agent-yes 1.223.0 → 1.223.1

package/dist/SUPPORTED_CLIS-CE3JLqnP.js

@@ -0,0 +1,9 @@
+import "./ts-bE-SKMWi.js";
+import "./logger-CDIsZ-Pp.js";
+import "./versionChecker-EEzUODBd.js";
+import "./pidStore-BIvsBQ8X.js";
+import "./globalPidIndex-CoNr7tS8.js";
+import "./messageLog-CxrKJj77.js";
+import { t as SUPPORTED_CLIS } from "./SUPPORTED_CLIS-CY6Qo_bF.js";
+
+export { SUPPORTED_CLIS };

package/dist/{SUPPORTED_CLIS-91SHco8n.js → SUPPORTED_CLIS-CY6Qo_bF.js}

@@ -1,8 +1,8 @@
-import { t as CLIS_CONFIG } from "./ts-74aVYJYj.js";
+import { t as CLIS_CONFIG } from "./ts-bE-SKMWi.js";
 
 //#region ts/SUPPORTED_CLIS.ts
 const SUPPORTED_CLIS = Object.keys(CLIS_CONFIG);
 
 //#endregion
 export { SUPPORTED_CLIS as t };
-//# sourceMappingURL=SUPPORTED_CLIS-91SHco8n.js.map
+//# sourceMappingURL=SUPPORTED_CLIS-CY6Qo_bF.js.map

package/dist/{agentShare-CXksKQvX.js → agentShare-CRJb4GhE.js}

@@ -2,7 +2,7 @@ import "./logger-CDIsZ-Pp.js";
 import "./globalPidIndex-CoNr7tS8.js";
 import "./messageLog-CxrKJj77.js";
 import "./configShared-aKTg-sa5.js";
-import { M as resolveOne } from "./subcommands-D2llN6dR.js";
+import { M as resolveOne } from "./subcommands-Dl2Kx1FC.js";
 import "./e2e-jb0Hp43q.js";
 import "./webrtcLink-B7REGtK2.js";
 import "./remotes-CZGDxzIP.js";
@@ -229,4 +229,4 @@ function transformEvent(rawEvent, agentId, forwarded) {
 
 //#endregion
 export { createScopedShare, listShares, revokeAllShares, revokeShare };
-//# sourceMappingURL=agentShare-CXksKQvX.js.map
+//# sourceMappingURL=agentShare-CRJb4GhE.js.map

package/dist/{callback-8taXMdxt.js → callback-CzFcLTZn.js}

@@ -2,11 +2,11 @@ import "./logger-CDIsZ-Pp.js";
 import "./globalPidIndex-CoNr7tS8.js";
 import "./messageLog-CxrKJj77.js";
 import "./configShared-aKTg-sa5.js";
-import "./subcommands-D2llN6dR.js";
+import "./subcommands-Dl2Kx1FC.js";
 import "./e2e-jb0Hp43q.js";
 import "./webrtcLink-B7REGtK2.js";
 import "./remotes-CZGDxzIP.js";
 import "./callbackCore-Cm_yYhep.js";
-import { i as loadOrCreateCallbackSecret, n as isCallbackRevoked, r as loadCallbackSecretReadOnly, t as cmdCallback } from "./callback-C1ICxY94.js";
+import { i as loadOrCreateCallbackSecret, n as isCallbackRevoked, r as loadCallbackSecretReadOnly, t as cmdCallback } from "./callback-DZhSN9-O.js";
 
 export { cmdCallback };

package/dist/{callback-C1ICxY94.js → callback-DZhSN9-O.js}

@@ -1,5 +1,5 @@
 import { t as agentYesHome } from "./agentYesHome-CtHb5b71.js";
-import { M as resolveOne } from "./subcommands-D2llN6dR.js";
+import { M as resolveOne } from "./subcommands-Dl2Kx1FC.js";
 import { a as mintCapability, o as parseExpires } from "./callbackCore-Cm_yYhep.js";
 import { randomBytes } from "node:crypto";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
@@ -72,7 +72,7 @@ async function resolveBase(flag) {
 	if (flag) return flag;
 	if (process.env.AGENT_YES_CALLBACK_BASE) return process.env.AGENT_YES_CALLBACK_BASE;
 	try {
-		const { resolveLocalServeUrl } = await import("./serve-D1GP9e62.js");
+		const { resolveLocalServeUrl } = await import("./serve-v5fUhHiR.js");
 		const url = await resolveLocalServeUrl();
 		if (url) return url;
 	} catch {}
@@ -187,4 +187,4 @@ async function cmdCallback(rest) {
 
 //#endregion
 export { loadOrCreateCallbackSecret as i, isCallbackRevoked as n, loadCallbackSecretReadOnly as r, cmdCallback as t };
-//# sourceMappingURL=callback-C1ICxY94.js.map
+//# sourceMappingURL=callback-DZhSN9-O.js.map

package/dist/cli.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env bun
 import { t as invokedCliName } from "./invokedCli-uqM2YYA7.js";
 import { n as logger } from "./logger-CDIsZ-Pp.js";
-import { i as versionString, n as displayVersion, t as checkAndAutoUpdate } from "./versionChecker-QP6QKiG-.js";
-import { n as getRustBinary } from "./rustBinary-CODJm5nX.js";
+import { i as versionString, n as displayVersion, t as checkAndAutoUpdate } from "./versionChecker-EEzUODBd.js";
+import { n as getRustBinary } from "./rustBinary-CUJuJD2N.js";
 import { argv } from "process";
 import { spawn } from "child_process";
 import ms from "ms";
@@ -285,7 +285,7 @@ function buildRustArgs(argv, cliFromScript, supportedClis) {
 	const rawArg = process.argv[2];
 	const managerCommands = !invokedCliName(process.argv);
 	const isHelpFlag = rawArg === "-h" || rawArg === "--help";
-	const { isSubcommand, runSubcommand, cmdHelp } = await import("./subcommands-CvmstmY_.js");
+	const { isSubcommand, runSubcommand, cmdHelp } = await import("./subcommands-ZqHQMFDJ.js");
 	if (isHelpFlag && process.argv.length === 3) {
 		await cmdHelp(managerCommands);
 		process.exit(0);
@@ -327,7 +327,7 @@ if (config.useRust) {
 		}
 	}
 	if (rustBinary) {
-		const { SUPPORTED_CLIS } = await import("./SUPPORTED_CLIS-6VyrMWG_.js");
+		const { SUPPORTED_CLIS } = await import("./SUPPORTED_CLIS-CE3JLqnP.js");
 		const rustArgs = buildRustArgs(process.argv, config.cli, SUPPORTED_CLIS);
 		if (config.verbose) {
 			console.log(`[rust] Using binary: ${rustBinary}`);

package/dist/index.js

@@ -1,6 +1,6 @@
-import { a as removeControlCharacters, i as AgentContext, n as agentYes, r as config, t as CLIS_CONFIG } from "./ts-74aVYJYj.js";
+import { i as AgentContext, n as agentYes, o as removeControlCharacters, r as config, t as CLIS_CONFIG } from "./ts-bE-SKMWi.js";
 import "./logger-CDIsZ-Pp.js";
-import "./versionChecker-QP6QKiG-.js";
+import "./versionChecker-EEzUODBd.js";
 import "./pidStore-BIvsBQ8X.js";
 import "./globalPidIndex-CoNr7tS8.js";
 import "./messageLog-CxrKJj77.js";

