agent-yes 1.205.0 → 1.207.0

package/ts/serve.ts

@@ -38,6 +38,7 @@ import {
 } from "./subcommands.ts";
 import { TYPING_BADGE } from "./badges.ts";
 import { isTerminalReply } from "./terminalReply.ts";
+import { parseStatusText } from "./statusText.ts";
 import { ensureNodeRuntime, liveEnv } from "./nodeRuntime.ts";
 import { acquireWebrtcHostLock, type ServeLockOwner } from "./serveLock.ts";
 import { type MailParty, recordInbox } from "./messageLog.ts";
@@ -47,6 +48,7 @@ import { findSpawnHiddenLauncher } from "./rustBinary.ts";
 import { pgidForWrapper } from "./reaper.ts";
 import { SUPPORTED_CLIS } from "./SUPPORTED_CLIS.ts";
 import { getInstalledPackage } from "./versionChecker.ts";
+import { negotiateSize, sanitizeCap, type SizeCap } from "./sizeNego.ts";
 import { listStrayServeProcesses } from "./strayServe.ts";
 import {
   getProvisionHook,
@@ -58,7 +60,56 @@ import {
   resolveSpawnCwd,
 } from "./workspaceConfig.ts";
 
-const DEFAULT_PORT = 7432;
+const DEFAULT_PORT = 0;
+const PORTLESS_APP_NAME = "agent-yes";
+const PORTLESS_CHILD_ENV = "AGENT_YES_PORTLESS_CHILD";
+
+export function portlessConsoleUrl(token?: string): string {
+  return portlessConsoleUrlForOrigin(
+    process.env.PORTLESS_URL?.replace(/\/$/, "") || `https://${PORTLESS_APP_NAME}.localhost`,
+    token,
+  );
+}
+
+function portlessConsoleUrlForOrigin(origin: string, token?: string): string {
+  const fragment = token ? `/#k=${encodeURIComponent(token)}` : "/";
+  return `${origin}${fragment}`;
+}
+
+async function resolvedPortlessConsoleUrl(token?: string): Promise<string> {
+  if (process.env.PORTLESS_URL) return portlessConsoleUrl(token);
+  try {
+    const port = Number(
+      (await readFile(path.join(homedir(), ".portless", "proxy.port"), "utf-8")).trim(),
+    );
+    if (Number.isInteger(port) && port > 0)
+      return portlessConsoleUrlForOrigin(
+        `https://${PORTLESS_APP_NAME}.localhost${port === 443 ? "" : `:${port}`}`,
+        token,
+      );
+  } catch {
+    /* Portless has not created state yet. */
+  }
+  return portlessConsoleUrl(token);
+}
+
+async function runWithPortless(rest: string[]): Promise<number> {
+  const portless = Bun.which("portless");
+  if (!portless) {
+    process.stderr.write(
+      "ay serve: Portless is required for local HTTPS. Install it with: npm install -g portless\n",
+    );
+    return 1;
+  }
+  const script = process.argv[1];
+  const self =
+    script && /\.[cm]?[jt]s$/.test(script) ? [process.execPath, script] : [process.execPath];
+  const proc = Bun.spawn([portless, PORTLESS_APP_NAME, ...self, "serve", ...rest], {
+    stdio: ["inherit", "inherit", "inherit"],
+    env: { ...liveEnv(), [PORTLESS_CHILD_ENV]: "1" },
+  });
+  return (await proc.exited) ?? 1;
+}
 
