agent-yes 1.189.1 → 1.191.0

package/dist/SUPPORTED_CLIS-P3I0D3Ka.js

@@ -0,0 +1,8 @@
+import "./ts-BQh1-ljE.js";
+import "./logger-CDIsZ-Pp.js";
+import "./versionChecker-DhCi7ncH.js";
+import "./pidStore-BIvsBQ8X.js";
+import "./globalPidIndex-CoNr7tS8.js";
+import { t as SUPPORTED_CLIS } from "./SUPPORTED_CLIS-mUaQHk4M.js";
+
+export { SUPPORTED_CLIS };

package/dist/{SUPPORTED_CLIS-DcA00P5Z.js → SUPPORTED_CLIS-mUaQHk4M.js}

@@ -1,8 +1,8 @@
-import { t as CLIS_CONFIG } from "./ts-1qx-QhAe.js";
+import { t as CLIS_CONFIG } from "./ts-BQh1-ljE.js";
 
 //#region ts/SUPPORTED_CLIS.ts
 const SUPPORTED_CLIS = Object.keys(CLIS_CONFIG);
 
 //#endregion
 export { SUPPORTED_CLIS as t };
-//# sourceMappingURL=SUPPORTED_CLIS-DcA00P5Z.js.map
+//# sourceMappingURL=SUPPORTED_CLIS-mUaQHk4M.js.map

package/dist/{agentShare-D5qYAXeL.js → agentShare-Boa9P2dK.js}

@@ -1,10 +1,10 @@
 import "./logger-CDIsZ-Pp.js";
 import "./globalPidIndex-CoNr7tS8.js";
 import "./configShared-0MnIQ652.js";
-import { j as resolveOne } from "./subcommands-BYKJkWNP.js";
+import { j as resolveOne } from "./subcommands-CNCgJ48t.js";
 import "./e2e-BeKjLhmO.js";
 import "./webrtcLink-BG0Xc4-W.js";
-import "./remotes-DsTnQhyx.js";
+import "./remotes-CgT91bMo.js";
 import { r as startShare } from "./share-29YbzpbU.js";
 
 //#region ts/agentShare.ts
@@ -228,4 +228,4 @@ function transformEvent(rawEvent, agentId, forwarded) {
 
 //#endregion
 export { createScopedShare, listShares, revokeAllShares, revokeShare };
-//# sourceMappingURL=agentShare-D5qYAXeL.js.map
+//# sourceMappingURL=agentShare-Boa9P2dK.js.map

package/dist/cli.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env bun
 import { t as invokedCliName } from "./invokedCli-uqM2YYA7.js";
 import { n as logger } from "./logger-CDIsZ-Pp.js";
-import { i as versionString, n as displayVersion, t as checkAndAutoUpdate } from "./versionChecker-Do5ex5Wm.js";
-import { n as getRustBinary } from "./rustBinary-xhXsfVn-.js";
+import { i as versionString, n as displayVersion, t as checkAndAutoUpdate } from "./versionChecker-DhCi7ncH.js";
+import { n as getRustBinary } from "./rustBinary-Cu8q2m9s.js";
 import { argv } from "process";
 import { spawn } from "child_process";
 import ms from "ms";
@@ -285,7 +285,7 @@ function buildRustArgs(argv, cliFromScript, supportedClis) {
 	const rawArg = process.argv[2];
 	const managerCommands = !invokedCliName(process.argv);
 	const isHelpFlag = rawArg === "-h" || rawArg === "--help";
-	const { isSubcommand, runSubcommand, cmdHelp } = await import("./subcommands-qe4h_Cvx.js");
+	const { isSubcommand, runSubcommand, cmdHelp } = await import("./subcommands-Uerol8Tz.js");
 	if (isHelpFlag && process.argv.length === 3) {
 		await cmdHelp(managerCommands);
 		process.exit(0);
@@ -299,16 +299,16 @@ await checkAndAutoUpdate();
 logger.info(versionString());
 const config = parseCliArgs(process.argv);
 if (config.tray) {
-	const { startTray } = await import("./tray-DKwVRBwr.js");
+	const { startTray } = await import("./tray-PMOWFOfk.js");
 	await startTray();
 	await new Promise(() => {});
 }
 {
-	const { ensureTray } = await import("./tray-DKwVRBwr.js");
+	const { ensureTray } = await import("./tray-PMOWFOfk.js");
 	ensureTray();
 }
 if (!config.showVersion && !config.appendPrompt && !config.tray) {
-	const { waitForSpawnCapacity } = await import("./spawnGate-C5nBiUZQ.js");
+	const { waitForSpawnCapacity } = await import("./spawnGate-BejtWiMJ.js");
 	await waitForSpawnCapacity({
 		onWait: (reason, waitedMs) => {
 			if (config.verbose || waitedMs === 0) console.error(`[agent-yes] spawn gate: ${reason} — waiting…`);
@@ -327,14 +327,14 @@ if (config.useRust) {
 		}
 	}
 	if (rustBinary) {
-		const { SUPPORTED_CLIS } = await import("./SUPPORTED_CLIS-D8ocFVqe.js");
+		const { SUPPORTED_CLIS } = await import("./SUPPORTED_CLIS-P3I0D3Ka.js");
 		const rustArgs = buildRustArgs(process.argv, config.cli, SUPPORTED_CLIS);
 		if (config.verbose) {
 			console.log(`[rust] Using binary: ${rustBinary}`);
 			console.log(`[rust] Args: ${rustArgs.join(" ")}`);
 		}
 		const attach = config.attach || process.env.AGENT_YES_ATTACH === "1";
-		const { shouldForkNested, buildSpawnTutorial, waitForFifo } = await import("./forkNested-C8q7E6mp.js");
+		const { shouldForkNested, buildSpawnTutorial, waitForFifo } = await import("./forkNested-C1kKsXi5.js");
 		if (shouldForkNested({
 			isTTY: Boolean(process.stdout.isTTY),
 			ayPid: process.env.AGENT_YES_PID,