package/dist/{notifyDaemon-C4Z9gxKe.js → notifyDaemon-CjszDILI.js}

@@ -2,7 +2,7 @@ import { n as logger } from "./logger-CDIsZ-Pp.js";
 import "./globalPidIndex-CoNr7tS8.js";
 import "./messageLog-CxrKJj77.js";
 import "./configShared-aKTg-sa5.js";
-import { $ as daemonLockOwnerPath, G as gcInboxes, J as listInboxParents, K as hostId, Q as daemonLockDir, S as listRecords, W as appendEvent, X as readInbox, Y as liveWatchers, Z as shouldStealLock, _ as isPidAlive, c as deriveLiveState, et as notifyDir, k as renderLogTailLines } from "./subcommands-D2llN6dR.js";
+import { $ as daemonLockOwnerPath, G as gcInboxes, J as listInboxParents, K as hostId, Q as daemonLockDir, S as listRecords, W as appendEvent, X as readInbox, Y as liveWatchers, Z as shouldStealLock, _ as isPidAlive, c as deriveLiveState, et as notifyDir, k as renderLogTailLines } from "./subcommands-Dl2Kx1FC.js";
 import "./e2e-jb0Hp43q.js";
 import "./webrtcLink-B7REGtK2.js";
 import "./remotes-CZGDxzIP.js";
@@ -589,4 +589,4 @@ async function ensureDaemon() {
 
 //#endregion
 export { daemonStatus, ensureDaemon, requestDaemonStop, runDaemon };
-//# sourceMappingURL=notifyDaemon-C4Z9gxKe.js.map
+//# sourceMappingURL=notifyDaemon-CjszDILI.js.map

package/dist/{rustBinary-CODJm5nX.js → rustBinary-CUJuJD2N.js}

@@ -1,4 +1,4 @@
-import { r as getInstalledPackage } from "./versionChecker-QP6QKiG-.js";
+import { r as getInstalledPackage } from "./versionChecker-EEzUODBd.js";
 import { execFileSync } from "child_process";
 import { existsSync, mkdirSync, unlinkSync } from "fs";
 import { chmod, copyFile } from "fs/promises";
@@ -225,4 +225,4 @@ async function getRustBinary(options = {}) {
 
 //#endregion
 export { getRustBinary as n, findSpawnHiddenLauncher as t };
-//# sourceMappingURL=rustBinary-CODJm5nX.js.map
+//# sourceMappingURL=rustBinary-CUJuJD2N.js.map

package/dist/{schedule-CmbUKK0u.js → schedule-CKF_arnv.js}

@@ -1,10 +1,10 @@
-import "./ts-74aVYJYj.js";
+import "./ts-bE-SKMWi.js";
 import "./logger-CDIsZ-Pp.js";
-import "./versionChecker-QP6QKiG-.js";
+import "./versionChecker-EEzUODBd.js";
 import "./pidStore-BIvsBQ8X.js";
 import "./globalPidIndex-CoNr7tS8.js";
 import "./messageLog-CxrKJj77.js";
-import { t as SUPPORTED_CLIS } from "./SUPPORTED_CLIS-91SHco8n.js";
+import { t as SUPPORTED_CLIS } from "./SUPPORTED_CLIS-CY6Qo_bF.js";
 import { d as resolveSpawnCwd } from "./workspaceConfig-Dcbe4y77.js";
 import { n as liveEnv, t as ensureNodeRuntime } from "./nodeRuntime-DttG711L.js";
 import { createHash } from "node:crypto";
@@ -151,4 +151,4 @@ async function cmdSchedule(rest) {
 
 //#endregion
 export { cmdSchedule };
-//# sourceMappingURL=schedule-CmbUKK0u.js.map
+//# sourceMappingURL=schedule-CKF_arnv.js.map

