agent-yes 1.204.0 → 1.206.0

package/dist/{serve-eqRnhz8Z.js → serve-crLypY_c.js}

@@ -1,14 +1,15 @@
-import "./ts-D9LzuGpU.js";
+import "./ts-DnqRreF4.js";
 import "./logger-CDIsZ-Pp.js";
-import { r as getInstalledPackage } from "./versionChecker-C8ScoMqV.js";
-import { t as findSpawnHiddenLauncher } from "./rustBinary-DMx8ljD0.js";
+import { r as getInstalledPackage } from "./versionChecker-d5c6_vgS.js";
+import { t as findSpawnHiddenLauncher } from "./rustBinary-BjRvvEs8.js";
+import { t as agentYesHome$1 } from "./agentYesHome-CtHb5b71.js";
 import "./pidStore-BIvsBQ8X.js";
 import { a as updateGlobalPidStatus } from "./globalPidIndex-CoNr7tS8.js";
 import { r as recordInbox } from "./messageLog-CxrKJj77.js";
 import { t as pgidForWrapper } from "./reaper-BUHCyxdF.js";
 import "./configShared-aKTg-sa5.js";
-import { t as SUPPORTED_CLIS } from "./SUPPORTED_CLIS-DqsPHFU9.js";
-import { A as renderRawLog, D as recentMessageEdges, E as readPtysize, L as snapshotStatus, M as resolveOne, O as recentReadEdges, S as listRecords, T as readNotes, U as writeToIpc, b as isUserTyping, et as TYPING_BADGE, f as extractNeedsInput, k as renderLogTailLines, l as deriveLiveStatus, o as controlCodeFromName, p as extractTaskCounts, u as extractBadges } from "./subcommands-B7NvTmdk.js";
+import { t as SUPPORTED_CLIS } from "./SUPPORTED_CLIS-DQSgURGW.js";
+import { A as renderRawLog, D as recentMessageEdges, E as readPtysize, L as snapshotStatus, M as resolveOne, O as recentReadEdges, S as listRecords, T as readNotes, U as writeToIpc, b as isUserTyping, f as extractNeedsInput, k as renderLogTailLines, l as deriveLiveStatus, o as controlCodeFromName, p as extractTaskCounts, q as isTransientLockMkdirError, tt as TYPING_BADGE, u as extractBadges } from "./subcommands-DkrMRVNh.js";
 import "./e2e-jb0Hp43q.js";
 import "./webrtcLink-B7REGtK2.js";
 import "./remotes-Cim0dBU7.js";
@@ -16,7 +17,7 @@ import { a as getSpawnHook, c as hasProvisionHook, d as resolveSpawnCwd, i as ge
 import { n as liveEnv, t as ensureNodeRuntime } from "./nodeRuntime-CwNJuwH5.js";
 import { r as spawnRejectionReason } from "./spawnGate-CXjEz6Pf.js";
 import yargs from "yargs";
-import { mkdir, open, readFile, stat, unlink, writeFile } from "fs/promises";
+import { mkdir, open, readFile, rename, rm, stat, unlink, writeFile } from "fs/promises";
 import { arch, cpus, freemem, homedir, hostname, loadavg, platform, totalmem, uptime, userInfo } from "os";
 import path from "path";
 import { execFileSync } from "node:child_process";
@@ -42,6 +43,170 @@ import { existsSync, renameSync, watch, writeFileSync } from "node:fs";
 */
 const isTerminalReply = (s) => /^(?:\x1b\[(?:\??\d+(?:;\d+)*R|\?[\d;]*c|>[\d;]*c|\d*n))+$/.test(s);
 
+//#endregion
+//#region ts/statusText.ts
+/**
+* Extract a short "what is the agent doing right now?" line from the rendered
+* terminal screen. Claude Code paints this as a spinner/status line, e.g.
+* "✶ Verifying calendar meetings with real data… (6m 30s · ↓ 19.5k tokens)".
