agent-yes 1.175.1 → 1.176.0

package/dist/{serve-DgQjFYQC.js → serve-B5PQdiOb.js}

@@ -1,26 +1,26 @@
-import "./ts-PerHq0yJ.js";
+import "./ts-Ce7a44Rj.js";
 import "./logger-CDIsZ-Pp.js";
-import { r as getInstalledPackage } from "./versionChecker-CfZx87hW.js";
-import { t as findSpawnHiddenLauncher } from "./rustBinary-DSN5ekb5.js";
+import { r as getInstalledPackage } from "./versionChecker-C7C7QAPu.js";
+import { t as findSpawnHiddenLauncher } from "./rustBinary-DZTU07SA.js";
 import "./pidStore-BIvsBQ8X.js";
 import { a as updateGlobalPidStatus } from "./globalPidIndex-CoNr7tS8.js";
 import { t as pgidForWrapper } from "./reaper-CWF2_ATd.js";
 import "./configShared-0MnIQ652.js";
-import { t as SUPPORTED_CLIS } from "./SUPPORTED_CLIS-DH7pORiR.js";
-import { A as resolveOne, E as readPtysize, F as snapshotStatus, H as TYPING_BADGE, O as renderRawLog, S as listRecords, T as readNotes, V as writeToIpc, b as isUserTyping, f as extractNeedsInput, l as deriveLiveStatus, o as controlCodeFromName, p as extractTaskCounts, u as extractBadges } from "./subcommands-DjA3FgJk.js";
-import "./e2e-jb0Hp43q.js";
-import "./webrtcLink-B7REGtK2.js";
-import "./remotes-CC-4GuJb.js";
-import { a as getSpawnHook, c as hasProvisionHook, d as resolveSpawnCwd, i as getProvisionRoot, l as hasSpawnHook, r as getProvisionHook, u as isProvisionAllowed } from "./workspaceConfig-BgqK-31W.js";
-import { r as spawnRejectionReason } from "./spawnGate-IJDByl2U.js";
+import { t as SUPPORTED_CLIS } from "./SUPPORTED_CLIS-TMmgX_p6.js";
+import { $ as TYPING_BADGE, D as recentReadEdges, E as readPtysize, H as writeToIpc, I as snapshotStatus, S as listRecords, T as readNotes, b as isUserTyping, f as extractNeedsInput, j as resolveOne, k as renderRawLog, l as deriveLiveStatus, o as controlCodeFromName, p as extractTaskCounts, u as extractBadges } from "./subcommands-BbSJ_nTU.js";
+import "./e2e-BeKjLhmO.js";
+import "./webrtcLink-BG0Xc4-W.js";
+import "./remotes-DsTnQhyx.js";
+import { a as getSpawnHook, c as hasProvisionHook, d as resolveSpawnCwd, i as getProvisionRoot, l as hasSpawnHook, r as getProvisionHook, u as isProvisionAllowed } from "./workspaceConfig-DKd6UvVm.js";
+import { r as spawnRejectionReason } from "./spawnGate-Clp9xBPX.js";
 import yargs from "yargs";
 import { mkdir, open, readFile, stat, unlink, writeFile } from "fs/promises";
 import { homedir, hostname, userInfo } from "os";
 import path from "path";
 import { execFileSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
-import { renameSync, watch, writeFileSync } from "node:fs";
 import { randomBytes, timingSafeEqual } from "crypto";
+import { renameSync, watch, writeFileSync } from "node:fs";
 