package/dist/{serve-D1GP9e62.js → serve-v5fUhHiR.js}

@@ -1,20 +1,20 @@
-import "./ts-74aVYJYj.js";
+import { a as CLAUDE_SESSION_PIN_ENV } from "./ts-bE-SKMWi.js";
 import "./logger-CDIsZ-Pp.js";
-import { r as getInstalledPackage } from "./versionChecker-QP6QKiG-.js";
-import { t as findSpawnHiddenLauncher } from "./rustBinary-CODJm5nX.js";
+import { r as getInstalledPackage } from "./versionChecker-EEzUODBd.js";
+import { t as findSpawnHiddenLauncher } from "./rustBinary-CUJuJD2N.js";
 import { t as agentYesHome$1 } from "./agentYesHome-CtHb5b71.js";
 import "./pidStore-BIvsBQ8X.js";
 import { a as updateGlobalPidStatus } from "./globalPidIndex-CoNr7tS8.js";
 import { r as recordInbox } from "./messageLog-CxrKJj77.js";
 import { t as pgidForWrapper } from "./reaper-BUHCyxdF.js";
 import "./configShared-aKTg-sa5.js";
-import { t as SUPPORTED_CLIS } from "./SUPPORTED_CLIS-91SHco8n.js";
-import { A as renderRawLog, D as recentMessageEdges, E as readPtysize, L as snapshotStatus, M as resolveOne, O as recentReadEdges, S as listRecords, T as readNotes, U as writeToIpc, b as isUserTyping, f as extractNeedsInput, j as renderRawLogLines, k as renderLogTailLines, l as deriveLiveStatus, o as controlCodeFromName, p as extractTaskCounts, q as isTransientLockMkdirError, tt as TYPING_BADGE, u as extractBadges } from "./subcommands-D2llN6dR.js";
+import { t as SUPPORTED_CLIS } from "./SUPPORTED_CLIS-CY6Qo_bF.js";
+import { A as renderRawLog, D as recentMessageEdges, E as readPtysize, L as snapshotStatus, M as resolveOne, O as recentReadEdges, S as listRecords, T as readNotes, U as writeToIpc, b as isUserTyping, f as extractNeedsInput, j as renderRawLogLines, k as renderLogTailLines, l as deriveLiveStatus, o as controlCodeFromName, p as extractTaskCounts, q as isTransientLockMkdirError, tt as TYPING_BADGE, u as extractBadges } from "./subcommands-Dl2Kx1FC.js";
 import "./e2e-jb0Hp43q.js";
 import "./webrtcLink-B7REGtK2.js";
 import "./remotes-CZGDxzIP.js";
 import { i as frameVisitorMessage, s as verifyCapability, t as MAX_CALLBACK_MSG_BYTES } from "./callbackCore-Cm_yYhep.js";
-import { n as isCallbackRevoked, r as loadCallbackSecretReadOnly } from "./callback-C1ICxY94.js";
+import { n as isCallbackRevoked, r as loadCallbackSecretReadOnly } from "./callback-DZhSN9-O.js";
 import { a as getSpawnHook, c as hasProvisionHook, d as resolveSpawnCwd, i as getProvisionRoot, l as hasSpawnHook, r as getProvisionHook, u as isProvisionAllowed } from "./workspaceConfig-Dcbe4y77.js";
 import { n as liveEnv, t as ensureNodeRuntime } from "./nodeRuntime-DttG711L.js";
 import { r as spawnRejectionReason } from "./spawnGate-SmqvtNIZ.js";
@@ -417,14 +417,7 @@ const defaultOpts = (overrides = {}) => ({
 	cwdScope: null,
 	...overrides
 });
-const SESSION_PIN_ENV = new Set([
-	"CLAUDECODE",
-	"CLAUDE_CODE_SSE_PORT",
-	"CLAUDE_CODE_SESSION_ID",
-	"CLAUDE_CODE_CHILD_SESSION",
-	"CLAUDE_CODE_ENTRYPOINT",
-	"AGENT_YES_PID"
-]);
+const SESSION_PIN_ENV = new Set([...CLAUDE_SESSION_PIN_ENV, "AGENT_YES_PID"]);
 let loginShellEnvCache;
 function loginShellEnv() {
 	if (loginShellEnvCache !== void 0) return loginShellEnvCache;
@@ -1997,7 +1990,7 @@ Options:
 			}
 		});
 		if (req.method === "GET" && p === "/api/ws") {
-			const ws = await import("./ws-93eeiNKB.js");
+			const ws = await import("./ws-qE_t5H8x.js");
 			try {
 				await ws.loadProvision();
 			} catch (e) {
@@ -2017,7 +2010,7 @@ Options:
 		if (req.method === "GET" && p === "/api/ws/status") {
 			const dirRaw = url.searchParams.get("path");
 			if (!dirRaw) return new Response("missing ?path=<workspace dir>", { status: 400 });
-			const ws = await import("./ws-93eeiNKB.js");
+			const ws = await import("./ws-qE_t5H8x.js");
 			let prov;
 			try {
 				prov = await ws.loadProvision();
@@ -2606,7 +2599,7 @@ Options:
 			const perm = body.perm ?? "r";
 			if (perm !== "r" && perm !== "rw") return new Response(`invalid perm ${perm} (want r or rw)`, { status: 400 });
 			try {
-				const { createScopedShare } = await import("./agentShare-CXksKQvX.js");
+				const { createScopedShare } = await import("./agentShare-CRJb4GhE.js");
 				const share = await createScopedShare({
 					agent: body.agent,
 					perm,
@@ -2621,12 +2614,12 @@ Options:
 			}
 		}
 		if (req.method === "GET" && p === "/api/shares") {
-			const { listShares } = await import("./agentShare-CXksKQvX.js");
+			const { listShares } = await import("./agentShare-CRJb4GhE.js");
 			return Response.json(listShares());
 		}
 		const revokeM = /^\/api\/share\/([^/]+)$/.exec(p);
 		if (req.method === "DELETE" && revokeM) {
-			const { revokeShare } = await import("./agentShare-CXksKQvX.js");
+			const { revokeShare } = await import("./agentShare-CRJb4GhE.js");
 			const ok = revokeShare(decodeURIComponent(revokeM[1]));
 			return new Response(ok ? "revoked" : "no such share", { status: ok ? 200 : 404 });
 		}
@@ -2928,7 +2921,7 @@ Options:
 	const shutdown = (resolve) => {
 		if (heartbeat) clearInterval(heartbeat);
 		closeShare?.();
-		import("./agentShare-CXksKQvX.js").then((m) => m.revokeAllShares()).catch(() => {});
+		import("./agentShare-CRJb4GhE.js").then((m) => m.revokeAllShares()).catch(() => {});
 		server?.stop();
 		Promise.resolve(releaseHostLock?.()).catch(() => {}).then(resolve);
 	};
@@ -2941,4 +2934,4 @@ Options:
 
 //#endregion
 export { cmdServe, resolveLocalServeUrl };
-//# sourceMappingURL=serve-D1GP9e62.js.map
+//# sourceMappingURL=serve-v5fUhHiR.js.map

package/dist/{setup-p9dIsEH2.js → setup-DojqtiR5.js}

@@ -32,7 +32,7 @@ async function cmdSetup(rest) {
 	if (!existsSync(abs)) process.stderr.write(`  note: that directory doesn't exist yet — create it, or agents spawned there will fail\n`);
 	if (noShare) return 0;
 	process.stdout.write(`\nsharing this machine to agent-yes.com…\n`);
-	const { cmdServe } = await import("./serve-D1GP9e62.js");
+	const { cmdServe } = await import("./serve-v5fUhHiR.js");
 	return cmdServe([
 		"install",
 		"--share",
@@ -42,4 +42,4 @@ async function cmdSetup(rest) {
 
 //#endregion
 export { cmdSetup };
-//# sourceMappingURL=setup-p9dIsEH2.js.map
+//# sourceMappingURL=setup-DojqtiR5.js.map

package/dist/{subcommands-D2llN6dR.js → subcommands-Dl2Kx1FC.js}

@@ -1238,19 +1238,19 @@ async function runSubcommand(argv) {
 			case "restart": return await cmdRestart(rest);
 			case "note": return await cmdNote(rest);
 			case "serve": {
-				const { cmdServe } = await import("./serve-D1GP9e62.js");
+				const { cmdServe } = await import("./serve-v5fUhHiR.js");
 				return cmdServe(rest);
 			}
 			case "setup": {
-				const { cmdSetup } = await import("./setup-p9dIsEH2.js");
+				const { cmdSetup } = await import("./setup-DojqtiR5.js");
 				return cmdSetup(rest);
 			}
 			case "ws": {
-				const { cmdWs } = await import("./ws-93eeiNKB.js");
+				const { cmdWs } = await import("./ws-qE_t5H8x.js");
 				return cmdWs(rest);
 			}
 			case "schedule": {
-				const { cmdSchedule } = await import("./schedule-CmbUKK0u.js");
+				const { cmdSchedule } = await import("./schedule-CKF_arnv.js");
 				return cmdSchedule(rest);
 			}
 			case "remote": {
@@ -1262,7 +1262,7 @@ async function runSubcommand(argv) {
 				return cmdExpose(rest);
 			}
 			case "callback": {
-				const { cmdCallback } = await import("./callback-8taXMdxt.js");
+				const { cmdCallback } = await import("./callback-CzFcLTZn.js");
 				return cmdCallback(rest);
 			}
 			case "reap":
@@ -4274,7 +4274,7 @@ async function cmdNotify(rest) {
 	}
 	const ensure = async () => {
 		if (!argv["ensure-daemon"]) return;
-		const { ensureDaemon } = await import("./notifyDaemon-C4Z9gxKe.js");
+		const { ensureDaemon } = await import("./notifyDaemon-CjszDILI.js");
 		await ensureDaemon().catch(() => null);
 	};
 	await heartbeatWatcher(parent, selfStartedAt);
@@ -4348,7 +4348,7 @@ async function cmdNotifyCursor(args) {
 }
 async function cmdNotifyd(rest) {
 	const sub = rest[0] ?? "status";
-	const daemon = await import("./notifyDaemon-C4Z9gxKe.js");
+	const daemon = await import("./notifyDaemon-CjszDILI.js");
 	switch (sub) {
 		case "run": return daemon.runDaemon();
 		case "once": return daemon.runDaemon({ once: true });
@@ -4375,4 +4375,4 @@ async function cmdNotifyd(rest) {
 