+*/
+const SPINNER_PREFIX = /^[\u2800-\u28ff✶✻✢✳✽✦✧✩✷✸✹✺✼·•●◐◓◒◑]\s+/u;
+const CONTROL = /[\x00-\x1f\x7f-\x9f]/g;
+function parseStatusText(lines) {
+	for (let i = lines.length - 1; i >= 0; i--) {
+		const line = lines[i]?.replace(CONTROL, "").trim();
+		if (!line || line.length < 3) continue;
+		if (!SPINNER_PREFIX.test(line)) continue;
+		if (/^(?:[•·]\s*)?(?:esc|ctrl|enter|return|shift|tab)\b/i.test(line)) continue;
+		return line.slice(0, 220).trim();
+	}
+	return null;
+}
+
+//#endregion
+//#region ts/serveLock.ts
+/**
+* Singleton lock for the WebRTC host role: one `ay serve` host per
+* ~/.agent-yes. Two hosts sharing the persisted room (~/.agent-yes/.share-room)
+* fight over every viewer connection — the exact outage seen live: an orphaned
+* `ay serve --webrtc` from a previous manager era plus a manual run left the
+* managed daemon crash-looping (12 watchdog restarts) and the share link
+* unloadable. The lock makes the loser fail FAST with a pointer to the owner
+* instead of silently contending.
+*
+* mkdir-based (atomic on every platform), owner JSON alongside, heartbeat
+* refresh while held. A stale owner — dead pid, or a heartbeat older than
+* SERVE_LOCK_STALE_MS (a SIGKILLed host can't clean up) — is stolen, so a
+* crashed host never wedges the next start.
+*/
+const SERVE_LOCK_STALE_MS = 2e4;
+const SERVE_LOCK_BEAT_MS = 5e3;
+const SERVE_LOCK_GRACE_MS = 12e3;
+function lockDir() {
+	return path.join(agentYesHome$1(), "webrtc-host.lock");
+}
+function ownerPath() {
+	return path.join(lockDir(), "owner.json");
+}
+function pidAlive(pid) {
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch (e) {
+		return e.code === "EPERM";
+	}
+}
+async function readOwner() {
+	try {
+		const o = JSON.parse(await readFile(ownerPath(), "utf-8"));
+		return typeof o?.pid === "number" ? o : null;
+	} catch {
+		return null;
+	}
+}
+/** Pure staleness decision, exported for tests. */
+function isOwnerStale(owner, now, alive, staleMs = SERVE_LOCK_STALE_MS) {
+	if (!owner) return true;
+	if (!alive(owner.pid)) return true;
+	return now - owner.beat_at > staleMs;
+}
+async function stampOwner(startedAt) {
+	const tmp = `${ownerPath()}.${process.pid}.tmp`;
+	try {
+		await writeFile(tmp, JSON.stringify({
+			pid: process.pid,
+			started_at: startedAt,
+			beat_at: Date.now()
+		}));
+		await rename(tmp, ownerPath());
+		return true;
+	} catch {
+		await rm(tmp, { force: true }).catch(() => {});
+		return false;
+	}
+}
+/**
+* Acquire the host lock, retrying for up to `graceMs`. Returns fast on a live
+* owner once the grace expires (never blocks a daemon boot forever). With
+* `takeover`, a live owner is SIGTERM'd (then SIGKILL'd) and the lock stolen.
+*/
+async function acquireWebrtcHostLock(opts) {
+	const graceMs = opts?.graceMs ?? SERVE_LOCK_GRACE_MS;
+	const staleMs = opts?.staleMs ?? SERVE_LOCK_STALE_MS;
+	const beatMs = opts?.beatMs ?? SERVE_LOCK_BEAT_MS;
+	const startedAt = Date.now();
+	const deadline = startedAt + graceMs;
+	let tookOver = false;
+	for (;;) try {
+		await mkdir(lockDir(), { recursive: false });
+		if (!await stampOwner(startedAt)) {
+			await rm(lockDir(), {
+				recursive: true,
+				force: true
+			}).catch(() => {});
+			return {
+				ok: false,
+				owner: null
+			};
+		}
+		const beat = setInterval(() => {
+			(async () => {
+				if ((await readOwner())?.pid !== process.pid) {
+					clearInterval(beat);
+					return;
+				}
+				await stampOwner(startedAt);
+			})();
+		}, beatMs);
+		if (typeof beat.unref === "function") beat.unref();
+		return {
+			ok: true,
+			release: async () => {
+				clearInterval(beat);
+				if ((await readOwner())?.pid === process.pid) await rm(lockDir(), {
+					recursive: true,
+					force: true
+				}).catch(() => {});
+			}
+		};
+	} catch (e) {