package/dist/expose-B3AGhVhM.js

@@ -0,0 +1,549 @@
+import { createHash, randomBytes } from "node:crypto";
+import { homedir } from "node:os";
+import path from "node:path";
+import { chmodSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+
+//#region node_modules/codehost/src/tunnel/protocol.ts
+let Op = /* @__PURE__ */ function(Op) {
+	Op[Op["HttpReq"] = 1] = "HttpReq";
+	Op[Op["HttpReqBody"] = 2] = "HttpReqBody";
+	Op[Op["HttpReqEnd"] = 3] = "HttpReqEnd";
+	Op[Op["HttpResHead"] = 4] = "HttpResHead";
+	Op[Op["HttpResBody"] = 5] = "HttpResBody";
+	Op[Op["HttpResEnd"] = 6] = "HttpResEnd";
+	Op[Op["WsOpen"] = 7] = "WsOpen";
+	Op[Op["WsText"] = 9] = "WsText";
+	Op[Op["WsBin"] = 10] = "WsBin";
+	Op[Op["WsClose"] = 11] = "WsClose";
+	Op[Op["WsOpenAck"] = 8] = "WsOpenAck";
+	Op[Op["Error"] = 12] = "Error";
+	Op[Op["WsCont"] = 13] = "WsCont";
+	return Op;
+}({});
+const FRAME_HEADER = 5;
+const MAX_FRAME = 64 * 1024;
+/** Max payload bytes per frame; larger bodies/messages are split across frames. */
+const MAX_CHUNK = MAX_FRAME - FRAME_HEADER;
+const enc = new TextEncoder();
+const dec = new TextDecoder();
+function encodeFrame(op, streamId, payload) {
+	const len = payload?.byteLength ?? 0;
+	const buf = new Uint8Array(5 + len);
+	buf[0] = op;
+	new DataView(buf.buffer).setUint32(1, streamId >>> 0, false);
+	if (payload && len) buf.set(payload, 5);
+	return buf;
+}
+function encodeJson(op, streamId, obj) {
+	return encodeFrame(op, streamId, enc.encode(JSON.stringify(obj)));
+}
+function decodeFrame(data) {
+	const u8 = data instanceof Uint8Array ? data : new Uint8Array(data);
+	return {
+		op: u8[0],
+		streamId: new DataView(u8.buffer, u8.byteOffset, u8.byteLength).getUint32(1, false),
+		payload: u8.subarray(5)
+	};
+}
+function payloadJson(payload) {
+	return JSON.parse(dec.decode(payload));
+}
+/** Split a body into MAX_CHUNK-sized slices (copies, safe to transfer). */
+function* chunk(body) {
+	for (let off = 0; off < body.byteLength; off += MAX_CHUNK) yield body.slice(off, Math.min(off + MAX_CHUNK, body.byteLength));
+}
+function concatBytes(parts) {
+	if (parts.length === 1) return parts[0];
+	const total = parts.reduce((n, p) => n + p.byteLength, 0);
+	const out = new Uint8Array(total);
+	let off = 0;
+	for (const p of parts) {
+		out.set(p, off);
+		off += p.byteLength;
+	}
+	return out;
+}
+/**
+* Frames for one WebSocket message. Messages that fit in a single frame emit
+* just a WsText/WsBin frame (back-compatible). Larger ones are split into
+* WsCont frames carrying the leading bytes, terminated by the WsText/WsBin
+* frame with the final bytes; the receiver concatenates them in order.
+*/
+function* wsMessageFrames(terminal, streamId, payload) {
+	let off = 0;
+	while (payload.byteLength - off > MAX_CHUNK) {
+		yield encodeFrame(Op.WsCont, streamId, payload.subarray(off, off + MAX_CHUNK));
+		off += MAX_CHUNK;
+	}
+	yield encodeFrame(terminal, streamId, payload.subarray(off));
+}
+/**
+* Reassembles WsCont + terminal frames back into whole WebSocket messages,
+* keyed by streamId. Feed it every WsCont/WsText/WsBin payload; it returns the
+* complete message bytes on a terminal frame, or null while buffering.
+*/
+var WsReassembler = class {
+	pending = /* @__PURE__ */ new Map();
+	cont(streamId, payload) {
+		const buf = this.pending.get(streamId);
+		if (buf) buf.push(payload.slice());
+		else this.pending.set(streamId, [payload.slice()]);
+	}
+	finish(streamId, payload) {
