280,10 +307,7 @@ export async function startShare(
   let S = firstS;
 
   const wsScheme = host.startsWith("localhost") || host.startsWith("127.") ? "ws" : "wss";
-  // The console web-app is served under /w/ (landing page lives at /).
-  const ui = host === "s.agent-yes.com" ? "https://agent-yes.com/w" : "http://localhost:7778/w";
-  const suffix = host === "s.agent-yes.com" ? "" : "@" + host;
-  const mkLink = () => `${ui}/#${room}:${MARKER}${S}${suffix}`;
+  const mkLink = () => formatShareLink(room, S, host);
   let authToken = await deriveAuthToken(S, room, host);
   let link = mkLink();
 

package/dist/SUPPORTED_CLIS-Bul6osAx.js

@@ -1,8 +0,0 @@
-import "./ts-ShVdzMAQ.js";
-import "./logger-B9h0djqx.js";
-import "./versionChecker-DzMmzvnT.js";
-import "./pidStore-CGKIhaJO.js";
-import "./globalPidIndex-C7r2m6s7.js";
-import { t as SUPPORTED_CLIS } from "./SUPPORTED_CLIS-BZWx2SIK.js";
-
-export { SUPPORTED_CLIS };