+		const code = e.code;
+		if (!isTransientLockMkdirError(code)) throw e;
+		if (code !== "EEXIST") {
+			await new Promise((r) => setTimeout(r, 25));
+			continue;
+		}
+		const owner = await readOwner();
+		if (isOwnerStale(owner, Date.now(), pidAlive, staleMs)) {
+			await rm(lockDir(), {
+				recursive: true,
+				force: true
+			}).catch(() => {});
+			continue;
+		}
+		if (opts?.takeover && owner && !tookOver) {
+			tookOver = true;
+			try {
+				process.kill(owner.pid, "SIGTERM");
+			} catch {}
+			await new Promise((r) => setTimeout(r, opts?.takeoverWaitMs ?? 2e3));
+			if (pidAlive(owner.pid)) try {
+				process.kill(owner.pid, "SIGKILL");
+			} catch {}
+			await rm(lockDir(), {
+				recursive: true,
+				force: true
+			}).catch(() => {});
+			continue;
+		}
+		if (Date.now() >= deadline) return {
+			ok: false,
+			owner
+		};
+		await new Promise((r) => setTimeout(r, 250));
+	}
+}
+
 //#endregion
 //#region ts/strayServe.ts
 const MANAGEMENT_COMMAND_RE = /\b(?:install|uninstall|status|logs|restart)\b/;
@@ -91,7 +256,49 @@ async function listStrayServeProcesses() {
 
 //#endregion
 //#region ts/serve.ts
-const DEFAULT_PORT = 7432;
+const DEFAULT_PORT = 0;
+const PORTLESS_APP_NAME = "agent-yes";
+const PORTLESS_CHILD_ENV = "AGENT_YES_PORTLESS_CHILD";
+function portlessConsoleUrl(token) {
+	return portlessConsoleUrlForOrigin(process.env.PORTLESS_URL?.replace(/\/$/, "") || `https://${PORTLESS_APP_NAME}.localhost`, token);
+}
+function portlessConsoleUrlForOrigin(origin, token) {
+	return `${origin}${token ? `/#k=${encodeURIComponent(token)}` : "/"}`;
+}
+async function resolvedPortlessConsoleUrl(token) {
+	if (process.env.PORTLESS_URL) return portlessConsoleUrl(token);
+	try {
+		const port = Number((await readFile(path.join(homedir(), ".portless", "proxy.port"), "utf-8")).trim());
+		if (Number.isInteger(port) && port > 0) return portlessConsoleUrlForOrigin(`https://${PORTLESS_APP_NAME}.localhost${port === 443 ? "" : `:${port}`}`, token);
+	} catch {}
+	return portlessConsoleUrl(token);
+}
+async function runWithPortless(rest) {
+	const portless = Bun.which("portless");
+	if (!portless) {
+		process.stderr.write("ay serve: Portless is required for local HTTPS. Install it with: npm install -g portless\n");
+		return 1;
+	}
+	const script = process.argv[1];
+	const self = script && /\.[cm]?[jt]s$/.test(script) ? [process.execPath, script] : [process.execPath];
+	return await Bun.spawn([
+		portless,
+		PORTLESS_APP_NAME,
+		...self,
+		"serve",
+		...rest
+	], {
+		stdio: [
+			"inherit",
+			"inherit",
+			"inherit"
+		],
+		env: {
+			...liveEnv(),
+			[PORTLESS_CHILD_ENV]: "1"
+		}
+	}).exited ?? 1;
+}
 /**
 * Normalize a user-supplied GitHub-ish source into the standard
 * `<owner>/<repo>/tree/<branch>` path that codehost/provision's `parseSpec`
@@ -565,7 +772,18 @@ async function readDaemonServeArgs(mgr) {
 }
 function portFromArgs(args) {
 	const m = /--port[=\s](\d+)/.exec(args.join(" "));
-	return m ? Number(m[1]) : DEFAULT_PORT;
+	return m ? Number(m[1]) : null;
+}
+function argsUsePortless(args) {
+	return (args.some((a) => a.startsWith("--http") || a.startsWith("--share")) || !args.some((a) => a.startsWith("--webrtc"))) && portFromArgs(args) === null;
+}
+async function portlessAppPort() {
+	try {
+		const route = JSON.parse(await readFile(path.join(homedir(), ".portless", "routes.json"), "utf-8")).find((r) => r.hostname === `${PORTLESS_APP_NAME}.localhost`);
+		return typeof route?.port === "number" ? route.port : null;
+	} catch {
+		return null;
+	}
 }
 async function warnStrayServeProcesses() {
 	const stray = await listStrayServeProcesses();
@@ -586,6 +804,7 @@ function explicitWebrtcUrl(args) {
 	}
 }
 async function fetchDaemonVersion(port, token) {
+	if (port === null) return null;
 	try {