+		const buf = this.pending.get(streamId);
+		if (!buf) return payload;
+		this.pending.delete(streamId);
+		buf.push(payload);
+		return concatBytes(buf);
+	}
+	drop(streamId) {
+		this.pending.delete(streamId);
+	}
+};
+
+//#endregion
+//#region node_modules/codehost/src/tunnel/host.ts
+const textDecoder = new TextDecoder();
+const HIGH_WATER = 4 * 1024 * 1024;
+const LOW_WATER = 1 * 1024 * 1024;
+const HOP_BY_HOP = new Set([
+	"connection",
+	"keep-alive",
+	"proxy-authenticate",
+	"proxy-authorization",
+	"te",
+	"trailer",
+	"transfer-encoding",
+	"upgrade",
+	"content-length",
+	"host"
+]);
+/**
+* Server half of the tunnel: bridges one transport to a local HTTP/WS server
+* on 127.0.0.1. Multiplexes concurrent HTTP requests and WebSocket
+* connections by streamId.
+*/
+var TunnelHost = class {
+	httpStreams = /* @__PURE__ */ new Map();
+	wsConns = /* @__PURE__ */ new Map();
+	wsRx = new WsReassembler();
+	origin;
+	wsOrigin;
+	port;
+	stripPrefix;
+	onLocal;
+	constructor(transport, opts) {
+		this.transport = transport;
+		this.port = opts.port;
+		this.stripPrefix = opts.stripPrefix;
+		this.onLocal = opts.onLocal;
+		this.origin = `http://127.0.0.1:${opts.port}`;
+		this.wsOrigin = `ws://127.0.0.1:${opts.port}`;
+		transport.setBufferedAmountLow?.(LOW_WATER, () => this.drainWaiter?.());
+		transport.onFrame((data) => void this.onFrame(data));
+		transport.onClose(() => this.closeAll());
+	}
+	/** Map a tunneled path to the local server's path, stripping the base prefix. */
+	localPath(path) {
+		if (this.stripPrefix && path.startsWith(this.stripPrefix)) {
+			const rest = path.slice(this.stripPrefix.length);
+			return rest.startsWith("/") ? rest : `/${rest}`;
+		}
+		return path;
+	}
+	async onFrame(data) {
+		const { op, streamId, payload } = decodeFrame(data);
+		switch (op) {
+			case Op.HttpReq:
+				this.httpStreams.set(streamId, {
+					head: payloadJson(payload),
+					body: []
+				});
+				break;
+			case Op.HttpReqBody:
+				this.httpStreams.get(streamId)?.body.push(payload.slice());
+				break;
+			case Op.HttpReqEnd:
+				await this.doHttp(streamId);
+				break;
+			case Op.WsOpen:
+				this.openWs(streamId, payloadJson(payload));
+				break;
+			case Op.WsCont:
+				this.wsRx.cont(streamId, payload);
+				break;
+			case Op.WsText:
+				this.wsConns.get(streamId)?.send(textDecoder.decode(this.wsRx.finish(streamId, payload)));
+				break;
+			case Op.WsBin:
+				this.wsConns.get(streamId)?.send(this.wsRx.finish(streamId, payload));
+				break;
+			case Op.WsClose:
+				this.wsRx.drop(streamId);
+				this.wsConns.get(streamId)?.close();
+				this.wsConns.delete(streamId);
+				break;
+		}
+	}
+	async doHttp(streamId) {
+		const stream = this.httpStreams.get(streamId);
+		if (!stream) return;
+		this.httpStreams.delete(streamId);
+		const { method, path, headers } = stream.head;
+		const reqHeaders = new Headers();
+		let forwardedHost = "";
+		for (const [k, v] of Object.entries(headers)) {
+			const lk = k.toLowerCase();
+			if (lk === "x-forwarded-host") {
+				forwardedHost = v;
+				continue;
+			}
+			if (!HOP_BY_HOP.has(lk)) reqHeaders.set(k, v);
+		}
+		reqHeaders.set("host", forwardedHost || `127.0.0.1:${this.port}`);
+		const body = method !== "GET" && method !== "HEAD" && stream.body.length > 0 ? concatBytes(stream.body) : void 0;
+		const wantsGzip = reqHeaders.get("x-codehost-accept-gzip") === "1";
+		reqHeaders.delete("x-codehost-accept-gzip");