 //#region ts/serve.ts
 const DEFAULT_PORT = 7432;
@@ -478,7 +478,7 @@ async function cmdServeDaemon(sub, args) {
 		let shareLink = null;
 		let shareLinkMinted = false;
 		if (webrtcDaemon) try {
-			const { loadOrCreateShareRoom, shareLinkFromRoomUrl } = await import("./share-QregR8a_.js");
+			const { loadOrCreateShareRoom, shareLinkFromRoomUrl } = await import("./share-nvqy64A2.js");
 			const explicit = explicitWebrtcUrl(effArgs);
 			shareLink = shareLinkFromRoomUrl(explicit ?? await loadOrCreateShareRoom());
 			shareLinkMinted = !explicit;
@@ -487,7 +487,7 @@ async function cmdServeDaemon(sub, args) {
 			if (!webrtcDaemon) return;
 			if (shareLink) {
 				process.stdout.write(`\nshared over WebRTC — open this link (the token is eaten from the URL on open):\n  ${shareLink}\n` + (shareLinkMinted ? `  (persistent room — same link across restarts; delete ~/.agent-yes/.share-room to rotate)\n` : ``));
-				const { offerOpenInBrowser } = await import("./openBrowser-ChR4llYa.js");
+				const { offerOpenInBrowser } = await import("./openBrowser-BO5RVYwL.js");
 				await offerOpenInBrowser(shareLink);
 			} else process.stdout.write("\nthe WebRTC share link carries a secret, so the daemon does NOT log it —\nread it from ~/.agent-yes/.share-link (mode 0600). The room persists in\n~/.agent-yes/.share-room, so the link survives restarts.\n");
 		};
@@ -767,6 +767,7 @@ Options:
 				const oscTitleRe = /\x1b\][02];([^\x07\x1b]*)(?:\x07|\x1b\\)/g;
 				let title = null;
 				for (let m; m = oscTitleRe.exec(text);) if (m[1].trim()) title = m[1].trim();
+				if (title) title = title.replace(/[\x00-\x1f\x7f-\x9f]/g, "").slice(0, 256).trim() || null;
 				titleCache.set(logFile, {
 					size,
 					mtimeMs,
@@ -1072,6 +1073,11 @@ Options:
 				Connection: "keep-alive"
 			} });
 		}
+		if (req.method === "GET" && p === "/api/edges") try {
+			return Response.json({ reads: await recentReadEdges() });
+		} catch (e) {
+			return new Response(e.message, { status: 500 });
+		}
 		if (req.method === "GET" && p === "/api/whoami") {
 			let user = "";
 			try {
@@ -1148,69 +1154,77 @@ Options:
 				const record = await resolveOne(keyword, defaultOpts());
 				if (!record.log_file) return new Response(`pid ${record.pid}: no log_file`, { status: 404 });
 				const logPath = record.log_file;
-				const stream = new ReadableStream({ async start(ctrl) {
-					const enc = new TextEncoder();
-					const send = (text) => ctrl.enqueue(enc.encode(`data: ${JSON.stringify(text)}\n\n`));
-					const ping = () => ctrl.enqueue(enc.encode(": ping\n\n"));
-					const initBuf = await readFile(logPath).catch(() => Buffer.alloc(0));
-					if (raw) send(new TextDecoder().decode(initBuf.slice(Math.max(0, initBuf.length - 65536))));
-					else send(await renderRawLog(initBuf, {
-						mode: "tail",
-						n: 96
-					}));
-					let offset = initBuf.length;
-					let closed = false;
-					const heartbeat = setInterval(() => {
-						if (closed) {
-							clearInterval(heartbeat);
-							return;
-						}
-						ping();
-					}, 15e3);
-					const ansiRe = /\x1b\[[0-?]*[ -/]*[@-~]|\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)|\x1b[@-Z\\-_]/g;
-					const ctrlRe = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g;
-					const fh = await open(logPath, "r").catch(() => null);
-					let reading = false;
-					const flush = async () => {
-						if (closed || reading || !fh) return;
-						reading = true;
-						try {
-							const { size } = await fh.stat();
-							if (size < offset) offset = size;
-							if (size > offset) {
-								const len = size - offset;
-								const buf = Buffer.allocUnsafe(len);
-								const { bytesRead } = await fh.read(buf, 0, len, offset);
-								offset += bytesRead;
-								const chunk = buf.subarray(0, bytesRead);
-								if (raw) send(new TextDecoder().decode(chunk));
-								else {
-									const text = new TextDecoder().decode(chunk).replace(ansiRe, "").replace(ctrlRe, "");
