agent-yes 1.144.0 → 1.146.0

package/dist/{subcommands-o3WRyHb9.js → subcommands-DWf6MHH6.js}

@@ -2,7 +2,8 @@ import { t as invokedCliName } from "./invokedCli-uqM2YYA7.js";
 import { t as agentYesHome } from "./agentYesHome-_eJa3DaX.js";
 import { a as updateGlobalPidStatus, i as readGlobalPids } from "./globalPidIndex-DlmmJlO8.js";
 import { t as loadSharedCliDefaults } from "./configShared-C1C04bbq.js";
-import { a as resolveRemoteSpec, i as readRemotes } from "./remotes-PKKjfTI1.js";
+import { n as isWebrtcSpec } from "./webrtcLink-BWhuA74k.js";
+import { a as resolveRemoteSpec, i as readRemotes } from "./remotes-qK6uozO4.js";
 import ms from "ms";
 import yargs from "yargs";
 import { appendFile, mkdir, open, readFile, stat, writeFile } from "fs/promises";
@@ -553,19 +554,19 @@ async function runSubcommand(argv) {
 			case "restart": return await cmdRestart(rest);
 			case "note": return await cmdNote(rest);
 			case "serve": {
-				const { cmdServe } = await import("./serve-QXNICu0K.js");
+				const { cmdServe } = await import("./serve-CbXS8sWv.js");
 				return cmdServe(rest);
 			}
 			case "setup": {
-				const { cmdSetup } = await import("./setup-dJlAGJEz.js");
+				const { cmdSetup } = await import("./setup-C8vJmagV.js");
 				return cmdSetup(rest);
 			}
 			case "schedule": {
-				const { cmdSchedule } = await import("./schedule-BKyOLSSe.js");
+				const { cmdSchedule } = await import("./schedule-B34TqMjC.js");
 				return cmdSchedule(rest);
 			}
 			case "remote": {
-				const { cmdRemote } = await import("./remotes-BdankQeI.js");
+				const { cmdRemote } = await import("./remotes-5lHLAAqn.js");
 				return cmdRemote(rest);
 			}
 			case "reap":
@@ -893,15 +894,26 @@ async function fetchRemoteRecordsRaw(url, token, opts) {
 	if (opts.all) params.set("all", "1");
 	if (opts.active) params.set("active", "1");
 	if (opts.keyword) params.set("keyword", opts.keyword);
+	let bridge = null;
 	try {
-		const res = await fetch(`${url}/api/ls?${params}`, {
-			headers: { Authorization: `Bearer ${token}` },
-			signal: AbortSignal.timeout(5e3)
+		let base = url;
+		let bearer = token;
+		if (isWebrtcSpec(url)) {
+			const { startWebrtcBridge } = await import("./webrtcRemote-jGM3ZHK3.js");
+			bridge = await startWebrtcBridge(url);
+			base = bridge.baseUrl;
+			bearer = bridge.token;
+		}
+		const res = await fetch(`${base}/api/ls?${params}`, {
+			headers: { Authorization: `Bearer ${bearer}` },
+			signal: AbortSignal.timeout(8e3)
 		});
 		if (!res.ok) return [];
 		return await res.json();
 	} catch {
 		return [];
+	} finally {
+		bridge?.close();
 	}
 }
 async function runAllRemotesLs(opts) {
@@ -2581,4 +2593,4 @@ async function cmdResultSet(rest) {
 
 //#endregion
 export { stopTipForCli as C, snapshotStatus as S, renderRawLog as _, cursorAbs as a, resolveReadWindow as b, extractTaskCounts as c, isExitRequest as d, isPidAlive as f, readNotes as g, matchKeyword as h, controlCodeFromName as i, finalizedLines as l, listRecords as m, READ_PAGE_DEFAULT as n, deriveLiveStatus as o, isSubcommand as p, cmdHelp as r, extractNeedsInput as s, GRACEFUL_EXIT_COMMANDS as t, isAgentStuck as u, renderRawLogLines as v, writeToIpc as w, runSubcommand as x, resolveOne as y };
-//# sourceMappingURL=subcommands-o3WRyHb9.js.map
+//# sourceMappingURL=subcommands-DWf6MHH6.js.map