 		const r = await fetch(`http://127.0.0.1:${port}/api/version`, {
 			headers: { Authorization: `Bearer ${token}` },
@@ -673,7 +892,7 @@ async function cmdServeDaemon(sub, args) {
 		let shareLink = null;
 		let shareLinkMinted = false;
 		if (webrtcDaemon) try {
-			const { loadOrCreateShareRoom, shareLinkFromRoomUrl } = await import("./share-Ciw1mWVN.js");
+			const { loadOrCreateShareRoom, shareLinkFromRoomUrl } = await import("./share-_QYjPN7q.js");
 			const explicit = explicitWebrtcUrl(effArgs);
 			shareLink = shareLinkFromRoomUrl(explicit ?? await loadOrCreateShareRoom());
 			shareLinkMinted = !explicit;
@@ -688,7 +907,7 @@ async function cmdServeDaemon(sub, args) {
 		};
 		if (priorArgs !== null) {
 			const sameConfig = JSON.stringify(effArgs) === JSON.stringify(priorArgs);
-			const runningVer = await fetchDaemonVersion(portFromArgs(effArgs), token);
+			const runningVer = await fetchDaemonVersion(argsUsePortless(effArgs) ? await portlessAppPort() : portFromArgs(effArgs), token);
 			if (runningVer === current && sameConfig) {
 				await ensureBootAutostart(mgr);
 				process.stdout.write(`'${DAEMON_NAME}' already running v${current} (up to date)\n`);
@@ -755,7 +974,8 @@ async function cmdServeDaemon(sub, args) {
 		}).exited;
 		if (code === 0) {
 			const onBoot = await ensureBootAutostart(mgr);
-			const port = portFromArgs(effArgs);
+			const port = argsUsePortless(effArgs) ? await portlessAppPort() : portFromArgs(effArgs);
+			const localUrl = argsUsePortless(effArgs) ? await resolvedPortlessConsoleUrl(token) : null;
 			const httpish = effArgs.some((a) => a.startsWith("--http") || a.startsWith("--share")) || !effArgs.some((a) => a.startsWith("--webrtc"));
 			process.stdout.write(`\n${priorArgs !== null ? `rolled '${DAEMON_NAME}' forward to` : `installed '${DAEMON_NAME}' as a daemon via ${mgr.id} —`} v${current}\n`);
 			if (mgr.id === "oxmgr" && process.platform === "win32") process.stdout.write(onBoot ? `start-on-login: enabled (Task Scheduler ONLOGON runs \`oxmgr daemon run\`)\n` : `start-on-login: not registered — run \`oxmgr service install\` to enable\n`);
@@ -764,8 +984,11 @@ async function cmdServeDaemon(sub, args) {
 			else process.stdout.write(onBoot ? `start-on-boot: enabled (pm2 startup registered with the system init)\n` : `start-on-boot: not registered — run \`pm2 startup\` (may need sudo) to enable\n`);
 			process.stdout.write(`token: ${token}\n\n`);
 			if (httpish) {
-				process.stdout.write(`  ay ls   ${token}@<host>:${port}\n`);
-				process.stdout.write(`  ay remote add <alias> http://${token}@<host>:${port}\n`);
+				if (argsUsePortless(effArgs)) process.stdout.write(`  web console: ${localUrl}\n`);
+				else if (port !== null) {
+					process.stdout.write(`  ay ls   ${token}@<host>:${port}\n`);
+					process.stdout.write(`  ay remote add <alias> http://${token}@<host>:${port}\n`);
+				}
 			}
 			process.stdout.write(`  ay serve logs                # view server logs\n`);
 			process.stdout.write(`  ay serve uninstall           # remove daemon\n`);
@@ -796,7 +1019,9 @@ async function cmdServeStatus(args) {
 	const daemonArgs = mgr ? await readDaemonServeArgs(mgr) : null;
 	const installed = daemonArgs !== null;
 	const a = daemonArgs ?? [];
-	const port = portFromArgs(a);
+	const local = argsUsePortless(a);
+	const port = local ? await portlessAppPort() : portFromArgs(a);
+	const localUrl = local ? await resolvedPortlessConsoleUrl(token ?? void 0) : null;
 	const webrtcish = a.some((x) => x.startsWith("--webrtc") || x.startsWith("--share"));
 	const httpish = a.some((x) => x.startsWith("--http") || x.startsWith("--share")) || !a.some((x) => x.startsWith("--webrtc"));
 	const mode = httpish && webrtcish ? "http+webrtc" : webrtcish ? "webrtc" : "http";