-									if (text.trim()) send(text.trimStart());
+				let cleanup = () => {};
+				const stream = new ReadableStream({
+					async start(ctrl) {
+						const enc = new TextEncoder();
+						const send = (text) => ctrl.enqueue(enc.encode(`data: ${JSON.stringify(text)}\n\n`));
+						const ping = () => ctrl.enqueue(enc.encode(": ping\n\n"));
+						const initBuf = await readFile(logPath).catch(() => Buffer.alloc(0));
+						if (raw) send(new TextDecoder().decode(initBuf.slice(Math.max(0, initBuf.length - 65536))));
+						else send(await renderRawLog(initBuf, {
+							mode: "tail",
+							n: 96
+						}));
+						let offset = initBuf.length;
+						let closed = false;
+						const heartbeat = setInterval(() => {
+							if (closed) {
+								clearInterval(heartbeat);
+								return;
+							}
+							ping();
+						}, 15e3);
+						const ansiRe = /\x1b\[[0-?]*[ -/]*[@-~]|\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)|\x1b[@-Z\\-_]/g;
+						const ctrlRe = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g;
+						const fh = await open(logPath, "r").catch(() => null);
+						let reading = false;
+						const flush = async () => {
+							if (closed || reading || !fh) return;
+							reading = true;
+							try {
+								const { size } = await fh.stat();
+								if (size < offset) offset = size;
+								if (size > offset) {
+									const len = size - offset;
+									const buf = Buffer.allocUnsafe(len);
+									const { bytesRead } = await fh.read(buf, 0, len, offset);
+									offset += bytesRead;
+									const chunk = buf.subarray(0, bytesRead);
+									if (raw) send(new TextDecoder().decode(chunk));
+									else {
+										const text = new TextDecoder().decode(chunk).replace(ansiRe, "").replace(ctrlRe, "");
+										if (text.trim()) send(text.trimStart());
+									}
 								}
+							} catch {} finally {
+								reading = false;
 							}
-						} catch {} finally {
-							reading = false;
-						}
-					};
-					let watcher = null;
-					try {
-						watcher = watch(logPath, () => void flush());
-					} catch {}
-					const poller = setInterval(() => void flush(), 60);
-					req.signal.addEventListener("abort", () => {
-						closed = true;
-						clearInterval(heartbeat);
-						clearInterval(poller);
-						try {
-							watcher?.close();
-						} catch {}
-						fh?.close().catch(() => {});
+						};
+						let watcher = null;
 						try {
-							ctrl.close();
+							watcher = watch(logPath, () => void flush());
 						} catch {}
-					});
-				} });
+						const poller = setInterval(() => void flush(), watcher ? 500 : 60);
+						cleanup = () => {
+							if (closed) return;
+							closed = true;
+							clearInterval(heartbeat);
+							clearInterval(poller);
+							try {
+								watcher?.close();
+							} catch {}
+							fh?.close().catch(() => {});
+							try {
+								ctrl.close();
+							} catch {}
+						};
+						req.signal.addEventListener("abort", cleanup);
+					},
+					cancel() {
+						cleanup();
+					}
+				});
 				return new Response(stream, { headers: {
 					"Content-Type": "text/event-stream",
 					"Cache-Control": "no-cache",
@@ -1558,13 +1572,64 @@ Options:
 				return new Response(e.message, { status: 500 });
 			}
 		}
+		if (req.method === "POST" && p === "/api/share") {
+			let body;
+			try {
+				body = await req.json();
+			} catch {
+				return new Response("invalid JSON body", { status: 400 });
+			}
+			if (!body.agent) return new Response("agent required", { status: 400 });
+			const perm = body.perm ?? "r";
+			if (perm !== "r" && perm !== "rw") return new Response(`invalid perm ${perm} (want r or rw)`, { status: 400 });
+			try {
+				const { createScopedShare } = await import("./agentShare-DRfghQz8.js");
+				const share = await createScopedShare({
+					agent: body.agent,
+					perm,
+					localFetch: apiFetch,
+					apiToken: token
+				});
+				return Response.json(share);
+			} catch (e) {