package/dist/{subcommands-_raQNJO3.js → subcommands-ZKr7Fks8.js}

@@ -1,7 +1,9 @@
 import "./logger-CDIsZ-Pp.js";
 import "./globalPidIndex-DlmmJlO8.js";
 import "./configShared-C1C04bbq.js";
-import "./remotes-PKKjfTI1.js";
-import { C as stopTipForCli, S as snapshotStatus, _ as renderRawLog, a as cursorAbs, b as resolveReadWindow, c as extractTaskCounts, d as isExitRequest, f as isPidAlive, g as readNotes, h as matchKeyword, i as controlCodeFromName, l as finalizedLines, m as listRecords, n as READ_PAGE_DEFAULT, o as deriveLiveStatus, p as isSubcommand, r as cmdHelp, s as extractNeedsInput, t as GRACEFUL_EXIT_COMMANDS, u as isAgentStuck, v as renderRawLogLines, w as writeToIpc, x as runSubcommand, y as resolveOne } from "./subcommands-o3WRyHb9.js";
+import "./e2e-ClOI_aqV.js";
+import "./webrtcLink-BWhuA74k.js";
+import "./remotes-qK6uozO4.js";
+import { C as stopTipForCli, S as snapshotStatus, _ as renderRawLog, a as cursorAbs, b as resolveReadWindow, c as extractTaskCounts, d as isExitRequest, f as isPidAlive, g as readNotes, h as matchKeyword, i as controlCodeFromName, l as finalizedLines, m as listRecords, n as READ_PAGE_DEFAULT, o as deriveLiveStatus, p as isSubcommand, r as cmdHelp, s as extractNeedsInput, t as GRACEFUL_EXIT_COMMANDS, u as isAgentStuck, v as renderRawLogLines, w as writeToIpc, x as runSubcommand, y as resolveOne } from "./subcommands-DWf6MHH6.js";
 
 export { cmdHelp, isSubcommand, runSubcommand };

package/dist/{tray-DsTv-C04.js → tray-5Hezw9uj.js}

@@ -187,4 +187,4 @@ async function startTray() {
 
 //#endregion
 export { ensureTray, startTray };
-//# sourceMappingURL=tray-DsTv-C04.js.map
+//# sourceMappingURL=tray-5Hezw9uj.js.map

package/dist/{ts-Qh0Z7nsZ.js → ts-CLOLKDtz.js}

@@ -1,5 +1,5 @@
 import { n as logger, t as addTransport } from "./logger-CDIsZ-Pp.js";
-import { r as getInstalledPackage } from "./versionChecker-BjKAfiI-.js";
+import { r as getInstalledPackage } from "./versionChecker-B6EYG8nW.js";
 import { t as agentYesHome } from "./agentYesHome-_eJa3DaX.js";
 import { i as shouldUseLock, r as releaseLock, t as acquireLock } from "./runningLock-V4qvXgAw.js";
 import { t as PidStore } from "./pidStore-fqXqTKkh.js";
@@ -1800,4 +1800,4 @@ function sleep(ms) {
 
 //#endregion
 export { removeControlCharacters as a, AgentContext as i, agentYes as n, config as r, CLIS_CONFIG as t };
-//# sourceMappingURL=ts-Qh0Z7nsZ.js.map
+//# sourceMappingURL=ts-CLOLKDtz.js.map

package/dist/{versionChecker-BjKAfiI-.js → versionChecker-B6EYG8nW.js}

@@ -7,7 +7,7 @@ import { fileURLToPath } from "url";
 
 //#region package.json
 var name = "agent-yes";
-var version = "1.144.0";
+var version = "1.146.0";
 
 //#endregion
 //#region ts/versionChecker.ts
@@ -215,4 +215,4 @@ async function displayVersion() {
 
 //#endregion
 export { versionString as i, displayVersion as n, getInstalledPackage as r, checkAndAutoUpdate as t };
-//# sourceMappingURL=versionChecker-BjKAfiI-.js.map
+//# sourceMappingURL=versionChecker-B6EYG8nW.js.map