 /**
  * Normalize a user-supplied GitHub-ish source into the standard
@@ -185,10 +236,19 @@ const SESSION_PIN_ENV = new Set([
 // ~/.bun/bin, ~/.cargo/bin, Homebrew, nvm shims, etc. A console-spawned agent
 // that inherits that env can't find `bun`/`bunx`/etc. (the user reported "bunx:
 // command not found" when spawning a new agent from the web UI). We recover the
-// real environment by running the user's interactive login shell and dumping its
-// env, exactly as a fresh terminal would have it. Returns null on Windows (no
-// rc-file model — the process env is already the right one) or on any failure, so
-// callers fall back to process.env.
+// real environment by running the user's LOGIN shell and dumping its env.
+//
+// IMPORTANT: NON-interactive (`-lc`, not `-ilc`). An interactive shell (`-i`)
+// HANGS indefinitely when the daemon has no controlling TTY — exactly the case
+// under any process manager (oxmgr/systemd/launchd/pm2) — and Bun's `spawnSync`
+// `timeout` does NOT kill the hung interactive shell. Because this runs
+// synchronously on the event loop from the /api/spawn handler, the interactive
+// variant PERMANENTLY WEDGED the daemon on the first console spawn (heartbeat
+// froze → healthcheck restart → cache lost → next spawn wedged again), making
+// console spawns impossible on a headless daemon. `-l` still sources the profile
+// chain (`~/.profile`/`~/.bash_profile` → `~/.bashrc`), so the tool PATHs are
+// still recovered. Returns null on Windows (no rc-file model — the process env is
+// already the right one) or on any failure, so callers fall back to process.env.
 let loginShellEnvCache: Record<string, string> | null | undefined;
 function loginShellEnv(): Record<string, string> | null {
   if (loginShellEnvCache !== undefined) return loginShellEnvCache;
@@ -200,7 +260,7 @@ function loginShellEnv(): Record<string, string> | null {
     // print to stdout; `env -0` is NUL-separated so values with newlines survive.
     const delim = "_AY_SHELL_ENV_DELIM_";
     const res = Bun.spawnSync(
-      [shell, "-ilc", `printf %s "${delim}"; env -0; printf %s "${delim}"`],
+      [shell, "-lc", `printf %s "${delim}"; env -0; printf %s "${delim}"`],
       {
         stdin: "ignore",
         stderr: "ignore",
@@ -704,9 +764,28 @@ async function readDaemonServeArgs(mgr: DaemonManager): Promise<string[] | null>
   }
 }
 
-function portFromArgs(args: string[]): number {
+function portFromArgs(args: string[]): number | null {
   const m = /--port[=\s](\d+)/.exec(args.join(" "));
-  return m ? Number(m[1]) : DEFAULT_PORT;
+  return m ? Number(m[1]) : null;
+}
+
+function argsUsePortless(args: string[]): boolean {
+  const wantsHttp =
+    args.some((a) => a.startsWith("--http") || a.startsWith("--share")) ||
+    !args.some((a) => a.startsWith("--webrtc"));
+  return wantsHttp && portFromArgs(args) === null;
+}
+
+async function portlessAppPort(): Promise<number | null> {
+  try {
+    const routes = JSON.parse(
+      await readFile(path.join(homedir(), ".portless", "routes.json"), "utf-8"),
+    ) as { hostname?: string; port?: number }[];
+    const route = routes.find((r) => r.hostname === `${PORTLESS_APP_NAME}.localhost`);
+    return typeof route?.port === "number" ? route.port : null;
+  } catch {
+    return null;
+  }
 }
 