@@ -808,6 +1033,7 @@ async function cmdServeStatus(args) {
 			installed,
 			mode,
 			port: httpish ? port : null,
+			localUrl: httpish ? localUrl : null,
 			reachable: runningVersion !== null,
 			runningVersion,
 			currentVersion: current,
@@ -823,18 +1049,23 @@ async function cmdServeStatus(args) {
 	w(`manager:      ${mgr ? mgr.id : "none — install pm2 or oxmgr to daemonize"}`);
 	if (installed) {
 		w(`installed:    yes (via ${mgr.id})`);
-		w(`mode:         ${mode}${httpish ? `  (port ${port})` : ""}`);
+		w(`mode:         ${mode}${httpish ? local ? `  (${localUrl})` : `  (port ${port})` : ""}`);
 		if (a.length) w(`args:         ${a.join(" ")}`);
 	} else w(`installed:    no — start a daemon with:  ay serve install [--share]`);
-	if (runningVersion !== null) w(`http api:     reachable on 127.0.0.1:${port} — v${runningVersion} (${runningVersion === current ? "up to date" : `outdated (current v${current})`})`);
-	else if (mode === "webrtc") w(`http api:     none (webrtc-only)`);
-	else w(`http api:     not reachable on 127.0.0.1:${port} (not running)`);
+	if (runningVersion !== null) {
+		const tag = runningVersion === current ? "up to date" : `outdated (current v${current})`;
+		w(`http api:     reachable ${local ? `via ${localUrl}` : `on 127.0.0.1:${port}`} — v${runningVersion} (${tag})`);
+	} else if (mode === "webrtc") w(`http api:     none (webrtc-only)`);
+	else w(`http api:     not reachable ${local ? `via ${localUrl}` : `on 127.0.0.1:${port}`} (not running)`);
 	w(`token:        ${token ?? "(none yet — created on first serve)"}`);
 	if (shareLink) w(`share link:   ${shareLink}`);
 	if (token && httpish) {
 		w();
-		w(`connect:  ay ls   ${token}@<host>:${port}`);
-		w(`          ay remote add <alias> http://${token}@<host>:${port}`);
+		if (local) w(`console:  ${localUrl}`);
+		else if (port !== null) {
+			w(`connect:  ay ls   ${token}@<host>:${port}`);
+			w(`          ay remote add <alias> http://${token}@<host>:${port}`);
+		}
 	}
 	return 0;
 }
@@ -855,7 +1086,13 @@ Modes (default: --http):
   --share [URL]     Legacy alias for --http --webrtc
 
 Options:
-  --port N          Port to listen on (default: ${DEFAULT_PORT})\n  --host HOST       Interface to bind (default: 127.0.0.1; use 0.0.0.0 to expose)\n  --token TOKEN     Auth token (auto-generated and saved if omitted)\n  -d, --daemon      Install these flags as a background daemon (pm2/oxmgr)\n                    (same as: ay serve install <flags>)\n  --allow-spawn     Deprecated no-op — the console can always spawn agents\n  --tls-cert FILE   TLS certificate PEM\n  --tls-key  FILE   TLS private key PEM\n\nSubcommands:\n  ay serve install    install as background daemon (oxmgr; pm2 fallback on Windows without the winfix build)\n  ay serve status     show daemon/server status (add --json for scripts)\n  ay serve uninstall  remove daemon\n  ay serve logs       view daemon logs\n\nOnce running, connect from another machine:\n  ay ls   <token>@<host>:${DEFAULT_PORT}\n  ay remote add <alias> http://<token>@<host>:${DEFAULT_PORT}\n`);
+  --port N          Bypass Portless and listen on a fixed HTTP port
+  --host HOST       Interface to bind (default: 127.0.0.1; use 0.0.0.0 to expose)
+  --token TOKEN     Auth token (auto-generated and saved if omitted)
+  -d, --daemon      Install these flags as a background daemon (pm2/oxmgr)
+                    (same as: ay serve install <flags>)
+  --local           Explicitly use Portless (the default for HTTP mode)
+                    ${portlessConsoleUrl()}\n  --allow-spawn     Deprecated no-op — the console can always spawn agents\n  --tls-cert FILE   TLS certificate PEM\n  --tls-key  FILE   TLS private key PEM\n\nSubcommands:\n  ay serve install    install as background daemon (oxmgr; pm2 fallback on Windows without the winfix build)\n  ay serve status     show daemon/server status (add --json for scripts)\n  ay serve uninstall  remove daemon\n  ay serve logs       view daemon logs\n\nOnce running, connect from another machine:\n  ay ls   <token>@<host>:<port>\n  ay remote add <alias> http://<token>@<host>:<port>\n`);