package/dist/webrtcLink-BWhuA74k.js

@@ -0,0 +1,45 @@
+import { u as parseSecret } from "./e2e-ClOI_aqV.js";
+
+//#region ts/webrtcLink.ts
+const SIGNAL_SUBPROTOCOL = "ay-signal-1";
+const DEFAULT_SIGHOST = "s.agent-yes.com";
+/**
+* Parse a share link into { room, secret, signaling-host }. Accepts:
+*   webrtc://<room>:<token>@<host>
+*   https://<anyhost>/w/#<room>:<token>            (signaling host defaults to s.agent-yes.com)
+*   https://<anyhost>/w/#<room>:<token>@<sighost>  (explicit signaling host)
+* Returns null if the string isn't a recognizable share link.
+*/
+function parseWebrtcLink(link) {
+	const wr = /^webrtc:\/\/([^:]+):([^@]+)@(.+)$/.exec(link);
+	if (wr) {
+		const { s } = parseSecret(wr[2]);
+		return {
+			room: wr[1],
+			s,
+			host: wr[3]
+		};
+	}
+	if (/^https?:\/\//.test(link) && link.includes("#")) {
+		const at = (link.split("#")[1] ?? "").split("@");
+		const host = at[1] || DEFAULT_SIGHOST;
+		const seg = at[0];
+		const i = seg.indexOf(":");
+		if (i < 0) return null;
+		const { s } = parseSecret(seg.slice(i + 1));
+		return {
+			room: seg.slice(0, i),
+			s,
+			host
+		};
+	}
+	return null;
+}
+/** True if `spec` looks like a WebRTC share link (vs. an http remote or alias). */
+function isWebrtcSpec(spec) {
+	return spec.startsWith("webrtc://") || /^https?:\/\//.test(spec) && spec.includes("#");
+}
+
+//#endregion
+export { isWebrtcSpec as n, parseWebrtcLink as r, SIGNAL_SUBPROTOCOL as t };
+//# sourceMappingURL=webrtcLink-BWhuA74k.js.map