+				const msg = e.message;
+				const status = /too many active shares/.test(msg) ? 409 : /no agent matched|no stable/.test(msg) ? 404 : 500;
+				return new Response(msg, { status });
+			}
+		}
+		if (req.method === "GET" && p === "/api/shares") {
+			const { listShares } = await import("./agentShare-DRfghQz8.js");
+			return Response.json(listShares());
+		}
+		const revokeM = /^\/api\/share\/([^/]+)$/.exec(p);
+		if (req.method === "DELETE" && revokeM) {
+			const { revokeShare } = await import("./agentShare-DRfghQz8.js");
+			const ok = revokeShare(decodeURIComponent(revokeM[1]));
+			return new Response(ok ? "revoked" : "no such share", { status: ok ? 200 : 404 });
+		}
 		return new Response("Not Found", { status: 404 });
 	};
 	const uiDir = path.join(path.dirname(fileURLToPath(import.meta.url)), "..", "lab", "ui");
+	const CONSOLE_CSP = [
+		"default-src 'self'",
+		"base-uri 'none'",
+		"object-src 'none'",
+		"frame-ancestors 'none'",
+		"form-action 'self'",
+		"img-src 'self' data:",
+		"font-src 'self' data:",
+		"style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net",
+		"script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net",
+		"connect-src 'self' https://s.agent-yes.com https://agent-yes.com wss:",
+		"worker-src 'self'",
+		"manifest-src 'self'"
+	].join("; ");
 	const serveUiFile = async (name, type) => {
 		try {
 			const buf = await readFile(path.join(uiDir, name));
-			return new Response(buf, { headers: { "Content-Type": type } });
+			const headers = { "Content-Type": type };
+			if (type.includes("text/html")) headers["Content-Security-Policy"] = CONSOLE_CSP;
+			return new Response(buf, { headers });
 		} catch {
 			return new Response("UI assets not found in this install — use the /api endpoints", { status: 404 });
 		}
@@ -1575,6 +1640,7 @@ Options:
 		if (req.method === "GET" && p === "/room-client.js") return serveUiFile("room-client.js", "text/javascript; charset=utf-8");
 		if (req.method === "GET" && p === "/console-logic.js") return serveUiFile("console-logic.js", "text/javascript; charset=utf-8");
 		if (req.method === "GET" && p === "/e2e.js") return serveUiFile("e2e.js", "text/javascript; charset=utf-8");
+		if (req.method === "GET" && p === "/qrcode.js") return serveUiFile("qrcode.js", "text/javascript; charset=utf-8");
 		if (req.method === "GET" && p === "/favicon.ico") return new Response(null, { status: 204 });
 		return apiFetch(req);
 	};
@@ -1630,7 +1696,7 @@ Options:
 		const webrtcVal = argv.webrtc ?? argv.share;
 		const explicitUrl = typeof webrtcVal === "string" && webrtcVal.startsWith("webrtc://") ? webrtcVal : void 0;
 		try {
-			const { startShare, loadOrCreateShareRoom } = await import("./share-QregR8a_.js");
+			const { startShare, loadOrCreateShareRoom } = await import("./share-nvqy64A2.js");
 			const linkFile = path.join(process.env.AGENT_YES_HOME ?? path.join(homedir(), ".agent-yes"), ".share-link");
 			const announce = async (room, link, rotated) => {
 				const lead = rotated ? "the room was rejected by signaling (stale generation) — rotated to a fresh link" : "shared over WebRTC — open this link (the token is eaten from the URL on open)";
@@ -1638,7 +1704,7 @@ Options:
 					const persistNote = explicitUrl ? "\n" : `  (persistent room — same link across restarts; delete ~/.agent-yes/.share-room to rotate)\n\n`;
 					process.stdout.write(`${wantHttp ? "\n" : ""}${lead}:\n  ${link}\n` + persistNote);
 					if (!rotated) {
-						const { offerOpenInBrowser } = await import("./openBrowser-ChR4llYa.js");
+						const { offerOpenInBrowser } = await import("./openBrowser-BO5RVYwL.js");
 						await offerOpenInBrowser(link);
 					}
 				} else {
@@ -1677,6 +1743,7 @@ Options:
 	const shutdown = (resolve) => {
 		if (heartbeat) clearInterval(heartbeat);
 		closeShare?.();
+		import("./agentShare-DRfghQz8.js").then((m) => m.revokeAllShares()).catch(() => {});
 		server?.stop();
 		resolve();
 	};
@@ -1689,4 +1756,4 @@ Options:
 