+		if (wantsGzip) reqHeaders.set("accept-encoding", "gzip");
+		try {
+			const local = this.onLocal?.({
+				method,
+				path,
+				headers: reqHeaders,
+				body
+			});
+			const res = local ? await local : await fetch(this.origin + this.localPath(path), {
+				method,
+				headers: reqHeaders,
+				body,
+				redirect: "manual",
+				...wantsGzip ? { decompress: false } : {}
+			});
+			const resHeaders = {};
+			res.headers.forEach((v, k) => {
+				if (!HOP_BY_HOP.has(k.toLowerCase())) resHeaders[k] = v;
+			});
+			await this.send(encodeJson(Op.HttpResHead, streamId, {
+				status: res.status,
+				statusText: res.statusText,
+				headers: resHeaders
+			}));
+			if (res.body) {
+				const reader = res.body.getReader();
+				for (;;) {
+					const { done, value } = await reader.read();
+					if (done) break;
+					for (const part of chunk(value)) await this.send(encodeFrame(Op.HttpResBody, streamId, part));
+				}
+			}
+			await this.send(encodeFrame(Op.HttpResEnd, streamId));
+		} catch (err) {
+			await this.send(encodeJson(Op.Error, streamId, { message: `proxy error: ${String(err)}` }));
+		}
+	}
+	openWs(streamId, info) {
+		let ws;
+		try {
+			ws = new WebSocket(this.wsOrigin + this.localPath(info.path), info.protocols);
+		} catch (err) {
+			this.send(encodeJson(Op.WsOpenAck, streamId, {
+				ok: false,
+				error: String(err)
+			}));
+			return;
+		}
+		ws.binaryType = "arraybuffer";
+		this.wsConns.set(streamId, ws);
+		ws.onopen = () => {
+			this.send(encodeJson(Op.WsOpenAck, streamId, {
+				ok: true,
+				protocol: ws.protocol
+			}));
+		};
+		ws.onmessage = (ev) => {
+			const [terminal, u8] = typeof ev.data === "string" ? [Op.WsText, new TextEncoder().encode(ev.data)] : [Op.WsBin, ev.data instanceof ArrayBuffer ? new Uint8Array(ev.data) : new Uint8Array(ev.data)];
+			for (const frame of wsMessageFrames(terminal, streamId, u8)) this.send(frame);
+		};
+		ws.onclose = (ev) => {
+			this.send(encodeJson(Op.WsClose, streamId, {
+				code: ev.code,
+				reason: ev.reason
+			}));
+			this.wsConns.delete(streamId);
+		};
+		ws.onerror = () => {
+			this.send(encodeJson(Op.WsClose, streamId, {
+				code: 1006,
+				reason: "error"
+			}));
+			this.wsConns.delete(streamId);
+		};
+	}
+	sendTail = Promise.resolve();
+	send(frame) {
+		const p = this.sendTail.then(async () => {
+			await this.waitForDrain();
+			if (!this.transport.isOpen()) return;
+			this.transport.send(frame);
+		});
+		this.sendTail = p.catch(() => {});
+		return p;
+	}
+	drainWaiter = null;
+	waitForDrain() {
+		if (!this.transport.isOpen() || this.transport.bufferedAmount() < HIGH_WATER) return Promise.resolve();
+		return new Promise((resolve) => {
+			let settled = false;
+			const finish = () => {
+				if (settled) return;
+				settled = true;
+				clearInterval(timer);
+				this.drainWaiter = null;
+				resolve();
+			};
+			this.drainWaiter = finish;
+			const timer = setInterval(() => {
+				if (!this.transport.isOpen() || this.transport.bufferedAmount() < HIGH_WATER) finish();
+			}, 100);
+		});
+	}
+	closeAll() {
+		for (const ws of this.wsConns.values()) try {
+			ws.close();
+		} catch {}
+		this.wsConns.clear();
+		this.httpStreams.clear();
+	}
+};
+
+//#endregion
+//#region ts/expose.ts
+const DEFAULT_RELAY = "https://agent-yes.com";
+const PING_MS = 25e3;
+const RECONNECT_MIN_MS = 1e3;
+const RECONNECT_MAX_MS = 3e4;
+function exposuresPath() {
+	const home = process.env.AGENT_YES_HOME ?? path.join(homedir(), ".agent-yes");