package/dist/webrtcRemote-jGM3ZHK3.js

@@ -0,0 +1,259 @@
+import { a as computeTranscriptHash, c as open, d as randomHex, f as seal, l as packEnvelope, n as FLAG_CONFIRM, o as deriveAuthToken, p as unpackEnvelope, s as deriveDirKeys } from "./e2e-ClOI_aqV.js";
+import { n as isWebrtcSpec, r as parseWebrtcLink, t as SIGNAL_SUBPROTOCOL } from "./webrtcLink-BWhuA74k.js";
+import { RTCPeerConnection } from "node-datachannel/polyfill";
+
+//#region ts/webrtcRemote.ts
+const CONNECT_TIMEOUT_MS = 25e3;
+/** A live, key-confirmed WebRTC connection to a single share room. */
+var WebRtcConn = class {
+	ws;
+	pc = null;
+	dc = null;
+	send = { sendCtr: 0n };
+	recv = { lastSeen: -1n };
+	keyC2H = null;
+	keyH2C = null;
+	th = null;
+	hostPeer = null;
+	myNonce = randomHex(16);
+	confirmedIn = false;
+	confirmedOut = false;
+	confirmed = false;
+	sendChain = Promise.resolve();
+	recvChain = Promise.resolve();
+	idCounter = 0;
+	pending = /* @__PURE__ */ new Map();
+	ready;
+	resolveReady;
+	rejectReady;
+	constructor(link) {
+		this.link = link;
+		this.ready = new Promise((res, rej) => {
+			this.resolveReady = res;
+			this.rejectReady = rej;
+		});
+		const timer = setTimeout(() => this.rejectReady(/* @__PURE__ */ new Error(`WebRTC connect timeout after ${CONNECT_TIMEOUT_MS}ms`)), CONNECT_TIMEOUT_MS);
+		this.ready.then(() => clearTimeout(timer), () => clearTimeout(timer));
+		this.ws = this.dial();
+	}
+	dial() {
+		const { room, host } = this.link;
+		const ws = new WebSocket(`wss://${host}/${room}`, [SIGNAL_SUBPROTOCOL]);
+		ws.onopen = async () => {
+			const authToken = await deriveAuthToken(this.link.s, room, host);
+			ws.send(JSON.stringify({
+				type: "hello",
+				role: "client",
+				v: 2,
+				token: authToken
+			}));
+		};
+		ws.onerror = (e) => this.rejectReady(/* @__PURE__ */ new Error(`signaling error: ${String(e?.message ?? e)}`));
+		ws.onclose = () => {
+			if (!this.confirmed) this.rejectReady(/* @__PURE__ */ new Error("signaling closed before connect"));
+		};
+		ws.onmessage = (ev) => void this.onSignal(ev);
+		return ws;
+	}
+	async onSignal(ev) {
+		const m = JSON.parse(typeof ev.data === "string" ? ev.data : await ev.data.text());
+		if (m.type === "offer") {
+			this.hostPeer = m.from;
+			const pc = new RTCPeerConnection({ iceServers: m.iceServers || [] });
+			this.pc = pc;
+			pc.onicecandidate = (e) => {
+				if (e.candidate) this.ws.send(JSON.stringify({
+					type: "candidate",
+					to: this.hostPeer,
+					candidate: e.candidate
+				}));
+			};
+			pc.ondatachannel = (e) => {
+				const dc = e.channel;
+				this.dc = dc;
+				dc.binaryType = "arraybuffer";
+				dc.onopen = () => this.enqueueSeal(FLAG_CONFIRM, {
+					t: "confirm",
+					nonce: this.myNonce
+				});
+				dc.onmessage = (ev2) => {
+					this.recvChain = this.recvChain.then(() => this.onFrame(ev2.data)).catch(() => {});
+				};
+			};
+			await pc.setRemoteDescription({
+				type: "offer",
+				sdp: m.sdp
+			});
+			const answer = await pc.createAnswer();
+			await pc.setLocalDescription(answer);
+			this.th = await computeTranscriptHash(m.sdp, pc.localDescription.sdp);
+			const keys = await deriveDirKeys(this.link.s, this.th);
+			this.keyC2H = keys.keyC2H;
+			this.keyH2C = keys.keyH2C;
+			this.ws.send(JSON.stringify({
+				type: "answer",
+				to: this.hostPeer,
+				sdp: pc.localDescription.sdp
+			}));
+		} else if (m.type === "candidate" && this.pc) await this.pc.addIceCandidate(m.candidate).catch(() => {});
+	}
+	enqueueSeal(flags, obj) {
+		this.sendChain = this.sendChain.then(async () => {
+			if (!this.dc || this.dc.readyState !== "open" || !this.keyC2H || !this.th) return;
+			const frame = await seal(this.keyC2H, this.send, flags, this.th, packEnvelope(obj));
+			try {
+				this.dc.send(frame);
+			} catch {}
+		});
+		return this.sendChain;
+	}
+	async onFrame(data) {
+		if (typeof data === "string" || !this.keyH2C || !this.th) return;
+		let env;
+		try {
+			const { plaintext } = await open(this.keyH2C, data, this.th, this.recv);
+			env = unpackEnvelope(plaintext);
+		} catch {
+			return;
+		}
+		if (!this.confirmed) {
+			if (!env || env.t !== "confirm") return;
+			if (typeof env.nonce === "string" && !this.confirmedOut) {
+				await this.enqueueSeal(FLAG_CONFIRM, {
+					t: "confirm",
+					nonce: this.myNonce,
+					echo: env.nonce
+				});
+				this.confirmedOut = true;
+			}
+			if (env.echo && env.echo === this.myNonce) this.confirmedIn = true;
+			if (this.confirmedIn && this.confirmedOut) {
+				this.confirmed = true;
+				this.resolveReady();
+			}
+			return;
+		}
+		if (!env || env.t === "confirm") return;
+		const p = this.pending.get(env.id);
+		if (!p) return;
+		if (env.t === "res") p.onRes(env.status, env.ct);
+		else if (env.t === "data") p.onData(env.chunk);
+		else if (env.t === "end") p.onEnd(env.error);
+	}
+	/**
+	* Issue one request over the channel. Resolves once the response head (status,
+	* content-type) arrives; the body is a ReadableStream fed by `data` frames as
+	* they land, so streaming endpoints (SSE `tail`) flow without buffering.
+	*/
+	request(method, path, body) {
+		const id = String(++this.idCounter);
+		return new Promise((resolve, reject) => {
+			let controller;
+			const enc = new TextEncoder();
+			let head = false;
+			const stream = new ReadableStream({
+				start: (c) => {
+					controller = c;
+				},
+				cancel: () => {
+					this.pending.delete(id);
+					this.enqueueSeal(0, {
+						t: "abort",
+						id
+					});
+				}
+			});
+			this.pending.set(id, {
+				onRes: (status, ct) => {
+					if (!head) {
+						head = true;
+						resolve({
+							status,
+							ct,
+							stream
+						});
+					}
+				},
+				onData: (chunk) => {
+					try {
+						controller.enqueue(enc.encode(chunk));
+					} catch {}
+				},
+				onEnd: (error) => {
+					this.pending.delete(id);
+					if (error) {
+						if (!head) {
+							head = true;
+							reject(new Error(error));
+						}
+						try {
+							controller.error(new Error(error));
+						} catch {}
+					} else try {
+						controller.close();
+					} catch {}
+				}
+			});
+			this.enqueueSeal(0, {
+				t: "req",
+				id,
+				method,
+				path,
+				body
+			});
+		});
+	}
+	close() {
+		try {
+			this.ws.close();
+		} catch {}
+		try {
+			this.pc?.close();
+		} catch {}
+	}
+};
+/**
+* Connect to a share room and start a local HTTP server that forwards every
+* request over the encrypted DataChannel. Returns the loopback base URL the
+* existing remote commands can `fetch()` against. The process owns teardown:
+* `ay` subcommands `process.exit()` when done, which closes the socket/peer.
+*/
+async function startWebrtcBridge(link) {
+	const parsed = parseWebrtcLink(link);
+	if (!parsed) throw new Error(`not a WebRTC share link: ${link}`);
+	const conn = new WebRtcConn(parsed);
+	await conn.ready;
+	const server = Bun.serve({
+		port: 0,
+		hostname: "127.0.0.1",
+		idleTimeout: 0,
+		async fetch(req) {
+			const u = new URL(req.url);
+			const pathWithQuery = u.pathname + u.search;
+			const body = req.method !== "GET" && req.method !== "HEAD" ? await req.text() : void 0;
+			try {
+				const { status, ct, stream } = await conn.request(req.method, pathWithQuery, body);
+				return new Response(stream, {
+					status,
+					headers: ct ? { "content-type": ct } : {}
+				});
+			} catch (e) {
+				return new Response(String(e?.message ?? e), { status: 502 });
+			}
+		}
+	});
+	return {
+		baseUrl: `http://127.0.0.1:${server.port}`,
+		token: "webrtc",
+		close: () => {
+			try {
+				server.stop(true);
+			} catch {}
+			conn.close();
+		}
+	};
+}
+
+//#endregion
+export { startWebrtcBridge };
+//# sourceMappingURL=webrtcRemote-jGM3ZHK3.js.map