 async function warnStrayServeProcesses(): Promise<void> {
@@ -741,7 +820,8 @@ function explicitWebrtcUrl(args: string[]): string | undefined {
 // Ask the live daemon its version over the local HTTP API. null if it's not
 // listening (webrtc-only) or too old to expose /api/version — both of which we
 // treat as "outdated" so a re-install rolls it forward.
-async function fetchDaemonVersion(port: number, token: string): Promise<string | null> {
+async function fetchDaemonVersion(port: number | null, token: string): Promise<string | null> {
+  if (port === null) return null;
   try {
     const r = await fetch(`http://127.0.0.1:${port}/api/version`, {
       headers: { Authorization: `Bearer ${token}` },
@@ -889,7 +969,8 @@ async function cmdServeDaemon(sub: string, args: string[]): Promise<number> {
       // share link for a WebRTC bridge that isn't actually running. A bare re-run
       // passes no args, so effArgs === priorArgs and this stays a no-op as before.
       const sameConfig = JSON.stringify(effArgs) === JSON.stringify(priorArgs);
-      const runningVer = await fetchDaemonVersion(portFromArgs(effArgs), token);
+      const daemonPort = argsUsePortless(effArgs) ? await portlessAppPort() : portFromArgs(effArgs);
+      const runningVer = await fetchDaemonVersion(daemonPort, token);
       if (runningVer === current && sameConfig) {
         await ensureBootAutostart(mgr);
         process.stdout.write(`'${DAEMON_NAME}' already running v${current} (up to date)\n`);
@@ -982,7 +1063,8 @@ async function cmdServeDaemon(sub: string, args: string[]): Promise<number> {
     const code = await proc.exited;
     if (code === 0) {
       const onBoot = await ensureBootAutostart(mgr);
-      const port = portFromArgs(effArgs);
+      const port = argsUsePortless(effArgs) ? await portlessAppPort() : portFromArgs(effArgs);
+      const localUrl = argsUsePortless(effArgs) ? await resolvedPortlessConsoleUrl(token) : null;
       // Mirror cmdServe's mode resolution: webrtc-only daemons open no HTTP port.
       const httpish =
         effArgs.some((a) => a.startsWith("--http") || a.startsWith("--share")) ||
@@ -1020,8 +1102,12 @@ async function cmdServeDaemon(sub: string, args: string[]): Promise<number> {
         );
       process.stdout.write(`token: ${token}\n\n`);
       if (httpish) {
-        process.stdout.write(`  ay ls   ${token}@<host>:${port}\n`);
-        process.stdout.write(`  ay remote add <alias> http://${token}@<host>:${port}\n`);
+        if (argsUsePortless(effArgs)) {
+          process.stdout.write(`  web console: ${localUrl}\n`);
+        } else if (port !== null) {
+          process.stdout.write(`  ay ls   ${token}@<host>:${port}\n`);
+          process.stdout.write(`  ay remote add <alias> http://${token}@<host>:${port}\n`);
+        }
       }
       process.stdout.write(`  ay serve logs                # view server logs\n`);
       process.stdout.write(`  ay serve uninstall           # remove daemon\n`);
@@ -1054,7 +1140,9 @@ async function cmdServeStatus(args: string[]): Promise<number> {
   const daemonArgs = mgr ? await readDaemonServeArgs(mgr) : null;
   const installed = daemonArgs !== null;
   const a = daemonArgs ?? [];
-  const port = portFromArgs(a);
+  const local = argsUsePortless(a);
+  const port = local ? await portlessAppPort() : portFromArgs(a);
+  const localUrl = local ? await resolvedPortlessConsoleUrl(token ?? undefined) : null;
   // Mirror cmdServe/install mode resolution: webrtc when --webrtc/--share; http
   // when --http/--share OR no --webrtc at all (http is the implicit default).
   const webrtcish = a.some((x) => x.startsWith("--webrtc") || x.startsWith("--share"));
@@ -1076,6 +1164,7 @@ async function cmdServeStatus(args: string[]): Promise<number> {
           installed,
           mode,
           port: httpish ? port : null,
+          localUrl: httpish ? localUrl : null,
           reachable: runningVersion !== null,
           runningVersion,
           currentVersion: current,
@@ -1096,25 +1185,32 @@ async function cmdServeStatus(args: string[]): Promise<number> {
   w(`manager:      ${mgr ? mgr.id : "none — install pm2 or oxmgr to daemonize"}`);
   if (installed) {
     w(`installed:    yes (via ${mgr!.id})`);
-    w(`mode:         ${mode}${httpish ? `  (port ${port})` : ""}`);
+    w(`mode:         ${mode}${httpish ? (local ? `  (${localUrl})` : `  (port ${port})`) : ""}`);
     if (a.length) w(`args:         ${a.join(" ")}`);
   } else {
     w(`installed:    no — start a daemon with:  ay serve install [--share]`);
   }
   if (runningVersion !== null) {
     const tag = runningVersion === current ? "up to date" : `outdated (current v${current})`;
-    w(`http api:     reachable on 127.0.0.1:${port} — v${runningVersion} (${tag})`);
+    w(
+      `http api:     reachable ${local ? `via ${localUrl}` : `on 127.0.0.1:${port}`} — v${runningVersion} (${tag})`,
+    );
   } else if (mode === "webrtc") {
     w(`http api:     none (webrtc-only)`);
   } else {
-    w(`http api:     not reachable on 127.0.0.1:${port} (not running)`);
+    w(
+      `http api:     not reachable ${local ? `via ${localUrl}` : `on 127.0.0.1:${port}`} (not running)`,
+    );
   }
   w(`token:        ${token ?? "(none yet — created on first serve)"}`);
   if (shareLink) w(`share link:   ${shareLink}`);
   if (token && httpish) {
     w();
-    w(`connect:  ay ls   ${token}@<host>:${port}`);
-    w(`          ay remote add <alias> http://${token}@<host>:${port}`);
+    if (local) w(`console:  ${localUrl}`);
+    else if (port !== null) {
+      w(`connect:  ay ls   ${token}@<host>:${port}`);
+      w(`          ay remote add <alias> http://${token}@<host>:${port}`);
+    }
   }
   return 0;
 }
@@ -1138,11 +1234,13 @@ export async function cmdServe(rest: string[]): Promise<number> {
         `                    (stable link across restarts; delete the file to rotate).\n` +
         `  --share [URL]     Legacy alias for --http --webrtc\n\n` +
         `Options:\n` +
-        `  --port N          Port to listen on (default: ${DEFAULT_PORT})\n` +
+        `  --port N          Bypass Portless and listen on a fixed HTTP port\n` +
         `  --host HOST       Interface to bind (default: 127.0.0.1; use 0.0.0.0 to expose)\n` +
         `  --token TOKEN     Auth token (auto-generated and saved if omitted)\n` +
         `  -d, --daemon      Install these flags as a background daemon (pm2/oxmgr)\n` +
         `                    (same as: ay serve install <flags>)\n` +
+        `  --local           Explicitly use Portless (the default for HTTP mode)\n` +
+        `                    ${portlessConsoleUrl()}\n` +
         `  --allow-spawn     Deprecated no-op — the console can always spawn agents\n` +
         `  --tls-cert FILE   TLS certificate PEM\n` +
         `  --tls-key  FILE   TLS private key PEM\n\n` +
@@ -1152,8 +1250,8 @@ export async function cmdServe(rest: string[]): Promise<number> {
         `  ay serve uninstall  remove daemon\n` +
         `  ay serve logs       view daemon logs\n\n` +
         `Once running, connect from another machine:\n` +
-        `  ay ls   <token>@<host>:${DEFAULT_PORT}\n` +
-        `  ay remote add <alias> http://<token>@<host>:${DEFAULT_PORT}\n`,
+        `  ay ls   <token>@<host>:<port>\n` +
+        `  ay remote add <alias> http://<token>@<host>:<port>\n`,
     );
     return 0;
   }
@@ -1189,7 +1287,7 @@ export async function cmdServe(rest: string[]): Promise<number> {
 