+	mkdirSync(home, { recursive: true });
+	return path.join(home, "exposures.json");
+}
+/** Stable id+key per (relay, port): re-exposing a port keeps its URL. */
+function loadOrCreateExposure(relayHost, port) {
+	const file = exposuresPath();
+	let all = {};
+	try {
+		all = JSON.parse(readFileSync(file, "utf8"));
+	} catch {}
+	const slot = `${relayHost}:${port}`;
+	const existing = all[slot];
+	if (existing?.id && existing.key) return existing;
+	const rec = {
+		id: "x" + randomBytes(8).toString("hex").slice(0, 15),
+		key: randomBytes(32).toString("hex")
+	};
+	all[slot] = rec;
+	const tmp = file + ".tmp";
+	writeFileSync(tmp, JSON.stringify(all, null, 2) + "\n");
+	chmodSync(tmp, 384);
+	renameSync(tmp, file);
+	return rec;
+}
+/** Bun's browser-style WebSocket as a TunnelTransport. No bufferedAmountLow
+*  event exists here — TunnelHost's 100ms safety poll covers drain resume. */
+function wsTransport(ws) {
+	return {
+		send: (frame) => {
+			const copy = new Uint8Array(frame.byteLength);
+			copy.set(frame);
+			ws.send(copy);
+		},
+		isOpen: () => ws.readyState === WebSocket.OPEN,
+		bufferedAmount: () => ws.bufferedAmount,
+		onFrame: (cb) => {
+			ws.addEventListener("message", (ev) => {
+				if (typeof ev.data === "string") return;
+				const d = ev.data;
+				cb(d instanceof Uint8Array ? d : new Uint8Array(d));
+			});
+		},
+		onClose: (cb) => ws.addEventListener("close", () => cb())
+	};
+}
+/**
+* Start (or fail) one exposure. Resolves once the relay has accepted the daemon
+* and the tunnel is live; rejects if the relay refuses this exposure (bad key).
+* Reconnects with backoff for the life of the handle.
+*/
+function startExposure(opts) {
+	const relay = opts.relay ?? DEFAULT_RELAY;
+	const port = opts.port;
+	const log = opts.log ?? (() => {});
+	const relayUrl = new URL(relay);
+	const rec = loadOrCreateExposure(relayUrl.host, port);
+	const tunnelUrl = `${relayUrl.protocol === "http:" ? "ws:" : "wss:"}//${relayUrl.host}/_ay/tunnel/${rec.id}`;
+	const publicHost = relayUrl.host === "agent-yes.com" ? `${rec.id}.agent-yes.com` : relayUrl.host;
+	const publicUrl = `https://${publicHost}/`;
+	let stopped = false;
+	let sock = null;
+	let ready = false;
+	let backoff = RECONNECT_MIN_MS;
+	const handle = {
+		id: rec.id,
+		port,
+		publicHost,
+		url: publicUrl,
+		relayHost: relayUrl.host,
+		createdAt: Date.now(),
+		mintClaim() {
+			const token = randomBytes(18).toString("base64url");
+			const hash = createHash("sha256").update(token).digest("hex");
+			if (sock && sock.readyState === WebSocket.OPEN) sock.send(JSON.stringify({
+				t: "claim",
+				claims: [hash]
+			}));
+			return `https://${publicHost}/_ay/claim?t=${token}`;
+		},
+		stop() {
+			stopped = true;
+			try {
+				sock?.close();
+			} catch {}
+		}
+	};
+	return new Promise((resolve, reject) => {
+		const connect = () => {
+			if (stopped) return;
+			sock = new WebSocket(tunnelUrl);
+			sock.binaryType = "arraybuffer";
+			const ws = sock;
+			let ping = null;
+			ws.addEventListener("open", () => {
+				ws.send(JSON.stringify({
+					t: "hello",
+					key: rec.key,
+					port,
+					v: 1
+				}));
+			});
+			ws.addEventListener("message", (ev) => {
+				if (typeof ev.data !== "string") return;
+				let msg;
+				try {
+					msg = JSON.parse(ev.data);
+				} catch {
+					return;
+				}
+				if (msg.t === "ready") {
+					backoff = RECONNECT_MIN_MS;
+					new TunnelHost(wsTransport(ws), { port });