package/dist/{workspaceConfig-BCOqRBEW.js → workspaceConfig-B3ylOZAO.js}

@@ -53,4 +53,4 @@ function resolveSpawnCwd(input) {
 
 //#endregion
 export { resolveSpawnCwd as n, setWorkspaceRoot as r, getWorkspaceRoot as t };
-//# sourceMappingURL=workspaceConfig-BCOqRBEW.js.map
+//# sourceMappingURL=workspaceConfig-B3ylOZAO.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-yes",
-  "version": "1.144.0",
+  "version": "1.146.0",
   "description": "A wrapper tool that automates interactions with various AI CLI tools by automatically handling common prompts and responses.",
   "keywords": [
     "ai",

package/ts/remotes.ts

@@ -2,6 +2,7 @@ import { mkdir, readFile, writeFile } from "fs/promises";
 import { homedir } from "os";
 import path from "path";
 import yaml from "yaml";
+import { isWebrtcSpec } from "./webrtcLink.ts";
 
 function remotesPath(): string {
   const dir = process.env.AGENT_YES_HOME ?? path.join(homedir(), ".agent-yes");
@@ -79,6 +80,10 @@ export function parseDirectRemoteSpec(
  * Returns null if the spec doesn't match any remote.
  */
 export async function resolveRemoteSpec(spec: string): Promise<ResolvedRemote | null> {
+  // Inline WebRTC share link: `ay ls webrtc://…` or `ay ls https://…/w/#room:token`.
+  // These carry their own secret and have no keyword (use an alias to add one).
+  if (isWebrtcSpec(spec)) return resolveWebrtc(spec, undefined);
+
   const direct = parseDirectRemoteSpec(spec);
   if (direct) {
     return { url: direct.baseUrl, token: direct.token, keyword: direct.keyword };
@@ -92,9 +97,22 @@ export async function resolveRemoteSpec(spec: string): Promise<ResolvedRemote |
   const remotes = await readRemotes();
   const cfg = remotes.get(alias);
   if (!cfg) return null;
+  // A saved alias may point at a WebRTC link; bridge it just like an inline one.
+  if (isWebrtcSpec(cfg.url)) return resolveWebrtc(cfg.url, keyword);
   return { url: cfg.url, token: cfg.token, keyword };
 }
 