   const y = yargs(rest)
     .usage("Usage: ay serve [options]")
-    .option("port", { type: "number", default: DEFAULT_PORT, description: "Port to listen on" })
+    .option("port", { type: "number", description: "Bypass Portless and listen on a fixed port" })
     .option("host", {
       type: "string",
       default: "127.0.0.1",
@@ -1217,6 +1315,11 @@ export async function cmdServe(rest: string[]): Promise<number> {
       default: false,
       description: "Install as a background daemon (same as: ay serve install <flags>)",
     })
+    .option("local", {
+      type: "boolean",
+      default: false,
+      description: `Use Portless at ${portlessConsoleUrl()} (default for HTTP mode)`,
+    })
     .option("allow-spawn", {
       type: "boolean",
       default: false,
@@ -1225,7 +1328,8 @@ export async function cmdServe(rest: string[]): Promise<number> {
     .option("takeover", {
       type: "boolean",
       default: false,
-      description: "If another ay serve already hosts this home's WebRTC room, stop it and take the room",
+      description:
+        "If another ay serve already hosts this home's WebRTC room, stop it and take the room",
     })
     .help(false)
     .version(false)
@@ -1240,6 +1344,18 @@ export async function cmdServe(rest: string[]): Promise<number> {
     return cmdServeDaemon("install", fwd);
   }
 