+					ping = setInterval(() => {
+						if (ws.readyState === WebSocket.OPEN) ws.send("ping");
+					}, PING_MS);
+					if (!ready) {
+						ready = true;
+						log(`sharing 127.0.0.1:${port} at ${publicUrl}`);
+						resolve(handle);
+					} else log(`reconnected`);
+				}
+			});
+			ws.addEventListener("close", (ev) => {
+				if (ping) clearInterval(ping);
+				if (stopped) return;
+				if (ev.code === 1008) {
+					const err = /* @__PURE__ */ new Error(`relay refused exposure (${ev.reason || "forbidden"})`);
+					if (!ready) return reject(err);
+					log(err.message);
+					return;
+				}
+				log(`connection lost, retrying in ${Math.round(backoff / 1e3)}s…`);
+				setTimeout(connect, backoff);
+				backoff = Math.min(backoff * 2, RECONNECT_MAX_MS);
+			});
+			ws.addEventListener("error", () => {});
+		};
+		connect();
+	});
+}
+const active = /* @__PURE__ */ new Map();
+/** In-flight starts, so concurrent POSTs for the same port share one dial. */
+const starting = /* @__PURE__ */ new Map();
+/** Start an exposure for `port` (or reuse a running one). Idempotent per port. */
+async function ensureExposure(port, relay) {
+	const existing = active.get(port);
+	if (existing) return existing;
+	const inflight = starting.get(port);
+	if (inflight) return inflight;
+	const p = startExposure({
+		port,
+		relay
+	}).then((h) => {
+		active.set(port, h);
+		starting.delete(port);
+		return h;
+	}).catch((e) => {
+		starting.delete(port);
+		throw e;
+	});
+	starting.set(port, p);
+	return p;
+}
+function listExposures() {
+	return [...active.values()].sort((a, b) => b.createdAt - a.createdAt).map((h) => ({
+		id: h.id,
+		port: h.port,
+		url: h.url,
+		createdAt: h.createdAt
+	}));
+}
+function stopExposure(port) {
+	const h = active.get(port);
+	if (!h) return false;
+	h.stop();
+	active.delete(port);
+	return true;
+}
+async function cmdExpose(args) {
+	let relay = DEFAULT_RELAY;
+	let port = 0;
+	for (let i = 0; i < args.length; i++) {
+		const a = args[i];
+		if (a === "--relay") relay = args[++i] ?? relay;
+		else if (a.startsWith("--relay=")) relay = a.slice(8);
+		else if (/^\d+$/.test(a)) port = Number(a);
+		else if (a === "-h" || a === "--help") {
+			console.log(`Usage: ay expose <port> [--relay ${DEFAULT_RELAY}]\n\nShares http://127.0.0.1:<port> at https://<id>.agent-yes.com (private:\nvisitors need the printed one-time claim link, which sets an 8h cookie).\nThe URL is stable per port on this machine. Ctrl-C stops sharing.`);
+			return 0;
+		}
+	}
+	if (!port || port < 1 || port > 65535) {
+		console.error("usage: ay expose <port> [--relay https://…]  (see ay expose --help)");
+		return 1;
+	}
+	let handle;
+	try {
+		handle = await startExposure({
+			port,
+			relay,
+			log: (m) => console.log(`[ay expose] ${m}`)
+		});
+	} catch (e) {
+		console.error(`[ay expose] ${e.message} — giving up`);
+		return 1;
+	}
+	const claimUrl = handle.mintClaim();
+	console.log(`  url:    ${handle.url}`);
+	console.log(`  claim:  ${claimUrl}`);
+	console.log(`          (one-time link — opens access for 8h in that browser)`);
+	const shutdown = () => {
+		console.log("\n[ay expose] stopped — the URL now answers 502 until you expose again");
+		handle.stop();
+		process.exit(0);
+	};
+	process.on("SIGINT", shutdown);
+	process.on("SIGTERM", shutdown);
+	return new Promise(() => {});
+}
+
+//#endregion
+export { cmdExpose, ensureExposure, listExposures, stopExposure };
+//# sourceMappingURL=expose-B3AGhVhM.js.map