 		return 0;
 	}
 	const sub = rest[0];
@@ -875,8 +1112,7 @@ Options:
 	if (sub === "install" || sub === "uninstall" || sub === "logs") return cmdServeDaemon(sub, rest.slice(1));
 	const argv = await yargs(rest).usage("Usage: ay serve [options]").option("port", {
 		type: "number",
-		default: DEFAULT_PORT,
-		description: "Port to listen on"
+		description: "Bypass Portless and listen on a fixed port"
 	}).option("host", {
 		type: "string",
 		default: "127.0.0.1",
@@ -904,19 +1140,36 @@ Options:
 		type: "boolean",
 		default: false,
 		description: "Install as a background daemon (same as: ay serve install <flags>)"
+	}).option("local", {
+		type: "boolean",
+		default: false,
+		description: `Use Portless at ${portlessConsoleUrl()} (default for HTTP mode)`
 	}).option("allow-spawn", {
 		type: "boolean",
 		default: false,
 		description: "Deprecated no-op — the console can always spawn agents"
+	}).option("takeover", {
+		type: "boolean",
+		default: false,
+		description: "If another ay serve already hosts this home's WebRTC room, stop it and take the room"
 	}).help(false).version(false).exitProcess(false).parseAsync();
 	if (argv.daemon) return cmdServeDaemon("install", rest.filter((a) => a !== "--daemon" && a !== "-d"));
+	const wantWebrtc = argv.webrtc !== void 0 || argv.share !== void 0;
+	const wantHttp = argv.http === true || argv.share !== void 0 || argv.webrtc === void 0;
+	const fixedPort = typeof argv.port === "number";
+	const usePortless = wantHttp && !fixedPort;
+	if (argv.local === true && fixedPort) {
+		process.stderr.write("ay serve: --local and --port cannot be used together\n");
+		return 1;
+	}
+	if (usePortless && process.env[PORTLESS_CHILD_ENV] !== "1" && process.env.PORTLESS !== "0") return runWithPortless(rest);
 	const stray = argv._.map(String);
 	if (stray.length) {
 		const hint = stray.includes("share") ? " (did you mean --share?)" : "";
 		process.stderr.write(`ay serve: ignoring unknown argument${stray.length > 1 ? "s" : ""}: ${stray.join(" ")}${hint}\n`);
 	}
 	delete process.env.AGENT_YES_PID;
-	const port = argv.port ?? DEFAULT_PORT;
+	const port = argv.port ?? (Number(process.env.PORT) || DEFAULT_PORT);
 	const host = argv.host ?? "127.0.0.1";
 	const tokenFlag = typeof argv.token === "string" ? argv.token : void 0;
 	const certPath = typeof argv["tls-cert"] === "string" ? argv["tls-cert"] : void 0;
@@ -927,8 +1180,17 @@ Options:
 	}
 	const useHttps = !!(certPath && keyPath);
 	const scheme = useHttps ? "https" : "http";
-	const wantWebrtc = argv.webrtc !== void 0 || argv.share !== void 0;
-	const wantHttp = argv.http === true || argv.share !== void 0 || argv.webrtc === void 0;
+	let releaseHostLock = null;
+	if (wantWebrtc && process.env.AGENT_YES_NO_SERVE_LOCK !== "1") {
+		const lock = await acquireWebrtcHostLock({ takeover: argv.takeover === true });
+		if (!lock.ok) {
+			const o = lock.owner;
+			const since = o ? new Date(o.started_at).toLocaleString() : "unknown";
+			process.stderr.write(`ay serve: another instance${o ? ` (pid ${o.pid}, started ${since})` : ""} already hosts this home's WebRTC room\n  ay serve status              # inspect it\n  ay serve --webrtc --takeover # stop it and take the room\n  AGENT_YES_NO_SERVE_LOCK=1    # opt out (multi-room setups only)\n`);
+			return 1;
+		}
+		releaseHostLock = lock.release;
+	}
 	if (wantHttp && host !== "127.0.0.1" && host !== "localhost") process.stderr.write("ay serve: warning: binding to non-loopback — ensure your network is trusted or use Tailscale/VPN\n");