+  const wantWebrtc = argv.webrtc !== undefined || argv.share !== undefined;
+  const wantHttp = argv.http === true || argv.share !== undefined || argv.webrtc === undefined;
+  const fixedPort = typeof argv.port === "number";
+  const usePortless = wantHttp && !fixedPort;
+  if (argv.local === true && fixedPort) {
+    process.stderr.write("ay serve: --local and --port cannot be used together\n");
+    return 1;
+  }
+  if (usePortless && process.env[PORTLESS_CHILD_ENV] !== "1" && process.env.PORTLESS !== "0") {
+    return runWithPortless(rest);
+  }
+
   // `ay serve` takes only flags (plus the install/uninstall/logs subcommands
   // handled above). A bare word like `ay serve share` is silently dropped into
   // argv._ by yargs and would otherwise start in the wrong mode — most often
@@ -1260,7 +1376,7 @@ export async function cmdServe(rest: string[]): Promise<number> {
   // top-level agents regardless of the spawn path.
   delete process.env.AGENT_YES_PID;
 
-  const port = (argv.port as number) ?? DEFAULT_PORT;
+  const port = (argv.port as number | undefined) ?? (Number(process.env.PORT) || DEFAULT_PORT);
   const host = (argv.host as string) ?? "127.0.0.1";
   const tokenFlag = typeof argv.token === "string" ? argv.token : undefined;
   const certPath = typeof argv["tls-cert"] === "string" ? argv["tls-cert"] : undefined;
@@ -1276,8 +1392,6 @@ export async function cmdServe(rest: string[]): Promise<number> {
   // Modes: --http (HTTP listener + web console), --webrtc (port-free WebRTC
   // share), or both. Bare `ay serve` stays HTTP-only; --share keeps its old
   // meaning (HTTP + WebRTC) for existing invocations.
-  const wantWebrtc = argv.webrtc !== undefined || argv.share !== undefined;
-  const wantHttp = argv.http === true || argv.share !== undefined || argv.webrtc === undefined;
 
   // Singleton WebRTC host per ~/.agent-yes: a second host joining the SAME
   // persisted room (~/.agent-yes/.share-room) fights the first over every
@@ -1435,6 +1549,28 @@ export async function cmdServe(rest: string[]): Promise<number> {
     }
   };
 