 //#endregion
 export { daemonLockOwnerPath as $, renderRawLog as A, submitAndConfirm as B, matchKeyword as C, recentMessageEdges as D, readPtysize as E, restartHintLines as F, gcInboxes as G, writeKeysPaced as H, runSubcommand as I, listInboxParents as J, hostId as K, snapshotStatus as L, resolveOne as M, resolveReadWindow as N, recentReadEdges as O, resolveResumeArgs as P, daemonLockDir as Q, stdinActivityPath as R, listRecords as S, readNotes as T, writeToIpc as U, waitForLogQuiet as V, appendEvent as W, readInbox as X, liveWatchers as Y, shouldStealLock as Z, isPidAlive as _, cmdHelp as a, isUserTyping as b, deriveLiveState as c, extractMenu as d, notifyDir as et, extractNeedsInput as f, isExitRequest as g, isAgentStuck as h, backoffWhileTyping as i, renderRawLogLines as j, renderLogTailLines as k, deriveLiveStatus as l, finalizedLines as m, READ_PAGE_DEFAULT as n, controlCodeFromName as o, extractTaskCounts as p, isTransientLockMkdirError as q, TYPING_WINDOW_MS as r, cursorAbs as s, GRACEFUL_EXIT_COMMANDS as t, TYPING_BADGE as tt, extractBadges as u, isSlashCommand as v, menuSelectKeys as w, lastStdinAt as x, isSubcommand as y, stopTipForCli as z };
-//# sourceMappingURL=subcommands-D2llN6dR.js.map
+//# sourceMappingURL=subcommands-Dl2Kx1FC.js.map

package/dist/{subcommands-CvmstmY_.js → subcommands-ZqHQMFDJ.js}

@@ -2,7 +2,7 @@ import "./logger-CDIsZ-Pp.js";
 import "./globalPidIndex-CoNr7tS8.js";
 import "./messageLog-CxrKJj77.js";
 import "./configShared-aKTg-sa5.js";
-import { A as renderRawLog, B as submitAndConfirm, C as matchKeyword, D as recentMessageEdges, E as readPtysize, F as restartHintLines, H as writeKeysPaced, I as runSubcommand, L as snapshotStatus, M as resolveOne, N as resolveReadWindow, O as recentReadEdges, P as resolveResumeArgs, R as stdinActivityPath, S as listRecords, T as readNotes, U as writeToIpc, V as waitForLogQuiet, _ as isPidAlive, a as cmdHelp, b as isUserTyping, c as deriveLiveState, d as extractMenu, f as extractNeedsInput, g as isExitRequest, h as isAgentStuck, i as backoffWhileTyping, j as renderRawLogLines, k as renderLogTailLines, l as deriveLiveStatus, m as finalizedLines, n as READ_PAGE_DEFAULT, o as controlCodeFromName, p as extractTaskCounts, r as TYPING_WINDOW_MS, s as cursorAbs, t as GRACEFUL_EXIT_COMMANDS, u as extractBadges, v as isSlashCommand, w as menuSelectKeys, x as lastStdinAt, y as isSubcommand, z as stopTipForCli } from "./subcommands-D2llN6dR.js";
+import { A as renderRawLog, B as submitAndConfirm, C as matchKeyword, D as recentMessageEdges, E as readPtysize, F as restartHintLines, H as writeKeysPaced, I as runSubcommand, L as snapshotStatus, M as resolveOne, N as resolveReadWindow, O as recentReadEdges, P as resolveResumeArgs, R as stdinActivityPath, S as listRecords, T as readNotes, U as writeToIpc, V as waitForLogQuiet, _ as isPidAlive, a as cmdHelp, b as isUserTyping, c as deriveLiveState, d as extractMenu, f as extractNeedsInput, g as isExitRequest, h as isAgentStuck, i as backoffWhileTyping, j as renderRawLogLines, k as renderLogTailLines, l as deriveLiveStatus, m as finalizedLines, n as READ_PAGE_DEFAULT, o as controlCodeFromName, p as extractTaskCounts, r as TYPING_WINDOW_MS, s as cursorAbs, t as GRACEFUL_EXIT_COMMANDS, u as extractBadges, v as isSlashCommand, w as menuSelectKeys, x as lastStdinAt, y as isSubcommand, z as stopTipForCli } from "./subcommands-Dl2Kx1FC.js";
 import "./e2e-jb0Hp43q.js";
 import "./webrtcLink-B7REGtK2.js";
 import "./remotes-CZGDxzIP.js";

package/dist/{ts-74aVYJYj.js → ts-bE-SKMWi.js}

@@ -1,5 +1,5 @@
 import { n as logger, t as addTransport } from "./logger-CDIsZ-Pp.js";
-import { r as getInstalledPackage } from "./versionChecker-QP6QKiG-.js";
+import { r as getInstalledPackage } from "./versionChecker-EEzUODBd.js";
 import { t as agentYesHome } from "./agentYesHome-CtHb5b71.js";
 import { i as shouldUseLock, r as releaseLock, t as acquireLock } from "./runningLock-CNMl13dC.js";
 import { t as PidStore } from "./pidStore-BIvsBQ8X.js";
@@ -300,6 +300,23 @@ function removeControlCharacters(str) {
 	return str.replace(OSC_PATTERN, "").replace(CSI_PATTERN, "");
 }
 
+//#endregion
+//#region ts/sessionEnv.ts
+const CLAUDE_SESSION_PIN_ENV = [
+	"CLAUDECODE",
+	"CLAUDE_CODE_SSE_PORT",
+	"CLAUDE_CODE_SESSION_ID",
+	"CLAUDE_CODE_CHILD_SESSION",
+	"CLAUDE_CODE_ENTRYPOINT"
+];
+/** Delete the parent Claude Code session-pin vars from a mutable env map, in
+*  place. Idempotent (a no-op when they're already absent, e.g. a console spawn
+*  whose env came from freshAgentEnv). Returns the same object for chaining. */
+function stripClaudeSessionPin(env) {
+	for (const k of CLAUDE_SESSION_PIN_ENV) delete env[k];
+	return env;
+}
+
 //#endregion
 //#region ts/beta/fifo.ts
 /**
@@ -1300,6 +1317,7 @@ async function agentYes({ cli, cliArgs = [], skipPermissions = false, prompt, ro
 	const parentPid = Number.isInteger(inheritedAyPid) && inheritedAyPid > 0 ? inheritedAyPid : void 0;
 	ptyEnv.AGENT_YES_PID = String(process.pid);
 	delete ptyEnv.AGENT_YES_AGENT_ID;
+	stripClaudeSessionPin(ptyEnv);
 	if (cliConf?.env) for (const [key, raw] of Object.entries(cliConf.env)) {
 		let unresolved = false;
 		const value = raw.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(?::-([^}]*))?\}/g, (_, name, fallback) => {
@@ -1900,5 +1918,5 @@ function sleep(ms) {
 }
 