 //#endregion
 export { cmdServe };
-//# sourceMappingURL=serve-DgQjFYQC.js.map
+//# sourceMappingURL=serve-B5PQdiOb.js.map

package/dist/{setup-DHVydU-j.js → setup-BCqFNJoB.js}

@@ -1,4 +1,4 @@
-import { f as setWorkspaceRoot, s as getWorkspaceRoot } from "./workspaceConfig-BgqK-31W.js";
+import { f as setWorkspaceRoot, s as getWorkspaceRoot } from "./workspaceConfig-DKd6UvVm.js";
 import { existsSync } from "node:fs";
 import { stdin, stdout } from "node:process";
 import { createInterface } from "node:readline/promises";
@@ -32,7 +32,7 @@ async function cmdSetup(rest) {
 	if (!existsSync(abs)) process.stderr.write(`  note: that directory doesn't exist yet — create it, or agents spawned there will fail\n`);
 	if (noShare) return 0;
 	process.stdout.write(`\nsharing this machine to agent-yes.com…\n`);
-	const { cmdServe } = await import("./serve-DgQjFYQC.js");
+	const { cmdServe } = await import("./serve-B5PQdiOb.js");
 	return cmdServe([
 		"install",
 		"--share",
@@ -42,4 +42,4 @@ async function cmdSetup(rest) {
 
 //#endregion
 export { cmdSetup };
-//# sourceMappingURL=setup-DHVydU-j.js.map
+//# sourceMappingURL=setup-BCqFNJoB.js.map