package/dist/{forkNested-C8q7E6mp.js → forkNested-C1kKsXi5.js}

@@ -56,4 +56,4 @@ async function waitForFifo(pid, timeoutMs = 2e3, aborted) {
 
 //#endregion
 export { buildSpawnTutorial, shouldForkNested, waitForFifo };
-//# sourceMappingURL=forkNested-C8q7E6mp.js.map
+//# sourceMappingURL=forkNested-C1kKsXi5.js.map

package/dist/index.js

@@ -1,6 +1,6 @@
-import { a as removeControlCharacters, i as AgentContext, n as agentYes, r as config, t as CLIS_CONFIG } from "./ts-1qx-QhAe.js";
+import { a as removeControlCharacters, i as AgentContext, n as agentYes, r as config, t as CLIS_CONFIG } from "./ts-BQh1-ljE.js";
 import "./logger-CDIsZ-Pp.js";
-import "./versionChecker-Do5ex5Wm.js";
+import "./versionChecker-DhCi7ncH.js";
 import "./pidStore-BIvsBQ8X.js";
 import "./globalPidIndex-CoNr7tS8.js";
 

package/dist/{notifyDaemon-BZmlbBqN.js → notifyDaemon-hKT38cBs.js}

@@ -1,10 +1,10 @@
 import { n as logger } from "./logger-CDIsZ-Pp.js";
 import "./globalPidIndex-CoNr7tS8.js";
 import "./configShared-0MnIQ652.js";
-import { G as hostId, J as readInbox, K as listInboxParents, O as renderLogTailLines, Q as notifyDir, S as listRecords, U as appendEvent, W as gcInboxes, X as daemonLockDir, Y as shouldStealLock, Z as daemonLockOwnerPath, _ as isPidAlive, c as deriveLiveState, q as liveWatchers } from "./subcommands-BYKJkWNP.js";
+import { G as hostId, J as readInbox, K as listInboxParents, O as renderLogTailLines, Q as notifyDir, S as listRecords, U as appendEvent, W as gcInboxes, X as daemonLockDir, Y as shouldStealLock, Z as daemonLockOwnerPath, _ as isPidAlive, c as deriveLiveState, q as liveWatchers } from "./subcommands-CNCgJ48t.js";
 import "./e2e-BeKjLhmO.js";
 import "./webrtcLink-BG0Xc4-W.js";
-import "./remotes-DsTnQhyx.js";
+import "./remotes-CgT91bMo.js";
 import { mkdir, readFile, rename, rm, stat, writeFile } from "fs/promises";
 import { randomUUID } from "node:crypto";
 import { execFile } from "node:child_process";
@@ -588,4 +588,4 @@ async function ensureDaemon() {
 
 //#endregion
 export { daemonStatus, ensureDaemon, requestDaemonStop, runDaemon };
-//# sourceMappingURL=notifyDaemon-BZmlbBqN.js.map
+//# sourceMappingURL=notifyDaemon-hKT38cBs.js.map

package/dist/{openBrowser-BO5RVYwL.js → openBrowser-DQVkxCyj.js}

@@ -68,4 +68,4 @@ async function offerOpenInBrowser(url, prompt = "Open in browser now? [Y/n] ") {
 
 //#endregion
 export { offerOpenInBrowser };
-//# sourceMappingURL=openBrowser-BO5RVYwL.js.map
+//# sourceMappingURL=openBrowser-DQVkxCyj.js.map