 //#endregion
-export { removeControlCharacters as a, AgentContext as i, agentYes as n, config as r, CLIS_CONFIG as t };
-//# sourceMappingURL=ts-74aVYJYj.js.map
+export { CLAUDE_SESSION_PIN_ENV as a, AgentContext as i, agentYes as n, removeControlCharacters as o, config as r, CLIS_CONFIG as t };
+//# sourceMappingURL=ts-bE-SKMWi.js.map

package/dist/{versionChecker-QP6QKiG-.js → versionChecker-EEzUODBd.js}

@@ -7,7 +7,7 @@ import { fileURLToPath } from "url";
 
 //#region package.json
 var name = "agent-yes";
-var version = "1.223.0";
+var version = "1.223.1";
 
 //#endregion
 //#region ts/versionChecker.ts
@@ -215,4 +215,4 @@ async function displayVersion() {
 
 //#endregion
 export { versionString as i, displayVersion as n, getInstalledPackage as r, checkAndAutoUpdate as t };
-//# sourceMappingURL=versionChecker-QP6QKiG-.js.map
+//# sourceMappingURL=versionChecker-EEzUODBd.js.map

package/dist/{ws-93eeiNKB.js → ws-qE_t5H8x.js}

@@ -2,7 +2,7 @@ import "./logger-CDIsZ-Pp.js";
 import "./globalPidIndex-CoNr7tS8.js";
 import "./messageLog-CxrKJj77.js";
 import "./configShared-aKTg-sa5.js";
-import { S as listRecords } from "./subcommands-D2llN6dR.js";
+import { S as listRecords } from "./subcommands-Dl2Kx1FC.js";
 import "./e2e-jb0Hp43q.js";
 import "./webrtcLink-B7REGtK2.js";
 import "./remotes-CZGDxzIP.js";
@@ -418,4 +418,4 @@ async function cmdWs(args) {
 
 //#endregion
 export { WS_JSON_SCHEMA, cmdWs, collectWorkspaces, isPathInside, loadProvision, workspaceStatus };
-//# sourceMappingURL=ws-93eeiNKB.js.map
+//# sourceMappingURL=ws-qE_t5H8x.js.map