 	const token = await loadOrCreateToken(tokenFlag);
 	const titleCache = /* @__PURE__ */ new Map();
@@ -1017,6 +1279,25 @@ Options:
 			return [];
 		}
 	};
+	const statusTextCache = /* @__PURE__ */ new Map();
+	const logStatusText = async (logFile) => {
+		if (!logFile) return null;
+		try {
+			const { size, mtimeMs } = await stat(logFile);
+			const hit = statusTextCache.get(logFile);
+			if (hit && hit.size === size && hit.mtimeMs === mtimeMs) return hit.statusText;
+			const lines = await renderLogTailLines(logFile, 40);
+			const statusText = lines ? parseStatusText(lines) : null;
+			statusTextCache.set(logFile, {
+				size,
+				mtimeMs,
+				statusText
+			});
+			return statusText;
+		} catch {
+			return null;
+		}
+	};
 	const niCache = /* @__PURE__ */ new Map();
 	const logNeedsInput = async (logFile, cli) => {
 		if (!logFile) return null;
@@ -1178,6 +1459,7 @@ Options:
 			status: status === "exited" ? status : r.unresponsive ? "stuck" : question ? "needs_input" : status,
 			question,
 			title: await logTitle(r.log_file),
+			status_text: status === "exited" ? null : await logStatusText(r.log_file),
 			git: status === "exited" ? null : await gitStatus(r.cwd),
 			tasks: status === "exited" ? null : await logTasks(r.log_file),
 			badges: status === "exited" ? [] : await logBadges(r.log_file).then(async (b) => await isUserTyping(r.pid) ? [...b, TYPING_BADGE.id] : b)
@@ -1497,7 +1779,7 @@ Options:
 			}
 		});
 		if (req.method === "GET" && p === "/api/ws") {
-			const ws = await import("./ws-BfqEcKyO.js");
+			const ws = await import("./ws-BmHpWaG_.js");
 			try {
 				await ws.loadProvision();
 			} catch (e) {
@@ -1517,7 +1799,7 @@ Options:
 		if (req.method === "GET" && p === "/api/ws/status") {
 			const dirRaw = url.searchParams.get("path");
 			if (!dirRaw) return new Response("missing ?path=<workspace dir>", { status: 400 });
-			const ws = await import("./ws-BfqEcKyO.js");
+			const ws = await import("./ws-BmHpWaG_.js");
 			let prov;
 			try {
 				prov = await ws.loadProvision();
@@ -2073,7 +2355,7 @@ Options:
 			const perm = body.perm ?? "r";
 			if (perm !== "r" && perm !== "rw") return new Response(`invalid perm ${perm} (want r or rw)`, { status: 400 });
 			try {
-				const { createScopedShare } = await import("./agentShare-TJXTia4N.js");
+				const { createScopedShare } = await import("./agentShare-k8224qiZ.js");
 				const share = await createScopedShare({
 					agent: body.agent,
 					perm,
@@ -2088,12 +2370,12 @@ Options:
 			}
 		}
 		if (req.method === "GET" && p === "/api/shares") {
-			const { listShares } = await import("./agentShare-TJXTia4N.js");
+			const { listShares } = await import("./agentShare-k8224qiZ.js");
 			return Response.json(listShares());
 		}
 		const revokeM = /^\/api\/share\/([^/]+)$/.exec(p);
 		if (req.method === "DELETE" && revokeM) {
-			const { revokeShare } = await import("./agentShare-TJXTia4N.js");
+			const { revokeShare } = await import("./agentShare-k8224qiZ.js");
 			const ok = revokeShare(decodeURIComponent(revokeM[1]));
 			return new Response(ok ? "revoked" : "no such share", { status: ok ? 200 : 404 });
 		}
@@ -2209,17 +2491,18 @@ Options:
 			throw e;
 		}
 		if (server) {
+			const listenPort = server.port;
 			const uiHost = host === "0.0.0.0" || host === "::" ? "127.0.0.1" : host;
-			process.stdout.write(`ay serve  ${scheme}://${host}:${port}\n`);
+			process.stdout.write(`ay serve  ${scheme}://${host}:${listenPort}\n`);
 			process.stdout.write(`token:    ${token}\n\n`);
 			process.stdout.write(`web console (token in the # is eaten on open):\n`);
-			process.stdout.write(`  ${scheme}://${uiHost}:${port}/#k=${token}\n\n`);
+			process.stdout.write(`  ${usePortless ? portlessConsoleUrl(token) : `${scheme}://${uiHost}:${listenPort}/#k=${token}`}\n\n`);