+  // Per-agent live status description from the rendered screen. Claude Code
+  // paints a spinner/status line while working; surfacing it lets the left panel
+  // show "what it's doing" without opening the terminal.
+  const statusTextCache = new Map<
+    string,
+    { size: number; mtimeMs: number; statusText: string | null }
+  >();
+  const logStatusText = async (logFile: string | null | undefined): Promise<string | null> => {
+    if (!logFile) return null;
+    try {
+      const { size, mtimeMs } = await stat(logFile);
+      const hit = statusTextCache.get(logFile);
+      if (hit && hit.size === size && hit.mtimeMs === mtimeMs) return hit.statusText;
+      const lines = await renderLogTailLines(logFile, 40);
+      const statusText = lines ? parseStatusText(lines) : null;
+      statusTextCache.set(logFile, { size, mtimeMs, statusText });
+      return statusText;
+    } catch {
+      return null;
+    }
+  };
+
   // Per-agent "waiting on you" detection: the agent is parked on an interactive
   // menu it did NOT auto-resolve (config `needsInput` patterns). Same source and
   // classifier as `ay ls` / `ay status`, so the console's dot matches the CLI's
@@ -1701,6 +1837,7 @@ export async function cmdServe(rest: string[]): Promise<number> {
       // WHAT the agent is waiting on. Null otherwise.
       question,
       title: await logTitle(r.log_file),
+      status_text: status === "exited" ? null : await logStatusText(r.log_file),
       git: status === "exited" ? null : await gitStatus(r.cwd),
       // Task progress from the rendered todo block (null when none detected → no
       // badge). Skipped for exited agents — their screen is no longer live.
@@ -1723,10 +1860,87 @@ export async function cmdServe(rest: string[]): Promise<number> {
   // never a security surface — viewers self-report. Pruned by TTL on read.
   const presence = new Map<
     string,
-    { viewer: string; agent: string; cols: number; rows: number; sel: string | null; ts: number }
+    {
+      viewer: string;
+      agent: string;
+      cols: number;
+      rows: number;
+      sel: string | null;
+      cap: SizeCap | null;
+      ts: number;
+    }
   >();
   const PRESENCE_TTL_MS = 12_000;
 