package/lab/ui/blog/ay-callback/index.html

@@ -0,0 +1,407 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>ay callback — let readers message your agent from any web page</title>
+    <meta
+      name="description"
+      content="ay callback mints a signed, send-only, single-agent capability and an embeddable widget — so a public report page can message the agent that wrote it, without ever exposing your serve token."
+    />
+    <link
+      rel="icon"
+      href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 16 16'%3E%3Ctext y='14' font-size='14'%3E%E2%9C%93%3C/text%3E%3C/svg%3E"
+    />
+    <style>
+      :root {
+        --bg: #0d1117;
+        --fg: #e6edf3;
+        --muted: #8b949e;
+        --accent: #58a6ff;
+        --green: #3fb950;
+        --red: #f85149;
+        --card: #161b22;
+        --border: #30363d;
+      }
+      @media (prefers-color-scheme: light) {
+        :root {
+          --bg: #ffffff;
+          --fg: #1f2328;
+          --muted: #59636e;
+          --accent: #0969da;
+          --green: #1a7f37;
+          --red: #cf222e;
+          --card: #f6f8fa;
+          --border: #d0d7de;
+        }
+      }
+      * {
+        box-sizing: border-box;
+      }
+      body {
+        background: var(--bg);
+        color: var(--fg);
+        font:
+          16px/1.65 -apple-system,
+          BlinkMacSystemFont,
+          "Segoe UI",
+          Helvetica,
+          Arial,
+          sans-serif;
+        margin: 0;
+        padding: 0 20px;
+      }
+      main {
+        max-width: 760px;
+        margin: 0 auto;
+        padding: 56px 0 96px;
+      }
+      .tag {
+        background: var(--accent);
+        color: #fff;
+        padding: 2px 8px;
+        border-radius: 6px;
+        font-size: 0.8em;
+        letter-spacing: 0.02em;
+      }
+      h1 {
+        font-size: 2em;
+        line-height: 1.2;
+        margin: 18px 0 8px;
+      }
+      h2 {
+        font-size: 1.3em;
+        margin: 40px 0 10px;
+        border-top: 1px solid var(--border);
+        padding-top: 28px;
+      }
+      h2 a.anchor {
+        color: var(--muted);
+        text-decoration: none;
+        margin-left: 6px;
+        opacity: 0;
+      }
+      h2:hover a.anchor {
+        opacity: 1;
+      }
+      .sub {
+        color: var(--muted);
+        font-size: 1.05em;
+      }
+      a {
+        color: var(--accent);
+      }
+      code {
+        background: var(--card);
+        border: 1px solid var(--border);
+        border-radius: 5px;
+        padding: 1px 5px;
+        font-size: 0.88em;
+        font-family: ui-monospace, "SF Mono", Menlo, Consolas, monospace;
+      }
+      pre {
+        background: var(--card);
+        border: 1px solid var(--border);
+        border-radius: 10px;
+        padding: 14px 16px;
+        overflow-x: auto;
+        font-size: 0.86em;
+        line-height: 1.5;
+      }
+      pre code {
+        background: none;
+        border: 0;
+        padding: 0;
+      }
+      .note {
+        border-left: 3px solid var(--accent);
+        background: var(--card);
+        padding: 10px 16px;
+        border-radius: 0 8px 8px 0;
+        margin: 18px 0;
+      }
+      .ok {
+        color: var(--green);
+      }
+      .no {
+        color: var(--red);
+      }
+      footer {
+        color: var(--muted);
+        font-size: 0.9em;
+        margin-top: 48px;
+        border-top: 1px solid var(--border);
+        padding-top: 20px;
+      }
+      table {
+        border-collapse: collapse;
+        width: 100%;
+        margin: 16px 0;
+        font-size: 0.92em;
+      }
+      th,
+      td {
+        border: 1px solid var(--border);
+        padding: 8px 10px;
+        text-align: left;
+        vertical-align: top;
+      }
+      th {
+        background: var(--card);
+      }
+      /* Inert demo replica of the widget the snippet renders. */
+      .demo {
+        position: relative;
+        background: var(--card);
+        border: 1px dashed var(--border);
+        border-radius: 12px;
+        min-height: 180px;
+        margin: 18px 0;
+        padding: 12px 16px;
+        color: var(--muted);
+        font-size: 0.9em;
+      }
+      .demo .fab {
+        position: absolute;
+        right: 16px;
+        bottom: 16px;
+        padding: 10px 14px;
+        border-radius: 20px;
+        border: none;
+        background: #1a7f37;
+        color: #fff;
+        font: 13px system-ui;
+        cursor: pointer;
+        box-shadow: 0 2px 8px rgba(0, 0, 0, 0.3);
+      }
+      .demo .modal {
+        position: absolute;
+        right: 16px;
+        bottom: 64px;
+        width: min(300px, 80%);
+        background: var(--bg);
+        color: var(--fg);
+        border: 1px solid var(--border);
+        border-radius: 8px;
+        padding: 12px;
+        font: 13px system-ui;
+        box-shadow: 0 4px 16px rgba(0, 0, 0, 0.25);
+        display: none;
+        text-align: left;
+      }
+      .demo .modal textarea {
+        width: 100%;
+        height: 64px;
+        box-sizing: border-box;
+        font: inherit;
+        margin: 8px 0;
+        resize: vertical;
+        background: var(--card);
+        color: var(--fg);
+        border: 1px solid var(--border);
+        border-radius: 6px;
+        padding: 6px;
+      }
+      .demo .modal button {
+        padding: 6px 12px;
+        border: none;
+        border-radius: 6px;
+        background: #1a7f37;
+        color: #fff;
+        cursor: pointer;
+        font: inherit;
+      }
+      .demo .status {
+        min-height: 16px;
+        font-size: 12px;
+        color: var(--muted);
+        margin-top: 6px;
+      }
+    </style>
+  </head>
+  <body>
+    <main>
+      <p><span class="tag">agent-yes</span> · engineering</p>
+      <h1>ay callback: let readers message your agent from any web page</h1>
+      <p class="sub">
+        Your agent just published a report. The person reading it has a question. Until now the
+        answer was "find the console, find the right terminal, type there." Now the report page
+        itself can carry a tiny widget that delivers the reader's message straight into that
+        agent's terminal — through a signed, send-only, single-agent capability that expires on a
+        date you chose, and never through your master token.
+      </p>
+
+      <h2 id="what">What it does <a class="anchor" href="#what">#</a></h2>
+      <p>
+        <code>ay callback</code> mints a capability for <strong>one agent</strong> and prints a
+        self-contained HTML snippet — one inline <code>&lt;script&gt;</code>, zero external
+        requests. Paste it into any page your agent publishes (a status dashboard, a nightly
+        report, a postmortem) and readers get a floating button:
+      </p>
+      <pre><code>$ ay callback --expires 7d
+callback 3b6f23e7 → claude #46555 @ ~/ws/reports
+expires:  2026-07-29T10:57:01.398Z  (7d)
+endpoint: https://x1a2b3c.agent-yes.com/cb/cb1.eyJpZCI6…
+revoke:   ay callback revoke 3b6f23e7
+
+── embed snippet ──────────────────────────────
+&lt;script&gt; … &lt;/script&gt;</code></pre>
+      <p>Here is what the widget feels like (demo only — this one talks to nobody):</p>
+      <div class="demo" id="cb-demo">
+        Imagine this box is your agent's published report page…
+        <button class="fab" id="cb-demo-fab">💬 Message the agent</button>
+        <div class="modal" id="cb-demo-modal">
+          <strong>Message the agent</strong>
+          <textarea id="cb-demo-ta" placeholder="Your message to the agent…"></textarea>
+          <button id="cb-demo-send">Send</button>
+          <div class="status" id="cb-demo-status"></div>
+        </div>
+      </div>
+      <p>
+        When a reader hits <em>Send</em>, the message lands in the agent's terminal wrapped in an
+        explicit "untrusted visitor" frame, and in its inbox. One way, by design — the visitor
+        never sees the terminal.
+      </p>
+
+      <h2 id="capability">The capability is a hash, not a key <a class="anchor" href="#capability">#</a></h2>
+      <p>
+        The obvious-but-wrong implementation is to put your daemon's serve token in the snippet.
+        That token is a master key: whoever holds it can read every terminal, send to every agent,
+        spawn and kill. Pasting it into a public page is game over.
+      </p>
+      <p>
+        So the snippet carries a <strong>capability token</strong> instead — three dot-separated
+        parts, the last one an HMAC-SHA256 over the rest:
+      </p>
+      <pre><code>cb1 . base64url({ "id": "3b6f23e7",
+                  "agent": "4d65a096e983",   // exactly one agent_id
+                  "exp": 1785322621398 })    // hard expiry, unix ms
+    . base64url(HMAC-SHA256(secret, "cb1." + payload))</code></pre>
+      <p>
+        The scope lives <em>inside the signed payload</em>. That has three consequences worth
+        spelling out:
+      </p>
+      <table>
+        <tr>
+          <th>Attack</th>
+          <th>Result</th>
+        </tr>
+        <tr>
+          <td>Edit the payload to point at another agent, or push the expiry out</td>
+          <td><span class="no">✗</span> signature no longer verifies — the daemon answers 404</td>
+        </tr>
+        <tr>
+          <td>Delete the daemon's bookkeeping to "resurrect" an expired token</td>
+          <td>
+            <span class="no">✗</span> expiry is in the token itself, not in local state — still
+            410
+          </td>
+        </tr>
+        <tr>
+          <td>Steal the token from the page source</td>
+          <td>
+            <span class="ok">✓</span> you can do exactly what the page could already do: send
+            rate-limited text to one agent, until the expiry the owner chose
+          </td>
+        </tr>
+      </table>
+      <p>
+        The HMAC secret is minted on first use into <code>~/.agent-yes/.callback-secret</code>
+        (0600), deliberately separate from the serve token — rotating one never invalidates the
+        other.
+      </p>
+
+      <h2 id="expiry">--expires is required. There is no "never" <a class="anchor" href="#expiry">#</a></h2>
+      <p>
+        Every capability API eventually grows a default lifetime, and every default lifetime
+        eventually becomes "forever, because nobody thinks about it." We refuse the default:
+      </p>
+      <pre><code>$ ay callback
+ay callback: --expires is required (e.g. --expires 7d) —
+an embed capability must carry an explicit lifetime</code></pre>
+      <p>
+        <code>--expires</code> takes <code>30m</code>, <code>12h</code>, <code>7d</code>,
+        <code>2w</code> — and caps at 365 days. There is no <code>--expires never</code> and there
+        never will be. The point is a moment of deliberate friction: whoever pastes a capability
+        into a public page must answer "how long should this live?" while they still remember the
+        page exists. When it lapses, the widget doesn't fail silently — it tells the reader the
+        link expired and to ask the owner for a fresh one.
+      </p>
+      <p>For everything before the deadline, there's the kill switch:</p>
+      <pre><code>$ ay callback ls
+3b6f23e7  6d left     → claude #46555 @ ~/ws/reports
+$ ay callback revoke 3b6f23e7
+revoked 3b6f23e7</code></pre>
+
+      <h2 id="hardening">A public route that leaks nothing <a class="anchor" href="#hardening">#</a></h2>
+      <p>
+        <code>POST /cb/&lt;cap&gt;</code> is the daemon's only unauthenticated write route, so it
+        is deliberately paranoid:
+      </p>
+      <ul>
+        <li>
+          <strong>Info-tight responses.</strong> The page learns <code>ok</code>,
+          <code>expired</code>, or a generic failure — never a pid, a cwd, a hostname, or whether
+          a given agent exists. Malformed and forged tokens are indistinguishable 404s.
+        </li>
+        <li>
+          <strong>Untrusted framing.</strong> Visitor text is stripped of control characters (no
+          smuggled escape sequences, no fake Enter) and wrapped in an
+          <code>&lt;ay-callback&gt;</code> block that names it an untrusted visitor message — the
+          agent is told to treat it as data, not instructions.
+        </li>
+        <li>
+          <strong>Flood control.</strong> Per-capability sliding-window rate limit and a 4&nbsp;KB
+          body cap. A public page can nudge your agent; it cannot bury it.
+        </li>
+        <li>
+          <strong>One-way.</strong> The route writes to the agent's stdin and records the inbox
+          entry. It never reads the terminal back — a public embed must not become a viewport
+          into your machine.
+        </li>
+      </ul>
+      <div class="note">
+        Two-way chat — the widget showing the agent's reply — is the obvious next step, and the
+        design line is already drawn: the page will only ever see replies the agent
+        <em>explicitly</em> addresses to that callback, never the raw terminal.
+      </div>
+
+      <h2 id="try">Try it <a class="anchor" href="#try">#</a></h2>
+      <pre><code>$ npm i -g agent-yes
+$ ay serve            # local daemon
+$ ay expose …         # or put the daemon on a public URL first
+$ ay callback --expires 7d --title "Ask the report bot"</code></pre>
+      <p>
+        Paste the printed snippet at the end of anything your agent publishes. Ship the report;
+        keep the conversation.
+      </p>
+
+      <footer>
+        <a href="/blog/">← All posts</a> · <a href="/">agent-yes.com</a> ·
+        <a href="https://github.com/snomiao/agent-yes">GitHub</a> ·
+        <a href="https://github.com/snomiao/agent-yes/pull/295">PR #295</a>
+      </footer>
+    </main>
+    <script>
+      // Inert demo widget — mirrors the real snippet's UX, delivers nowhere.
+      (function () {
+        var fab = document.getElementById("cb-demo-fab");
+        var modal = document.getElementById("cb-demo-modal");
+        var ta = document.getElementById("cb-demo-ta");
+        var send = document.getElementById("cb-demo-send");
+        var status = document.getElementById("cb-demo-status");
+        fab.onclick = function () {
+          modal.style.display = modal.style.display === "block" ? "none" : "block";
+        };
+        send.onclick = function () {
+          if (!ta.value.trim()) return;
+          status.textContent = "sending…";
+          setTimeout(function () {
+            status.textContent = "Delivered. (demo — no agent was harmed)";
+            ta.value = "";
+          }, 450);
+        };
+      })();
+    </script>
+  </body>
+</html>