 			process.stdout.write(`connect from another machine:\n`);
-			process.stdout.write(`  ay ls   ${token}@<host>:${port}\n`);
-			process.stdout.write(`  ay tail ${token}@<host>:${port}:<keyword>\n`);
-			process.stdout.write(`  ay send ${token}@<host>:${port}:<keyword> "message"\n\n`);
+			process.stdout.write(`  ay ls   ${token}@<host>:${listenPort}\n`);
+			process.stdout.write(`  ay tail ${token}@<host>:${listenPort}:<keyword>\n`);
+			process.stdout.write(`  ay send ${token}@<host>:${listenPort}:<keyword> "message"\n\n`);
 			process.stdout.write(`save as alias:\n`);
-			process.stdout.write(`  ay remote add <alias> ${scheme}://${token}@<host>:${port}\n\n`);
+			process.stdout.write(`  ay remote add <alias> ${scheme}://${token}@<host>:${listenPort}\n\n`);
 			if (!useHttps) process.stdout.write("for HTTPS: ay serve --tls-cert cert.pem --tls-key key.pem\n  openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes -subj '/CN=localhost'\n\n");
 		}
 	}
@@ -2228,7 +2511,7 @@ Options:
 		const webrtcVal = argv.webrtc ?? argv.share;
 		const explicitUrl = typeof webrtcVal === "string" && webrtcVal.startsWith("webrtc://") ? webrtcVal : void 0;
 		try {
-			const { startShare, loadOrCreateShareRoom } = await import("./share-Ciw1mWVN.js");
+			const { startShare, loadOrCreateShareRoom } = await import("./share-_QYjPN7q.js");
 			const linkFile = path.join(process.env.AGENT_YES_HOME ?? path.join(homedir(), ".agent-yes"), ".share-link");
 			const announce = async (room, link, rotated) => {
 				const lead = rotated ? "the room was rejected by signaling (stale generation) — rotated to a fresh link" : "shared over WebRTC — open this link (the token is eaten from the URL on open)";
@@ -2256,7 +2539,10 @@ Options:
 			await announce(room, link, false);
 		} catch (e) {
 			process.stderr.write(`ay serve --webrtc failed: ${e.message}\n`);
-			if (!wantHttp) return 1;
+			if (!wantHttp) {
+				await releaseHostLock?.().catch(() => {});
+				return 1;
+			}
 		}
 	}
 	let heartbeat;
@@ -2275,9 +2561,9 @@ Options:
 	const shutdown = (resolve) => {
 		if (heartbeat) clearInterval(heartbeat);
 		closeShare?.();
-		import("./agentShare-TJXTia4N.js").then((m) => m.revokeAllShares()).catch(() => {});
+		import("./agentShare-k8224qiZ.js").then((m) => m.revokeAllShares()).catch(() => {});
 		server?.stop();
-		resolve();
+		Promise.resolve(releaseHostLock?.()).catch(() => {}).then(resolve);
 	};
 	await new Promise((resolve) => {
 		process.on("SIGINT", () => shutdown(resolve));
@@ -2288,4 +2574,4 @@ Options:
 
 //#endregion
 export { cmdServe };
-//# sourceMappingURL=serve-eqRnhz8Z.js.map
+//# sourceMappingURL=serve-crLypY_c.js.map

package/dist/{setup-BgD5RFXj.js → setup-BPNkeSmY.js}

@@ -32,7 +32,7 @@ async function cmdSetup(rest) {
 	if (!existsSync(abs)) process.stderr.write(`  note: that directory doesn't exist yet — create it, or agents spawned there will fail\n`);
 	if (noShare) return 0;
 	process.stdout.write(`\nsharing this machine to agent-yes.com…\n`);
-	const { cmdServe } = await import("./serve-eqRnhz8Z.js");
+	const { cmdServe } = await import("./serve-crLypY_c.js");
 	return cmdServe([
 		"install",
 		"--share",
@@ -42,4 +42,4 @@ async function cmdSetup(rest) {
 
 //#endregion
 export { cmdSetup };
-//# sourceMappingURL=setup-BgD5RFXj.js.map
+//# sourceMappingURL=setup-BPNkeSmY.js.map

package/dist/{share-Ciw1mWVN.js → share-_QYjPN7q.js}

@@ -1,4 +1,4 @@
 import "./e2e-jb0Hp43q.js";
-import { n as shareLinkFromRoomUrl, r as startShare, t as loadOrCreateShareRoom } from "./share-BfIU8t_h.js";
+import { n as shareLinkFromRoomUrl, r as startShare, t as loadOrCreateShareRoom } from "./share-vchIyVd8.js";
 
 export { loadOrCreateShareRoom, shareLinkFromRoomUrl, startShare };