+  // ── PTY size negotiation — tmux's "smallest client wins" ──────────────────
+  // Writable viewers report their readable capacity (`cap`) alongside their
+  // presence; we resize the agent's PTY to the elementwise min across live caps
+  // (see sizeNego.ts), so a phone gets a grid it can read while wider viewers
+  // letterbox the shared canvas. Uses the same winsize-file + SIGWINCH path as
+  // POST /api/resize. When the last cap leaves (viewer switched agent, tab
+  // died → TTL), the size is withdrawn: the file is deleted ONLY if its content
+  // is still our own last write (so `ay attach`'s pushed size is never
+  // clobbered) and the wrapper falls back to the real tty size.
+  const negoApplied = new Map<number, { cols: number; rows: number; content: string }>();
+  const negoTimers = new Map<number, ReturnType<typeof setTimeout>>();
+  const NEGO_DEBOUNCE_MS = 350;
+  const winsizePathFor = (pid: number) =>
+    path.join(process.env.AGENT_YES_HOME ?? path.join(homedir(), ".agent-yes"), "winsize", String(pid));
+  const liveCapsFor = (pid: number): SizeCap[] => {
+    const now = Date.now();
+    const caps: SizeCap[] = [];
+    for (const v of presence.values())
+      if (now - v.ts <= PRESENCE_TTL_MS && String(v.agent) === String(pid) && v.cap)
+        caps.push(v.cap);
+    return caps;
+  };
+  const applyNego = async (pid: number) => {
+    negoTimers.delete(pid);
+    const eff = negotiateSize(liveCapsFor(pid));
+    const file = winsizePathFor(pid);
+    const prev = negoApplied.get(pid);
+    try {
+      if (eff) {
+        if (prev && prev.cols === eff.cols && prev.rows === eff.rows) return;
+        const content = `${eff.cols} ${eff.rows} ${Date.now()}\n`;
+        await mkdir(path.dirname(file), { recursive: true });
+        await writeFile(file, content);
+        negoApplied.set(pid, { ...eff, content });
+      } else {
+        if (!prev) return;
+        negoApplied.delete(pid);
+        try {
+          // withdraw only what we wrote — a different content means ay attach
+          // (or a direct /api/resize) owns the size now; leave it alone.
+          if ((await readFile(file, "utf-8")) !== prev.content) return;
+          await unlink(file);
+        } catch {
+          return; // already gone — nothing to signal
+        }
+      }
+      try {
+        process.kill(pid, "SIGWINCH");
+      } catch {
+        /* agent gone */
+      }
+    } catch {
+      /* best-effort: a failed write just leaves the previous size in place */
+    }
+  };
+  const scheduleNego = (pid: number) => {
+    if (!Number.isFinite(pid) || pid <= 0 || negoTimers.has(pid)) return;
+    negoTimers.set(
+      pid,
+      setTimeout(() => void applyNego(pid), NEGO_DEBOUNCE_MS),
+    );
+  };
+  // TTL grow-back sweep: a viewer that vanished without clearing its presence
+  // (tab killed, phone locked) stops refreshing; once its entry expires the
+  // negotiated size must be recomputed even though no presence POST arrives.
+  setInterval(() => {
+    for (const pid of negoApplied.keys()) scheduleNego(pid);
+  }, 5_000);
+
   // The whole API as a plain handler: served over HTTP by Bun.serve (--http)
   // and called in-process by the WebRTC bridge (--webrtc) — the latter needs
   // no TCP port at all.
@@ -2203,6 +2417,10 @@ export async function cmdServe(rest: string[]): Promise<number> {
           pid: record.pid,
           cols: size?.cols ?? null,
           rows: size?.rows ?? null,
+          // This host negotiates the PTY size from viewer capacities (presence
+          // `cap`) — a capable console should report its cap instead of pushing
+          // /api/resize directly, so viewers stop fighting last-writer-wins.
+          nego: true,
         });
       } catch (e) {
         return new Response((e as Error).message, { status: 404 });
@@ -2608,6 +2826,7 @@ export async function cmdServe(rest: string[]): Promise<number> {
         cols?: number;
         rows?: number;
         sel?: string;
+        cap?: { cols?: number; rows?: number };
       };
       try {
         b = (await req.json()) as typeof b;
@@ -2616,6 +2835,9 @@ export async function cmdServe(rest: string[]): Promise<number> {
       }
       const viewer = String(b.viewer ?? "").slice(0, 64);
       if (!viewer) return new Response("missing viewer", { status: 400 });
+      // The agent this viewer WAS on — if the entry moves (agent switch) or
+      // clears, that agent's negotiated size must be recomputed (grow-back).
+      const prevAgent = presence.get(viewer)?.agent;
       if (b.agent == null) presence.delete(viewer);
       else
         presence.set(viewer, {
@@ -2624,8 +2846,12 @@ export async function cmdServe(rest: string[]): Promise<number> {
           cols: Math.max(0, Math.floor(Number(b.cols) || 0)),
           rows: Math.max(0, Math.floor(Number(b.rows) || 0)),
           sel: typeof b.sel === "string" ? b.sel.slice(0, 200) : null,
+          cap: sanitizeCap(b.cap),
           ts: Date.now(),
         });
+      if (b.agent != null) scheduleNego(Number(b.agent));
+      if (prevAgent != null && String(prevAgent) !== String(b.agent ?? ""))
+        scheduleNego(Number(prevAgent));
       return new Response(null, { status: 204 });
     }
     // GET /api/presence — all live viewers (TTL-pruned), for "who's watching".
@@ -3208,17 +3434,20 @@ export async function cmdServe(rest: string[]): Promise<number> {
     // server is null only when we degraded to WebRTC-only above (port wedged);
     // skip the HTTP connection banner since nothing is listening on the port.
     if (server) {
+      const listenPort = server.port;
       const uiHost = host === "0.0.0.0" || host === "::" ? "127.0.0.1" : host;
-      process.stdout.write(`ay serve  ${scheme}://${host}:${port}\n`);
+      process.stdout.write(`ay serve  ${scheme}://${host}:${listenPort}\n`);
       process.stdout.write(`token:    ${token}\n\n`);
       process.stdout.write(`web console (token in the # is eaten on open):\n`);
-      process.stdout.write(`  ${scheme}://${uiHost}:${port}/#k=${token}\n\n`);
+      process.stdout.write(
+        `  ${usePortless ? portlessConsoleUrl(token) : `${scheme}://${uiHost}:${listenPort}/#k=${token}`}\n\n`,
+      );
       process.stdout.write(`connect from another machine:\n`);
-      process.stdout.write(`  ay ls   ${token}@<host>:${port}\n`);
-      process.stdout.write(`  ay tail ${token}@<host>:${port}:<keyword>\n`);
-      process.stdout.write(`  ay send ${token}@<host>:${port}:<keyword> "message"\n\n`);
+      process.stdout.write(`  ay ls   ${token}@<host>:${listenPort}\n`);
+      process.stdout.write(`  ay tail ${token}@<host>:${listenPort}:<keyword>\n`);
+      process.stdout.write(`  ay send ${token}@<host>:${listenPort}:<keyword> "message"\n\n`);
       process.stdout.write(`save as alias:\n`);
-      process.stdout.write(`  ay remote add <alias> ${scheme}://${token}@<host>:${port}\n\n`);
+      process.stdout.write(`  ay remote add <alias> ${scheme}://${token}@<host>:${listenPort}\n\n`);
       if (!useHttps) {
         process.stdout.write(
           `for HTTPS: ay serve --tls-cert cert.pem --tls-key key.pem\n` +