package/lab/ui/blog/index.html

@@ -156,6 +156,16 @@
         </p>
       </a>
 
+      <a class="post" href="/blog/ay-callback/">
+        <span class="tag">Feature</span>
+        <h2>ay callback — let readers message your agent from any web page</h2>
+        <p>
+          A signed, send-only, single-agent capability plus a one-script embed widget: report
+          pages that can talk back, with a required expiry and a revoke kill-switch — never your
+          serve token.
+        </p>
+      </a>
+
       <a class="post" href="/blog/e2ee-share-links/">
         <span class="tag">Security</span>
         <h2>End-to-end encryption for agent-yes share links</h2>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-yes",
-  "version": "1.223.0",
+  "version": "1.223.1",
   "description": "A wrapper tool that automates interactions with various AI CLI tools by automatically handling common prompts and responses.",
   "keywords": [
     "ai",

package/ts/index.ts

@@ -13,6 +13,7 @@ import {
 } from "./resume/codexSessionManager.ts";
 import pty, { ptyPackage } from "./pty.ts";
 import { removeControlCharacters } from "./removeControlCharacters.ts";
+import { stripClaudeSessionPin } from "./sessionEnv.ts";
 import { acquireLock, releaseLock, shouldUseLock } from "./runningLock.ts";
 import { logger } from "./logger.ts";
 import { createFifoStream } from "./beta/fifo.ts";
@@ -394,6 +395,16 @@ export default async function agentYes({
   // `ay`) don't inherit it and register under the same id (which would make that
   // id ambiguous). The wrapper's own process.env still carries it for pidStore.
   delete ptyEnv.AGENT_YES_AGENT_ID;
+  // Strip the parent Claude Code session markers so the wrapped CLI is a CLEAN
+  // top-level session. Without this, an `ay claude` launched from inside another
+  // Claude Code session (or this claude's Bash tool) inherits
+  // CLAUDE_CODE_CHILD_SESSION — the child claude then disables transcript saving
+  // ("⚠ Transcript saving is off …") — and CLAUDE_CODE_SSE_PORT/SESSION_ID make it
+  // attach to the parent's stale session. The daemon /api/spawn path already drops
+  // these via freshAgentEnv; this covers the direct-launch path. Idempotent, and
+  // AGENT_YES_PID is handled above (read for parentPid, then re-stamped). See
+  // ts/sessionEnv.ts (mirrored in rs/src/pty_spawner.rs for the Rust runtime).
+  stripClaudeSessionPin(ptyEnv);
   // Inject per-CLI env (e.g. glm → Z.AI endpoint). Expand ${VAR} against the
   // launching env; skip entries whose vars are unset so we never blank out an
   // inherited value (e.g. ANTHROPIC_AUTH_TOKEN when ZAI_API_KEY isn't exported).

package/ts/serve.ts

@@ -39,6 +39,7 @@ import {
 } from "./subcommands.ts";
 import { TYPING_BADGE } from "./badges.ts";
 import { isCallbackRevoked, loadCallbackSecretReadOnly } from "./callback.ts";
+import { CLAUDE_SESSION_PIN_ENV } from "./sessionEnv.ts";
 import { MAX_CALLBACK_MSG_BYTES, frameVisitorMessage, verifyCapability } from "./callbackCore.ts";
 import { isTerminalReply } from "./terminalReply.ts";
 import { parseStatusText } from "./statusText.ts";
@@ -223,23 +224,17 @@ const defaultOpts = (overrides: Partial<CommonOpts> = {}): CommonOpts => ({
   ...overrides,
 });
 
-// The vars that pin a process to a PARENT Claude Code session — NOT the many
-// other CLAUDE_CODE_* settings that configure provider/auth/limits (USE_BEDROCK,
-// USE_VERTEX, MAX_OUTPUT_TOKENS, …), which must pass through untouched.
-const SESSION_PIN_ENV = new Set([
-  "CLAUDECODE",
-  "CLAUDE_CODE_SSE_PORT",
-  "CLAUDE_CODE_SESSION_ID",
-  "CLAUDE_CODE_CHILD_SESSION",
-  "CLAUDE_CODE_ENTRYPOINT",
-  // The agent-yes wrapper pid of the agent that launched `ay serve`. A daemon
-  // started from inside an agent's shell carries that agent's AGENT_YES_PID for
-  // its whole lifetime; without stripping it, every console-spawned agent would
-  // inherit it and be recorded with parent_pid = that stale agent, mis-rooting
-  // the whole subagent tree under an unrelated agent. Dropping it makes console
-  // spawns clean top-level agents (parent_pid = None).
-  "AGENT_YES_PID",
-]);
+// The vars that pin a process to a PARENT Claude Code session (the shared
+// CLAUDE_SESSION_PIN_ENV set, see ts/sessionEnv.ts) plus AGENT_YES_PID:
+//   The agent-yes wrapper pid of the agent that launched `ay serve`. A daemon
+//   started from inside an agent's shell carries that agent's AGENT_YES_PID for
+//   its whole lifetime; without stripping it, every console-spawned agent would
+//   inherit it and be recorded with parent_pid = that stale agent, mis-rooting
+//   the whole subagent tree under an unrelated agent. Dropping it makes console
+//   spawns clean top-level agents (parent_pid = None).
+// (The direct `ay …` launch path re-stamps AGENT_YES_PID with its own pid instead
+// — see ts/index.ts — so it strips only the shared claude set, not this one.)
+const SESSION_PIN_ENV = new Set<string>([...CLAUDE_SESSION_PIN_ENV, "AGENT_YES_PID"]);
 