+/**
+ * Start a local HTTP↔WebRTC bridge for a share link and present it as an
+ * ordinary http remote, so every fetch-based remote command works unchanged.
+ * The bridge lives for the rest of the process (torn down on `process.exit`).
+ */
+async function resolveWebrtc(link: string, keyword?: string): Promise<ResolvedRemote> {
+  const { startWebrtcBridge } = await import("./webrtcRemote.ts");
+  const bridge = await startWebrtcBridge(link);
+  return { url: bridge.baseUrl, token: bridge.token, keyword };
+}
+
 // ---------------------------------------------------------------------------
 // ay remote subcommand
 // ---------------------------------------------------------------------------
@@ -108,7 +126,9 @@ export async function cmdRemote(rest: string[]): Promise<number> {
         `Manage saved remote server aliases.\n\n` +
         `Subcommands:\n` +
         `  ay remote ls                                           list configured remotes\n` +
-        `  ay remote add <alias> http://<token>@<host>:<port>    add a remote\n` +
+        `  ay remote add <alias> http://<token>@<host>:<port>    add an http remote\n` +
+        `  ay remote add <alias> webrtc://<room>:<token>@<host>  add a WebRTC share remote\n` +
+        `  ay remote add <alias> https://agent-yes.com/w/#<room>:<token>   (share link form)\n` +
         `  ay remote rm <alias>                                   remove a remote\n\n` +
         `Once added, use the alias anywhere a keyword is accepted:\n` +
         `  ay ls   <alias>\n` +
@@ -145,6 +165,13 @@ export async function cmdRemote(rest: string[]): Promise<number> {
       );
       return 1;
     }
+    // WebRTC share links carry their own secret — store verbatim (token in the link).
+    if (isWebrtcSpec(rawUrl)) {
+      await writeRemoteAlias(alias, { url: rawUrl, token: "" });
+      process.stdout.write(`remote '${alias}' added → ${rawUrl} (webrtc)\n`);
+      process.stderr.write(`\n  ay ls ${alias}            # list agents on ${alias}\n`);
+      return 0;
+    }
     let url: string, token: string;
     try {
       const parsed = new URL(rawUrl);

package/ts/subcommands.ts

@@ -32,6 +32,7 @@ import { invokedCliName } from "./invokedCli.ts";
 import type { AgentCliConfig } from "./index.ts";
 import yargs from "yargs";
 import { type ResolvedRemote, readRemotes, resolveRemoteSpec } from "./remotes.ts";
+import { isWebrtcSpec } from "./webrtcLink.ts";
 
 // ---------------------------------------------------------------------------
 // notes store  (~/.agent-yes/notes.jsonl)
@@ -865,15 +866,27 @@ async function fetchRemoteRecordsRaw(
   if (opts.all) params.set("all", "1");
   if (opts.active) params.set("active", "1");
   if (opts.keyword) params.set("keyword", opts.keyword);
+  // WebRTC remotes have no http port — bridge them, then fetch the loopback URL.
+  let bridge: { baseUrl: string; token: string; close: () => void } | null = null;
   try {
-    const res = await fetch(`${url}/api/ls?${params}`, {
-      headers: { Authorization: `Bearer ${token}` },
-      signal: AbortSignal.timeout(5000),
+    let base = url;
+    let bearer = token;
+    if (isWebrtcSpec(url)) {
+      const { startWebrtcBridge } = await import("./webrtcRemote.ts");
+      bridge = await startWebrtcBridge(url);
+      base = bridge.baseUrl;
+      bearer = bridge.token;
+    }
+    const res = await fetch(`${base}/api/ls?${params}`, {
+      headers: { Authorization: `Bearer ${bearer}` },
+      signal: AbortSignal.timeout(8000),
     });
     if (!res.ok) return [];
     return (await res.json()) as any[];
   } catch {
     return [];
+  } finally {
+    bridge?.close();
   }
 }
 