package/ts/serveLock.spec.ts

@@ -140,7 +140,8 @@ describe("acquireWebrtcHostLock — held-lock lifecycle", () => {
   });
 
   const ownerFile = () => path.join(home, "webrtc-host.lock", "owner.json");
-  const readOwnerFile = async () => JSON.parse(await readFile(ownerFile(), "utf-8")) as ServeLockOwner;
+  const readOwnerFile = async () =>
+    JSON.parse(await readFile(ownerFile(), "utf-8")) as ServeLockOwner;
 
   it("heartbeats refresh beat_at while held", async () => {
     const got = await acquireWebrtcHostLock({ graceMs: 0, beatMs: 40 });
@@ -190,19 +191,19 @@ describe("acquireWebrtcHostLock — held-lock lifecycle", () => {
   it.skipIf(process.platform === "win32")(
     "escalates to SIGKILL when the owner ignores SIGTERM",
     async () => {
-    const { spawn } = await import("node:child_process");
-    const stubborn = spawn("/bin/sh", ["-c", "trap '' TERM; sleep 30"], { stdio: "ignore" });
-    const pid = stubborn.pid!;
-    await new Promise((r) => setTimeout(r, 100)); // let the trap install
-    const { mkdir: mkd, writeFile: wf } = await import("fs/promises");
-    await mkd(path.join(home, "webrtc-host.lock"), { recursive: true });
-    await wf(ownerFile(), JSON.stringify({ pid, started_at: Date.now(), beat_at: Date.now() }));
-
-    const got = await acquireWebrtcHostLock({ takeover: true, graceMs: 0, takeoverWaitMs: 200 });
-    expect(got.ok).toBe(true);
-    if (got.ok) releases.push(got.release);
-    await new Promise((r) => setTimeout(r, 100));
-    expect(stubborn.signalCode).toBe("SIGKILL");
+      const { spawn } = await import("node:child_process");
+      const stubborn = spawn("/bin/sh", ["-c", "trap '' TERM; sleep 30"], { stdio: "ignore" });
+      const pid = stubborn.pid!;
+      await new Promise((r) => setTimeout(r, 100)); // let the trap install
+      const { mkdir: mkd, writeFile: wf } = await import("fs/promises");
+      await mkd(path.join(home, "webrtc-host.lock"), { recursive: true });
+      await wf(ownerFile(), JSON.stringify({ pid, started_at: Date.now(), beat_at: Date.now() }));
+
+      const got = await acquireWebrtcHostLock({ takeover: true, graceMs: 0, takeoverWaitMs: 200 });
+      expect(got.ok).toBe(true);
+      if (got.ok) releases.push(got.release);
+      await new Promise((r) => setTimeout(r, 100));
+      expect(stubborn.signalCode).toBe("SIGKILL");
     },
   );