 // The login-shell environment, captured once and cached for the daemon's
 // lifetime. `ay serve` is daemonized by oxmgr/launchd/pm2, which start it with a

package/ts/sessionEnv.spec.ts

@@ -0,0 +1,65 @@
+import { describe, expect, it } from "vitest";
+import { CLAUDE_SESSION_PIN_ENV, stripClaudeSessionPin } from "./sessionEnv.ts";
+
+describe("CLAUDE_SESSION_PIN_ENV", () => {
+  it("includes the markers that cause the child-session symptoms", () => {
+    // CLAUDE_CODE_CHILD_SESSION → "Transcript saving is off"; SSE_PORT/SESSION_ID
+    // → nested-attach "fail to connect". All must be in the strip set.
+    for (const k of [
+      "CLAUDECODE",
+      "CLAUDE_CODE_CHILD_SESSION",
+      "CLAUDE_CODE_SSE_PORT",
+      "CLAUDE_CODE_SESSION_ID",
+      "CLAUDE_CODE_ENTRYPOINT",
+    ]) {
+      expect(CLAUDE_SESSION_PIN_ENV).toContain(k);
+    }
+  });
+
+  it("does NOT include AGENT_YES_PID (re-stamped per path, not shared)", () => {
+    expect(CLAUDE_SESSION_PIN_ENV).not.toContain("AGENT_YES_PID");
+  });
+});
+
+describe("stripClaudeSessionPin", () => {
+  it("removes every pin var so the child is a clean top-level session", () => {
+    const env: Record<string, string | undefined> = {
+      CLAUDECODE: "1",
+      CLAUDE_CODE_SSE_PORT: "12345",
+      CLAUDE_CODE_SESSION_ID: "abc-123",
+      CLAUDE_CODE_CHILD_SESSION: "1",
+      CLAUDE_CODE_ENTRYPOINT: "cli",
+    };
+    stripClaudeSessionPin(env);
+    for (const k of CLAUDE_SESSION_PIN_ENV) expect(env[k]).toBeUndefined();
+  });
+
+  it("preserves non-pin CLAUDE_CODE_* config and unrelated vars", () => {
+    const env: Record<string, string | undefined> = {
+      CLAUDE_CODE_CHILD_SESSION: "1",
+      // provider/auth/limit config that must survive
+      CLAUDE_CODE_USE_BEDROCK: "1",
+      CLAUDE_CODE_MAX_OUTPUT_TOKENS: "8000",
+      CLAUDE_EFFORT: "high",
+      ANTHROPIC_API_KEY: "sk-xxx",
+      PATH: "/usr/bin",
+      AGENT_YES_PID: "999",
+    };
+    stripClaudeSessionPin(env);
+    expect(env.CLAUDE_CODE_CHILD_SESSION).toBeUndefined();
+    expect(env.CLAUDE_CODE_USE_BEDROCK).toBe("1");
+    expect(env.CLAUDE_CODE_MAX_OUTPUT_TOKENS).toBe("8000");
+    expect(env.CLAUDE_EFFORT).toBe("high");
+    expect(env.ANTHROPIC_API_KEY).toBe("sk-xxx");
+    expect(env.PATH).toBe("/usr/bin");
+    // AGENT_YES_PID is this path's own concern (re-stamped), not stripped here.
+    expect(env.AGENT_YES_PID).toBe("999");
+  });
+
+  it("is idempotent and returns the same object (already-clean env)", () => {
+    const env: Record<string, string | undefined> = { PATH: "/bin" };
+    const out = stripClaudeSessionPin(env);
+    expect(out).toBe(env);
+    expect(out).toEqual({ PATH: "/bin" });
+  });
+});

package/ts/sessionEnv.ts

@@ -0,0 +1,37 @@
+// Env vars that PIN a process to a PARENT Claude Code session.
+//
+// When `ay` launches an agent, the wrapped CLI must be a CLEAN TOP-LEVEL session
+// — every agent-yes agent gets its own pid, its own log, and (for claude) its
+// own saved transcript. If these markers leak in from the launching env (e.g.
+// `ay claude` run from inside another Claude Code session, or from this claude's
+// Bash tool), the child claude:
+//   - sees CLAUDE_CODE_CHILD_SESSION and turns transcript saving OFF
+//     ("⚠ Transcript saving is off — inherited CLAUDE_CODE_CHILD_SESSION marker"), and
+//   - sees CLAUDE_CODE_SSE_PORT / CLAUDE_CODE_SESSION_ID and tries to attach to
+//     the parent's stale session, surfacing as "fail to connect".
+//
+// So we strip exactly this set on every spawn path. It is deliberately NARROW —
+// the many OTHER CLAUDE_CODE_* settings configure provider/auth/limits
+// (CLAUDE_CODE_USE_BEDROCK, CLAUDE_CODE_USE_VERTEX, CLAUDE_CODE_MAX_OUTPUT_TOKENS,
+// …) and MUST pass through untouched.
+//
+// MIRRORED in rs/src/pty_spawner.rs (`CLAUDE_SESSION_PIN_ENV`) — the Rust runtime
+// (the default) strips the same set; keep the two lists in sync. `AGENT_YES_PID`
+// is handled separately per spawn path (index.ts re-stamps it with its own pid to
+// build the subagent tree; serve.ts's freshAgentEnv drops it for clean console
+// roots), so it is NOT part of this shared set.
+export const CLAUDE_SESSION_PIN_ENV = [
+  "CLAUDECODE",
+  "CLAUDE_CODE_SSE_PORT",
+  "CLAUDE_CODE_SESSION_ID",
+  "CLAUDE_CODE_CHILD_SESSION",
+  "CLAUDE_CODE_ENTRYPOINT",
+] as const;
+
+/** Delete the parent Claude Code session-pin vars from a mutable env map, in
+ *  place. Idempotent (a no-op when they're already absent, e.g. a console spawn
+ *  whose env came from freshAgentEnv). Returns the same object for chaining. */
+export function stripClaudeSessionPin<T extends Record<string, string | undefined>>(env: T): T {
+  for (const k of CLAUDE_SESSION_PIN_ENV) delete env[k];
+  return env;
+}

package/dist/SUPPORTED_CLIS-6VyrMWG_.js

@@ -1,9 +0,0 @@
-import "./ts-74aVYJYj.js";
-import "./logger-CDIsZ-Pp.js";
-import "./versionChecker-QP6QKiG-.js";
-import "./pidStore-BIvsBQ8X.js";
-import "./globalPidIndex-CoNr7tS8.js";
-import "./messageLog-CxrKJj77.js";
-import { t as SUPPORTED_CLIS } from "./SUPPORTED_CLIS-91SHco8n.js";
-
-export { SUPPORTED_CLIS };