package/ts/webrtcLink.spec.ts

@@ -0,0 +1,45 @@
+import { describe, expect, it } from "vitest";
+import { DEFAULT_SIGHOST, isWebrtcSpec, parseWebrtcLink } from "./webrtcLink.ts";
+
+// A representative v2 share secret (e1.<64 hex>); parseSecret keeps the hex `s`.
+const SECRET = "e1.982610a3034f065bfe9700037b306a6afeb7dc48567064058e6c4bbc09e502c2";
+
+describe("isWebrtcSpec", () => {
+  it("accepts webrtc:// links", () => {
+    expect(isWebrtcSpec(`webrtc://r1:${SECRET}@s.agent-yes.com`)).toBe(true);
+  });
+  it("accepts https share links (have a # fragment)", () => {
+    expect(isWebrtcSpec(`https://agent-yes.com/w/#r1:${SECRET}`)).toBe(true);
+    expect(isWebrtcSpec(`http://localhost:8080/w/#r1:${SECRET}`)).toBe(true);
+  });
+  it("rejects http remotes and bare aliases", () => {
+    expect(isWebrtcSpec("token@192.168.1.5:7432")).toBe(false);
+    expect(isWebrtcSpec("work-mac")).toBe(false);
+    expect(isWebrtcSpec("work-mac:claude")).toBe(false);
+    expect(isWebrtcSpec("http://192.168.1.5:7432")).toBe(false); // no fragment
+  });
+});
+
+describe("parseWebrtcLink", () => {
+  it("parses webrtc://room:token@host", () => {
+    const r = parseWebrtcLink(`webrtc://r223104:${SECRET}@example.com`);
+    expect(r).toEqual({ room: "r223104", s: expect.any(String), host: "example.com" });
+    expect(r!.s.length).toBeGreaterThan(0);
+  });
+
+  it("parses an https share link and defaults the signaling host", () => {
+    const r = parseWebrtcLink(`https://agent-yes.com/w/#r223104:${SECRET}`);
+    expect(r).toMatchObject({ room: "r223104", host: DEFAULT_SIGHOST });
+  });
+
+  it("honors an explicit @sighost in the fragment", () => {
+    const r = parseWebrtcLink(`https://agent-yes.com/w/#r1:${SECRET}@sig.example.com`);
+    expect(r).toMatchObject({ room: "r1", host: "sig.example.com" });
+  });
+
+  it("returns null for non-share strings and malformed fragments", () => {
+    expect(parseWebrtcLink("token@host:7432")).toBeNull();
+    expect(parseWebrtcLink("just-an-alias")).toBeNull();
+    expect(parseWebrtcLink("https://agent-yes.com/w/#noColonHere")).toBeNull();
+  });
+});

package/ts/webrtcLink.ts

@@ -0,0 +1,45 @@
+// Pure parsing/detection for WebRTC share links. Kept free of node-datachannel
+// (the native WebRTC dep) so callers — and resolveRemoteSpec on every remote
+// command — can detect/parse a link without loading the native module, and so
+// the helpers stay unit-testable. The actual connection lives in webrtcRemote.ts.
+import { parseSecret } from "../lab/ui/e2e.js";
+
+export const SIGNAL_SUBPROTOCOL = "ay-signal-1";
+export const DEFAULT_SIGHOST = "s.agent-yes.com";
+
+export interface WebrtcLink {
+  room: string;
+  s: string;
+  host: string;
+}
+
+/**
+ * Parse a share link into { room, secret, signaling-host }. Accepts:
+ *   webrtc://<room>:<token>@<host>
+ *   https://<anyhost>/w/#<room>:<token>            (signaling host defaults to s.agent-yes.com)
+ *   https://<anyhost>/w/#<room>:<token>@<sighost>  (explicit signaling host)
+ * Returns null if the string isn't a recognizable share link.
+ */
+export function parseWebrtcLink(link: string): WebrtcLink | null {
+  const wr = /^webrtc:\/\/([^:]+):([^@]+)@(.+)$/.exec(link);
+  if (wr) {
+    const { s } = parseSecret(wr[2]!);
+    return { room: wr[1]!, s, host: wr[3]! };
+  }
+  if (/^https?:\/\//.test(link) && link.includes("#")) {
+    const frag = link.split("#")[1] ?? "";
+    const at = frag.split("@");
+    const host = at[1] || DEFAULT_SIGHOST;
+    const seg = at[0]!;
+    const i = seg.indexOf(":");
+    if (i < 0) return null;
+    const { s } = parseSecret(seg.slice(i + 1));
+    return { room: seg.slice(0, i), s, host };
+  }
+  return null;
+}
+
+/** True if `spec` looks like a WebRTC share link (vs. an http remote or alias). */
+export function isWebrtcSpec(spec: string): boolean {
+  return spec.startsWith("webrtc://") || (/^https?:\/\//.test(spec) && spec.includes("#"));
+}