package/dist/{share-QregR8a_.js → share-29YbzpbU.js}

@@ -1,4 +1,4 @@
-import { a as computeTranscriptHash, c as open$1, d as randomHex, f as seal, i as MAX_CHUNK, l as packEnvelope, n as FLAG_CONFIRM, o as deriveAuthToken, p as unpackEnvelope, r as MARKER, s as deriveDirKeys, t as CONFIRM_TIMEOUT_MS, u as parseSecret } from "./e2e-jb0Hp43q.js";
+import { a as computeTranscriptHash, c as open$1, d as randomHex, f as seal, i as MAX_CHUNK, l as packEnvelope, n as FLAG_CONFIRM, o as deriveAuthToken, p as unpackEnvelope, r as MARKER, s as deriveDirKeys, t as CONFIRM_TIMEOUT_MS, u as parseSecret } from "./e2e-BeKjLhmO.js";
 import { mkdir, readFile, writeFile } from "fs/promises";
 import { homedir } from "os";
 import path from "path";
@@ -58,7 +58,7 @@ async function loadOrCreateShareRoom(sighost = DEFAULT_SIGHOST) {
 			if (parseShareUrl(url).token.startsWith(MARKER)) return url;
 		}
 	} catch {}
-	const url = `webrtc://${"r" + randomBytes(3).toString("hex")}:${MARKER}${randomBytes(32).toString("hex")}@${sighost}`;
+	const url = `webrtc://${"r" + randomBytes(6).toString("hex")}:${MARKER}${randomBytes(32).toString("hex")}@${sighost}`;
 	await mkdir(path.dirname(shareRoomPath()), { recursive: true });
 	await writeFile(shareRoomPath(), url, { mode: 384 });
 	return url;
@@ -146,7 +146,7 @@ async function startShare(opts) {
 	opts.url;
 	const sighost = opts.sighost ?? DEFAULT_SIGHOST;
 	const initial = opts.url ? parseShareUrl(opts.url) : {
-		room: "r" + randomBytes(3).toString("hex"),
+		room: "r" + randomBytes(6).toString("hex"),
 		token: `${MARKER}${randomBytes(32).toString("hex")}`,
 		host: sighost
 	};
@@ -165,7 +165,7 @@ async function startShare(opts) {
 	const rotate = async () => {
 		if (!opts.onRotate || closed || rotateCount >= 5) return false;
 		rotateCount++;
-		room = "r" + randomBytes(3).toString("hex");
+		room = "r" + randomBytes(6).toString("hex");
 		token = `${MARKER}${randomBytes(32).toString("hex")}`;
 		S = parseSecret(token).s;
 		authToken = await deriveAuthToken(S, room, host);
@@ -533,5 +533,5 @@ async function startShare(opts) {
 }
 
 //#endregion
-export { loadOrCreateShareRoom, shareLinkFromRoomUrl, startShare };
-//# sourceMappingURL=share-QregR8a_.js.map
+export { shareLinkFromRoomUrl as n, startShare as r, loadOrCreateShareRoom as t };
+//# sourceMappingURL=share-29YbzpbU.js.map

package/dist/share-nvqy64A2.js

@@ -0,0 +1,4 @@
+import "./e2e-BeKjLhmO.js";
+import { n as shareLinkFromRoomUrl, r as startShare, t as loadOrCreateShareRoom } from "./share-29YbzpbU.js";
+
+export { loadOrCreateShareRoom, shareLinkFromRoomUrl, startShare };

package/dist/{spawnGate-BFhva-2F.js → spawnGate-C5nBiUZQ.js}

@@ -1,5 +1,5 @@
 import "./logger-CDIsZ-Pp.js";
 import "./globalPidIndex-CoNr7tS8.js";
-import { i as waitForSpawnCapacity, n as spawnGateEnabled, r as spawnRejectionReason, t as memAvailableMb } from "./spawnGate-IJDByl2U.js";
+import { i as waitForSpawnCapacity, n as spawnGateEnabled, r as spawnRejectionReason, t as memAvailableMb } from "./spawnGate-Clp9xBPX.js";
 
 export { waitForSpawnCapacity };

package/dist/{spawnGate-IJDByl2U.js → spawnGate-Clp9xBPX.js}

@@ -1,5 +1,5 @@
 import { i as readGlobalPids } from "./globalPidIndex-CoNr7tS8.js";
-import { n as getMinFreeMb, o as getSpawnWaitMs, t as getMaxAgents } from "./workspaceConfig-BgqK-31W.js";
+import { n as getMinFreeMb, o as getSpawnWaitMs, t as getMaxAgents } from "./workspaceConfig-DKd6UvVm.js";
 import { readFile } from "fs/promises";
 
 //#region ts/spawnGate.ts
@@ -104,4 +104,4 @@ async function waitForSpawnCapacity(opts) {
 
 //#endregion
 export { waitForSpawnCapacity as i, spawnGateEnabled as n, spawnRejectionReason as r, memAvailableMb as t };
-//# sourceMappingURL=spawnGate-IJDByl2U.js.map
+//# sourceMappingURL=spawnGate-Clp9xBPX.js.map